chore(deps): update all non-major dependencies by renovate[bot] · Pull Request #1750 · stacksjs/stx

renovate · 2026-06-03T11:55:27Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@11ty/eleventy (source)	`^3.1.5` → `^3.1.6`	dependencies	patch
@cwcss/crosswind	`^0.1.3` → `^0.2.4`	dependencies	minor
@cwcss/crosswind	`^0.2.0` → `^0.2.4`	dependencies	patch
@iconify/json (source)	`^2.2.463` → `^2.2.484`	devDependencies	patch
@stacksjs/clapp	`^0.2.0` → `^0.2.10`	dependencies	patch
@stacksjs/ts-cloud	`^0.2.3` → `^0.2.26`	dependencies	patch
@types/bun (source)	`^1.3.11` → `^1.3.14`	devDependencies	patch
@types/vscode (source)	`^1.110.0` → `^1.120.0`	devDependencies	minor
@vscode/vsce (source)	`^3.7.2-12` → `^3.9.2`	devDependencies	minor
actions/cache	`v5.0.3` → `v5.0.5`	action	patch
actions/checkout	`v6.0.2` → `v6.0.3`	action	patch
bun (source)	`>=1.3.11` → `>=1.3.14`	peerDependencies	patch
bunfig	`^0.15.6` → `^0.15.13`	dependencies	patch
dompurify	`^3.3.3` → `^3.4.8`	dependencies	minor
ejs	`^5.0.1` → `^5.0.2`	dependencies	patch
happy-dom	`^20.8.9` → `^20.10.2`	dependencies	minor
isomorphic-dompurify	`^3.7.1` → `^3.16.0`	dependencies	minor
js-yaml	`^4.1.1` → `^4.2.0`	dependencies	minor
jsdom	`^29.0.1` → `^29.1.1`	devDependencies	minor
liquidjs	`^10.25.2` → `^10.27.0`	dependencies	minor
markdown-it	`^14.1.1` → `^14.2.0`	dependencies	minor
marked (source)	`^17.0.5` → `^17.0.6`	dependencies	patch
oven-sh/setup-bun	`v2.1.2` → `v2.2.0`	action	minor
pickier	`^0.1.20` → `^0.1.34`	devDependencies	patch
prettier (source)	`^3.8.1` → `^3.8.4`	dependencies	patch
sanitize-html (source)	`^2.17.2` → `^2.17.4`	dependencies	patch
tinybench	`^6.0.0` → `^6.0.2`	dependencies	patch
ts-broadcasting	`^0.0.4` → `^0.0.5`	dependencies	patch
typescript (source)	`^6.0.2` → `^6.0.3`	devDependencies	patch
vscode-languageserver-types (source)	`^3.17.5` → `^3.18.0`	devDependencies	minor
ws	`^8.20.0` → `^8.21.0`	dependencies	minor

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

11ty/eleventy (@11ty/eleventy)

`v3.1.6`: Eleventy v3.1.6: Everybody wants to do Maintenance

Compare Source

Fixes Node 26 module.register deprecation warning shown in console #4283 (fixed in v4 alphas in #4271)
Minor dependency upgrades for npm audit fixes
- liquidjs upgrade from 1.25.0 to 1.27.0
- markdown-it upgrade from 14.1.1 to 14.2.0
Adds Node 26 to CI for v3 branch
Opt out of package manager cache for GitHub Actions CI release workflow (hardening security)

Milestone: https://github.com/11ty/eleventy/milestone/52?closed=1
Full Changelog: 11ty/eleventy@v3.1.5...v3.1.6

cwcss/crosswind (@cwcss/crosswind)

`v0.2.4`

Compare Source

Compare changes

🚀 Features

rules: table display family, flow-root/list-item/contents, arbitrary accent/caret (f31d55c)

🧹 Chores

release v0.2.4 (09382bd)

Contributors

Chris <chrisbreuer93@gmail.com>

`v0.2.3`

Compare Source

Compare changes

🧹 Chores

release v0.2.3 (0af1adb)
split and minify dist (23aef98)

Contributors

Chris <chrisbreuer93@gmail.com>

`v0.2.2`

Compare Source

Compare changes

🐛 Bug Fixes

build: emit dist/index.js + dist/cli.js to match exports/bin paths (1544b47)

🧹 Chores

release v0.2.2 (a0ceda7)

Contributors

Chris <chrisbreuer93@gmail.com>

`v0.2.1`

Compare Source

Compare changes

🚀 Features

add css alias (bcc203d)
rules: pure-CSS iconify rule for any @iconify-json/* collection (d57a427)

🐛 Bug Fixes

add setup-bun to publish-commit job (1a02e04)
resolve typecheck errors (e6caa08)

🤖 Continuous Integration

drop redundant setup-bun (pantry installs bun via deps.yaml) (b506af1)

🧹 Chores

release v0.2.1 (fb65a3d)
remove headwind refs (2290f5e)
fresh install to pick up dtsx 0.9.14 and bunfig 0.15.9 (074e1fa)
fresh install to pick up pickier 0.1.21 (c7d15c0)
cascade order improvements (126617c)
several minor improvements (04caac1)
improve arbitrary values (36d341d)
wip (38d57fd)
merge and resolve conflict (1e00cce)
fix lint errors (12526b8)
minor improvements (0a2924a)
improve group-has-* and peer-has-* (7de7dc3)
several minor improvements (cc6ffe4)

Contributors

Chris <chrisbreuer93@gmail.com>
glennmichael123 gtorregosa@gmail.com

`v0.2.0`

Compare Source

Compare changes

🚀 Features

improve arbitrary values (9c6af1e)
handle arbitrary bracket opacity on named colors (af6f0f3)

🐛 Bug Fixes

resolve typecheck errors (8876156)
resolve typecheck errors (18bbc68)

🧹 Chores

release v0.2.0 (74a6cfa)
update lockfile (a95e37f)
release updates (c3908da)
adjust test (ce9472c)
repo cleanup and modernization (9f1d450)
repo cleanup and modernization (f5e5369)
remove unocss (4446ec1)
remove @stacksjs/docs (8ca150e)
remove redundant docs/.vitepress (9496179)
use Pantry action for publish-commit and add job dependencies (35b820a)
fix better-dx version to ^0.2.7 (4afffd7)
migrate to better-dx (2489f19)

`v0.1.6`

Compare Source

`v0.1.5`

Compare Source

Full Changelog: cwcss/crosswind@v0.1.4...v0.1.5

iconify/icon-sets (@iconify/json)

stacksjs/clapp (@stacksjs/clapp)

`v0.2.10`

Compare Source

`v0.2.9`

Compare Source

`v0.2.8`

Compare Source

`v0.2.7`

Compare Source

`v0.2.6`

Compare Source

`v0.2.5`

Compare Source

`v0.2.4`

Compare Source

`v0.2.3`

Compare Source

stacksjs/ts-cloud (@stacksjs/ts-cloud)

`v0.2.26`

Compare Source

`v0.2.25`

Compare Source

`v0.2.24`

Compare Source

`v0.2.23`

Compare Source

`v0.2.22`

Compare Source

`v0.2.21`

Compare Source

`v0.2.20`

Compare Source

`v0.2.19`

Compare Source

`v0.2.18`

Compare Source

`v0.2.17`

Compare Source

`v0.2.16`

Compare Source

`v0.2.15`

Compare Source

`v0.2.14`

Compare Source

`v0.2.13`

Compare Source

`v0.2.12`

Compare Source

`v0.2.11`

Compare Source

`v0.2.10`

Compare Source

`v0.2.9`

Compare Source

`v0.2.8`

Compare Source

`v0.2.7`

Compare Source

`v0.2.6`

Compare Source

`v0.2.5`

Compare Source

Microsoft/vsce (@vscode/vsce)

`v3.9.2`

Compare Source

Changes:

#1283: fix: skip APIScan
#1282: chore: bump CI to Node 22 and fix build
#1279: Bump the uuid test fixture version to 100.0.0
#1278: Bump tmp from 0.2.4 to 0.2.6
#1277: Bump qs from 6.14.2 to 6.15.2
#1276: Bump uuid and @azure/msal-node
#1274: Run npm audit fix
#1272: Bump fast-uri from 3.0.6 to 3.1.2
#1267: Bump minimatch from 10.2.2 to 10.2.3
#1247: Update minimatch dependency to v10

This list of changes was auto generated.

`v3.9.1`

Compare Source

Changes:

#1266: fix: module type mismatch

This list of changes was auto generated.

`v3.9.0`

Compare Source

Changes:

#1263: fix: build regressions in 3.8.1
#1261: Add override for serialize-javascript

This list of changes was auto generated.

`v3.8.1`

Compare Source

Changes:

#1259: chore: update @azure/identity to 4.13.1 and modernize TypeScript/Node.js configuration

This list of changes was auto generated.

`v3.8.0`

Compare Source

Changes:

#1258: fix: run npm audit fix
#1255: Bump brace-expansion
#1253: Bump picomatch from 2.3.1 to 2.3.2
#1252: Bump yauzl from 2.10.0 to 3.2.1
#1250: Bump underscore from 1.13.1 to 1.13.8
#1249: Bump minimatch
#1243: Bump markdown-it from 14.1.0 to 14.1.1
#1244: Bump qs from 6.14.1 to 6.14.2
#1239: Bump @isaacs/brace-expansion from 5.0.0 to 5.0.1
#1238: Bump lodash from 4.17.21 to 4.17.23

See More

#1234: Bump qs from 6.11.0 to 6.14.1
#1233: Return non-zero exit code when signature verification fails
#1232: Audit npm package
#1228: Bump jws

This list of changes was auto generated.

`v3.7.2-13`

Compare Source

Changes:

#1258: fix: run npm audit fix

This list of changes was auto generated.

actions/cache (actions/cache)

`v5.0.5`

Compare Source

What's Changed

Update ts-http-runtime dependency by @yacaovsnc in #1747

Full Changelog: actions/cache@v5...v5.0.5

`v5.0.4`

Compare Source

actions/checkout (actions/checkout)

`v6.0.3`

Compare Source

Fix checkout init for SHA-256 repositories by @yaananth in #2439
fix: expand merge commit SHA regex and add SHA-256 test cases by @yaananth in #2414

oven-sh/bun (bun)

`v1.3.14`: Bun v1.3.14

Compare Source

To install Bun v1.3.14

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.14:

bun upgrade

Read Bun v1.3.14's release notes on Bun's blog

Thanks to 11 contributors!

`v1.3.13`: Bun v1.3.13

Compare Source

To install Bun v1.3.13

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.13:

bun upgrade

Read Bun v1.3.13's release notes on Bun's blog

Thanks to 8 contributors!

`v1.3.12`: Bun v1.3.12

Compare Source

To install Bun v1.3.12

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.12:

bun upgrade

Read Bun v1.3.12's release notes on Bun's blog

Thanks to 8 contributors!

stacksjs/bunfig (bunfig)

`v0.15.13`

Compare Source

`v0.15.12`

Compare Source

`v0.15.11`

Compare Source

`v0.15.10`

Compare Source

`v0.15.9`

Compare Source

`v0.15.8`

Compare Source

`v0.15.7`

Compare Source

cure53/DOMPurify (dompurify)

`v3.4.8`: DOMPurify 3.4.8

Compare Source

Cleaned up the repository root, renamed some and removed unneeded files
Fixed an issue with handling of Trusted Types policies, thanks @fulstadev
Fixed the node iterator for better template scrubbing, thanks @IamLeandrooooo
Included formerly missing LICENSE-MPL in published npm package, thanks @asamuzaK
Bumped several dependencies where possible

`v3.4.7`: DOMPurify 3.4.7

Compare Source

Hardened the handling of Shadow Roots when using IN_PLACE, thanks @GameZoneHacker
Removed a problem leading to permanent hook pollution, thanks @offset
Refactored the test suite and expanded test coverage significantly

`v3.4.6`: DOMPurify 3.4.6

Compare Source

Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @offset & @Bankde
Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @offset & @Bankde
Added more test coverage for IN_PLACE and general DOM Clobbering attacks
Bumped several dependencies where possible

`v3.4.5`

Compare Source

`v3.4.4`: DOMPurify 3.4.4

Compare Source

Added the selectedcontent element to default allow-list, thanks @lukewarlow
Added the command and commandfor attributes to default allowed-list, thanks @lukewarlow
Added better template scrubbing for IN_PLACE operations, thanks @DEMON1A
Added stronger checks for cross-realm windows, thanks @DEMON1A & @fg0x0
Updated demo website and made sure it uses the latest from main
Updated existing workflows, fuzzer, dependabot, etc., added more tests
Bumped several dependencies where possible

`v3.4.3`

Compare Source

`v3.4.2`: DOMPurify 3.4.2

Compare Source

Fixed an issue with URI validation on attributes allowed via ADD_ATTR callback, thanks @nelstrom
Fixed an issue with source maps referring to non-existing files, thanks @cmdcolin
Updated existing workflows, fuzzer, release signing, etc., added more tests
Bumped several dependencies where possible

`v3.4.1`: DOMPurify 3.4.1

Compare Source

Fixed an issue with on-handler stripping for HTML-spec-reserved custom element names (font-face, color-profile, missing-glyph, font-face-src, font-face-uri, font-face-format, font-face-name) under permissive CUSTOM_ELEMENT_HANDLING
Fixed a case-sensitivity gap in the annotation-xml check that allowed mixed-case variants to bypass the basic-custom-element exclusion in XHTML mode
Fixed SANITIZE_NAMED_PROPS repeatedly prefixing already-prefixed id and name values on subsequent sanitization
Fixed the IN_PLACE root-node check to explicitly guard against non-string nodeName (DOM-clobbering robustness)
Removed a duplicate slot entry from the default HTML attribute allow-list
Strengthened the fast-check fuzz harness with explicit XSS invariants, an expanded seed-payload corpus, an additional idempotence property for SANITIZE_NAMED_PROPS, and a negative-control assertion ensuring the invariants actually fire
Added regression and pinning tests covering the above fixes and two accepted-behavior contracts (SAFE_FOR_TEMPLATES greedy scrub, hook-added attribute handling)
Extended CodeQL analysis to run on 3.x and 2.x maintenance branches

`v3.4.0`: DOMPurify 3.4.0

Compare Source

Most relevant changes:

Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @kodareef5
Fixed several minor problems and typos regarding MathML attributes, thanks @DavidOliver
Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @1Jesper1
Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @bencalif
Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @trace37labs
Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @eddieran
Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @christos-eth
Fixed an issue with USE_PROFILES prototype pollution, thanks @christos-eth
Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @researchatfluidattacks and others
Fixed a problem with the type dentition patcher after Node version bump
Fixed freezing BS runs by reducing the tested browsers array
Bumped several dependencies where possible
Added needed files for OpenSSF scorecard checks

Published Advisories are here:
https://github.com/cure53/DOMPurify/security/advisories?state=published

mde/ejs (ejs)

`v5.0.2`

Compare Source

Version 5.0.2

capricorn86/happy-dom (happy-dom)

`v20.10.2`

Compare Source

👷‍♂️ Patch fixes

Updates external dependencies - By @capricorn86 in task #2163

`v20.10.1`

Compare Source

`v20.10.0`

Compare Source

`v20.9.0`

Compare Source

🎨 Features

Adds support for event listener properties on Window (e.g. Window.onkeydown) - By @capricorn86 in task #2131

kkomelin/isomorphic-dompurify (isomorphic-dompurify)

`v3.16.0`: : Updated dependencies

Compare Source

dompurify 3.4.7 -> 3.4.8
vitest 4.1.7 -> 4.1.8
lefthook 2.1.8 -> 2.1.9

`v3.15.0`: : Updated dependencies

Compare Source

dompurify 3.4.5 -> 3.4.7
@biomejs/biome 2.4.15 -> 2.4.16
vitest 4.1.6 -> 4.1.7
packageManager pnpm 11.1.3 -> 11.4.0

`v3.14.0`: : Updated dependencies

Compare Source

What's Cha

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

netlify · 2026-06-03T11:55:36Z

❌ Deploy Preview for stacks-stx failed. Why did it fail? →

Name	Link
🔨 Latest commit	`bf8e414`
🔍 Latest deploy log	https://app.netlify.com/projects/stacks-stx/deploys/6a288524ff117b0008aa49ed

renovate Bot added dependencies patch labels Jun 3, 2026

renovate Bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from a05091e to 5552fb2 Compare June 9, 2026 12:58

chore(deps): update all non-major dependencies

bf8e414

renovate Bot force-pushed the renovate/all-minor-patch branch from 5552fb2 to bf8e414 Compare June 9, 2026 21:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): update all non-major dependencies#1750

chore(deps): update all non-major dependencies#1750
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-minor-patch

renovate Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

netlify Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v3.1.6: Eleventy v3.1.6: Everybody wants to do Maintenance

🚀 Features

🧹 Chores

Contributors

🧹 Chores

Contributors

🐛 Bug Fixes

🧹 Chores

Contributors

🚀 Features

🐛 Bug Fixes

🤖 Continuous Integration

🧹 Chores

Contributors

🚀 Features

🐛 Bug Fixes

🧹 Chores

Changes:

Changes:

Changes:

Changes:

Changes:

Changes:

What's Changed

v1.3.14: Bun v1.3.14

Thanks to 11 contributors!

v1.3.13: Bun v1.3.13

Thanks to 8 contributors!

v1.3.12: Bun v1.3.12

Thanks to 8 contributors!

v3.4.8: DOMPurify 3.4.8

v3.4.7: DOMPurify 3.4.7

v3.4.6: DOMPurify 3.4.6

v3.4.4: DOMPurify 3.4.4

v3.4.2: DOMPurify 3.4.2

v3.4.1: DOMPurify 3.4.1

v3.4.0: DOMPurify 3.4.0

👷‍♂️ Patch fixes

🎨 Features

v3.16.0: : Updated dependencies

v3.15.0: : Updated dependencies

v3.14.0: : Updated dependencies

What's Cha

Configuration

Uh oh!

netlify Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for stacks-stx failed. Why did it fail? →

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

renovate Bot commented Jun 3, 2026 •

edited

Loading

`v3.1.6`: Eleventy v3.1.6: Everybody wants to do Maintenance

`v1.3.14`: Bun v1.3.14

`v1.3.13`: Bun v1.3.13

`v1.3.12`: Bun v1.3.12

`v3.4.8`: DOMPurify 3.4.8

`v3.4.7`: DOMPurify 3.4.7

`v3.4.6`: DOMPurify 3.4.6

`v3.4.4`: DOMPurify 3.4.4

`v3.4.2`: DOMPurify 3.4.2

`v3.4.1`: DOMPurify 3.4.1

`v3.4.0`: DOMPurify 3.4.0

`v3.16.0`: : Updated dependencies

`v3.15.0`: : Updated dependencies

`v3.14.0`: : Updated dependencies

netlify Bot commented Jun 3, 2026 •

edited

Loading