[dependabot]

Bumps the minor-and-patch group with 10 updates in the / directory:

Package	From	To
@ownclouders/eslint-config	12.5.0	12.5.1
@ownclouders/prettier-config	0.0.1	0.0.2
@ownclouders/tsconfig	0.0.6	0.0.7
@playwright/test	1.64.0	1.64.1
@ownclouders/extension-sdk	12.5.0	12.5.1
sass-embedded	1.105.1	1.106.1
qs	6.16.0	6.16.1
js-yaml	5.4.3	5.5.0
jsdom	30.1.2	30.1.3
@zip.js/zip.js	2.23.0	2.24.0

Updates @ownclouders/eslint-config from 12.5.0 to 12.5.1

Commits

• See full diff in compare view

Updates @ownclouders/prettier-config from 0.0.1 to 0.0.2

Changelog

Sourced from @​ownclouders/prettier-config's changelog.

Table of Contents

• Changelog for unreleased
• Changelog for 8.0.0
• Changelog for 7.3.1
• Changelog for 7.3.0
• Changelog for 7.2.0
• Changelog for 7.1.3
• Changelog for 7.1.2
• Changelog for 7.1.1
• Changelog for 7.1.0
• Changelog for 7.0.0
• Changelog for 5.0.9
• Changelog for 6.6.1
• Changelog for 6.6.0
• Changelog for 6.5.0
• Changelog for 5.0.8
• Changelog for 6.4.0
• Changelog for 5.0.7
• Changelog for 6.3.0
• Changelog for 6.2.0
• Changelog for 5.0.6
• Changelog for 6.1.0
• Changelog for 6.0.0
• Changelog for 5.0.5
• Changelog for 5.0.4
• Changelog for 5.0.3
• Changelog for 5.0.2
• Changelog for 5.0.1
• Changelog for 4.0.7
• Changelog for 5.0.0
• Changelog for 4.0.6
• Changelog for 4.0.5
• Changelog for 4.0.4
• Changelog for 4.0.3
• Changelog for 4.0.2
• Changelog for 4.0.1
• Changelog for 4.0.0
• Changelog for 3.0.0
• Changelog for 2.0.0
• Changelog for 1.20.0
• Changelog for 1.19.1
• Changelog for 1.19.0
• Changelog for 1.18.0
• Changelog for 1.17.0
• Changelog for 1.16.0
• Changelog for 1.15.0
• Changelog for 1.14.0
• Changelog for 1.13.0
• Changelog for 1.12.0

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​ownclouders/prettier-config since your current version.

Updates @ownclouders/tsconfig from 0.0.6 to 0.0.7

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​ownclouders/tsconfig since your current version.

Updates @playwright/test from 1.64.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• See full diff in compare view

Updates @ownclouders/extension-sdk from 12.5.0 to 12.5.1

Commits

• See full diff in compare view

Updates sass-embedded from 1.105.1 to 1.106.1

Changelog

Sourced from sass-embedded's changelog.

1.106.1

• Fix a bug where an attribute selector with an empty value (such as [class=""]) would crash when serializing.

• Don't crash when serializing a number with an empty unit. This is only possible through the JavaScript and Dart APIs or the embedded protocol.

Embedded Dart Sass

• More robustly convert invalid value errors into PARAMS errors.

1.106.0

• Don't normalize CSS escapes in statement contexts that can contain interpolation. For example, @f\6Fo is now emitted as written rather than normalized to @foo.

• Fix a bug where quotes would be removed from attribute selector values that contained backslashes.

• Fix invalid source spans that could cause crashes when encountering a syntax error in selectors or media queries that also contain escape sequences.

• Fix a bug where the indented syntax parser would crash when parsing a file where the first statement was indented and appeared after the first line.

• Fix a bug that could cause crashes when encountering errors or warnings in interpolations that contain patterns like // */.

• Potentially breaking compatibility fix: CSS escape codes whose values are 0, for Unicode surrogates, or greater than the maximum allowed code point are now consistently normalized to U+FFFD REPLACEMENT CHARACTER in expression contexts. Previously, in some cases these were instead normalized to the normalized form of the original escape sequence, which violates the principle that all escape sequences for identical values should be normalized the same way. In other cases, these would simply throw errors.

  As a special case, \0 on its own will continue to be normalized to \0 to support historical CSS hacks.

• Potentially breaking bug fix: Throw an error for mixins and functions that have rest parameters which are the same as normal parameters. Previously, the positional parameters wouldn't be accessible and calling such a mixin or function with a named argument would crash the compiler.

• Potentially breaking bug fix: Fix various cases where using a CSS escape code at the beginning of an identifier would change parsing behavior versus using the character directly.

... (truncated)

Commits

• c60459d Update Dart Sass version and release
• 5d64b1e Update Dart Sass version and release
• 0ce7457 Update Dart Sass version and release
• 888b58f Merge pull request #449 from sass/deadlock
• See full diff in compare view

Updates qs from 6.16.0 to 6.16.1

Changelog

Sourced from qs's changelog.

6.16.1

• [Fix] parse: do not mutate an object input
• [Fix] stringify: stop re-encoding structural separator dots when encodeDotInKeys is set (#564)
• [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments with encodeValuesOnly
• [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip (#565)
• [Fix] parse: only convert top-level dots to brackets when allowDots is on (#621)
• [Fix] stringify: ignore inherited array format names (#622)
• [Fix] stringify: arrayFormat: 'comma': do not throw on elements with no callable toString
• [Fix] utils: merge: seed an overflow container's index from its own keys, not just the source
• [Fix] utils: merge: keep a strictMerge conflict container's index and arrayLimit correct
• [Fix] parse: only treat [] as array syntax when it ends the key
• [Perf] decode: skip decoders when there is no percent sign (#583)
• [Robustness] utils: merge: apply arrayLimit to the two-element array built for colliding values
• [Robustness] parse: bound the nesting added by repeated strictMerge conflicts (credit @​Yeaseen)
• [Docs] document that qs and flat parsers disagree about parameter names
• [Docs] clarify that throwOnLimitExceeded limits each array, not the total number of values
• [Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (#567, #568)
• [meta] fix changelog indents
• [actions] set least-privilege cache-mode
• [Tests] utils: decode: add missing cases
• [Tests] parse: characterize the ]= split when an = precedes any bracket group (#620)
• [Tests] parse: allowDots: cover stray close brackets before a dot
• [Dev Deps] update @ljharb/eslint-config, eslint, tape

Commits

• 2471b66 v6.16.1
• 51f736e [Docs] document that qs and flat parsers disagree about parameter names
• 40239f7 [Dev Deps] update tape
• d219359 [Fix] parse: do not mutate an object input
• 98157dc [Fix] stringify: stop re-encoding structural separator dots when `encodeDot...
• cb075c5 [Fix] stringify: arrayFormat: 'comma': pass the full encoder arguments wi...
• 4b89c03 [Fix] utils: encode + as %2B in iso-8859-1 mode so values round-trip
• 266527d [Perf] decode: skip decoders when there is no percent sign
• 82c5bd0 [Tests] utils: decode: add missing cases
• 3ee412c [Tests] parse: characterize the ]= split when an = precedes any bracket...
• Additional commits viewable in compare view

Updates js-yaml from 5.4.3 to 5.5.0

Changelog

Sourced from js-yaml's changelog.

[5.5.0] - 2026-10-16

Changed

• Updated argparse to v3.
• Updated development dependencies.

Fixed

• Correct percent-encoding of shorthand and verbatim tags.
• Reject ,, ], and } at the start of block plain scalars, #801.
• Report the exact position of non-printable characters in errors, #801.

Commits

• cb62b2d 5.5.0 released
• 87aed90 Deps bump
• 3aec511 Fix error positions for non-printable characters, #801
• 11aa483 Reject flow indicators at the start of block plain scalars, #801
• 339d8e0 Refactor tag encoder and decoder to match the YAML specification
• See full diff in compare view

Updates jsdom from 30.1.2 to 30.1.3

Release notes

Sourced from jsdom's releases.

v30.1.3

• Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)
• Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)
• Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.
• Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.
• Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)
• Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.
• Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.
• Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.
• Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.
• Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.
• Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.
• Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.
• Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.
• Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)

Commits

• 058c0f5 30.1.3
• fcd1fd1 Cascade parsed longhands independently
• a3ee786 Cascade computed style properties on demand
• f42dc15 Resolve colors before caching or using currentcolor
• 074b1fb Compute background-position lengths against the final font size
• d19598c Apply style rules nested in multiple @​media rules
• 45d626c Rule out attribute selector subjects before matching
• 3ff0a5b Upgrade Undici and remove abort workarounds
• 8813bb1 Ignore CSS declarations with unparseable math functions
• 63712d8 Fix XHR credentials across redirects
• Additional commits viewable in compare view

Updates @zip.js/zip.js from 2.23.0 to 2.24.0

Release notes

Sourced from @​zip.js/zip.js's releases.

v2.24.0

What's Changed in v2.24.0

New features

• The uncompressedSize option of ZipWriter#add() is now read for a ReadableStream or any reader without a size, as the size the stream is expected to have: the entry is then laid out like one read from a reader of that size, i.e. without Zip64 structures below 4 GB and, with bufferedWrite, without a data descriptor. The sizes written remain the measured ones. The option is validated on every path and throws the new ERR_INVALID_UNCOMPRESSED_SIZE_OPTION error when it is not a non-negative integer

Improvements

• Skip the data descriptor by default when the local header can carry the CRC-32 and the sizes: a passThrough entry read from a reader of known size with crc32 provided (or AES-encrypted, which stores no CRC-32), which also keeps the direct write path instead of a temporary stream, and a reader of unknown size written with bufferedWrite or dataDescriptor: false. ZipCrypto entries, entries copied with the entry option and explicit dataDescriptor: true keep their descriptor
• Split the Node.js and Deno CI job into three lanes

Documentation

• State that the duplicates policy of the filesystem imports applies to the entries kept by the filter option only

Full Changelog: gildas-lormeau/zip.js@v2.23.0...v2.24.0

Co-Authored-By: Claude Fable 5.1 noreply@anthropic.com

Commits

• 855527f bump up version
• 1e037b2 use the uncompressedSize option as the size of a stream
• 448c12b skip the data descriptor when the header can carry the values
• 4d6a9fe split the node and deno ci job into three lanes
• 5f6139e document the precedence of the import filter over duplicates
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.