chore(deps): bump the npm-minor-patch group across 1 directory with 6 updates by dependabot[bot] · Pull Request #11 · anviod/edgeCore

dependabot · 2026-10-15T05:54:23Z

Bumps the npm-minor-patch group with 6 updates in the /ui directory:

Package	From	To
axios	`1.18.1`	`1.20.0`
dompurify	`3.4.11`	`3.4.17`
vue	`3.5.39`	`3.5.44`
vue-i18n	`11.4.6`	`11.4.14`
@vue/test-utils	`2.4.11`	`2.5.1`
less	`4.6.7`	`4.9.1`

Updates axios from 1.18.1 to 1.20.0

Release notes

Sourced from axios's releases.

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#11082)

🔒 Security Fixes

Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#11141)

🐛 Bug Fixes

Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#11087, #11118)

Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#11109)

XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#11094, #11121)

Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#11091)

Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#11096)

🔧 Maintenance & Chores

Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#11092, #11098, #11099, #11106, #11107, #11122, #11123, #11126, #11127, #11133, #11140, #11143, #11144)

Documentation: Applied the v1.19.0 documentation updates, added the missing fs import to the README stream example, introduced localized global search, and repaired the interceptor test link. (#11101, #11113, #11097, #11119)

Sponsorship: Updated sponsorship links and data and added ScrapingBee as a sponsor. (#11124, #11136, #11137)

CI and Release: Switched ESM smoke tests to locked dependencies and synchronized package and runtime version metadata for v1.20.0. (#11128, #11152)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@yens1 (#11109)

@Sasireddy001 (#11113)

@ari-token-security (#11094)

@timothyokooboh (#11097)

@gi9439041-png (#11119)

@Hashim1999164 (#11082)

@v-dev-cl (#11091)

@r0h1tb (#11118)

@ostapondo (#11121)

Full Changelog (axios/axios@v1.19.0...v1.20.0)

v1.19.0 - July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.19.0 — July 22, 2026

This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.

🔒 Security Fixes

Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (GHSA-hmw2-7cc7-3qxx). (#11028)

🚀 New Features

Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors, adapters, and serializers. (#11043, #11081)

Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)

HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)

🐛 Bug Fixes

Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)

Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)

Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)

Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)

URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)

Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)

Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)

Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)

Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)

🔧 Maintenance & Chores

Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)

Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)

Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)

Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)

Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)

Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@afonsojramos (#11028)

@MahinAnowar (#11006)

@yassertawfik4 (#11024)

@AnandSundar (#11029)

@lin-hongkuan (#11035)

@Wali007-lab (#11054)

@magicdawn (#11043)

... (truncated)

Commits

84a9f3b chore(release): prepare release 1.20.0 (#11152)
e6824ee fix: core methodList, HTTP adapter errors, and add tests (#11096)
d8a919f fix(xhr): flush final progress during the live loadend dispatch (#11121)
2d2a21a fix(interceptors): tolerate nullish handlers in syncHandlerEntries (#11118)
d19040b fix: harden runtime option handling (#11141)
e0a02dd chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 in the github-...
d10cb3a chore(deps-dev): bump the development_dependencies group with 4 updates (#11143)
2c94646 chore(deps): bump js-yaml and mocha in /tests/smoke/cjs (#11133)
76c12bc chore(deps-dev): bump js-yaml from 4.3.0 to 4.3.1 (#11140)
ba98559 docs: add ScrapingBee sponsor (#11137)
Additional commits viewable in compare view

Updates dompurify from 3.4.11 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @manus-pi

Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @uttej-badwane

Fixed the SMIL attributeName guard in XHTML mode, thanks @Koukyosyumei

Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @artiphishell

Added a purify-edge test runner as a compatibility check, thanks @anzal1

Clarified the IN_PLACE documentation in the README about possible risks

Updated several dependencies

DOMPurify 3.4.16

Fixed a problem with IN_PLACE node removal when working with hooks, thanks @manus-pi

Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @h-t-m

Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @ssi02014

Migrated from rollup to rolldown because performance, thanks @ssi02014

Bumped several dependencies where possible

DOMPurify 3.4.15

Added better clobbering hardening when XML content is involved, thanks @gnyselcuk

Added several smaller hardening and edge-case improvements, thanks @leechristensen

Bumped several dependencies where possible

DOMPurify 3.4.14

Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @AlirezaRouhbakhsh

Fixed a couple of edge cases with mixed document contexts, thanks @fishjojo1

Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @Jaybhade

Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation

Updated the documentation in several spots, README, wiki, etc., thanks @Akokonunes

Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

Fixed an issue with hook removal during IN_PLACE sanitization, thanks @koyokr

Fixed an issue with hooks potentially bypassing the clone guard, thanks @AkshayjainG

Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @AkshayjainG

Bumped several dependencies where possible

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

Commits

a77a3e7 release: 3.4.17 (#1672)
b9b9d80 release: 3.4.16 (#1636)
1d7460c release: 3.4.15 (#1609)
4e6fe24 release: 3.4.14 (#1587)
3067f77 release: 3.4.13 (#1562)
a9ca1e5 release: 3.4.12 (#1537)
See full diff in compare view

Updates vue from 3.5.39 to 3.5.44

Release notes

Sourced from vue's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.41

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.40

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.44 (2026-10-13)

Bug Fixes

compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)

compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723

compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)

compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)

compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602

custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775

hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)

KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710

reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643

reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009

reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)

reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792

runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632

runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551

runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728

runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)

runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)

runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)

server-renderer: propagate async setup errors (#15857) (6930374), closes #15716

ssr: honor falsy vnode content overrides (#15769) (c11c5c8)

suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639

suspense: skip rendering async components unmounted while pending (4ab865a)

teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817

transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531

transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500

3.5.43 (2026-09-17)

Bug Fixes

compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)

compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495

compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465

compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)

hydration: run leave hooks for hydration placeholders (#15431) (5dda192)

reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)

runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)

shared: handle circular references in looseEqual (#15499) (718f782), closes #15496

shared: preserve comment-like text in style values (#15471) (b9456cb)

suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)

suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506

suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)

suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)

types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546

3.5.42 (2026-08-27)

... (truncated)

Commits

bf5f0dd release: v3.5.44
6930374 fix(server-renderer): propagate async setup errors (#15857)
8e8c547 chore(deps): update all non-major dependencies (#15585)
4cb0ca8 chore(deps): update playground (#15685)
e38478f chore(deps): update dawidd6/action-download-artifact action to v27 (#15768)
1caed5a chore(deps): update compiler (#15586)
a49f451 chore(deps): update lint (#15680)
219b858 chore(deps): update build (#15679)
ff35014 fix(transition): handle comment-wrapped component roots (#15853)
d084b90 fix(compiler-core): parenthesise v-for key in v-memo cache guard (#15724)
Additional commits viewable in compare view

Updates vue-i18n from 11.4.6 to 11.4.14

Release notes

Sourced from vue-i18n's releases.

v11.4.14

What's Changed

🔒 Security Fixes

fix(shared): neutralize srcdoc attribute in sanitizeTranslatedHtml by @kazupon in intlify/vue-i18n#2679

fix(core-base): escape both list and named values with escapeParameter by @kazupon in intlify/vue-i18n#2680

fix: ignore locales named after Object.prototype properties by @kazupon in intlify/vue-i18n#2681

👕 Refactoring

refactor(core-base): extract the resolved message format check by @kazupon in intlify/vue-i18n#2674

refactor(vue-i18n-core): remove dead branches in getCoreContext() by @kazupon in intlify/vue-i18n#2675

refactor(vue-i18n-core): share the fallbackContext handling in the composer by @kazupon in intlify/vue-i18n#2676

refactor(vue-i18n-core): simplify flat JSON handling in setLocaleMessage / mergeLocaleMessage by @kazupon in intlify/vue-i18n#2677

refactor(core-base): give the compile cache a proper type by @kazupon in intlify/vue-i18n#2678

Full Changelog: intlify/vue-i18n@v11.4.13...v11.4.14

v11.4.13

What's Changed

⚡ Improvement Features

fix(core-base): map locale unions without the UnionToTuple round-trip by @kazupon in intlify/vue-i18n#2651

Full Changelog: intlify/vue-i18n@v11.4.12...v11.4.13

v11.4.12

What's Changed

🐛 Bug Fixes

fix(core-base): cache locale chains by fallback identity by @kazupon in intlify/vue-i18n#2635

fix(vue-i18n-core): sync the core context when inheritLocale is enabled by @kazupon in intlify/vue-i18n#2636

Full Changelog: intlify/vue-i18n@v11.4.10...v11.4.12

v11.4.10

What's Changed

🐛 Bug Fixes

fix(core-base): avoid throwing on AST keys in devtools groupId by @kazupon in intlify/vue-i18n#2603

Full Changelog: intlify/vue-i18n@v11.4.9...v11.4.10

v11.4.9

... (truncated)

Changelog

Sourced from vue-i18n's changelog.

v11.4.14 (2026-10-10T11:06:13.502Z)

This changelog is generated by GitHub Releases

What's Changed

🔒 Security Fixes

fix(shared): neutralize srcdoc attribute in sanitizeTranslatedHtml by @kazupon in intlify/vue-i18n#2679

fix(core-base): escape both list and named values with escapeParameter by @kazupon in intlify/vue-i18n#2680

fix: ignore locales named after Object.prototype properties by @kazupon in intlify/vue-i18n#2681

👕 Refactoring

refactor(core-base): extract the resolved message format check by @kazupon in intlify/vue-i18n#2674

refactor(vue-i18n-core): remove dead branches in getCoreContext() by @kazupon in intlify/vue-i18n#2675

refactor(vue-i18n-core): share the fallbackContext handling in the composer by @kazupon in intlify/vue-i18n#2676

refactor(vue-i18n-core): simplify flat JSON handling in setLocaleMessage / mergeLocaleMessage by @kazupon in intlify/vue-i18n#2677

refactor(core-base): give the compile cache a proper type by @kazupon in intlify/vue-i18n#2678

Full Changelog: intlify/vue-i18n@v11.4.13...v11.4.14

v11.4.13 (2026-10-02T11:01:59.781Z)

This changelog is generated by GitHub Releases

What's Changed

⚡ Improvement Features

fix(core-base): map locale unions without the UnionToTuple round-trip by @kazupon in intlify/vue-i18n#2651

Full Changelog: intlify/vue-i18n@v11.4.12...v11.4.13

v11.4.12 (2026-09-16T14:30:30.396Z)

This changelog is generated by GitHub Releases

What's Changed

🐛 Bug Fixes

fix(core-base): cache locale chains by fallback identity by @kazupon in intlify/vue-i18n#2635

fix(vue-i18n-core): sync the core context when inheritLocale is enabled by @kazupon in intlify/vue-i18n#2636

... (truncated)

Commits

6bb9ebd release: v11.4.14
f6b3e75 release: v11.4.13
87f3745 release: v11.4.12
87510e2 release: v11.4.10
5128bf0 release: v11.4.9
de2393b release: v11.4.8
ceb0548 release: v11.4.7
See full diff in compare view

Updates @vue/test-utils from 2.4.11 to 2.5.1

Release notes

Sourced from @vue/test-utils's releases.

v2.5.1

What's Changed

fix: generic SFC findComponent types by @simonyang08 in vuejs/test-utils#2934

fix: share config across builds by @cexbrayat in vuejs/test-utils#2937

New Contributors

@simonyang08 made their first contribution in vuejs/test-utils#2934

Full Changelog: vuejs/test-utils@v2.5.0...v2.5.1

v2.5.0

⚠️ Breaking change: Vue Test Utils no longer supports class components. See #2904.

What's Changed

fix: keep re-rendering root component after another wrapper is mounted by @lazerg in vuejs/test-utils#2890

fix: correct summary element behavior by @nn-morishita in vuejs/test-utils#2806

fix: clear emitted event history for child components on unmount by @ebiryu in vuejs/test-utils#2898

chore!: drop class component support by @cexbrayat in vuejs/test-utils#2904

fix: expose defineExpose bindings on findComponent vm by @adamberecz in vuejs/test-utils#2927

New Contributors

@MetRonnie made their first contribution in vuejs/test-utils#2885

@lazerg made their first contribution in vuejs/test-utils#2890

@bartlomieju made their first contribution in vuejs/test-utils#2892

@nn-morishita made their first contribution in vuejs/test-utils#2806

@ebiryu made their first contribution in vuejs/test-utils#2898

@chiaraani made their first contribution in vuejs/test-utils#2916

@souserge made their first contribution in vuejs/test-utils#2695

@adamberecz made their first contribution in vuejs/test-utils#2927

Full Changelog: vuejs/test-utils@v2.4.11...v2.5.0

Commits

dcb5d6c v2.5.1 (#2945)
4d4f733 chore(deps): update all non-major dependencies (#2944)
9bd5eb7 chore(deps): update dependency oxfmt to v0.67.0 (#2943)
e8abdb7 chore(deps): update vitest to v5 (#2942)
4f3a372 chore(deps): update pnpm to v12 (#2940)
84c7504 chore(deps): update pnpm/action-setup action to v6.1.0 (#2939)
af30f8e chore(deps): update dependency oxfmt to v0.66.0 (#2938)
028e4c1 docs: explain global config sharing
261ac26 fix: share config across builds
133e80c fix: generic SFC findComponent types (#2934)
Additional commits viewable in compare view

Updates less from 4.6.7 to 4.9.1

Release notes

Sourced from less's releases.

Release v4.9.1

Changes

See CHANGELOG.md for details.

Installation
npm install less@4.9.1
Release v4.9.0

Changes

See CHANGELOG.md for details.

Installation
npm install less@4.9.0
Release v4.8.1

Changes

See CHANGELOG.md for details.

Installation
npm install less@4.8.1
Release v4.8.0

Changes

See CHANGELOG.md for details.

Installation
npm install less@4.8.0
Release v4.7.0

Changes

See CHANGELOG.md for details.

Installation

... (truncated)

Changelog

Sourced from less's changelog.

v4.9.1 (2026-09-02)

Changes

#4478 fix: error when a mixin call is used as a property value (@Lfan-ke)

v4.9.0 (2026-08-13)

Changes

#4488 feat: support [...] lookups in @{...} interpolation (@matthew-dean)

#4486 fix: prevent reparsing escape() results (@snowyukitty)

#4481 fix: keep the media type first when flattening nested @media queries (@Lfan-ke)

v4.8.1 (2026-07-26)

Changes

#4483 fix(release): sync release version from PR title (@matthew-dean)

#4479 fix: leave math functions for the browser when an argument is a runtime CSS var() (@Lfan-ke)

#4477 fix: forwarding an unset variadic no longer overrides callee defaults (@Lfan-ke)

#4474 chore: release v4.8.0 — deprecate legacy identifier forms and dynamic @charset (@app/github-actions)

v4.8.0 (2026-07-22)

Changes

#4473 fix(mixing): resolves issue #4234 (@puckowski)

#4472 Fix boolean() parsing for comparisons between inline condition expressions (@app/copilot-swe-agent)

Deprecation Warnings

#4475 Deprecate numeric-leading and dash-only variable names, dash-only mixin names, and dynamic @charset interpolation for removal in Less 5.x. Less 4 preserves the existing output while warning; migrate names to valid identifiers and use a static quoted @charset declaration. (@matthew-dean)

v4.7.0 (2026-07-18)

Changes

#4469 Follow-up to #4462: migrate remaining @var fixtures, DRY the prelude bare-@var scan, add warnings coverage (@matthew-dean)

#4462 feat: deprecate bare @variable in non-value at-rule positions (@matthew-dean)

#4461 Fix #4460: parse comparison/range syntax in container style() queries (@dweep-js)

#4459 refactor: extract shared ESLint config and add lint scripts (@JessenReinhart)

#4456 Replace image-size with probe-image-size (@priyamkarn)

Commits

7133316 Merge pull request #4513 from less/chore/release-v4.9.1
a0c3571 chore: release v4.9.1
33e486c Merge pull request #4478 from Lfan-ke/fix/mixin-ruleset-as-value-error
7499bbd chore: release v4.9.0 (

dependabot · 2026-10-15T05:54:26Z

Labels

The following labels could not be found: dependencies, frontend. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

… updates Bumps the npm-minor-patch group with 6 updates in the /ui directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.18.1` | `1.20.0` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.11` | `3.4.17` | | [vue](https://github.com/vuejs/core) | `3.5.39` | `3.5.44` | | [vue-i18n](https://github.com/intlify/vue-i18n/tree/HEAD/packages/vue-i18n) | `11.4.6` | `11.4.14` | | [@vue/test-utils](https://github.com/vuejs/test-utils) | `2.4.11` | `2.5.1` | | [less](https://github.com/less/less.js) | `4.6.7` | `4.9.1` | Updates `axios` from 1.18.1 to 1.20.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.18.1...v1.20.0) Updates `dompurify` from 3.4.11 to 3.4.17 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.11...3.4.17) Updates `vue` from 3.5.39 to 3.5.44 - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](vuejs/core@v3.5.39...v3.5.44) Updates `vue-i18n` from 11.4.6 to 11.4.14 - [Release notes](https://github.com/intlify/vue-i18n/releases) - [Changelog](https://github.com/intlify/vue-i18n/blob/v11.4.14/CHANGELOG.md) - [Commits](https://github.com/intlify/vue-i18n/commits/v11.4.14/packages/vue-i18n) Updates `@vue/test-utils` from 2.4.11 to 2.5.1 - [Release notes](https://github.com/vuejs/test-utils/releases) - [Commits](vuejs/test-utils@v2.4.11...v2.5.1) Updates `less` from 4.6.7 to 4.9.1 - [Release notes](https://github.com/less/less.js/releases) - [Changelog](https://github.com/less/less.js/blob/master/CHANGELOG.md) - [Commits](less/less.js@v4.6.7...v4.9.1) --- updated-dependencies: - dependency-name: "@vue/test-utils" dependency-version: 2.5.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: axios dependency-version: 1.20.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: dompurify dependency-version: 3.4.16 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: less dependency-version: 4.9.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-minor-patch - dependency-name: vue dependency-version: 3.5.43 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch - dependency-name: vue-i18n dependency-version: 11.4.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot changed the title ~~chore(deps): bump the npm-minor-patch group in /ui with 6 updates~~ chore(deps): bump the npm-minor-patch group across 1 directory with 6 updates Oct 19, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/ui/npm-minor-patch-3a41ee3564 branch from 9341817 to 3c9bd4f Compare October 19, 2026 22:26

Navigation Menu

Repository navigation

chore(deps): bump the npm-minor-patch group across 1 directory with 6 updates - #11

chore(deps): bump the npm-minor-patch group across 1 directory with 6 updates#11
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/npm_and_yarn/ui/npm-minor-patch-3a41ee3564

dependabot Bot commented on behalf of github Oct 15, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 15, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.20.0 — August 19, 2026

⚠️ Breaking Changes & Deprecations

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.19.0 - July 22, 2026

🔒 Security Fixes

Changelog

v1.19.0 — July 22, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

DOMPurify 3.4.17

DOMPurify 3.4.16

DOMPurify 3.4.15

DOMPurify 3.4.14

DOMPurify 3.4.13

DOMPurify 3.4.12

v3.5.44

v3.5.43

v3.5.42

v3.5.41

v3.5.40

3.5.44 (2026-10-13)

Bug Fixes

3.5.43 (2026-09-17)

Bug Fixes

3.5.42 (2026-08-27)

v11.4.14

What's Changed

🔒 Security Fixes

👕 Refactoring

v11.4.13

What's Changed

⚡ Improvement Features

v11.4.12

What's Changed

🐛 Bug Fixes

v11.4.10

What's Changed

🐛 Bug Fixes

v11.4.9

v11.4.14 (2026-10-10T11:06:13.502Z)

What's Changed

🔒 Security Fixes

👕 Refactoring

v11.4.13 (2026-10-02T11:01:59.781Z)

What's Changed

⚡ Improvement Features

v11.4.12 (2026-09-16T14:30:30.396Z)

What's Changed

🐛 Bug Fixes

v2.5.1

What's Changed

New Contributors

v2.5.0

What's Changed

New Contributors

Release v4.9.1

Changes

Installation

Release v4.9.0

Changes

Installation

Release v4.8.1

Changes

Installation

Release v4.8.0

Changes

Installation

Release v4.7.0

Changes

Installation

v4.9.1 (2026-09-02)

dependabot Bot commented on behalf of github Oct 15, 2026 •

edited

Loading