Skip to content

deps(backend): bump the backend-patches group across 1 directory with 3 updates#85

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-patches-28fe7a2b36
Open

deps(backend): bump the backend-patches group across 1 directory with 3 updates#85
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/backend/backend-patches-28fe7a2b36

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 1, 2026

Copy link
Copy Markdown

Bumps the backend-patches group with 3 updates in the /backend directory: otplib, sanitize-html and vitest.

Updates otplib from 13.4.0 to 13.4.1

Release notes

Sourced from otplib's releases.

v13.4.1

What's Changed

New Contributors

Full Changelog: yeojz/otplib@v13.4.0...v13.4.1

Commits
  • 1d997b0 release(packages): v13.4.1 (#854)
  • 0e9566f docs(otplib): note 16-byte minimum and fix broken secret-handling link (#851)
  • e01b4f1 chore(deps-dev): bump the dev-dependencies-patch group across 1 directory wit...
  • 212534b chore(deps-dev): bump the dev-dependencies-minor group with 4 updates (#828)
  • b54adad refactor(testing): rename test secret constants for semantic clarity (#832)
  • 4898252 refactor(testing): centralize test secrets and normalize naming (#831)
  • See full diff in compare view

Updates sanitize-html from 2.17.2 to 2.17.4

Changelog

Sourced from sanitize-html's changelog.

2.17.4

Changes

  • sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

  • Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

2.17.3 (2026-04-15)

Security

  • Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.
Commits

Updates vitest from 4.1.4 to 4.1.8

Release notes

Sourced from vitest's releases.

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

v4.1.5

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • e61f2dd chore: release v4.1.8
  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • a09d472 chore: release v4.1.7
  • a8fd24c chore: release v4.1.6
  • 18af98c fix(browser): simplify orchestrator otel carrier (#10285)
  • 3188260 feat(browser): provide project reference in ToMatchScreenshotResolvePath (#...
  • e399846 chore: release v4.1.5
  • 7dc6d54 Revert "fix: respect diff config options in soft assertions (#8696)"
  • 9787ded fix: respect diff config options in soft assertions (#8696)
  • 325463a fix(ast-collect): recognize _vi_import prefix in static test discovery (#10...
  • Additional commits viewable in compare view

@dependabot @github

dependabot Bot commented on behalf of github Jun 1, 2026

Copy link
Copy Markdown
Author

Labels

The following labels could not be found: backend, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

… 3 updates

Bumps the backend-patches group with 3 updates in the /backend directory: [otplib](https://github.com/yeojz/otplib/tree/HEAD/packages/otplib), [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `otplib` from 13.4.0 to 13.4.1
- [Release notes](https://github.com/yeojz/otplib/releases)
- [Commits](https://github.com/yeojz/otplib/commits/v13.4.1/packages/otplib)

Updates `sanitize-html` from 2.17.2 to 2.17.4
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html)

Updates `vitest` from 4.1.4 to 4.1.8
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/vitest)

---
updated-dependencies:
- dependency-name: otplib
  dependency-version: 13.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-patches
- dependency-name: sanitize-html
  dependency-version: 2.17.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-patches
- dependency-name: vitest
  dependency-version: 4.1.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-patches
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/backend/backend-patches-28fe7a2b36 branch from 615fda1 to 126cc53 Compare June 8, 2026 04:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants