[dependabot]

Bumps the npm_and_yarn group with 17 updates in the / directory:

Package	From	To
electron	44.3.0	44.9.1
@hono/node-server	2.1.5	2.1.8
@hono/node-server	1.19.17	1.19.19
@azure/msal-node	5.3.0	7.2.2
@grpc/grpc-js	1.14.4	1.14.7
@tiptap/core	3.20.4	3.33.1
@vue/server-renderer	3.5.30	3.5.45
axios	1.19.0	1.21.1
fast-uri	3.1.2	3.1.9
follow-redirects	1.16.0	1.16.3
joi	18.2.3	18.3.2
undici	6.29.0	6.29.1
katex	0.16.47	0.18.10
moment	2.30.1	2.31.0
prosemirror-view	1.41.7	1.42.9
qs	6.15.3	6.17.1
serialize-javascript	7.0.5	7.1.4
shell-quote	1.9.0	1.12.0

Updates electron from 44.3.0 to 44.9.1

Release notes

Sourced from electron's releases.

electron v44.9.1

Release Notes for v44.9.1

[!NOTE] This release contains the fix for GHSA-jr5w-w6x2-84p9, the mitigation for compromised eMudhra intermediate certificates

electron v44.9.0

Release Notes for v44.9.0

Features

• Added app shims on macOS to show windows under another app's Dock icon. #55073 (Also in 45)

Fixes

• Fixed link-opened windows not using the opener's session and webPreferences. #55048 (Also in 42, 43, 45)
• Fixed setCertificateVerifyProc occasionally not being applied to a request issued concurrently with the first request to a host. #55046 (Also in 42, 43, 45)

electron v44.8.0

Release Notes for v44.8.0

Features

• Added support for Notification action buttons on Linux. #54890 (Also in 45)

Fixes

• Fixed mouse cursor missing over native dialogs in certain scenarios on Windows. #54987
• Fixed net.fetch and session.fetch failing permanently with net::ERR_FAILED after the Network Service process restarts. #54909 (Also in 42, 43, 45)
• Fixed utilityProcess dropping messages posted with process.parentPort.postMessage() right before the process exits. #54960 (Also in 42, 43, 45)
• Fixed win.isFullScreen() being stale in fullscreen events on Windows. #55009 (Also in 45)

Other Changes

• Backported fixes from upstream Chromium and V8. #55034
• Updated Chromium to 152.0.7977.167. #54928
• Updated Node.js to v24.22.0. #55004

electron v44.7.2

Release Notes for v44.7.2

Fixes

• Fixed an issue where clicks posted to a background app were dropped on macOS. #54819 (Also in 45)
• Fixed interrupted macOS updates leaving a broken app behind. #54844 (Also in 45)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, PDFium and V8. #54898

... (truncated)

Commits

• e02265b fix: apply the certificate SPKI blocklist to Node and add entries (44-x-y) (#...
• 0545d89 test: replace fix_crypto_tests_to_run_with_bssl.patch with upstream backport ...
• 0ec830f docs: fix code block line highlighting after docs reformats (#55102)
• 68ddc64 test: re-enable Node.js tests that now pass with BoringSSL (#55095)
• cb2bde2 build: stop overriding node GN declare_args defaults in patch (#55077)
• aa16ac2 build: update PGO profiles (#55090)
• fd148b9 feat: add app shims on macOS (#55073)
• fe5dd7e fix: avoid misaligned char16_t reads in crdtp string deserialization (#55061)
• c6874c5 fix: use the opener's session and webPreferences for windows opened from link...
• 790b4b8 ci: skip native builds when installing deps for type generation (#55066)
• Additional commits viewable in compare view

Updates @hono/node-server from 2.1.5 to 2.1.8

Release notes

Sourced from @​hono/node-server's releases.

v2.1.8

What's Changed

• fix(request): forward duplex to the native request in honojs/node-server#409
• fix(utils): do not chain a promise per chunk while streaming a response in honojs/node-server#417
• fix(listener): cancel the response body when the client has already disconnected in honojs/node-server#412
• fix(utils): cancel late HTTP/2 response bodies in honojs/node-server#419
• fix(listener): do not send a complete response when the body fails during the early read in honojs/node-server#420

Full Changelog: honojs/node-server@v2.1.7...v2.1.8

v2.1.7

Security fixes

This release includes a fix for the following security issue:

serveStatic with allowPercentInPath still allows the double-decode middleware bypass

Affects: serveStatic with allowPercentInPath: true. The fix for GHSA-rmxm-3fg6-px4f rejects a path containing %, but the allowPercentInPath option skipped that check entirely. A malformed percent sequence such as /static/%%36%31dmin/secret.txt was routed as /static/%61dmin/secret.txt, so middleware on /static/admin/* did not run, and serveStatic then decoded %61 to a and served static/admin/secret.txt. The default configuration was already fixed in 2.1.3. GHSA-fj57-4f93-cfw6

serveStatic now accepts the second decode only when its result equals the routed path with %25 replaced by %. File names containing a literal %, requested as %25, are served as before.

---

The same fix ships in hono v4.13.18 (GHSA-74fm-fwc7-3fwp).

Full Changelog: honojs/node-server@v2.1.6...v2.1.7

v2.1.6

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

... (truncated)

Commits

• 1fc1dfc 2.1.8
• 3463817 fix(listener): do not send a complete response when the body fails during the...
• f22b99c fix(utils): cancel late HTTP/2 response bodies (#419)
• 4b885d3 fix(listener): cancel the response body when the client has already disconnec...
• 653ec79 fix(utils): do not chain a promise per chunk while streaming a response (#417)
• 7da431b fix(request): forward duplex to the native request (#409)
• abe63c8 2.1.7
• cc42986 Merge commit from fork
• 123f782 2.1.6
• cfaa79f Merge commit from fork
• Additional commits viewable in compare view

Updates @hono/node-server from 1.19.17 to 1.19.19

Release notes

Sourced from @​hono/node-server's releases.

v2.1.8

What's Changed

• fix(request): forward duplex to the native request in honojs/node-server#409
• fix(utils): do not chain a promise per chunk while streaming a response in honojs/node-server#417
• fix(listener): cancel the response body when the client has already disconnected in honojs/node-server#412
• fix(utils): cancel late HTTP/2 response bodies in honojs/node-server#419
• fix(listener): do not send a complete response when the body fails during the early read in honojs/node-server#420

Full Changelog: honojs/node-server@v2.1.7...v2.1.8

v2.1.7

Security fixes

This release includes a fix for the following security issue:

serveStatic with allowPercentInPath still allows the double-decode middleware bypass

Affects: serveStatic with allowPercentInPath: true. The fix for GHSA-rmxm-3fg6-px4f rejects a path containing %, but the allowPercentInPath option skipped that check entirely. A malformed percent sequence such as /static/%%36%31dmin/secret.txt was routed as /static/%61dmin/secret.txt, so middleware on /static/admin/* did not run, and serveStatic then decoded %61 to a and served static/admin/secret.txt. The default configuration was already fixed in 2.1.3. GHSA-fj57-4f93-cfw6

serveStatic now accepts the second decode only when its result equals the routed path with %25 replaced by %. File names containing a literal %, requested as %25, are served as before.

---

The same fix ships in hono v4.13.18 (GHSA-74fm-fwc7-3fwp).

Full Changelog: honojs/node-server@v2.1.6...v2.1.7

v2.1.6

Security fixes

This release includes fixes for the following security issues:

Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy

Affects: all requests. The raw request-target was passed to the WHATWG URL parser, which treats a backslash in the path as / and resolves .. segments, so /admin\secret reached the application as /admin/secret. A reverse proxy that forwards the backslash unchanged applied its path-based rules to the original path. GHSA-jpvv-r467-5p4w

A request whose path contains a raw backslash is now rejected with 400 Bad Request, for HTTP/1.1, HTTP/2 and WebSocket upgrades. A percent-encoded backslash (%5C) and a backslash in the query string are still accepted.

WebSocket upgrade request-target starting with // replaces the host in c.req.url, bypassing Origin checks

Affects: upgradeWebSocket. The URL of an upgrade request was built by resolving the request-target against the Host header, so a request-target such as //attacker.example/ws set the host of c.req.url to a client-chosen value while routing still saw /ws. An application that compared Origin with the origin of c.req.url could be bypassed by a page on another site. GHSA-7v5p-43qr-wch5

The host of upgrade requests now comes from the Host header, as for ordinary requests.

Unhandled ECONNRESET on the socket during an asynchronous WebSocket upgrade crashes the process

Affects: upgradeWebSocket. While the application handled an upgrade request, the socket had no error listener. A client that reset the connection during asynchronous middleware caused an unhandled 'error' event and terminated the process. GHSA-qv5m-9pm6-hqp3

Error and close events on the socket are now handled while the application runs, and a pending upgrade is released when the socket closes.

... (truncated)

Commits

• 1fc1dfc 2.1.8
• 3463817 fix(listener): do not send a complete response when the body fails during the...
• f22b99c fix(utils): cancel late HTTP/2 response bodies (#419)
• 4b885d3 fix(listener): cancel the response body when the client has already disconnec...
• 653ec79 fix(utils): do not chain a promise per chunk while streaming a response (#417)
• 7da431b fix(request): forward duplex to the native request (#409)
• abe63c8 2.1.7
• cc42986 Merge commit from fork
• 123f782 2.1.6
• cfaa79f Merge commit from fork
• Additional commits viewable in compare view

Updates @azure/msal-node from 5.3.0 to 7.2.2

Release notes

Sourced from @​azure/msal-node's releases.

@​azure/msal-node v7.2.2

7.2.2

Thu, 12 Nov 2026 18:58:52 GMT

Patches

• Sanitize authorization code response payloads consistently across Node clients #8959 (nugetaad@microsoft.com)
• Bump @​azure/msal-common to v16.16.2 (beachball)

@​azure/msal-node v7.2.1

7.2.1

Fri, 06 Nov 2026 23:13:16 GMT

Patches

• Bump @​azure/msal-common to v16.16.1 (beachball)

@​azure/msal-node v7.2.0

7.2.0

Thu, 05 Nov 2026 01:03:50 GMT

Minor changes

• Bump @​azure/msal-common to v16.16.0 (beachball)

Patches

• Bind interactive browser authorization responses to per-request state #8952 (undefined)

@​azure/msal-node v7.1.2

7.1.2

Tue, 27 Oct 2026 18:15:10 GMT

Patches

• Bump @​azure/msal-common to v16.15.0 (beachball)

@​azure/msal-node v7.1.1

7.1.1

Wed, 21 Oct 2026 18:37:17 GMT

Patches

• Bump @​azure/msal-common to v16.14.3 (beachball)

... (truncated)

Commits

• ac530e1 AB#3816566: MSAL JS: prevent raw exception data from bypassing PII filtering ...
• 8999653 Sanitize authorization code response payloads consistently across Node client...
• 40469db docs: prefer existing repository patterns (#8980)
• 0ad29a0 build(deps): bump qs from 6.16.0 to 6.16.2 (#8944)
• 31acc7f Omit raw state values from authorization response validation errors (#8955)
• 3da0958 Post-release PR (#8978)
• 9847797 docs: minimize library code churn (#8977)
• 5901161 Update Angular and Vite tooling dependencies (#8976)
• f0dfcc4 Update Azure Identity in E2E tooling (#8972)
• 1fbbf4f Fix native token-cache isolation for brokered child requests (#8971)
• Additional commits viewable in compare view

Updates @grpc/grpc-js from 1.14.4 to 1.14.7

Release notes

Sourced from @​grpc/grpc-js's releases.

@​grpc/grpc-js 1.14.7

• Fix a bug causing automatic retries to continue after a call is cancelled (#3102 contributed by @​phyous)
• Fix a bug causing automatic retries to fail to trigger in some cases (#3111 contributed by @​kahirokunn)

@​grpc/grpc-js 1.14.6

• Address remaining instances of advisory GHSA-f596-whhp-79r4 (#3105)
• Avoid Date allocations on request and channelz tracking paths (#3090 contributed by @​olavloite)
• Avoid throwaway timer allocation in ResolvingCall (#3092 contributed by @​olavloite)
• Avoid building metadata map when parsing trailers (#3093 contributed by @​olavloite)
• Lazily allocate Metadata opaqueData map (#3095 contributed by @​olavloite)
• Cache precomputed serviceUrl in InternalChannel (#3097 contributed by @​olavloite)
• Memoize method config lookup in default config selector (#3098 contributed by @​olavloite)
• Avoid array allocation for single-value metadata headers (#3099 contributed by @​olavloite)
• Avoid allocations for empty CallCredentials on the RPC hot path (#3100 contributed by @​olavloite)
• Avoid redundant metadata clone in RetryingCall on initial attempt (#3101 contributed by @​olavloite)

@​grpc/grpc-js 1.14.5

• Fix a bug that caused clients to automatically transmit excessive error details to clients by default (advisory GHSA-f596-whhp-79r4)
• Fix a bug that caused getAuthContext to return unverified certificates as though they were verified in some configurations (advisory GHSA-m9gg-hp2v-232j)
• Fix a bug that could cause stale call data to accumulate if a channel failed to connect for a long period of time (#3078)
• Fix a bug that could cause call status to be reported with expected fields missing (#3079)
• Avoid redundant end() calls on completed HTTP/2 streams (#3082 contributed by @​olavloite)
• Unify call numbers and avoid disabled trace allocations (#3084 contributed by @​olavloite)

Commits

• 5e0c170 Merge pull request #3119 from murgatroid99/grpc-js_1.14.7
• 4fdb028 Merge commit from fork
• 870fd2b Merge commit from fork
• d3d1649 Merge pull request #3110 from murgatroid99/grpc-js-xds_authority_validation
• 387fcf3 grpc-js(-xds): Bump patch version (1.14.x)
• ea73ef5 Merge pull request #3118 from murgatroid99/grpc-js_refused_stream_fix_1.14_at...
• a167b2f grpc-js: Preserve HTTP/2 reset codes on write errors
• 5f932bf Merge pull request #3117 from murgatroid99/grpc-js_retry_cancel_backoff_fix_1.14
• e7b81e7 fix(grpc-js): stop retry attempts after the call is cancelled
• 99b5008 grpc-js-xds: Fix bug causing clients to accept resources from the wrong autho...
• Additional commits viewable in compare view

Updates @tiptap/core from 3.20.4 to 3.33.1

Release notes

Sourced from @​tiptap/core's releases.

v3.33.1

@​tiptap/core

Patch Changes

• Deleting a text selection that spans the whole document no longer leaves the deleted text's marks active, so text typed into the emptied editor is no longer bold, linked or otherwise marked.

@​tiptap/extension-find-and-replace

Patch Changes

• The first goToNextResult() or goToPreviousResult() after a new search now selects the highlighted first result instead of skipping it.

@​tiptap/y-tiptap

Minor Changes

• yCursorPlugin now publishes a lastSelection awareness field with each collaborative field's latest selection and whether its editor is focused. Unlike cursor, it stays after the editor loses focus, so other clients can still read the selection. lastSelection is now reserved and can't be used as the cursor field.

v3.33.0

@​tiptap/extension-collaboration

Minor Changes

• With enableContentCheck: true, shared content that does not fit the editor schema now emits contentError instead of being deleted. The editor pauses editing and sends no changes until compatible content arrives, so read-only users no longer send repairs that the server rejects.

  If you use enableContentCheck with collaboration and want the editor to keep repairing invalid content, turn the content check off.

@​tiptap/y-tiptap

Minor Changes

• Add the onInvalidContent sync option. When it is set, shared content that does not fit the editor schema stays in the shared document instead of being deleted. The editor shows what it can, pauses editing and sends no changes until compatible content arrives.

v3.32.3

@​tiptap/core

Patch Changes

• Clearing formatting on a nested list now turns every level into paragraphs, and clearNodes() works in a chain with other node commands.
• Stop removed resizable node views from responding to later editor updates.

@​tiptap/extension-bubble-menu

Patch Changes

• Bubble menus now update correctly after IME input, including Korean text

@​tiptap/extension-code-block-lowlight

... (truncated)

Changelog

Sourced from @​tiptap/core's changelog.

3.33.1

Patch Changes

• 1005e79: Deleting a text selection that spans the whole document no longer leaves the deleted text's marks active, so text typed into the emptied editor is no longer bold, linked or otherwise marked.

3.33.0

No changes in this release.

3.32.3

Patch Changes

• bbe4d6e: Clearing formatting on a nested list now turns every level into paragraphs, and clearNodes() works in a chain with other node commands.
• 88892f9: Stop removed resizable node views from responding to later editor updates.

3.32.2

Patch Changes

• @​tiptap/pm@​3.32.2

3.32.1

Patch Changes

• 959e0e8: Large transactions (for example a big paste with Link autolink enabled) are processed faster.
• 3ebb519: Keep indented Markdown task-item continuation lines in the same paragraph instead of turning them into separate paragraphs or code blocks.
• 3ebb519: Indent continuation lines when exporting Markdown task items so they stay inside the item when imported again.
• 3ebb519: Keep Markdown task-item continuation lines in the same paragraph when the opening text resembles a heading or list, including tasks nested inside bullet lists.
• 3ebb519: Preserve task-list continuation text with custom block tokenizers and tab indentation.
• b513d24: deleteSelection keeps the marks of the deleted text again, so typing after deleting bold text is bold, like in ProseMirror.
• 22b0e70: Markdown lexer tokens for a task list at the end of the input now match the source text when it has no final newline.
• @​tiptap/pm@​3.32.1

3.32.0

Minor Changes

• 8e2a86f: Add the schemaSpec editor option to use an external ProseMirror schema structure with local extension behavior.

Patch Changes

• cc90cc5: Fix list toggling between list types that use different item nodes. Nested lists are recursively converted when the target item schema supports nesting, and flattened into sibling items when it does not.
• Updated dependencies [3b5560c]
  • @​tiptap/pm@​3.32.0

3.31.4

... (truncated)

Commits

• See full diff in compare view

Updates @vue/server-renderer from 3.5.30 to 3.5.45

Release notes

Sourced from @​vue/server-renderer's releases.

v3.5.45

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.41

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.40

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.39

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.38

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.37

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.35

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.34

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.33

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.32

For stable releases, please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from @​vue/server-renderer's changelog.

3.5.45 (2026-11-05)

Bug Fixes

• compiler-core: copy loc in cloneLoc instead of recomputing it (#16092) (3cee79a), closes #16091
• compiler-dom: preserve static boolean binding semantics (#16055) (05db7e8), closes #16051
• compiler-sfc: respect catch and switch lexical scopes (fix #16098) (#16101) (0f20152)
• hmr: retry reloads after pending async roots resolve (#16060) (fbaa794)
• hydration: only update component el when replacing its host node (#16001) (51fd0cb)
• KeepAlive: cache a resolved Suspense child right away (#16119) (716a29e)
• KeepAlive: unmount a child deactivated before it was cached (#15981) (02d2c2b)
• reactivity: run onScopeDispose in a stopped scope (#16108) (21dd33c)
• runtime-core: anchor on the async placeholder when a component root has no el (#16122) (b5abf8c)
• runtime-core: call directive mounted hooks with the latest binding (#16120) (6416207), closes #12460 #12482
• runtime-core: remove the placeholder of an unmounted pending async component (#15982) (2b9a0bb)
• runtime-core: render nothing for a component whose async setup rejects (#16111) (f64bfa5)
• runtime-core: skip stopped error boundaries for async failures (#16061) (0326ed8)
• runtime-dom: treat disablepictureinpicture and disableremoteplayback as boolean attributes (#15952) (ef81ddc)
• suspense: do not mount the fallback after the boundary is unmounted (#15939) (4fd6a6b)
• suspense: drop the unmount hooks of a pending branch when the boundary is unmounted (d04b662)
• suspense: enter transitions nested in the pending branch on reveal (#16121) (b8074de), closes #12435 #15294
• suspense: keep a discarded component marked unmounted (1dc8cdf)
• suspense: keep the async root update retry across a discarded pending branch (#16107) (06bea73)
• suspense: keep the internal cleanup of a discarded component (79b80b7)
• suspense: keep the timeout counting when the root is switched again while pending (#16143) (a045acd)
• suspense: patch same-root updates of nested boundaries in retained content (#16109) (2dbcea8), closes #15878
• suspense: release parent dep on suspensible unmount (#15870) (46e5dbf)
• suspense: resolve async deps whose pending cycle was discarded (#15980) (f7d0811)
• suspense: resolve the boundary when an async setup rejects without an error handler in dev (#16110) (a14aa0b)
• suspense: skip a root replacement in a retained nested boundary showing its fallback (#16125) (a47af77)
• suspense: skip the out-in afterLeave of an unmounted boundary (#16115) (85e71c0), closes #11037 #11059
• transition: handle leave immediately done in out-in mode (#11824) (70599b5), closes #15727
• transition: switch modes around a keyed suspense boundary (#16124) (ff0b341)
• types: add dialog closedby attribute (#16064) (24c9d0b)
• v-model: respect number modifier for Set select values (0ff253b)

Performance Improvements

• compiler-sfc: skip unused tsconfig include enumeration (#15899) (1612403), closes #15898
• compiler-ssr: render static style attributes at compile time (#16010) (2629c89)
• mark internal initializers as pure (#16012) (34fbeb1)
• runtime-core: copy raw attrs when setup context attrs are passed as vnode props (#16129) (823c744)

3.5.44 (2026-10-13)

Bug Fixes

• compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)
• compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723
• compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)

... (truncated)

Commits

• 8b479a8 release: v3.5.45
• f64bfa5 fix(runtime-core): render nothing for a component whose async setup rejects (...
• 2629c89 perf(compiler-ssr): render static style attributes at compile time (#16010)
• ef81ddc fix(runtime-dom): treat disablepictureinpicture and disableremoteplayback as ...
• bf5f0dd release: v3.5.44
• 6930374 fix(server-renderer): propagate async setup errors (#15857)
• c11c5c8 fix(ssr): honor falsy vnode content overrides (#15769)
• ad19e7d fix(runtime-core): render nothing for an invalid v-for range in production (#...
• a084e44 fix(runtime-dom): treat playsinline as a boolean attribute (#15627)
• 5be58b4 release: v3.5.43
• Additional commits viewable in compare view

Updates axios from 1.19.0 to 1.21.1

Release notes

Sourced from axios's releases.

v1.21.1 — November 9, 2026

This release raises the minimum follow-redirects version to fix a published CVE, fixes a Next.js prerendering failure caused by the response duration timer, corrects the getAdapter typings, and includes documentation corrections, new test coverage, CI runner changes and dependency updates.

🔒 Security Fixes

• follow-redirects: Raised the follow-redirects range from ^1.16.0 to ^1.16.2 to fix CVE-2026-116689 (GHSA-mrwp-f3q8-3g9p). In the vulnerable versions, sensitiveHeaders arrays from another realm were ignored and custom credentials could follow redirects. Only the Node.js HTTP adapter is affected, and there are no API changes. (#11410)

🐛 Bug Fixes

• Response Duration: dispatchRequest now measures response.duration with performance.now() and uses Date.now() only when performance.now() isn't available. In v1.21.0, any axios request from a Server Component failed Next.js production builds with Cache Components (cacheComponents: true), because Next.js rejects Date.now() while prerendering. The duration is still a whole number of milliseconds, and system clock changes no longer affect it. (#11411)
• TypeScript: getAdapter now accepts an optional config?: AxiosRequestConfig in index.d.ts and index.d.cts, matching what it does at runtime. You can now call getAdapter('fetch', { env: { fetch: myFetch } }) without a cast. (#11404)

🔧 Maintenance & Chores

• Documentation Corrections: Brought the README and docs site in line with how axios actually behaves:

  • transformRequest runs for every method, and transformers receive (data, headers, status).
  • responseType and Content-Type have no default value.
  • AxiosHeaders#get and #normalize are described correctly.
  • Errors should be identified with axios.isAxiosError(), not by name.
  • The error tables now list ECONNREFUSED and ERR_FORM_DATA_DEPTH_EXCEEDED, and note that FormData parsing has a fixed depth limit that maxDepth doesn't change.
  • New notes cover what redact doesn't scan, which adapters enforce maxContentLength / maxBodyLength, and how formToJSON() handles field name collisions.

  (#11374, #11373, #11389, #11419, #11429, #11430)

• Docs Site: Added a Partners page, a shared card design for sponsors and partners, a Namespace sponsor badge, and a blog whose first post announces HeroDevs Never-Ending Support for Axios v0. Also applied the v1.20.0/v1.21.0 release notes to the docs, and fixed internal links in the es, fr and zh translations so they keep their locale prefix. (#11390, #11399, #11400, #11412, #11401)

• Test Coverage: Added cancellation tests across the HTTP, fetch and XHR adapters. They cover AbortSignal, CancelToken, cancelling while a request interceptor is pending, and timeout precedence. Also added tests for no_proxy edge cases in shouldBypassProxy, such as internationalized domain names, malformed CIDR and IPv4 entries, and port-qualified entries. Neither changes runtime behavior. (#11376, #11431)...

  Description has been truncated

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml