Bump the patch-updates group with 9 updates by dependabot[bot] · Pull Request #1 · Catwb/Furrity

dependabot · 2026-06-30T06:55:27Z

Bumps the patch-updates group with 9 updates:

Package	From	To
@astrojs/check	`0.9.6`	`0.9.9`
@astrojs/rss	`4.0.14`	`4.0.18`
@astrojs/svelte	`7.2.3`	`7.2.5`
@fontsource/roboto	`5.2.9`	`5.2.10`
@iconify-json/material-symbols	`1.2.50`	`1.2.81`
@tailwindcss/typography	`0.5.19`	`0.5.20`
sanitize-html	`2.17.0`	`2.17.5`
@types/sanitize-html	`2.16.0`	`2.16.1`
@astrojs/ts-plugin	`1.10.6`	`1.10.9`

Updates @astrojs/check from 0.9.6 to 0.9.9

Changelog

Sourced from @astrojs/check's changelog.

0.9.9

Patch Changes

#16471 f56bb3f Thanks @delucis! - Adds support for TypeScript v6 to peer dependencies range

Updated dependencies [8c62159]:

@astrojs/language-server@2.16.7

0.9.8

Patch Changes

#15892 a2f597d Thanks @Princesseuh! - Fixes Astro not being able to find astro check sometimes

Updated dependencies [7b4b254]:

@astrojs/language-server@2.16.5

0.9.7

Patch Changes

#15187 bbb5811 Thanks @matthewp! - Update to Astro 6 beta

#15198 55107a1 Thanks @HiDeoo! - Updates to Astro 6 beta

Updated dependencies [bbb5811, df6d2d7]:

@astrojs/language-server@2.16.1

0.9.7-beta.1

Patch Changes

#15198 55107a1 Thanks @HiDeoo! - Updates to Astro 6 beta

0.9.6-beta.1

Patch Changes

#15187 bbb5811 Thanks @matthewp! - Update to Astro 6 beta

Updated dependencies [bbb5811]:

@astrojs/language-server@2.16.1-beta.1

0.9.6-alpha.0

Patch Changes

Updated dependencies [df6d2d7]:

@astrojs/language-server@2.16.1-alpha.0

Commits

c1f2e4f [ci] release (#16467)
f56bb3f Widen typescript peer dependency range to allow v6 (#16471)
184700c fix(deps): update language tools (#16230)
88fcc98 fix integrations links across docs (#16098)
b9e96da fix(deps): update dependency vitest to v4 (#15372)
09ecdd7 [ci] release (#15889)
a2f597d fix(check): Revert publint lint fix (#15892)
48e5c4d [ci] release (#15808)
1118ac4 feat: update tsconfig template to prepare for TS 6 (#15668)
ddeb230 chore: address publint suggestions (#15653)
Additional commits viewable in compare view

Updates @astrojs/rss from 4.0.14 to 4.0.18

Changelog

Sourced from @astrojs/rss's changelog.

4.0.18

Patch Changes

#16037 fdd2c5a Thanks @blimmer! - Unpin fast-xml-parser to ^5.5.7 to resolve entity expansion CVEs

4.0.17

Patch Changes

#15830 8d3f3aa Thanks @Princesseuh! - Pin fast-xml-parser to 5.4.1 in order to fix an upstream bug

4.0.16

Patch Changes

#15187 bbb5811 Thanks @matthewp! - Update to Astro 6 beta

#14956 0ff51df Thanks @matthewp! - Updates usage of zod to own dependency rather than relying on astro/zod

#15561 413b0f7 Thanks @renovate! - Updates fast-xml-parser to v5.3.6

#15283 daf41c6 Thanks @eldair! - Updates validation to use Zod v4

#15373 14252b2 Thanks @renovate! - Updates zod to v4

4.0.15-beta.4

Patch Changes

#15561 413b0f7 Thanks @renovate! - Updates fast-xml-parser to v5.3.6

4.0.15-beta.3

Patch Changes

#15373 14252b2 Thanks @renovate! - Updates zod to v4

4.0.15-beta.2

Patch Changes

#15283 daf41c6 Thanks @eldair! - Updates validation to use Zod v4

4.0.15-beta.1

Patch Changes

#15187 bbb5811 Thanks @matthewp! - Update to Astro 6 beta

... (truncated)

Commits

4a6ff2a [ci] release (#16020)
fdd2c5a fix(rss): unpin fast-xml-parser to resolve entity expansion CVEs (#16037)
a2fff74 [ci] release (#15826)
8d3f3aa fix(rss): Pin fast-xml-parser until upstream fix (#15830)
48e5c4d [ci] release (#15808)
6453380 fix: manually updates packages who had main releases later than betas (#15816)
6414732 Spelling (#15601)
1118ac4 feat: update tsconfig template to prepare for TS 6 (#15668)
10088fd fix(deps): update all non-major dependencies (#15707)
4d49632 [ci] release (beta) (#15590)
Additional commits viewable in compare view

Updates @astrojs/svelte from 7.2.3 to 7.2.5

Changelog

Sourced from @astrojs/svelte's changelog.

7.2.5

Patch Changes

#15070 fa9c464 Thanks @antonyfaris! - Improve Svelte children prop type checking

7.2.4

Patch Changes

#15004 16f3994 Thanks @antonyfaris! - Fixes an issue where Svelte components used in Astro files would incorrectly report type errors when using client:* directives.

Commits

e73deb8 [ci] release (#15031)
fa9c464 fix(svelte): improve Svelte children prop type checking (#15070)
1847601 fix(deps): update astro client runtimes (#15085)
0343993 [ci] release (#14997)
16f3994 fix(svelte): allow client directives (#15004)
See full diff in compare view

Updates @fontsource/roboto from 5.2.9 to 5.2.10

Commits

See full diff in compare view

Updates @iconify-json/material-symbols from 1.2.50 to 1.2.81

Commits

See full diff in compare view

Updates @tailwindcss/typography from 0.5.19 to 0.5.20

Release notes

Sourced from @tailwindcss/typography's releases.

v0.5.20

Fixed

Support installing with stable versions of Tailwind CSS v4 (#424)

Changelog

Sourced from @tailwindcss/typography's changelog.

[0.5.20] - 2026-06-08

Fixed

Support installing with stable versions of Tailwind CSS v4 (#424)

Commits

e3714a3 0.5.20
f34283d Update tailwindcss peer dependency version (#424)
543de42 bump Node.js
881b048 Setup OIDC (#423)
74a3da7 Fix typo in README.md (#413)
3963dfe Bump js-yaml from 3.14.1 to 3.14.2 (#410)
abf85cc className instead of classname (#406)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @tailwindcss/typography since your current version.

Updates sanitize-html from 2.17.0 to 2.17.5

Changelog

Sourced from sanitize-html's changelog.

2.17.5 (2026-06-10)

Security

Added a number of new attributes to be protected against unsafe URLs, e.g. javascript: and similar. None of these are used in the default configuration of sanitize-html or apostrophe or likely to be used there, and some attributes, like an action for a form, are inherently unsafe to allow if XSS protection is your goal. Nevertheless it makes sense to block certain URL types where they are not appropriate. Some attributes are not supported at all by modern browsers but are included for completeness. Thanks to crattack for reporting the vulnerability.

Address a potential vulnerability when nonTextTags is configured in a nonstandard way. While it is never a good idea to remove known non-text tags from the standard list e.g. script, styles, etc., this change ensures that doing so does not result in nested tags being passed through without sanitization when they are not expressly allowed. (ApostropheCMS would never trigger this situation.) Thanks to Dipanshu singh for pointing out the issue and contributing the fix.

2.17.4

Changes

sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

2.17.3 (2026-04-15)

Security

Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.

2.17.2 (2026-03-19)

Changes

Upgrade htmlparser2 from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g., &[#0000001](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html/issues/0000001)) that previously bypassed javascript: URL detection. Also fixes double-encoding of entities inside raw text elements like textarea and option.

2.17.1 (2026-02-18)

Fixes

Fix unclosed tags (e.g., <hello) returning empty string in escape and recursiveEscape modes. Fixes #706. Thanks to Byeong Hyeon for the fix.

Commits

2427508 release and changelog edits (#5465)
5a88e96 Latest security q2 (#5464)
958d162 merge main to latest (#5460)
e9b0ab0 release only (changelogs formatted) (#5408)
f03fa5b Latest security merge (#5407)
96cf174 For release only (#5381)
7ca2d16 Merge commit from fork
297a422 Bump dependencies (#5376)
7e607c9 Changelog reconciliation for release (#5359)
49d0bb7 Port/sanitize html community contrib (#5337)
Additional commits viewable in compare view

Updates @types/sanitize-html from 2.16.0 to 2.16.1

Commits

See full diff in compare view

Updates @astrojs/ts-plugin from 1.10.6 to 1.10.9

Changelog

Sourced from @astrojs/ts-plugin's changelog.

1.10.9

Patch Changes

#16661 03b8f7f Thanks @ocavue! - Updates typescript to v6. No changes are needed from users.

