Skip to content

Bump the minor-updates group across 1 directory with 12 updates - #16

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot-npm_and_yarn-minor-updates-683cf73cbe
Closed

Bump the minor-updates group across 1 directory with 12 updates#16
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot-npm_and_yarn-minor-updates-683cf73cbe

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-updates group with 12 updates in the / directory:

Package From To
@astrojs/mdx 8.0.2 8.1.1
@astrojs/svelte 9.0.1 9.1.1
astro 7.3.5 7.4.2
katex 0.16.47 0.19.1
overlayscrollbars 2.16.0 2.17.0
sanitize-html 2.17.7 2.18.1
@types/sanitize-html 2.16.1 2.16.2
subset-font 2.7.0 2.9.0
unist-util-visit 5.1.0 5.2.0
@axe-core/playwright 4.13.0 4.14.0
@biomejs/biome 2.5.15 2.6.3
@playwright/test 1.63.0 1.64.1
@types/sanitize-html 2.16.1 2.16.2

Updates @astrojs/mdx from 8.0.2 to 8.1.1

Release notes

Sourced from @​astrojs/mdx's releases.

@​astrojs/mdx@​8.1.1

Patch Changes

@​astrojs/mdx@​8.1.0

Minor Changes

Patch Changes

  • Updated dependencies [b7a1bd9]:
    • @​astrojs/internal-helpers@​0.13.0
    • @​astrojs/markdown-satteri@​0.4.4

@​astrojs/mdx@​8.0.3

Patch Changes

  • #18099 6987261 Thanks @​renovate! - Adds YAML parsing with timestamp and merge key support, and formats YAML errors consistently across Astro, Markdown, MDX, and Markdoc.
  • Updated dependencies [6987261, 62b13ba]:
    • @​astrojs/internal-helpers@​0.12.0
    • @​astrojs/markdown-satteri@​0.4.3

@​astrojs/mdx@​8.0.3-beta.0

Patch Changes

Changelog

Sourced from @​astrojs/mdx's changelog.

8.1.1

Patch Changes

8.1.0

Minor Changes

Patch Changes

  • Updated dependencies [b7a1bd9]:
    • @​astrojs/internal-helpers@​0.13.0
    • @​astrojs/markdown-satteri@​0.4.4

8.0.3

Patch Changes

  • #18099 6987261 Thanks @​renovate! - Adds YAML parsing with timestamp and merge key support, and formats YAML errors consistently across Astro, Markdown, MDX, and Markdoc.
  • Updated dependencies [6987261, 62b13ba]:
    • @​astrojs/internal-helpers@​0.12.0
    • @​astrojs/markdown-satteri@​0.4.3
Commits

Updates @astrojs/svelte from 9.0.1 to 9.1.1

Release notes

Sourced from @​astrojs/svelte's releases.

@​astrojs/svelte@​9.1.1

Patch Changes

@​astrojs/svelte@​9.1.0

Minor Changes

@​astrojs/svelte@​9.0.2-beta.0

Patch Changes

Changelog

Sourced from @​astrojs/svelte's changelog.

9.1.1

Patch Changes

9.1.0

Minor Changes

Commits

Updates astro from 7.3.5 to 7.4.2

Release notes

Sourced from astro's releases.

astro@7.4.2

Patch Changes

  • #18430 dda9ec3 Thanks @​Abhirup-99! - Speeds up content sync with experimental.collectionStorage: "chunked" by computing each character's UTF-8 width from its code point instead of encoding every character through TextEncoder. On a store of ~44k entries this cuts the chunking step from about 60 seconds to well under a second, with byte-identical output.

  • #18438 5e0eaa4 Thanks @​astro-factory! - Fixes astro dev with @astrojs/cloudflare failing with Calling `require` for "node-fetch" when a server dependency such as cross-fetch requires node-fetch

  • #18376 a4e201d Thanks @​okxint! - Fixes astro dev treating a stale lock file containing a Linux thread ID as a running Astro server. A successful process lookup with no matching PID now marks the lock as stale, preventing astro dev stop and astro dev --force from killing the unrelated process that owns the thread.

  • #18467 d1fb7d3 Thanks @​astro-factory! - Fixes the defineConfig() types for i18n.defaultLocale, i18n.fallback, and i18n.domains so they accept a custom locale's path instead of its codes, matching how Astro validates and uses these values

  • #18475 cf27e70 Thanks @​ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

    This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

  • #18451 7a0ba6f Thanks @​DenisCDev! - Fixes astro sync, astro check and astro build replacing the optimized dependencies of a dev server running in the same project, which broke framework islands in that dev server until it was restarted with --force

  • #18336 e943003 Thanks @​astro-factory! - Fixes inline styles in dev so that framework-transformed CSS is used, such as scoped styles and v-bind() in Vue single-file components

  • #18399 829fc00 Thanks @​astro-factory! - Fixes a dev server error (Could not find server component name) for a server:defer island that imports astro:actions or astro:config/server, when its page was not the first island page loaded after starting the server

  • #18330 4db9e0d Thanks @​Samuteg! - Fixes the astro:env/server virtual module being generated with invalid JS in dev when any environment variable contains $ replacement patterns ($`, $&, $', $1, …). The inlined env JSON was passed as a string to String.replace, so e.g. the KITTY_PUBLIC_KEY value set by default in Kitty terminals corrupted the module and broke dev with Failed to parse source for import analysis

  • Updated dependencies [cf27e70]:

    • @​astrojs/telemetry@​3.4.1
    • @​astrojs/markdown-satteri@​0.4.5

astro@7.4.1

Patch Changes

  • #18425 6fdc36e Thanks @​astro-factory! - Preserves the last modified date of cached optimized images and incrementally restored build output when copying them into the build output on all platforms

  • #18419 395d195 Thanks @​astro-factory! - Fixes a typo in the error message shown when a font cssVariable is invalid

  • #18401 484822f Thanks @​danielmlr! - Fixes a bug where projects whose path contains an apostrophe (') failed to load sessions, middleware, a cache provider, or a src/fetch.ts handler

  • #18407 a6e00be Thanks @​astro-factory! - Fixes a TSCONFIG_ERROR during astro build when a parent directory contains a tsconfig.json that cannot be resolved, such as one extending astro/tsconfigs/strict without installed dependencies

  • #18427 908f167 Thanks @​astro-factory! - Fixes an Unterminated string build error when application code imports from astro/config (for example, fontProviders in a shared fonts module)

  • #18428 40e7d54 Thanks @​astro-factory! - Fixes missing styles in production builds for conditionally rendered framework components (e.g. Svelte components inside {#if} blocks) imported by a hydrated island

  • #18424 617ff59 Thanks @​astro-factory! - Fixes style-only HMR in .astro components falling back to a full page reload when a PostCSS plugin (such as @unocss/postcss) lists the component as a dependency of its own style

  • #18274 70834bb Thanks @​Princesseuh! - Fixes increasing memory usage when editing the Astro configuration while the dev server is running

astro@7.4.0

Minor Changes

... (truncated)

Changelog

Sourced from astro's changelog.

7.4.2

Patch Changes

  • #18430 dda9ec3 Thanks @​Abhirup-99! - Speeds up content sync with experimental.collectionStorage: "chunked" by computing each character's UTF-8 width from its code point instead of encoding every character through TextEncoder. On a store of ~44k entries this cuts the chunking step from about 60 seconds to well under a second, with byte-identical output.

  • #18438 5e0eaa4 Thanks @​astro-factory! - Fixes astro dev with @astrojs/cloudflare failing with Calling `require` for "node-fetch" when a server dependency such as cross-fetch requires node-fetch

  • #18376 a4e201d Thanks @​okxint! - Fixes astro dev treating a stale lock file containing a Linux thread ID as a running Astro server. A successful process lookup with no matching PID now marks the lock as stale, preventing astro dev stop and astro dev --force from killing the unrelated process that owns the thread.

  • #18467 d1fb7d3 Thanks @​astro-factory! - Fixes the defineConfig() types for i18n.defaultLocale, i18n.fallback, and i18n.domains so they accept a custom locale's path instead of its codes, matching how Astro validates and uses these values

  • #18475 cf27e70 Thanks @​ematipico! - Bumps the minimum supported Node.js version to 22.23.4, which includes the fixes from the October 2026 Node.js security releases

    This is a patch release because the Node.js support and upgrade policy allows the Core team to raise the minimum Maintenance LTS version in a patch release when a disclosed and fixed Node.js security flaw affects Astro.

  • #18451 7a0ba6f Thanks @​DenisCDev! - Fixes astro sync, astro check and astro build replacing the optimized dependencies of a dev server running in the same project, which broke framework islands in that dev server until it was restarted with --force

  • #18336 e943003 Thanks @​astro-factory! - Fixes inline styles in dev so that framework-transformed CSS is used, such as scoped styles and v-bind() in Vue single-file components

  • #18399 829fc00 Thanks @​astro-factory! - Fixes a dev server error (Could not find server component name) for a server:defer island that imports astro:actions or astro:config/server, when its page was not the first island page loaded after starting the server

  • #18330 4db9e0d Thanks @​Samuteg! - Fixes the astro:env/server virtual module being generated with invalid JS in dev when any environment variable contains $ replacement patterns ($`, $&, $', $1, …). The inlined env JSON was passed as a string to String.replace, so e.g. the KITTY_PUBLIC_KEY value set by default in Kitty terminals corrupted the module and broke dev with Failed to parse source for import analysis

  • Updated dependencies [cf27e70]:

    • @​astrojs/telemetry@​3.4.1
    • @​astrojs/markdown-satteri@​0.4.5

7.4.1

Patch Changes

  • #18425 6fdc36e Thanks @​astro-factory! - Preserves the last modified date of cached optimized images and incrementally restored build output when copying them into the build output on all platforms

  • #18419 395d195 Thanks @​astro-factory! - Fixes a typo in the error message shown when a font cssVariable is invalid

  • #18401 484822f Thanks @​danielmlr! - Fixes a bug where projects whose path contains an apostrophe (') failed to load sessions, middleware, a cache provider, or a src/fetch.ts handler

  • #18407 a6e00be Thanks @​astro-factory! - Fixes a TSCONFIG_ERROR during astro build when a parent directory contains a tsconfig.json that cannot be resolved, such as one extending astro/tsconfigs/strict without installed dependencies

  • #18427 908f167 Thanks @​astro-factory! - Fixes an Unterminated string build error when application code imports from astro/config (for example, fontProviders in a shared fonts module)

  • #18428 40e7d54 Thanks @​astro-factory! - Fixes missing styles in production builds for conditionally rendered framework components (e.g. Svelte components inside {#if} blocks) imported by a hydrated island

  • #18424 617ff59 Thanks @​astro-factory! - Fixes style-only HMR in .astro components falling back to a full page reload when a PostCSS plugin (such as @unocss/postcss) lists the component as a dependency of its own style

  • #18274 70834bb Thanks @​Princesseuh! - Fixes increasing memory usage when editing the Astro configuration while the dev server is running

7.4.0

Minor Changes

... (truncated)

Commits
  • 34c9535 [ci] release (#18459)
  • cf27e70 fix: minimal support node version (#18475)
  • 1efb9d6 Update dependency @​playwright/test to v1.64.1 (#18441)
  • 5e0eaa4 fix(astro): stop excluding node-fetch from server dep optimization in workerd...
  • a4e201d fix(dev): treat missing ps row as stale in lockfile process check (#18376)
  • 7a0ba6f Use a separate Vite cache for the temporary sync server (#18451)
  • d1fb7d3 fix(i18n): use locale path instead of codes in defineConfig i18n types (#18467)
  • dda9ec3 fix(content): compute UTF-8 width arithmetically in getChunkEnd (#18430)
  • 7af66fc Fix astro-check binary silently dropping the first two CLI arguments (#18455)
  • 829fc00 Skip server island manifest in CSS ensureModulesLoaded to fix late-discovery ...
  • Additional commits viewable in compare view

Updates katex from 0.16.47 to 0.19.1

Release notes

Sourced from katex's releases.

v0.19.1

0.19.1 (2026-10-23)

Bug Fixes

v0.19.0

0.19.0 (2026-10-01)

Documentation

BREAKING CHANGES

  • Missing character metrics now reported via strict with error code symbolNotInFont, changing warning formatting, calling any strict callbacks, and producing errors in strict: "error" mode. Also, strict callbacks returning undefined or null now warn instead of ignoring the issue (and no longer typecheck); return false or "ignore" to suppress warnings.

v0.18.11

0.18.11 (2026-10-01)

Features

  • handle character metrics warnings via strict (#4243) (4237070)

v0.18.10

0.18.10 (2026-09-30)

Features

  • make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

v0.18.9

0.18.9 (2026-09-23)

Features

v0.18.8

0.18.8 (2026-09-23)

Bug Fixes

... (truncated)

Changelog

Sourced from katex's changelog.

0.19.1 (2026-10-23)

Bug Fixes

0.19.0 (2026-10-01)

Documentation

BREAKING CHANGES

  • Missing character metrics now reported via strict with error code symbolNotInFont, changing warning formatting, calling any strict callbacks, and producing errors in strict: "error" mode. Also, strict callbacks returning undefined or null now warn instead of ignoring the issue (and no longer typecheck); return false or "ignore" to suppress warnings.

0.18.11 (2026-10-01)

Features

  • handle character metrics warnings via strict (#4243) (4237070)

0.18.10 (2026-09-30)

Features

  • make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

0.18.9 (2026-09-23)

Features

0.18.8 (2026-09-23)

Bug Fixes

0.18.7 (2026-09-06)

... (truncated)

Commits
  • 8000fbd chore(release): 0.19.1 [ci skip]
  • 6971e5c fix: allow percent sign in raw argument type (#4307)
  • 8f0d9bc chore: handle devicePixelRatio in screenshotter (#4303)
  • faa8a4c docs(users): add Whiteboard (#4310)
  • f18d73d docs(users): add Liubai (#4313)
  • 4ffde03 chore(deps): bump github/codeql-action from 4.38.3 to 4.39.0 (#4314)
  • cac2561 chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 (#4306)
  • 6ea2dc9 chore(release): 0.19.0 [ci skip]
  • cbb1fce docs: note strict changes shipped in 0.18.11 (#4300)
  • d5bed9f chore(release): 0.18.11 [ci skip]
  • Additional commits viewable in compare view
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates overlayscrollbars from 2.16.0 to 2.17.0

Changelog

Sourced from overlayscrollbars's changelog.

2.17.0

Features

  • Instead of adding tabindex blindly to the viewport element to make it accessable, detect whether the browser supports focusable scrollers. Support is reflect in OverlayScrollbars.env().focusableScrollers. #732

Improvements

  • Provide .min.js versions for esm and cjs outputs for consumers without bundlers. #758

Bug Fixes

  • Remove any "dummy" animation keyframes for ScrollTimeline animations. #761
  • Fix an issue in Safari where "smooth" scrollIntoView stopped early because of ::-webkit-scrollbar styling. #762
Commits
  • 08388f8 v2.17.0
  • be608aa fix test
  • d2308ca add focusableScrollers support
  • e48383d only hide native scrollbars with ::-webkit-scrollbar where scrollbar-width is...
  • 6c1a264 v2.16.1
  • e4645c7 build minified versions for esm and cjs versions
  • 0ae6b4e improvements to non-default scroll direction detection, performance and viewp...
  • 9d61d2a use fill: both for scrolltimelines, overall improvements
  • See full diff in compare view

Updates sanitize-html from 2.17.7 to 2.18.1

Changelog

Sourced from sanitize-html's changelog.

2.18.1 (2026-10-14)

Changes

  • Remove the deepmerge dependency, which was used only to combine tag-specific and * (all tags) entries in allowedClasses and allowedStyles. That is now done by a few lines of code within sanitize-html.

    This is not a fix for a vulnerability in sanitize-html. Security scanners such as Snyk now report CVE-2026-93753 in deepmerge, which can affect applications that merge untrusted objects, such as parsed JSON request bodies. sanitize-html only ever merged the developer's own configuration, never anything taken from the HTML being sanitized, so it was not exploitable through sanitize-html. Since we needed only a small part of what deepmerge does, we removed the dependency so that these reports no longer appear for sanitize-html users.

Security

  • Since 2.18.0, the fallback markup of a discarded <iframe> was re-sanitized by a recursive call with no limit, one level per nested unclosed <iframe>. A few kilobytes of crafted input could throw RangeError: Maximum call stack size exceeded with the default options, and the nestingLimit option was not enforced across the fallback because each nested call started counting from zero. The fallback of a discarded <iframe> is still sanitized and kept, but only up to eight nested <iframe> elements (deeper fallback is escaped as text, as before 2.18.0), and the current nesting depth now carries into the nested call so nestingLimit applies to the whole output. Only 2.18.0 was affected, and the exception is thrown synchronously, so applications that catch errors from sanitizeHtml only lost the affected request (CWE-674, GHSA-c9rx-x947-fp3h).

    Thanks to hkmj19, JohnBeckley, and amikhailovstiltsoft for reporting the vulnerability.

2.18.0 (2026-09-30)

Adds

  • Added a logger option: pass any console-shaped object, with debug, info, warn and error methods, and sanitize-html's own diagnostics are delivered to it rather than to the console, so an application with a logging pipeline of its own can route them. Missing methods, and no option at all, fall back to the console. Those messages also lost their decorative line breaks and warning icon, so each is now a single line of text; their wording is otherwise unchanged.

Fixes

  • allowedSchemesByTag is now applied to srcset and imagesrcset URLs. Previously the per-tag lookup used the attribute name instead of the tag name, so these attributes always fell back to the global allowedSchemes and ignored a tag-specific scheme allowlist. Thanks to spokodev for the fix.
  • Starting in version 2.17.6, sanitize-html began escaping any markup preserved inside a disallowed iframe tag, which was a change in behavior due to an upstream change in htmlparser2. This fix ensures such "fallback markup" is preserved without escaping, but also fully sanitized according to the same rules as the original input. Thanks to sumitjhacodes for the fix.

Security

  • When meta was allowed together with its http-equiv and content attributes, the destination URL of a <meta http-equiv="refresh" content="0;url=..."> was never checked against allowedSchemes, because it is embedded in content rather than being an attribute of its own. So javascript:, data: and other disallowed destinations passed through. The refresh URL is now extracted the way browsers do it, allowing for the different spellings, separators, quoting and letter case of url=, and checked against allowedSchemes (or allowedSchemesByTag.meta). If it is rejected, or the content cannot be parsed as a refresh, the content attribute is removed. content on other meta elements is unchanged. The default configuration does not allow meta and was not affected (CWE-79, CWE-601, GHSA-cv27-6wvh-8x7j).

    Thanks to adrbogacz for reporting the vulnerability.

  • When noscript is listed in nonTextTags, the discarded region could end too early. Browsers with scripting enabled treat <noscript> content as raw text up to the first </noscript>, but the underlying parser treats it as markup, so an end tag for an enclosing element inside <noscript> closed it implicitly and the rest of its content was emitted as ordinary sanitized markup. The discard region now continues until the point where a browser would end the <noscript> element, while implied closes of other nonTextTags such as <option> behave as before (CWE-79, CWE-436, GHSA-x3q4-9hxx-gx8m).

    Thanks to joaquiniglesiaslug for reporting the vulnerability.

  • The check that drops SVG animation elements (animate, animateColor, animateMotion, animateTransform, set) when they retarget a URL attribute such as href compared the full tag name, so a namespace-prefixed spelling like svg:animate was not recognized when such tags were allowed (for example with allowedTags: false). In XML serializations such as XHTML or standalone SVG, the prefixed element is a real animation element and could retarget a link to a javascript: URL after sanitization. The element and attributeName are now matched by their local names, ignoring any prefix (CWE-79, CWE-184, GHSA-374f-7chj-9948).

    Thanks to Kai Aizen (SnailSploit) for reporting the vulnerability.

Commits

Updates @types/sanitize-html from 2.16.1 to 2.16.2

Commits

Updates subset-font from 2.7.0 to 2.9.0

Changelog

Sourced from subset-font's changelog.

v2.9.0 (2026-09-20)

Pull requests

Commits to master

v2.8.0 (2026-09-20)

Pull requests

  • #32 feat: add keepAllGlyphs option to instance without subsetting (Daniel Roe)

Commits to master

Commits
  • d2e6366 2.9.0
  • b57f0b9 Style nit: heapu8 => getHeapu8, use function decl
  • 0f38a0f Merge pull request #31 from danielroe/feat/harfbuzz-upgrade
  • 54ef56f 2.8.0
  • e55412f Remove extraneous tests from #32
  • f2cb051 Merge pull request #32 from danielroe/feat/instance-without-subsetting
  • 0f3584e feat: add keepAllGlyphs option to instance without subsetting
  • ce4641f feat(deps): upgrade to harfbuzzjs v1.6.1
  • See full diff in compare view

Updates unist-util-visit from 5.1.0 to 5.2.0

Release notes

Sourced from unist-util-visit's releases.

5.2.0

Add

  • c1ed449 Add support for exit visitors

Performance

  • f57c39f Fix performance around indexOf

Full Changelog: https://github.com/syntax-tree/unist-util-visit/compare...

Description has been truncated

@dependabot
Bump the minor-updates group across 1 directory with 12 updates
946e514 
Bumps the minor-updates group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/mdx](https://github.com/withastro/astro/tree/HEAD/packages/integrations/mdx) | `8.0.2` | `8.1.1` |
| [@astrojs/svelte](https://github.com/withastro/astro/tree/HEAD/packages/integrations/svelte) | `9.0.1` | `9.1.1` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `7.3.5` | `7.4.2` |
| [katex](https://github.com/KaTeX/KaTeX) | `0.16.47` | `0.19.1` |
| [overlayscrollbars](https://github.com/KingSora/OverlayScrollbars/tree/HEAD/packages/overlayscrollbars) | `2.16.0` | `2.17.0` |
| [sanitize-html](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html) | `2.17.7` | `2.18.1` |
| [@types/sanitize-html](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sanitize-html) | `2.16.1` | `2.16.2` |
| [subset-font](https://github.com/papandreou/subset-font) | `2.7.0` | `2.9.0` |
| [unist-util-visit](https://github.com/syntax-tree/unist-util-visit) | `5.1.0` | `5.2.0` |
| [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.13.0` | `4.14.0` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.5.15` | `2.6.3` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` |
| [@types/sanitize-html](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/sanitize-html) | `2.16.1` | `2.16.2` |



Updates `@astrojs/mdx` from 8.0.2 to 8.1.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/mdx/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/mdx@8.1.1/packages/integrations/mdx)

Updates `@astrojs/svelte` from 9.0.1 to 9.1.1
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/svelte/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/svelte@9.1.1/packages/integrations/svelte)

Updates `astro` from 7.3.5 to 7.4.2
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@7.4.2/packages/astro)

Updates `katex` from 0.16.47 to 0.19.1
- [Release notes](https://github.com/KaTeX/KaTeX/releases)
- [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md)
- [Commits](KaTeX/KaTeX@v0.16.47...v0.19.1)

Updates `overlayscrollbars` from 2.16.0 to 2.17.0
- [Release notes](https://github.com/KingSora/OverlayScrollbars/releases)
- [Changelog](https://github.com/KingSora/OverlayScrollbars/blob/master/packages/overlayscrollbars/CHANGELOG.md)
- [Commits](https://github.com/KingSora/OverlayScrollbars/commits/v2.17.0/packages/overlayscrollbars)

Updates `sanitize-html` from 2.17.7 to 2.18.1
- [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md)
- [Commits](https://github.com/apostrophecms/apostrophe/commits/sanitize-html@2.18.1/packages/sanitize-html)

Updates `@types/sanitize-html` from 2.16.1 to 2.16.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sanitize-html)

Updates `subset-font` from 2.7.0 to 2.9.0
- [Changelog](https://github.com/papandreou/subset-font/blob/master/CHANGELOG.md)
- [Commits](papandreou/subset-font@v2.7.0...v2.9.0)

Updates `unist-util-visit` from 5.1.0 to 5.2.0
- [Release notes](https://github.com/syntax-tree/unist-util-visit/releases)
- [Commits](syntax-tree/unist-util-visit@5.1.0...5.2.0)

Updates `@axe-core/playwright` from 4.13.0 to 4.14.0
- [Release notes](https://github.com/dequelabs/axe-core-npm/releases)
- [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md)
- [Commits](dequelabs/axe-core-npm@v4.13.0...v4.14.0)

Updates `@biomejs/biome` from 2.5.15 to 2.6.3
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/CHANGELOG_v1.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.6.3/packages/@biomejs/biome)

Updates `@playwright/test` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `@types/sanitize-html` from 2.16.1 to 2.16.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/sanitize-html)

---
updated-dependencies:
- dependency-name: "@astrojs/mdx"
  dependency-version: 8.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: "@astrojs/svelte"
  dependency-version: 9.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: astro
  dependency-version: 7.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: katex
  dependency-version: 0.19.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: overlayscrollbars
  dependency-version: 2.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: sanitize-html
  dependency-version: 2.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: "@types/sanitize-html"
  dependency-version: 2.16.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-updates
- dependency-name: subset-font
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: unist-util-visit
  dependency-version: 5.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: "@axe-core/playwright"
  dependency-version: 4.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: "@biomejs/biome"
  dependency-version: 2.6.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: "@playwright/test"
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-updates
- dependency-name: "@types/sanitize-html"
  dependency-version: 2.16.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 28, 2026
@TTStudio336
TTStudio336 deleted the dependabot-npm_and_yarn-minor-updates-683cf73cbe branch October 29, 2026 01:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@TTStudio336