feat: return boolean from submit to indicate submission validity for enhanced form remote functions (#15530)
Patch Changes
fix: use array type for select fields that accept multiple values (#15591)
fix: silently 404 Chrome DevTools workspaces request in dev and preview (#15656)
fix: config.kit.csp.directives['trusted-types'] requires 'svelte-trusted-html' (and 'sveltekit-trusted-url' when a service worker is automatically registered) if it is configured (#15323)
fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#15647)
feat: return boolean from submit to indicate submission validity for enhanced form remote functions (#15530)
Patch Changes
fix: use array type for select fields that accept multiple values (#15591)
fix: silently 404 Chrome DevTools workspaces request in dev and preview (#15656)
fix: config.kit.csp.directives['trusted-types'] requires 'svelte-trusted-html' (and 'sveltekit-trusted-url' when a service worker is automatically registered) if it is configured (#15323)
fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (#15647)
Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.
Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.
Fixes a ReferenceError issue in lodashlodash-eslodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167
These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.
There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:
_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.
_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".
Docs
Add security notice for _.template in threat model and API docs (#6099)
Document lower > upper behavior in _.random (#6115)
We have also regenerated and published a select number of the lodash.* modular packages.
These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/23772
**Author:** [@dependabot[bot]](https://github.com/apps/dependabot)
**Created:** 4/16/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `dependabot/npm_and_yarn/npm_and_yarn-dfc813aa02`
---
### 📝 Commits (1)
- [`8782c03`](https://github.com/open-webui/open-webui/commit/8782c0366cce5d3fd60090fdd0d60e00766a8042) build(deps): bump the npm_and_yarn group across 1 directory with 8 updates
### 📊 Changes
**2 files changed** (+3243 additions, -3315 deletions)
<details>
<summary>View changed files</summary>
📝 `package-lock.json` (+3237 -3309)
📝 `package.json` (+6 -6)
</details>
### 📄 Description
Bumps the npm_and_yarn group with 8 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.3.3` | `3.4.0` |
| [yaml](https://github.com/eemeli/yaml) | `2.8.2` | `2.8.3` |
| [yaml](https://github.com/eemeli/yaml) | `1.10.2` | `1.10.3` |
| [@sveltejs/kit](https://github.com/sveltejs/kit/tree/HEAD/packages/kit) | `2.55.0` | `2.57.1` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.4.21` | `8.0.8` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.14` |
| [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.8.11` | `0.8.12` |
| [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` |
| [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` |
Updates `dompurify` from 3.3.3 to 3.4.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/cure53/DOMPurify/releases">dompurify's releases</a>.</em></p>
<blockquote>
<h2>DOMPurify 3.4.0</h2>
<p><strong>Most relevant changes:</strong></p>
<ul>
<li>Fixed a problem with <code>FORBID_TAGS</code> not winning over <code>ADD_TAGS</code>, thanks <a href="https://github.com/kodareef5"><code>@kodareef5</code></a></li>
<li>Fixed several minor problems and typos regarding MathML attributes, thanks <a href="https://github.com/DavidOliver"><code>@DavidOliver</code></a></li>
<li>Fixed <code>ADD_ATTR</code>/<code>ADD_TAGS</code> function leaking into subsequent array-based calls, thanks <a href="https://github.com/1Jesper1"><code>@1Jesper1</code></a></li>
<li>Fixed a missing <code>SAFE_FOR_TEMPLATES</code> scrub in <code>RETURN_DOM</code> path, thanks <a href="https://github.com/bencalif"><code>@bencalif</code></a></li>
<li>Fixed a prototype pollution via <code>CUSTOM_ELEMENT_HANDLING</code>, thanks <a href="https://github.com/trace37labs"><code>@trace37labs</code></a></li>
<li>Fixed an issue with <code>ADD_TAGS</code> function form bypassing <code>FORBID_TAGS</code>, thanks <a href="https://github.com/eddieran"><code>@eddieran</code></a></li>
<li>Fixed an issue with <code>ADD_ATTR</code> predicates skipping URI validation, thanks <a href="https://github.com/christos-eth"><code>@christos-eth</code></a></li>
<li>Fixed an issue with <code>USE_PROFILES</code> prototype pollution, thanks <a href="https://github.com/christos-eth"><code>@christos-eth</code></a></li>
<li>Fixed an issue leading to possible mXSS via Re-Contextualization, thanks <a href="https://github.com/researchatfluidattacks"><code>@researchatfluidattacks</code></a> and others</li>
<li>Fixed an issue with closing tags leading to possible mXSS, thanks <a href="https://github.com/frevadiscor"><code>@frevadiscor</code></a></li>
<li>Fixed a problem with the type dentition patcher after Node version bump</li>
<li>Fixed freezing BS runs by reducing the tested browsers array</li>
<li>Bumped several dependencies where possible</li>
<li>Added needed files for OpenSSF scorecard checks</li>
</ul>
<p><strong>Published Advisories are here:</strong>
<a href="https://github.com/cure53/DOMPurify/security/advisories?state=published">https://github.com/cure53/DOMPurify/security/advisories?state=published</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/cure53/DOMPurify/commit/5b16e0b892e82b1779d62b9928b43c4c4ff290b9"><code>5b16e0b</code></a> Getting 3.x branch ready for 3.4.0 release (<a href="https://redirect.github.com/cure53/DOMPurify/issues/1250">#1250</a>)</li>
<li>See full diff in <a href="https://github.com/cure53/DOMPurify/compare/3.3.3...3.4.0">compare view</a></li>
</ul>
</details>
<br />
Updates `yaml` from 2.8.2 to 2.8.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/eemeli/yaml/releases">yaml's releases</a>.</em></p>
<blockquote>
<h2>v2.8.3</h2>
<ul>
<li>Add <code>trailingComma</code> ToString option for multiline flow formatting (<a href="https://redirect.github.com/eemeli/yaml/issues/670">#670</a>)</li>
<li>Catch stack overflow during node composition (1e84ebb)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/eemeli/yaml/commit/ce14587484822bffb0f7d31aefedcaf2dc0d0387"><code>ce14587</code></a> 2.8.3</li>
<li><a href="https://github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b"><code>1e84ebb</code></a> fix: Catch stack overflow during node composition</li>
<li><a href="https://github.com/eemeli/yaml/commit/6b24090280eaaab5040112bba41ccef57f39c2d5"><code>6b24090</code></a> ci: Include Prettier check in lint action</li>
<li><a href="https://github.com/eemeli/yaml/commit/9424dee38c85163fad53ac27533c7c4bdaf7495d"><code>9424dee</code></a> chore: Refresh lockfile</li>
<li><a href="https://github.com/eemeli/yaml/commit/d1aca82bc15a4c261bdc58561d32189a5d3a45ef"><code>d1aca82</code></a> Add trailingComma ToString option for multiline flow formatting (<a href="https://redirect.github.com/eemeli/yaml/issues/670">#670</a>)</li>
<li><a href="https://github.com/eemeli/yaml/commit/43215099f7fcdac422d778c15e70d83c691b0e41"><code>4321509</code></a> ci: Drop the branch filter from GitHub PR actions</li>
<li><a href="https://github.com/eemeli/yaml/commit/47207d0fc7d4f863cd5fbdcff1378637bd93e847"><code>47207d0</code></a> chore: Update docs-slate</li>
<li><a href="https://github.com/eemeli/yaml/commit/5212faeed5936d1fa291d2f28672e4a96e2c2c5d"><code>5212fae</code></a> chore: Update docs-slate</li>
<li>See full diff in <a href="https://github.com/eemeli/yaml/compare/v2.8.2...v2.8.3">compare view</a></li>
</ul>
</details>
<br />
Updates `yaml` from 1.10.2 to 1.10.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/eemeli/yaml/releases">yaml's releases</a>.</em></p>
<blockquote>
<h2>v2.8.3</h2>
<ul>
<li>Add <code>trailingComma</code> ToString option for multiline flow formatting (<a href="https://redirect.github.com/eemeli/yaml/issues/670">#670</a>)</li>
<li>Catch stack overflow during node composition (1e84ebb)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/eemeli/yaml/commit/ce14587484822bffb0f7d31aefedcaf2dc0d0387"><code>ce14587</code></a> 2.8.3</li>
<li><a href="https://github.com/eemeli/yaml/commit/1e84ebbea7ec35011a4c61bbb820a529ee4f359b"><code>1e84ebb</code></a> fix: Catch stack overflow during node composition</li>
<li><a href="https://github.com/eemeli/yaml/commit/6b24090280eaaab5040112bba41ccef57f39c2d5"><code>6b24090</code></a> ci: Include Prettier check in lint action</li>
<li><a href="https://github.com/eemeli/yaml/commit/9424dee38c85163fad53ac27533c7c4bdaf7495d"><code>9424dee</code></a> chore: Refresh lockfile</li>
<li><a href="https://github.com/eemeli/yaml/commit/d1aca82bc15a4c261bdc58561d32189a5d3a45ef"><code>d1aca82</code></a> Add trailingComma ToString option for multiline flow formatting (<a href="https://redirect.github.com/eemeli/yaml/issues/670">#670</a>)</li>
<li><a href="https://github.com/eemeli/yaml/commit/43215099f7fcdac422d778c15e70d83c691b0e41"><code>4321509</code></a> ci: Drop the branch filter from GitHub PR actions</li>
<li><a href="https://github.com/eemeli/yaml/commit/47207d0fc7d4f863cd5fbdcff1378637bd93e847"><code>47207d0</code></a> chore: Update docs-slate</li>
<li><a href="https://github.com/eemeli/yaml/commit/5212faeed5936d1fa291d2f28672e4a96e2c2c5d"><code>5212fae</code></a> chore: Update docs-slate</li>
<li>See full diff in <a href="https://github.com/eemeli/yaml/compare/v2.8.2...v2.8.3">compare view</a></li>
</ul>
</details>
<br />
Updates `@sveltejs/kit` from 2.55.0 to 2.57.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/sveltejs/kit/releases"><code>@sveltejs/kit</code>'s releases</a>.</em></p>
<blockquote>
<h2><code>@sveltejs/kit</code><a href="https://github.com/2"><code>@2</code></a>.57.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: better validation for <code>redirect</code> inputs (<a href="https://github.com/sveltejs/kit/commit/10d7b44425c3d9da642eecce373d0c6ef83b4fcd"><code>10d7b44</code></a>)</p>
</li>
<li>
<p>fix: enforce <code>BODY_SIZE_LIMIT</code> on chunked requests (<a href="https://github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95"><code>3202ed6</code></a>)</p>
</li>
<li>
<p>fix: use default values as fallbacks (<a href="https://redirect.github.com/sveltejs/kit/pull/15680">#15680</a>)</p>
</li>
<li>
<p>fix: relax form typings for union types (<a href="https://redirect.github.com/sveltejs/kit/pull/15687">#15687</a>)</p>
</li>
</ul>
<h2><code>@sveltejs/kit</code><a href="https://github.com/2"><code>@2</code></a>.57.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>feat: return boolean from <code>submit</code> to indicate submission validity for enhanced <code>form</code> remote functions (<a href="https://redirect.github.com/sveltejs/kit/pull/15530">#15530</a>)</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: use array type for select fields that accept multiple values (<a href="https://redirect.github.com/sveltejs/kit/pull/15591">#15591</a>)</p>
</li>
<li>
<p>fix: silently 404 Chrome DevTools workspaces request in dev and preview (<a href="https://redirect.github.com/sveltejs/kit/pull/15656">#15656</a>)</p>
</li>
<li>
<p>fix: <code>config.kit.csp.directives['trusted-types']</code> requires <code>'svelte-trusted-html'</code> (and <code>'sveltekit-trusted-url'</code> when a service worker is automatically registered) if it is configured (<a href="https://redirect.github.com/sveltejs/kit/pull/15323">#15323</a>)</p>
</li>
<li>
<p>fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (<a href="https://redirect.github.com/sveltejs/kit/pull/15647">#15647</a>)</p>
</li>
<li>
<p>fix: reimplement treeshaking non-dynamic prerendered remote functions (<a href="https://redirect.github.com/sveltejs/kit/pull/15447">#15447</a>)</p>
</li>
</ul>
<h2><code>@sveltejs/kit</code><a href="https://github.com/2"><code>@2</code></a>.56.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>chore: update JSDoc (<a href="https://redirect.github.com/sveltejs/kit/pull/15640">#15640</a>)</li>
</ul>
<h2><code>@sveltejs/kit</code><a href="https://github.com/2"><code>@2</code></a>.56.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>
<p>breaking: rework client-driven refreshes (<a href="https://redirect.github.com/sveltejs/kit/pull/15562">#15562</a>)</p>
</li>
<li>
<p>breaking: stabilize remote function caching by sorting object keys (<a href="https://redirect.github.com/sveltejs/kit/pull/15570">#15570</a>)</p>
</li>
<li>
<p>breaking: add <code>run()</code> method to queries, disallow awaiting queries outside render (<a href="https://redirect.github.com/sveltejs/kit/pull/15533">#15533</a>)</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/sveltejs/kit/blob/main/packages/kit/CHANGELOG.md"><code>@sveltejs/kit</code>'s changelog</a>.</em></p>
<blockquote>
<h2>2.57.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: better validation for <code>redirect</code> inputs (<a href="https://github.com/sveltejs/kit/commit/10d7b44425c3d9da642eecce373d0c6ef83b4fcd"><code>10d7b44</code></a>)</p>
</li>
<li>
<p>fix: enforce <code>BODY_SIZE_LIMIT</code> on chunked requests (<a href="https://github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95"><code>3202ed6</code></a>)</p>
</li>
<li>
<p>fix: use default values as fallbacks (<a href="https://redirect.github.com/sveltejs/kit/pull/15680">#15680</a>)</p>
</li>
<li>
<p>fix: relax form typings for union types (<a href="https://redirect.github.com/sveltejs/kit/pull/15687">#15687</a>)</p>
</li>
</ul>
<h2>2.57.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>feat: return boolean from <code>submit</code> to indicate submission validity for enhanced <code>form</code> remote functions (<a href="https://redirect.github.com/sveltejs/kit/pull/15530">#15530</a>)</li>
</ul>
<h3>Patch Changes</h3>
<ul>
<li>
<p>fix: use array type for select fields that accept multiple values (<a href="https://redirect.github.com/sveltejs/kit/pull/15591">#15591</a>)</p>
</li>
<li>
<p>fix: silently 404 Chrome DevTools workspaces request in dev and preview (<a href="https://redirect.github.com/sveltejs/kit/pull/15656">#15656</a>)</p>
</li>
<li>
<p>fix: <code>config.kit.csp.directives['trusted-types']</code> requires <code>'svelte-trusted-html'</code> (and <code>'sveltekit-trusted-url'</code> when a service worker is automatically registered) if it is configured (<a href="https://redirect.github.com/sveltejs/kit/pull/15323">#15323</a>)</p>
</li>
<li>
<p>fix: avoid inlineDynamicImports ignored with codeSplitting warning when using Vite 8 (<a href="https://redirect.github.com/sveltejs/kit/pull/15647">#15647</a>)</p>
</li>
<li>
<p>fix: reimplement treeshaking non-dynamic prerendered remote functions (<a href="https://redirect.github.com/sveltejs/kit/pull/15447">#15447</a>)</p>
</li>
</ul>
<h2>2.56.1</h2>
<h3>Patch Changes</h3>
<ul>
<li>chore: update JSDoc (<a href="https://redirect.github.com/sveltejs/kit/pull/15640">#15640</a>)</li>
</ul>
<h2>2.56.0</h2>
<h3>Minor Changes</h3>
<ul>
<li>breaking: rework client-driven refreshes (<a href="https://redirect.github.com/sveltejs/kit/pull/15562">#15562</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/sveltejs/kit/commit/75147d464a1b52ec05cd9a792a9d2430445621ac"><code>75147d4</code></a> Version Packages (<a href="https://github.com/sveltejs/kit/tree/HEAD/packages/kit/issues/15684">#15684</a>)</li>
<li><a href="https://github.com/sveltejs/kit/commit/10d7b44425c3d9da642eecce373d0c6ef83b4fcd"><code>10d7b44</code></a> Merge commit from fork</li>
<li><a href="https://github.com/sveltejs/kit/commit/3202ed6c98f9e8d86bf0c4c7ad0f2e273e5e3b95"><code>3202ed6</code></a> Merge commit from fork</li>
<li><a href="https://github.com/sveltejs/kit/commit/24d7e76a77291f3760baa9fd4350221d55aa341a"><code>24d7e76</code></a> chore: fix reuse wording in client comment (<a href="https://github.com/sveltejs/kit/tree/HEAD/packages/kit/issues/15679">#15679</a>)</li>
<li><a href="https://github.com/sveltejs/kit/commit/6a9cdaa84689a9cc7067ec1abd82bbdded10fa2e"><code>6a9cdaa</code></a> fix: relax form typings for union types (<a href="https://github.com/sveltejs/kit/tree/HEAD/packages/kit/issues/15687">#15687</a>)</li>
<li><a href="https://github.com/sveltejs/kit/commit/ab8b2f182be1d081e01624e1fd0c922b08f3d354"><code>ab8b2f1</code></a> fix: use default values as fallbacks (<a href="https://github.com/sveltejs/kit/tree/HEAD/packages/kit/issues/15680">#15680</a>)</li>
<li><a href="https://github.com/sveltejs/kit/commit/3ccb33b7a88228037fdc8832ae1e597699df7b99"><code>3ccb33b</code></a> Version Packages (<a href="https://github.com/sveltejs/kit/tree/HEAD/packages/kit/issues/15651">#15651</a>)</li>
<li><a href="https://github.com/sveltejs/kit/commit/7f8aef77e41c0effa1be4dcd7eba2e3f1420a2f9"><code>7f8aef7</code></a> chore: reduce use of any types (<a href="https://github.com/sveltejs/kit/tree/HEAD/packages/kit/issues/15659">#15659</a>)</li>
<li><a href="https://github.com/sveltejs/kit/commit/be1c95f1e3068f6eaa3a1ec331ec3baeb69e340e"><code>be1c95f</code></a> chore: avoid importing types directly from Rollup (<a href="https://github.com/sveltejs/kit/tree/HEAD/packages/kit/issues/15668">#15668</a>)</li>
<li><a href="https://github.com/sveltejs/kit/commit/1615af7f8244e37344ae37571059a3fd8860afec"><code>1615af7</code></a> chore: centralize noops (<a href="https://github.com/sveltejs/kit/tree/HEAD/packages/kit/issues/15662">#15662</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/sveltejs/kit/commits/@sveltejs/kit@2.57.1/packages/kit">compare view</a></li>
</ul>
</details>
<br />
Updates `vite` from 5.4.21 to 8.0.8
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p>
<blockquote>
<h2>v8.0.8</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.8/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>v8.0.7</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.7/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>v8.0.6</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.6/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>v8.0.5</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.5/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>v8.0.4</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.4/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>create-vite@8.0.3</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@8.0.3/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>v8.0.3</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.3/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>create-vite@8.0.2</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@8.0.2/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>v8.0.2</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>create-vite@8.0.1</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@8.0.1/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>v8.0.1</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>plugin-legacy@8.0.1</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.0.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>create-vite@8.0.0</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@8.0.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>plugin-legacy@8.0.0</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.0.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>v8.0.0</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>v8.0.0-beta.18</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.0-beta.18/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<h2>v8.0.0-beta.17</h2>
<p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.0.0-beta.17/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.0.7...v8.0.8">8.0.8</a> (2026-04-09)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>update rolldown to 1.0.0-rc.15 (<a href="https://redirect.github.com/vitejs/vite/issues/22201">#22201</a>) (<a href="https://github.com/vitejs/vite/commit/6baf587255936e91348cbe624caefd10e8c607ab">6baf587</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>avoid <code>dns.getDefaultResultOrder</code> temporary (<a href="https://redirect.github.com/vitejs/vite/issues/22202">#22202</a>) (<a href="https://github.com/vitejs/vite/commit/15f1c15ac9be343ee4f317fd025c3d67f0c7bd53">15f1c15</a>)</li>
<li><strong>ssr:</strong> class property keys hoisting matching imports (<a href="https://redirect.github.com/vitejs/vite/issues/22199">#22199</a>) (<a href="https://github.com/vitejs/vite/commit/e1376018cd516d6970534fce495e24f9ee683ce3">e137601</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.0.6...v8.0.7">8.0.7</a> (2026-04-07)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li>use sync dns.getDefaultResultOrder instead of dns.promises (<a href="https://redirect.github.com/vitejs/vite/issues/22185">#22185</a>) (<a href="https://github.com/vitejs/vite/commit/5c05b04db6f3f64af60ff6525eb5f04bc330fbb5">5c05b04</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.0.5...v8.0.6">8.0.6</a> (2026-04-07)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>update rolldown to 1.0.0-rc.13 (<a href="https://redirect.github.com/vitejs/vite/issues/22097">#22097</a>) (<a href="https://github.com/vitejs/vite/commit/51d3e48980bf3e352d31ecde49d1aa56859918e0">51d3e48</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li><strong>css:</strong> avoid mutating sass error multiple times (<a href="https://redirect.github.com/vitejs/vite/issues/22115">#22115</a>) (<a href="https://github.com/vitejs/vite/commit/d5081c2f3e73f3fc06956d8cf5f2cf06463c2325">d5081c2</a>)</li>
<li><strong>optimize-deps:</strong> hoist CJS interop assignment (<a href="https://redirect.github.com/vitejs/vite/issues/22156">#22156</a>) (<a href="https://github.com/vitejs/vite/commit/17a8f9edfcd3b9344668120a84e3328aeada3c97">17a8f9e</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li>early return in <code>getLocalhostAddressIfDiffersFromDNS</code> when DNS order is <code>verbatim</code> (<a href="https://redirect.github.com/vitejs/vite/issues/22151">#22151</a>) (<a href="https://github.com/vitejs/vite/commit/56ec25613dba6cc71911f7af6e545ebcb77ec012">56ec256</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>create-vite:</strong> remove unnecessary DOM.Iterable (<a href="https://redirect.github.com/vitejs/vite/issues/22168">#22168</a>) (<a href="https://github.com/vitejs/vite/commit/bdc53ab1e67f7e2e000112eeed9c85413ddb0e9e">bdc53ab</a>)</li>
<li>replace remaining prettier script (<a href="https://redirect.github.com/vitejs/vite/issues/22179">#22179</a>) (<a href="https://github.com/vitejs/vite/commit/af71fb26dd15098b9523efc3d8ed04f27553174b">af71fb2</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.0.4...v8.0.5">8.0.5</a> (2026-04-06)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li>apply server.fs check to env transport (<a href="https://redirect.github.com/vitejs/vite/issues/22159">#22159</a>) (<a href="https://github.com/vitejs/vite/commit/f02d9fde0b195afe3ea2944414186962fbbe41e0">f02d9fd</a>)</li>
<li>avoid path traversal with optimize deps sourcemap handler (<a href="https://redirect.github.com/vitejs/vite/issues/22161">#22161</a>) (<a href="https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694">79f002f</a>)</li>
<li>check <code>server.fs</code> after stripping query as well (<a href="https://redirect.github.com/vitejs/vite/issues/22160">#22160</a>) (<a href="https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff">a9a3df2</a>)</li>
<li>disallow referencing files outside the package from sourcemap (<a href="https://redirect.github.com/vitejs/vite/issues/22158">#22158</a>) (<a href="https://github.com/vitejs/vite/commit/f05f50173461789e0f1323fe06b51f18ca41c132">f05f501</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.0.3...v8.0.4">8.0.4</a> (2026-04-06)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li>allow esbuild 0.28 as peer deps (<a href="https://redirect.github.com/vitejs/vite/issues/22155">#22155</a>) (<a href="https://github.com/vitejs/vite/commit/b0da97372f5dba73e78035d1cc7680466ff6cf7f">b0da973</a>)</li>
<li><strong>hmr:</strong> truncate list of files on hmr update (<a href="https://redirect.github.com/vitejs/vite/issues/21535">#21535</a>) (<a href="https://github.com/vitejs/vite/commit/d00e806d7be15ebbfe7875e9244963d80ee8b142">d00e806</a>)</li>
<li><strong>optimizer:</strong> log when dependency scanning or bundling takes over 1s (<a href="https://redirect.github.com/vitejs/vite/issues/21797">#21797</a>) (<a href="https://github.com/vitejs/vite/commit/f61a1ab33b05dc6f6a7eda6e8bc9c4c5b9aab133">f61a1ab</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/vitejs/vite/commit/6e585dcb05a3b159fba7ae57f7faf0b1eca7a390"><code>6e585dc</code></a> release: v8.0.8</li>
<li><a href="https://github.com/vitejs/vite/commit/e1376018cd516d6970534fce495e24f9ee683ce3"><code>e137601</code></a> fix(ssr): class property keys hoisting matching imports (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22199">#22199</a>)</li>
<li><a href="https://github.com/vitejs/vite/commit/15f1c15ac9be343ee4f317fd025c3d67f0c7bd53"><code>15f1c15</code></a> fix: avoid <code>dns.getDefaultResultOrder</code> temporary (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22202">#22202</a>)</li>
<li><a href="https://github.com/vitejs/vite/commit/6baf587255936e91348cbe624caefd10e8c607ab"><code>6baf587</code></a> feat: update rolldown to 1.0.0-rc.15 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22201">#22201</a>)</li>
<li><a href="https://github.com/vitejs/vite/commit/fdb2e6f63894d8c458c1778f3df77afe537f2bb2"><code>fdb2e6f</code></a> release: v8.0.7</li>
<li><a href="https://github.com/vitejs/vite/commit/5c05b04db6f3f64af60ff6525eb5f04bc330fbb5"><code>5c05b04</code></a> fix: use sync dns.getDefaultResultOrder instead of dns.promises (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22185">#22185</a>)</li>
<li><a href="https://github.com/vitejs/vite/commit/7b3086fae4170252e4cd53f3988f207a943ac5cb"><code>7b3086f</code></a> release: v8.0.6</li>
<li><a href="https://github.com/vitejs/vite/commit/af71fb26dd15098b9523efc3d8ed04f27553174b"><code>af71fb2</code></a> chore: replace remaining prettier script (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22179">#22179</a>)</li>
<li><a href="https://github.com/vitejs/vite/commit/51d3e48980bf3e352d31ecde49d1aa56859918e0"><code>51d3e48</code></a> feat: update rolldown to 1.0.0-rc.13 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22097">#22097</a>)</li>
<li><a href="https://github.com/vitejs/vite/commit/17a8f9edfcd3b9344668120a84e3328aeada3c97"><code>17a8f9e</code></a> fix(optimize-deps): hoist CJS interop assignment (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22156">#22156</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v8.0.8/packages/vite">compare view</a></li>
</ul>
</details>
<br />
Updates `brace-expansion` from 1.1.12 to 1.1.14
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/10c05fcf3699b1a29ef5e611c011af3d3c97e6e3"><code>10c05fc</code></a> 1.1.14</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/1afa1b22ead12f6a7a02f25bf0f7d64c2439b007"><code>1afa1b2</code></a> Add opt-in { max } mitigation to v1 legacy line (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/103">#103</a>)</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/2fbb6a2aa0f984bb2fb5f60252ca6cba3e1368ec"><code>2fbb6a2</code></a> Revert "Backport fix for GHSA-7h2j-956f-4vf2 to v1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/101">#101</a>)" (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/102">#102</a>)</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/0d7652e3093d3273151729812f9b0b79a17ecba6"><code>0d7652e</code></a> Backport fix for GHSA-7h2j-956f-4vf2 to v1 (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/101">#101</a>)</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/6c353caf23beb9644f858eb3fe38d43a68b82898"><code>6c353ca</code></a> 1.1.13</li>
<li><a href="https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2"><code>7fd684f</code></a> Backport fix for GHSA-f886-m6hf-6m8v (<a href="https://redirect.github.com/juliangruber/brace-expansion/issues/95">#95</a>)</li>
<li>See full diff in <a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v1.1.14">compare view</a></li>
</ul>
</details>
<br />
Updates `@xmldom/xmldom` from 0.8.11 to 0.8.12
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/xmldom/xmldom/releases"><code>@xmldom/xmldom</code>'s releases</a>.</em></p>
<blockquote>
<h2>0.8.12</h2>
<p><a href="https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12">Commits</a></p>
<h3>Fixed</h3>
<ul>
<li>preserve trailing whitespace in ProcessingInstruction data <a href="https://redirect.github.com/xmldom/xmldom/pull/962"><code>[#962](https://github.com/xmldom/xmldom/issues/962)</code></a> / <a href="https://redirect.github.com/xmldom/xmldom/issues/42"><code>[#42](https://github.com/xmldom/xmldom/issues/42)</code></a></li>
<li>Security: <code>createCDATASection</code> now throws <code>InvalidCharacterError</code> when <code>data</code> contains <code>"]]>"</code>, as required by the <a href="https://dom.spec.whatwg.org/#dom-document-createcdatasection">WHATWG DOM spec</a>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li>
<li>Security: <code>XMLSerializer</code> now splits CDATASection nodes whose data contains <code>"]]>"</code> into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (<code>appendData</code>, <code>replaceData</code>, <code>.data =</code>, <code>.textContent =</code>). <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li>
</ul>
<p>Code that passes a string containing <code>"]]>"</code> to <code>createCDATASection</code> and relied on the previously unsafe behavior will now receive <code>InvalidCharacterError</code>. Use a mutation method such as <code>appendData</code> if you intentionally need <code>"]]>"</code> in a CDATASection node's data.</p>
<p>Thank you,
<a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>,
<a href="https://github.com/stevenobiajulu"><code>@stevenobiajulu</code></a>,
for your contributions</p>
<p><a href="https://github.com/xmldom/xmldom/discussions/357">https://github.com/xmldom/xmldom/discussions/357</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md"><code>@xmldom/xmldom</code>'s changelog</a>.</em></p>
<blockquote>
<h2><a href="https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12">0.8.12</a></h2>
<h3>Fixed</h3>
<ul>
<li>preserve trailing whitespace in ProcessingInstruction data <a href="https://redirect.github.com/xmldom/xmldom/pull/962"><code>[#962](https://github.com/xmldom/xmldom/issues/962)</code></a> / <a href="https://redirect.github.com/xmldom/xmldom/issues/42"><code>[#42](https://github.com/xmldom/xmldom/issues/42)</code></a></li>
<li>Security: <code>createCDATASection</code> now throws <code>InvalidCharacterError</code> when <code>data</code> contains <code>"]]>"</code>, as required by the <a href="https://dom.spec.whatwg.org/#dom-document-createcdatasection">WHATWG DOM spec</a>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li>
<li>Security: <code>XMLSerializer</code> now splits CDATASection nodes whose data contains <code>"]]>"</code> into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (<code>appendData</code>, <code>replaceData</code>, <code>.data =</code>, <code>.textContent =</code>). <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li>
</ul>
<p>Code that passes a string containing <code>"]]>"</code> to <code>createCDATASection</code> and relied on the previously unsafe behavior will now receive <code>InvalidCharacterError</code>. Use a mutation method such as <code>appendData</code> if you intentionally need <code>"]]>"</code> in a CDATASection node's data.</p>
<p>Thank you,
<a href="https://github.com/thesmartshadow"><code>@thesmartshadow</code></a>,
<a href="https://github.com/stevenobiajulu"><code>@stevenobiajulu</code></a>,
for your contributions</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/xmldom/xmldom/commit/189cb78a83e81e1515880988a399e863a8be85ac"><code>189cb78</code></a> 0.8.12</li>
<li><a href="https://github.com/xmldom/xmldom/commit/ed08df7572f4236d4fd88d16063c3fd8f59c7884"><code>ed08df7</code></a> fix: XML injection via unsafe CDATA serialization (GHSA-wh4c-j3r5-mjhp) (<a href="https://redirect.github.com/xmldom/xmldom/issues/968">#968</a>)</li>
<li><a href="https://github.com/xmldom/xmldom/commit/a5b929ba008f067eeabb427c38de008e36a92796"><code>a5b929b</code></a> chore: clean up generated test artefacts before running ci-local</li>
<li><a href="https://github.com/xmldom/xmldom/commit/4e37a205627a08eb64365b13c4e4cce5e86278cb"><code>4e37a20</code></a> ci: run format:check in lint job</li>
<li><a href="https://github.com/xmldom/xmldom/commit/ac0ac7714f0e5a7bd7aff5c30f7733666cf03982"><code>ac0ac77</code></a> chore: ignore generated files when checking formatting</li>
<li><a href="https://github.com/xmldom/xmldom/commit/968c8939438eec2eca1d003b333cd0fc4595c72d"><code>968c893</code></a> chore: add local CI script and format:check script</li>
<li><a href="https://github.com/xmldom/xmldom/commit/ac40424adfa49429811095bcdaf6598255a81a39"><code>ac40424</code></a> fix: preserve trailing whitespace in ProcessingInstruction data (<a href="https://redirect.github.com/xmldom/xmldom/issues/962">#962</a>)</li>
<li><a href="https://github.com/xmldom/xmldom/commit/cece7521a3c77da7a10f3fc66521e3e077c9974c"><code>cece752</code></a> chore: add .nvmrc pointing to node version 18</li>
<li><a href="https://github.com/xmldom/xmldom/commit/cbf44d90a40703237d217598fa0bcd88770bfa0b"><code>cbf44d9</code></a> docs: improve links to changes in most recent release</li>
<li>See full diff in <a href="https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12">compare view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a href="https://www.npmjs.com/~karfau">karfau</a>, a new releaser for <code>@xmldom/xmldom</code> since your current version.</p>
</details>
<br />
Updates `picomatch` from 2.3.1 to 2.3.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/micromatch/picomatch/releases">picomatch's releases</a>.</em></p>
<blockquote>
<h2>2.3.2</h2>
<p>This is a security release fixing several security relevant issues.</p>
<h2>What's Changed</h2>
<ul>
<li>fix: exception when glob pattern contains constructor by <a href="https://github.com/Jason3S"><code>@Jason3S</code></a> in <a href="https://redirect.github.com/micromatch/picomatch/pull/144">micromatch/picomatch#144</a></li>
<li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj">CVE-2026-33671</a></li>
<li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p">CVE-2026-33672</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2">https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md">picomatch's changelog</a>.</em></p>
<blockquote>
<h1>Release history</h1>
<p><strong>All notable changes to this project will be documented in this file.</strong></p>
<p>The format is based on <a href="http://keepachangelog.com/en/1.0.0/">Keep a Changelog</a>
and this project adheres to <a href="http://semver.org/spec/v2.0.0.html">Semantic Versioning</a>.</p>
<!-- raw HTML omitted -->
<ul>
<li>Changelogs are for humans, not machines.</li>
<li>There should be an entry for every single version.</li>
<li>The same types of changes should be grouped.</li>
<li>Versions and sections should be linkable.</li>
<li>The latest version comes first.</li>
<li>The release date of each versions is displayed.</li>
<li>Mention whether you follow Semantic Versioning.</li>
</ul>
<!-- raw HTML omitted -->
<!-- raw HTML omitted -->
<p>Changelog entries are classified using the following labels <em>(from <a href="http://keepachangelog.com/">keep-a-changelog</a></em>):</p>
<ul>
<li><code>Added</code> for new features.</li>
<li><code>Changed</code> for changes in existing functionality.</li>
<li><code>Deprecated</code> for soon-to-be removed features.</li>
<li><code>Removed</code> for now removed features.</li>
<li><code>Fixed</code> for any bug fixes.</li>
<li><code>Security</code> in case of vulnerabilities.</li>
</ul>
<!-- raw HTML omitted -->
<h2>4.0.0 (2024-02-07)</h2>
<h3>Fixes</h3>
<ul>
<li>Fix bad text values in parse <a href="https://redirect.github.com/micromatch/picomatch/issues/126">#126</a>, thanks to <a href="https://github.com/connor4312"><code>@connor4312</code></a></li>
</ul>
<h3>Changed</h3>
<ul>
<li>Remove process global to work outside of node <a href="https://redirect.github.com/micromatch/picomatch/issues/129">#129</a>, thanks to <a href="https://github.com/styfle"><code>@styfle</code></a></li>
<li>Add sideEffects to package.json <a href="https://redirect.github.com/micromatch/picomatch/issues/128">#128</a>, thanks to <a href="https://github.com/frandiox"><code>@frandiox</code></a></li>
<li>Removed <code>os</code>, make compatible browser environment. See <a href="https://redirect.github.com/micromatch/picomatch/issues/124">#124</a>, thanks to <a href="https://github.com/gwsbhqt"><code>@gwsbhqt</code></a></li>
</ul>
<h2>3.0.1</h2>
<h3>Fixes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/micromatch/picomatch/commit/81cba8d4b767cab3cb29d26eb4f691eed75b73b2"><code>81cba8d</code></a> Publish 2.3.2</li>
<li><a href="https://github.com/micromatch/picomatch/commit/fc1f6b69006e9435caf8fb40d8aff378bc0b7bce"><code>fc1f6b6</code></a> Merge commit from fork</li>
<li><a href="https://github.com/micromatch/picomatch/commit/eec17aee5428a7249e9ca5adbb8a0d28fa29619b"><code>eec17ae</code></a> Merge commit from fork</li>
<li><a href="https://github.com/micromatch/picomatch/commit/78f8ca4362d9e66cadea97b93e292f10096452ed"><code>78f8ca4</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/picomatch/issues/156">#156</a> from micromatch/backport-144</li>
<li><a href="https://github.com/micromatch/picomatch/commit/3f4f10eaa65bf3a52e8f2999674cd27e11fa3c9b"><code>3f4f10e</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/picomatch/issues/144">#144</a> from Jason3S/jdent-object-properties</li>
<li>See full diff in <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2">compare view</a></li>
</ul>
</details>
<br />
Updates `lodash` from 4.17.23 to 4.18.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/lodash/lodash/releases">lodash's releases</a>.</em></p>
<blockquote>
<h2>4.18.1</h2>
<h2>Bugs</h2>
<p>Fixes a <code>ReferenceError</code> issue in <code>lodash</code> <code>lodash-es</code> <code>lodash-amd</code> and <code>lodash.template</code> when using the <code>template</code> and <code>fromPairs</code> functions from the modular builds. See <a href="https://redirect.github.com/lodash/lodash/issues/6167#issuecomment-4165269769">lodash/lodash#6167</a></p>
<p>These defects were related to how lodash distributions are built from the main branch using <a href="https://github.com/lodash-archive/lodash-cli">https://github.com/lodash-archive/lodash-cli</a>. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.</p>
<p>There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:</p>
<ul>
<li><code>lodash</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm">https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm</a></li>
<li><code>lodash-es</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es">https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es</a></li>
<li><code>lodash-amd</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd">https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd</a></li>
<li><code>lodash.template</code><a href="https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages">https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages</a></li>
</ul>
<h2>4.18.0</h2>
<h2>v4.18.0</h2>
<p><strong>Full Changelog</strong>: <a href="https://github.com/lodash/lodash/compare/4.17.23...4.18.0">https://github.com/lodash/lodash/compare/4.17.23...4.18.0</a></p>
<h3>Security</h3>
<p><strong><code>_.unset</code> / <code>_.omit</code></strong>: Fixed prototype pollution via <code>constructor</code>/<code>prototype</code> path traversal (<a href="https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh">GHSA-f23m-r3pf-42rh</a>, <a href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b">fe8d32e</a>). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now <code>constructor</code> and <code>prototype</code> are blocked unconditionally as non-terminal path keys, matching <code>baseSet</code>. Calls that previously returned <code>true</code> and deleted the property now return <code>false</code> and leave the target untouched.</p>
<p><strong><code>_.template</code></strong>: Fixed code injection via <code>imports</code> keys (<a href="https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc">GHSA-r5fr-rjxr-66jc</a>, CVE-2026-4800, <a href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6">879aaa9</a>). Fixes an incomplete patch for CVE-2021-23337. The <code>variable</code> option was validated against <code>reForbiddenIdentifierChars</code> but <code>importsKeys</code> was left unguarded, allowing code injection via the same <code>Function()</code> constructor sink. <code>imports</code> keys containing forbidden identifier characters now throw <code>"Invalid imports option passed into _.template"</code>.</p>
<h3>Docs</h3>
<ul>
<li>Add security notice for <code>_.template</code> in threat model and API docs (<a href="https://redirect.github.com/lodash/lodash/pull/6099">#6099</a>)</li>
<li>Document <code>lower > upper</code> behavior in <code>_.random</code> (<a href="https://redirect.github.com/lodash/lodash/pull/6115">#6115</a>)</li>
<li>Fix quotes in <code>_.compact</code> jsdoc (<a href="https://redirect.github.com/lodash/lodash/pull/6090">#6090</a>)</li>
</ul>
<h3><code>lodash.*</code> modular packages</h3>
<p><a href="https://redirect.github.com/lodash/lodash/pull/6157">Diff</a></p>
<p>We have also regenerated and published a select number of the <code>lodash.*</code> modular packages.</p>
<p>These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:</p>
<ul>
<li><a href="https://www.npmjs.com/package/lodash.orderby">lodash.orderby</a></li>
<li><a href="https://www.npmjs.com/package/lodash.tonumber">lodash.tonumber</a></li>
<li><a href="https://www.npmjs.com/package/lodash.trim">lodash.trim</a></li>
<li><a href="https://www.npmjs.com/package/lodash.trimend">lodash.trimend</a></li>
<li><a href="https://www.npmjs.com/package/lodash.sortedindexby">lodash.sortedindexby</a></li>
<li><a href="https://www.npmjs.com/package/lodash.zipobjectdeep">lodash.zipobjectdeep</a></li>
<li><a href="https://www.npmjs.com/package/lodash.unset">lodash.unset</a></li>
<li><a href="https://www.npmjs.com/package/lodash.omit">lodash.omit</a></li>
<li><a href="https://www.npmjs.com/package/lodash.template">lodash.template</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/lodash/lodash/commit/cb0b9b9212521c08e3eafe7c8cb0af1b42b6649e"><code>cb0b9b9</code></a> release(patch): bump main to 4.18.1 (<a href="https://redirect.github.com/lodash/lodash/issues/6177">#6177</a>)</li>
<li><a href="https://github.com/lodash/lodash/commit/75535f57883b7225adb96de1cfc1cd4169cfcb51"><code>75535f5</code></a> chore: prune stale advisory refs (<a href="https://redirect.github.com/lodash/lodash/issues/6170">#6170</a>)</li>
<li><a href="https://github.com/lodash/lodash/commit/62e91bc6a39c98d85b9ada8c44d40593deaf82a4"><code>62e91bc</code></a> docs: remove n_ Node.js < 6 REPL note from README (<a href="https://redirect.github.com/lodash/lodash/issues/6165">#6165</a>)</li>
<li><a href="https://github.com/lodash/lodash/commit/59be2de61f8aa9461c7856533b51d31b7d8babc4"><code>59be2de</code></a> release(minor): bump to 4.18.0 (<a href="https://redirect.github.com/lodash/lodash/issues/6161">#6161</a>)</li>
<li><a href="https://github.com/lodash/lodash/commit/af634573030f979194871da7c68f79420992f53d"><code>af63457</code></a> fix: broken tests for _.template 879aaa9</li>
<li><a href="https://github.com/lodash/lodash/commit/1073a7693e1727e0cf3641e5f71f75ddcf8de7c0"><code>1073a76</code></a> fix: linting issues</li>
<li><a href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6"><code>879aaa9</code></a> fix: validate imports keys in _.template</li>
<li><a href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b"><code>fe8d32e</code></a> fix: block prototype pollution in baseUnset via constructor/prototype traversal</li>
<li><a href="https://github.com/lodash/lodash/commit/18ba0a32f42fd02117f096b032f89c984173462d"><code>18ba0a3</code></a> refactor(fromPairs): use baseAssignValue for consistent assignment (<a href="https://redirect.github.com/lodash/lodash/issues/6153">#6153</a>)</li>
<li><a href="https://github.com/lodash/lodash/commit/b8190803d48d60b8c80ad45d39125f32fa618cb2"><code>b819080</code></a> ci: add dist sync validation workflow (<a href="https://redirect.github.com/lodash/lodash/issues/6137">#6137</a>)</li>
<li>Additional commits viewable in <a href="https://github.com/lodash/lodash/compare/4.17.23...4.18.1">compare view</a></li>
</ul>
</details>
<br />
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/open-webui/open-webui/network/alerts).
</details>
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/23772
Author: @dependabot[bot]
Created: 4/16/2026
Status: ❌ Closed
Base:
main← Head:dependabot/npm_and_yarn/npm_and_yarn-dfc813aa02📝 Commits (1)
8782c03build(deps): bump the npm_and_yarn group across 1 directory with 8 updates📊 Changes
2 files changed (+3243 additions, -3315 deletions)
View changed files
📝
package-lock.json(+3237 -3309)📝
package.json(+6 -6)📄 Description
Bumps the npm_and_yarn group with 8 updates in the / directory:
3.3.33.4.02.8.22.8.31.10.21.10.32.55.02.57.15.4.218.0.81.1.121.1.140.8.110.8.122.3.12.3.24.17.234.18.1Updates
dompurifyfrom 3.3.3 to 3.4.0Release notes
Sourced from dompurify's releases.
Commits
5b16e0bGetting 3.x branch ready for 3.4.0 release (#1250)Updates
yamlfrom 2.8.2 to 2.8.3Release notes
Sourced from yaml's releases.
Commits
ce145872.8.31e84ebbfix: Catch stack overflow during node composition6b24090ci: Include Prettier check in lint action9424deechore: Refresh lockfiled1aca82Add trailingComma ToString option for multiline flow formatting (#670)4321509ci: Drop the branch filter from GitHub PR actions47207d0chore: Update docs-slate5212faechore: Update docs-slateUpdates
yamlfrom 1.10.2 to 1.10.3Release notes
Sourced from yaml's releases.
Commits
ce145872.8.31e84ebbfix: Catch stack overflow during node composition6b24090ci: Include Prettier check in lint action9424deechore: Refresh lockfiled1aca82Add trailingComma ToString option for multiline flow formatting (#670)4321509ci: Drop the branch filter from GitHub PR actions47207d0chore: Update docs-slate5212faechore: Update docs-slateUpdates
@sveltejs/kitfrom 2.55.0 to 2.57.1Release notes
Sourced from
@sveltejs/kit's releases.... (truncated)
Changelog
Sourced from
@sveltejs/kit's changelog.... (truncated)
Commits
75147d4Version Packages (#15684)10d7b44Merge commit from fork3202ed6Merge commit from fork24d7e76chore: fix reuse wording in client comment (#15679)6a9cdaafix: relax form typings for union types (#15687)ab8b2f1fix: use default values as fallbacks (#15680)3ccb33bVersion Packages (#15651)7f8aef7chore: reduce use of any types (#15659)be1c95fchore: avoid importing types directly from Rollup (#15668)1615af7chore: centralize noops (#15662)Updates
vitefrom 5.4.21 to 8.0.8Release notes
Sourced from vite's releases.
... (truncated)
Changelog
Sourced from vite's changelog.
... (truncated)
Commits
6e585dcrelease: v8.0.8e137601fix(ssr): class property keys hoisting matching imports (#22199)15f1c15fix: avoiddns.getDefaultResultOrdertemporary (#22202)6baf587feat: update rolldown to 1.0.0-rc.15 (#22201)fdb2e6frelease: v8.0.75c05b04fix: use sync dns.getDefaultResultOrder instead of dns.promises (#22185)7b3086frelease: v8.0.6af71fb2chore: replace remaining prettier script (#22179)51d3e48feat: update rolldown to 1.0.0-rc.13 (#22097)17a8f9efix(optimize-deps): hoist CJS interop assignment (#22156)Updates
brace-expansionfrom 1.1.12 to 1.1.14Commits
10c05fc1.1.141afa1b2Add opt-in { max } mitigation to v1 legacy line (#103)2fbb6a2Revert "Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)" (#102)0d7652eBackport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)6c353ca1.1.137fd684fBackport fix for GHSA-f886-m6hf-6m8v (#95)Updates
@xmldom/xmldomfrom 0.8.11 to 0.8.12Release notes
Sourced from
@xmldom/xmldom's releases.Changelog
Sourced from
@xmldom/xmldom's changelog.Commits
189cb780.8.12ed08df7fix: XML injection via unsafe CDATA serialization (GHSA-wh4c-j3r5-mjhp) (#968)a5b929bchore: clean up generated test artefacts before running ci-local4e37a20ci: run format:check in lint jobac0ac77chore: ignore generated files when checking formatting968c893chore: add local CI script and format:check scriptac40424fix: preserve trailing whitespace in ProcessingInstruction data (#962)cece752chore: add .nvmrc pointing to node version 18cbf44d9docs: improve links to changes in most recent releaseMaintainer changes
This version was pushed to npm by karfau, a new releaser for
@xmldom/xmldomsince your current version.Updates
picomatchfrom 2.3.1 to 2.3.2Release notes
Sourced from picomatch's releases.
Changelog
Sourced from picomatch's changelog.
... (truncated)
Commits
81cba8dPublish 2.3.2fc1f6b6Merge commit from forkeec17aeMerge commit from fork78f8ca4Merge pull request #156 from micromatch/backport-1443f4f10eMerge pull request #144 from Jason3S/jdent-object-propertiesUpdates
lodashfrom 4.17.23 to 4.18.1Release notes
Sourced from lodash's releases.
Commits
cb0b9b9release(patch): bump main to 4.18.1 (#6177)75535f5chore: prune stale advisory refs (#6170)62e91bcdocs: remove n_ Node.js < 6 REPL note from README (#6165)59be2derelease(minor): bump to 4.18.0 (#6161)af63457fix: broken tests for _.template 879aaa91073a76fix: linting issues879aaa9fix: validate imports keys in _.templatefe8d32efix: block prototype pollution in baseUnset via constructor/prototype traversal18ba0a3refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)b819080ci: add dist sync validation workflow (#6137)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.