Updated dependencies [03b8f7f]:

@astrojs/yaml2ts@0.2.4

1.10.8

Patch Changes

#16716 04fdbb2 Thanks @delucis! - Drops support for versions of VS Code below 1.101.0 [May 2025]

1.10.7

Patch Changes

#15820 e20474b Thanks @Princesseuh! - Fixes broken publish

Updated dependencies [e20474b]:

@astrojs/yaml2ts@0.2.3

Commits

45b7fa9 [ci] release (#16742)
03b8f7f chore: update typescript to v6 (#16661)
e345bcd [ci] release (#16653)
04fdbb2 Update pnpm to v11 (#16716)
5a8cd09 refactor: update tsconfig to use TypeScript project references (#16505)
0c0ae11 refactor(ts-plugin): migrate tests to typescript (#16417)
5557dca feat: erasableSyntaxOnly (#15719)
b9e96da fix(deps): update dependency vitest to v4 (#15372)
9a8eb99 [ci] release (#15822)
1118ac4 feat: update tsconfig template to prepare for TS 6 (#15668)
Additional commits viewable in compare view

Updates @types/sanitize-html from 2.16.0 to 2.16.1

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the patch-updates group with 9 updates: | Package | From | To | | --- | --- | --- | | [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.6` | `0.9.9` | | [@astrojs/rss](https://github.com/withastro/astro/tree/HEAD/packages/astro-rss) | `4.0.14` | `4.0.18` | | [@astrojs/svelte](https://github.com/withastro/astro/tree/HEAD/packages/integrations/svelte) | `7.2.3` | `7.2.5` | | [@fontsource/roboto](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/roboto) | `5.2.9` | `5.2.10` | | [@iconify-json/material-symbols](https://github.com/iconify/icon-sets) | `1.2.50` | `1.2.81` | | [@tailwindcss/typography](https://github.com/tailwindlabs/tailwindcss-typography) | `0.5.19` | `0.5.20` | | [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.0` | `2.17.5` | | [@types/sanitize-html](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sanitize-html) | `2.16.0` | `2.16.1` | | [@astrojs/ts-plugin](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/ts-plugin) | `1.10.6` | `1.10.9` | Updates `@astrojs/check` from 0.9.6 to 0.9.9 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/language-tools/astro-check) Updates `@astrojs/rss` from 4.0.14 to 4.0.18 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/astro-rss/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/astro-rss) Updates `@astrojs/svelte` from 7.2.3 to 7.2.5 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/svelte/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/integrations/svelte) Updates `@fontsource/roboto` from 5.2.9 to 5.2.10 - [Changelog](https://github.com/fontsource/font-files/blob/main/CHANGELOG.md) - [Commits](https://github.com/fontsource/font-files/commits/HEAD/fonts/google/roboto) Updates `@iconify-json/material-symbols` from 1.2.50 to 1.2.81 - [Commits](https://github.com/iconify/icon-sets/commits) Updates `@tailwindcss/typography` from 0.5.19 to 0.5.20 - [Release notes](https://github.com/tailwindlabs/tailwindcss-typography/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss-typography/blob/main/CHANGELOG.md) - [Commits](tailwindlabs/tailwindcss-typography@v0.5.19...v0.5.20) Updates `sanitize-html` from 2.17.0 to 2.17.5 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/[email protected]/packages/sanitize-html) Updates `@types/sanitize-html` from 2.16.0 to 2.16.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sanitize-html) Updates `@astrojs/ts-plugin` from 1.10.6 to 1.10.9 - [Release notes](https://github.com/withastro/astro/releases) - [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/ts-plugin/CHANGELOG.md) - [Commits](https://github.com/withastro/astro/commits/@astrojs/[email protected]/packages/language-tools/ts-plugin) Updates `@types/sanitize-html` from 2.16.0 to 2.16.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sanitize-html) --- updated-dependencies: - dependency-name: "@astrojs/check" dependency-version: 0.9.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@astrojs/rss" dependency-version: 4.0.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@astrojs/svelte" dependency-version: 7.2.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@fontsource/roboto" dependency-version: 5.2.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@iconify-json/material-symbols" dependency-version: 1.2.81 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@tailwindcss/typography" dependency-version: 0.5.20 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: sanitize-html dependency-version: 2.17.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@types/sanitize-html" dependency-version: 2.16.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@astrojs/ts-plugin" dependency-version: 1.10.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@types/sanitize-html" dependency-version: 2.16.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 30, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the patch-updates group with 9 updates#1

Bump the patch-updates group with 9 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot-npm_and_yarn-patch-updates-7907fc803b

dependabot Bot commented on behalf of github Jun 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jun 30, 2026

0.9.9

Patch Changes

0.9.8

Patch Changes

0.9.7

Patch Changes

0.9.7-beta.1

Patch Changes

0.9.6-beta.1

Patch Changes

0.9.6-alpha.0

Patch Changes

4.0.18

Patch Changes

4.0.17

Patch Changes

4.0.16

Patch Changes

4.0.15-beta.4

Patch Changes

4.0.15-beta.3

Patch Changes

4.0.15-beta.2

Patch Changes

4.0.15-beta.1

Patch Changes

7.2.5

Patch Changes

7.2.4

Patch Changes

v0.5.20

Fixed

[0.5.20] - 2026-06-08

Fixed

2.17.5 (2026-06-10)

Security

2.17.4

Changes

Security

2.17.3 (2026-04-15)

Security

2.17.2 (2026-03-19)

Changes

2.17.1 (2026-02-18)

Fixes

1.10.9

Patch Changes

1.10.8

Patch Changes

1.10.7

Patch Changes

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants