Skip to content

chore(deps): bump the npm_and_yarn group across 3 directories with 15 updates - #36695

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/angular-ssr/npm_and_yarn-7195e239b0
Open

chore(deps): bump the npm_and_yarn group across 3 directories with 15 updates#36695
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/examples/angular-ssr/npm_and_yarn-7195e239b0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 22, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm_and_yarn group with 3 updates in the /examples/angular-ssr directory: @angular/common, hono and undici.
Bumps the npm_and_yarn group with 2 updates in the /examples/astro directory: @astrojs/vercel and astro.
Bumps the npm_and_yarn group with 8 updates in the /starter/nextjs directory:

Package From To
postcss 8.4.47 8.5.10
brace-expansion 1.1.11 1.1.16
picomatch 2.3.1 2.3.2
flatted 3.3.1 3.4.3
picomatch 2.3.1 2.3.2
yaml 2.6.0 2.9.0
next 14.2.16 15.5.18
js-yaml 4.1.0 4.3.0
picomatch 2.3.1 2.3.2
tinymce 7.4.1 7.9.3

Updates @angular/common from 20.3.24 to 22.0.8

Release notes

Sourced from @​angular/common's releases.

22.0.8

common

Commit Description
fix - c0368f2278 preserve crossorigin on image preloads

core

Commit Description
fix - 8616ba9db6 ensure SVG animation attributeName is checked case-insensitively

forms

Commit Description
fix - d302c7ab83 ensure pending status propagates to the root form in signal forms

http

Commit Description
fix - 9d40f8aefe prevent transfer cache key collisions

migrations

Commit Description
fix - 388daea2fc correctly migrate ngClass with mixed space-separated keys
fix - bb39cda648 preserve NgClass import on partial migration

22.0.7

common

Commit Description
fix - 91e33aa1de avoid prototype lookups in date format caches

compiler

Commit Description
fix - 5b516e3a58 parsing of an empty template literal interpolation

compiler-cli

Commit Description
fix - c88ddde1c9 re-tag SourceFiles after TsCreateProgramDriver.updateFiles()

core

Commit Description
fix - 94d9591b51 allow static attributes for explicit input transforms
fix - c89f71a74c ignore processing instruction syntax in templates
fix - 70500e4067 preserve explicit input transform write type

forms

Commit Description
fix - 1b9964675f allow multiple async validators
fix - 64d6d47a0c preserve intermediate number values in signal forms
fix - 6cf7446afa prevent stale CVA writeback during debounce

http

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

22.0.8 (2026-07-22)

common

Commit Type Description
c0368f2278 fix preserve crossorigin on image preloads

core

Commit Type Description
8616ba9db6 fix ensure SVG animation attributeName is checked case-insensitively

forms

Commit Type Description
d302c7ab83 fix ensure pending status propagates to the root form in signal forms

http

Commit Type Description
9d40f8aefe fix prevent transfer cache key collisions

migrations

Commit Type Description
388daea2fc fix correctly migrate ngClass with mixed space-separated keys
bb39cda648 fix preserve NgClass import on partial migration

22.1.0-next.6 (2026-07-15)

common

Commit Type Description
359fb503b8 fix avoid prototype lookups in date format caches

compiler

Commit Type Description
da52137724 fix parsing of an empty template literal interpolation
5bd00add07 fix support foreign components inside control flow blocks (#69674)
2e442f7876 perf do not emit tag name when control flow root is foreign component (#69674)

compiler-cli

Commit Type Description
ae0ec7315c fix re-tag SourceFiles after TsCreateProgramDriver.updateFiles()

core

Commit Type Description
9b9b0e93c9 fix allow static attributes for explicit input transforms
68ac204074 fix ignore processing instruction syntax in templates
0ae6d81ed2 fix preserve explicit input transform write type

forms

Commit Type Description

... (truncated)

Commits
  • c0368f2 fix(common): preserve crossorigin on image preloads
  • 9d40f8a fix(http): prevent transfer cache key collisions
  • 91e33aa fix(common): avoid prototype lookups in date format caches
  • 20b7dc3 fix(http): prevent interceptor signal reads from leaking into calling reactiv...
  • 748faa4 docs(docs-infra): Add build-time validation for API and guide links using rou...
  • 8e6d7f7 fix(router): use safe hasOwnProperty when parsing query params
  • eb8fb9f fix(common): use Object.hasOwn in I18nSelectPipe to handle null-prototype and...
  • cd8f472 docs: add documentation for HttpClient response body size limit and related e...
  • 8cdc202 fix(http): prevent caching of responses with Set-Cookie headers
  • 6867f77 fix(http): distinguish repeated transfer cache params
  • Additional commits viewable in compare view

Updates hono from 4.12.23 to 4.12.31

Release notes

Sourced from hono's releases.

v4.12.31

What's Changed

Full Changelog: honojs/hono@v4.12.30...v4.12.31

v4.12.30

What's Changed

Full Changelog: honojs/hono@v4.12.29...v4.12.30

v4.12.29

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.12.28...v4.12.29

v4.12.28

What's Changed

... (truncated)

Commits
  • cadff88 4.12.31
  • 64c613a test(validator): fix misspelled identifier in transform type test (#5136)
  • aeba9ec fix(sse): emit retry feild when retry is 0 (#5135)
  • d796450 fix(request): fix multipart boundary mismatch in cloneRawRequest (#5133)
  • 80959d4 fix(utils/body): reuse cached formData in parseBody() (#5131)
  • 21b44b6 refactor(aws-lambada): remove FIXME in @ts-expect-error (#5130)
  • 5f73897 docs(combine): close quote in combine JSDoc example (#5126)
  • c285f9a chore(benchmark): add app.fetch() overhead benchmark (#5117)
  • fb9d7bf test(context): assert case-insensitive header names in response helpers (#5116)
  • b2ae3a2 4.12.30
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.


Updates piscina from 5.1.3 to 5.2.0

Release notes

Sourced from piscina's releases.

v5.1.4

What's Changed

Full Changelog: piscinajs/piscina@v5.1.3...v5.1.4

Changelog

Sourced from piscina's changelog.

5.2.0 (2026-06-12)

Features

Bug Fixes

  • eagerly spawn workers up to maxThreads on cold-pool burst (#1043) (779c640)
  • include skipQueue in queueSize calculation (#1030) (b7d4d61)
  • interface name and add missing curly brace (#951) (8cd51f2)
  • onWorkerMessage gets skipped in Jest environment (#968) (54de192)

5.1.4 (2025-11-07)

Bug Fixes

Commits
  • 8baaa1b chore(release): 5.2.0
  • 107b09a Merge commit from fork
  • 3eeaa37 docs: correct typo 'maintanance' in CONTRIBUTING.md (#1071)
  • b7d4d61 fix: include skipQueue in queueSize calculation (#1030)
  • 6beabe0 feat: Add idleThreads getter (#1059)
  • e104a89 chore(deps): Bump fast-uri from 3.0.6 to 3.1.2 in /docs in the npm_and_yarn g...
  • 779c640 fix: eagerly spawn workers up to maxThreads on cold-pool burst (#1043)
  • 469cb93 docs: Update Fastify listen() calls to use { port: 3000 } in docs and example...
  • d752afd [Backport v5] chore(deps): docs: Bump lodash from 4.17.23 to 4.18.1 in /docs ...
  • 6ed6284 chores: gh actions least privilege (#1013) (#1015)
  • Additional commits viewable in compare view

Updates undici from 6.26.0 to 6.27.0

Release notes

Sourced from undici's releases.

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory CVE Severity (CVSS) Fixed in Fix commit
GHSA-vxpw-j846-p89q CVE-2026-12151 High (7.5) 6.27.0 b7f252e7
GHSA-p88m-4jfj-68fv CVE-2026-9679 Moderate (5.9) 6.27.0 25efa447
GHSA-g8m3-5g58-fq7m CVE-2026-11525 Low (3.7) 6.27.0 25efa447
GHSA-35p6-xmwp-9g52 CVE-2026-6733 Low (3.7) 6.27.0 f4c31d60

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did not limit the number of fragments per message, leading to unbounded memory growth and denial of service. All releases from 6.17.0 onward are affected.

  • Affected: applications using new WebSocket(...) or WebSocketStream against untrusted endpoints.
  • Workaround: none — upgrade is required.

Moderate severity

HTTP header injection via Set-Cookie percent-decoding — CVE-2026-9679

... (truncated)

Commits

Updates vite from 7.3.2 to 7.3.5

Release notes

Sourced from vite's releases.

v7.3.5

Please refer to CHANGELOG.md for details.

v7.3.3

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.5 (2026-06-01)

Bug Fixes

Miscellaneous Chores

7.3.4 (2026-06-01)

Bug Fixes

7.3.3 (2026-05-07)

Bug Fixes

Commits

Updates vite from 7.3.2 to 7.3.5

Release notes

Sourced from vite's releases.

v7.3.5

Please refer to CHANGELOG.md for details.

v7.3.3

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.5 (2026-06-01)

Bug Fixes

Miscellaneous Chores

7.3.4 (2026-06-01)

Bug Fixes

7.3.3 (2026-05-07)

Bug Fixes

Commits

Updates @astrojs/vercel from 9.0.5 to 11.0.3

Release notes

Sourced from @​astrojs/vercel's releases.

@​astrojs/vercel@​11.0.3

Patch Changes

@​astrojs/vercel@​11.0.2

Patch Changes

  • Updated dependencies [eb6f97e]:
    • @​astrojs/internal-helpers@​0.10.1

@​astrojs/vercel@​11.0.1

Patch Changes

@​astrojs/vercel@​11.0.0

Major Changes

Minor Changes

  • #16335 9a53f77 Thanks @​ascorbic! - Adds a CDN cache provider for Astro route caching on Vercel

    Setup

    Import cacheVercel() from @astrojs/vercel/cache and set it as your cache provider:

    import { defineConfig } from 'astro/config';
import vercel from '@astrojs/vercel';
import { cacheVercel } from '@astrojs/vercel/cache';
export default defineConfig({
adapter: vercel(),
cache: {
provider: cacheVercel(),
},
});

    Caching responses

    Use Astro.cache.set() in your pages and API routes to cache responses on Vercel's edge network. The provider sets Vercel-CDN-Cache-Control and Vercel-Cache-Tag headers on responses.

    ---
Astro.cache.set({ maxAge: 300, tags: ['products'] });
const data = await fetchProducts();

... (truncated)

Changelog

Sourced from @​astrojs/vercel's changelog.

11.0.3

Patch Changes

11.0.2

Patch Changes

  • Updated dependencies [eb6f97e]:
    • @​astrojs/internal-helpers@​0.10.1

11.0.1

Patch Changes

11.0.0

Major Changes

Minor Changes

  • #16335 9a53f77 Thanks @​ascorbic! - Adds a CDN cache provider for Astro route caching on Vercel

    Setup

    Import cacheVercel() from @astrojs/vercel/cache and set it as your cache provider:

    import { defineConfig } from 'astro/config';
import vercel from '@astrojs/vercel';
import { cacheVercel } from '@astrojs/vercel/cache';
export default defineConfig({
adapter: vercel(),
cache: {
provider: cacheVercel(),
},
});

    Caching responses

    Use Astro.cache.set() in your pages and API routes to cache responses on Vercel's edge network. The provider sets Vercel-CDN-Cache-Control and Vercel-Cache-Tag headers on responses.

... (truncated)

Commits

Updates astro from 5.18.2 to 7.1.3

Release notes

Sourced from astro's releases.

astro@7.1.3

Patch Changes

  • #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

astro@7.1.2

Patch Changes

  • #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

  • #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

  • #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

astro@7.1.1

Patch Changes

astro@7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

    By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

    Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

    // astro.config.mjs

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.3

Patch Changes

  • #17427 630b382 Thanks @​astrobot-houston! - Fixes image optimization during astro build using too many parallel processes in CPU-limited containers. Builds now respect the container's CPU limit, reducing peak memory usage and avoiding out-of-memory crashes.

7.1.2

Patch Changes

  • #17445 a5f7230 Thanks @​ocavue! - Updates dependency cookie to v2. Cookie values made entirely of URL-safe characters are no longer percent-encoded in Set-Cookie headers; encoded values round-trip exactly as before.

  • #17402 a89c137 Thanks @​farrosfr! - Fixes a bug where mutated Astro.locals during the request lifecycle are lost and not passed to custom error pages (404.astro/500.astro)

  • #17405 91992ef Thanks @​Araluma! - Prevents an unhandled promise rejection from the prefetch fetch fallback. In WebKit (Safari), <link rel="prefetch"> is unsupported, so prefetch uses the fetch() fallback; on a flaky connection that fetch rejects with TypeError: Load failed, and because the promise was not awaited or caught, it surfaced as an unhandled rejection to the page's global error handlers. The best-effort prefetch now swallows the failure with .catch().

7.1.1

Patch Changes

7.1.0

Minor Changes

  • #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

    When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

    This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

    // src/content.config.ts
import { defineCollection } from 'astro:content';
import { glob } from 'astro/loaders';
const docs = defineCollection({
loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
});

    By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

  • #17296 30698a2 Thanks Description has been truncated

@dependabot
chore(deps): bump the npm_and_yarn group across 3 directories with 15…
8cde782 
… updates

Bumps the npm_and_yarn group with 3 updates in the /examples/angular-ssr directory: [@angular/common](https://github.com/angular/angular/tree/HEAD/packages/common), [hono](https://github.com/honojs/hono) and [undici](https://github.com/nodejs/undici).
Bumps the npm_and_yarn group with 2 updates in the /examples/astro directory: [@astrojs/vercel](https://github.com/withastro/astro/tree/HEAD/packages/integrations/vercel) and [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro).
Bumps the npm_and_yarn group with 8 updates in the /starter/nextjs directory:

| Package | From | To |
| --- | --- | --- |
| [postcss](https://github.com/postcss/postcss) | `8.4.47` | `8.5.10` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.11` | `1.1.16` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [flatted](https://github.com/WebReflection/flatted) | `3.3.1` | `3.4.3` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [yaml](https://github.com/eemeli/yaml) | `2.6.0` | `2.9.0` |
| [next](https://github.com/vercel/next.js) | `14.2.16` | `15.5.18` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.0` | `4.3.0` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [tinymce](https://github.com/tinymce/tinymce/tree/HEAD/modules/tinymce) | `7.4.1` | `7.9.3` |



Updates `@angular/common` from 20.3.24 to 22.0.8
- [Release notes](https://github.com/angular/angular/releases)
- [Changelog](https://github.com/angular/angular/blob/main/CHANGELOG.md)
- [Commits](https://github.com/angular/angular/commits/v22.0.8/packages/common)

Updates `hono` from 4.12.23 to 4.12.31
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.12.23...v4.12.31)

Updates `piscina` from 5.1.3 to 5.2.0
- [Release notes](https://github.com/piscinajs/piscina/releases)
- [Changelog](https://github.com/piscinajs/piscina/blob/v5.2.0/CHANGELOG.md)
- [Commits](piscinajs/piscina@v5.1.3...v5.2.0)

Updates `undici` from 6.26.0 to 6.27.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.26.0...v6.27.0)

Updates `vite` from 7.3.2 to 7.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.5/packages/vite)

Updates `vite` from 7.3.2 to 7.3.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.5/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.5/packages/vite)

Updates `@astrojs/vercel` from 9.0.5 to 11.0.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/vercel/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/vercel@11.0.3/packages/integrations/vercel)

Updates `astro` from 5.18.2 to 7.1.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.1.3/packages/astro)

Updates `postcss` from 8.4.47 to 8.5.10
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.47...8.5.10)

Updates `brace-expansion` from 1.1.11 to 1.1.16
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.16)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `flatted` from 3.3.1 to 3.4.3
- [Commits](WebReflection/flatted@v3.3.1...v3.4.3)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `postcss` from 8.4.47 to 8.5.10
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.47...8.5.10)

Updates `yaml` from 2.6.0 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.6.0...v2.9.0)

Updates `next` from 14.2.16 to 15.5.18
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v14.2.16...v15.5.18)

Updates `postcss` from 8.4.47 to 8.5.10
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.47...8.5.10)

Updates `brace-expansion` from 1.1.11 to 1.1.16
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@1.1.11...v1.1.16)

Updates `flatted` from 3.3.1 to 3.4.3
- [Commits](WebReflection/flatted@v3.3.1...v3.4.3)

Updates `js-yaml` from 4.1.0 to 4.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.0...4.3.0)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@2.3.1...2.3.2)

Updates `tinymce` from 7.4.1 to 7.9.3
- [Changelog](https://github.com/tinymce/tinymce/blob/7.9.3/modules/tinymce/CHANGELOG.md)
- [Commits](https://github.com/tinymce/tinymce/commits/7.9.3/modules/tinymce)

Updates `yaml` from 2.6.0 to 2.9.0
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.6.0...v2.9.0)

---
updated-dependencies:
- dependency-name: "@angular/common"
  dependency-version: 22.0.8
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-version: 4.12.31
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: piscina
  dependency-version: 5.2.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 6.27.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 7.3.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@astrojs/vercel"
  dependency-version: 11.0.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: astro
  dependency-version: 7.1.3
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.16
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: yaml
  dependency-version: 2.9.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-version: 15.5.18
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 1.1.16
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: flatted
  dependency-version: 3.4.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tinymce
  dependency-version: 7.9.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: yaml
  dependency-version: 2.9.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 22, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 22, 2026
@github-actions

github-actions Bot commented Jul 22, 2026

Copy link
Copy Markdown
Contributor

❌ Issue Linking Required

This PR could not be linked to an issue. All PRs must be linked to an issue for tracking purposes.

How to fix this:

Option 1: Add keyword to PR body (Recommended - auto-removes this comment)
Edit this PR description and add one of these lines:

  • Fixes #123 or Closes #123 — same-repo issue
  • Fixes org/repo#123 or Closes org/repo#123 — cross-repo or private issue
  • Closes https://github.com/org/repo/issues/123 — full GitHub URL
  • Other supported keywords: fix, fixed, close, closed, resolve, resolved

Option 2: Link via GitHub UI (Note: won't clear the failed check)

  1. Go to the PR → Development section (right sidebar)

  2. Click "Link issue" and select an existing issue

  3. Push a new commit or re-run the workflow to clear the failed check
    Option 3: Use branch naming
    Create a new branch with one of these patterns:

  • 123-feature-description (number at start)

  • issue-123-feature-description (issue-number at start)

  • feature-issue-123 (issue-number anywhere)

Why is this required?

Issue linking ensures proper tracking, documentation, and helps maintain project history. It connects your code changes to the problem they solve.
---This comment was automatically generated by the issue linking workflow

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

dotCMS - Product Planning
Status: No status

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants