Skip to content

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates - #2

Open
dependabot[bot] wants to merge 1521 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-f2e4459aea
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 10 updates#2
dependabot[bot] wants to merge 1521 commits into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-f2e4459aea

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
dompurify 3.4.5 3.4.12
js-yaml 4.1.1 4.3.0
vite 7.3.3 8.2.0
vitest 4.0.16 4.1.10
brace-expansion 2.1.0 2.1.4
esbuild 0.27.3 0.28.1
sharp 0.34.5 0.35.2

Updates dompurify from 3.4.5 to 3.4.12

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.12

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.11

  • Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
  • Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
  • Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
  • Updated up the linting tool-chain and removed now-redundant lint directives
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible

DOMPurify 3.4.10

  • Refactored codebase for clarity: extracted the public type declarations into types.ts
  • Decomposed the three largest sanitizer functions into focused helpers
  • Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
  • Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
  • Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
  • Reduced CI cost by running the full three-engine browser suite once per PR
  • Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
  • Documented the bench and test:happydom scripts in the README
  • Completed the Attack Classes & Bypass History wiki page
  • Bumped several dependencies where possible

DOMPurify 3.4.9

  • Further improved the handling of Trusted Types config options, thanks @​offset
  • Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
  • Added more test coverage for IN_PLACE and Trusted Types related usage
  • Bumped several dependencies where possible
  • Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

  • Cleaned up the repository root, renamed some and removed unneeded files
  • Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
  • Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
  • Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
  • Bumped several dependencies where possible

DOMPurify 3.4.7

  • Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
  • Removed a problem leading to permanent hook pollution, thanks @​offset
  • Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

... (truncated)

Commits

Updates js-yaml from 4.1.1 to 4.3.0

Changelog

Sourced from js-yaml's changelog.

4.3.0, 3.15.0 - 2026-06-27

Security

  • Backported maxTotalMergeKeys option.

[5.2.0] - 2026-06-26

Added

  • Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one load() / loadAll() call.
  • Added maxAliases (-1) loader option to limit the number of YAML aliases per document.

Removed

  • maxMergeSeqLength replaced with maxTotalMergeKeys for limiting YAML merge processing.

Fixed

  • Round-trip of integers with exponential form (>= 1e21)

[5.1.0] - 2026-06-23

Added

  • Collection tags can finalize an incrementally populated carrier into a different result value.

Changed

  • [breaking] quoteStyle now selects the preferred quote style; use the restored forceQuotes option to force quoting non-key strings.

[5.0.0] - 2026-06-20

Added

  • Added named exports for schemas, tags, parser events and AST utilities.
  • Reworked JSON_SCHEMA and CORE_SCHEMA with spec-compliant scalar resolution rules, and added YAML11_SCHEMA.
  • Added realMapTag for lossless mappings with non-string and complex keys. Object-based mappings now reject complex keys instead of stringifying them.
  • Added dump() transform option for changing the generated AST before rendering.
  • Added dump() options seqInlineFirst, flowBracketPadding, flowSkipCommaSpace, flowSkipColonSpace, quoteFlowKeys, quoteStyle and tagBeforeAnchor.
  • Added formal data layers (events and AST) for modular data pipelines.
    • Added low-level parser (to events), presenter and visitor APIs.
  • Added the YAML Test Suite to the test set.

Changed

  • See the migration guide for upgrade notes.
  • Rewritten in TypeScript and reorganized the public API around flat named exports.

... (truncated)

Commits
  • 33d05b5 4.3.0 released
  • 663bfab Drop demo publish, to not override new v5 one.
  • 1cb8c7b Add v4-legacy tag for publish
  • 02f27af Restore umd builds back to es5
  • 8be84ed Fix es5 compatibility
  • 59423c6 Replace maxMergeSeqLength option with maxTotalMergeKeys (more robust). Ba...
  • 6842ef6 doc polish
  • 590dbab 4.2.0 released
  • f944dc5 Add package.json funding field
  • f692719 Changelog update
  • Additional commits viewable in compare view

Updates vite from 7.3.3 to 8.2.0

Release notes

Sourced from vite's releases.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.5

Please refer to CHANGELOG.md for details.

v8.1.4

Please refer to CHANGELOG.md for details.

v8.1.3

Please refer to CHANGELOG.md for details.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.2.0 (2026-07-30)

Features

  • add input to server.fs.allow (#23035) (95a3cda)
  • bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)
  • bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)
  • config: include column in config incompatibility location (#23064) (8a24572)
  • dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

  • bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)
  • deps: update all non-major dependencies (#23069) (4c07b74)
  • hmr: preserve environment snapshot during server restart (#22992) (b1186c3)
  • importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)
  • module-runner: keep stack trace interception working when Object.prototype is frozen (#23073) (599c5b0)
  • server: strip base in indexHtml module graph lookup (#22932) (fa005d1)
  • support resolving top-level input option with plugins (#23101) (41df81a)

Documentation

  • config: correct cacheDir default fallback description (#23060) (aafa103)

Tests

8.2.0-beta.0 (2026-07-22)

Features

  • add input option (#22642) (9beae37)
  • config: warn features incompatible with native loader in bundle loader (#22850) (05302b0)
  • css: export PostCSS config type for type-safe configs (#22792) (302c755)
  • dev: label network URLs with their interface name (#22830) (78accc4)
  • optimizer: support aube lockfile (#22813) (6319827)
  • optimizer: support nub lockfile (#22891) (65d3604)
  • update rolldown-related dependencies and use client-side HMR in bundled-dev (#22961) (960e9ef)
  • wasm: expand test suite, unwrap WebAssembly.Global and enable js-string builtins (#22674) (9e79b51)

Bug Fixes

Performance Improvements

... (truncated)

Commits
  • 6a34ac3 fix(deps): update all non-major dependencies (#21096)
  • 02ceaec chore(deps): update dependency @​rollup/plugin-commonjs to v29 (#21099)
  • 572aaca release: v7.2.2
  • 728c8ee fix: revert "refactor: use fs.cpSync (#21019)" (#21081)
  • a532e68 release: v7.2.1
  • 82d2d6c fix(worker): some worker asset was missing (#21074)
  • f83264f refactor(build): rename indexOfMatchInSlice to findPreloadMarker (#21054)
  • 8293de0 release: v7.2.0
  • 2833c55 fix(types): add undefined to optional properties for exactOptionalProperties ...
  • e3a6a83 chore(deps): update rolldown-related dependencies (#21047)
  • Additional commits viewable in compare view

Updates vitest from 4.0.16 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

... (truncated)

Commits
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • a7a61e7 chore: release v4.1.9 (#10598)
  • 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
  • 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
  • a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
  • e61f2dd chore: release v4.1.8
  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • a09d472 chore: release v4.1.7
  • a8fd24c chore: release v4.1.6
  • Additional commits viewable in compare view

Updates vitest from 4.0.16 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub

v4.1.9

🐞 Bug Fixes

View changes on GitHub

v4.1.8

   🐞 Bug Fixes

    View changes on GitHub

v4.1.7

   🐞 Bug Fixes

    View changes on GitHub

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

... (truncated)

Commits
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • a7a61e7 chore: release v4.1.9 (#10598)
  • 934b0f5 fix(pool): prevent test run hang on worker crash (#10543) [backport to v4] (#...
  • 7fb2965 fix(browser): wait for orchestrator readiness before resolving browser sessio...
  • a518019 fix: fix importOriginal with optimizer and query import [backport to v4] (#...
  • e61f2dd chore: release v4.1.8
  • e4067b3 fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
  • a09d472 chore: release v4.1.7
  • a8fd24c chore: release v4.1.6
  • Additional commits viewable in compare view

Updates brace-expansion from 2.1.0 to 2.1.4

Release notes

Sourced from brace-expansion's releases.

v2.1.1

  • Backport v5.0.6 change to v2 (#109) c3a817c

juliangruber/brace-expansion@v2.1.0...v2.1.1

Commits

Updates esbuild from 0.27.3 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

  • Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

    This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

    Thanks to @​dellalibera for reporting this issue.

  • Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

    The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

    Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

    Thanks to @​sondt99 for reporting this issue.

  • Avoid inlining using and await using declarations (#4482)

    Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

    // Original code
{
  using x = new Resource()
  x.activate()
}
// Old output (with --minify)
new Resource().activate();
// New output (with --minify)
{using e=new Resource;e.activate()}

  • Fix module evaluation when an error is thrown (#4461, #4467)

    If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

  • Fix some edge cases around the new operator (#4477)

    Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

    // Original code
new (foo()`bar`)()
new (foo()?.bar)()
// Old output
new foo()bar();
new (foo())?.bar();

... (truncated)

Commits

Updates postcss from 8.5.15 to 8.5.25

Release notes

Sourced from postcss's releases.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

Changelog

Sourced from postcss's changelog.

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

8.5.19

  • Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

  • Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

  • Fixed Maximum call stack size exceeded error.
  • Fixed Prototype hijacking for postcss.fromJSON().
  • Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

Commits
  • 08c989c Release 8.5.25 version
  • 24f6814 Fix 8.5.17 visitor regression
  • f2fa53f Add supply chain security requirement to PostCSS plugin guide
  • 10edf0b fix: return empty array for empty string in list.split (#2121)
  • 0ebe8ad Release 8.5.24 version
  • 73218c6 Update dependencies
  • Description has been truncated

    Note
    Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

imzyb and others added 30 commits April 25, 2026 21:45
@imzyb
fix: use QuanX wss obfs for vmess tls
1a607bf
@imzyb
fix: use QuanX positional hysteria2 syntax
46893cf
@imzyb
fix: use tls-host for QuanX hysteria2
f4b37be
@imzyb
fix: skip unsupported QuanX hysteria2 nodes
7a69ca7
@github-actions
Merge remote-tracking branch 'upstream/main'
f5a085e
@imzyb
fix: invalidate node cache after telegram imports
d18e9a0
@github-actions
Merge remote-tracking branch 'upstream/main'
1de3f1c
@imzyb
docs: improve fetch proxy tutorial
ef4b64b
@github-actions
Merge remote-tracking branch 'upstream/main'
6d04de4
@imzyb
fix: detect Yuetu client as Clash compatible
1e7c147
@imzyb
fix: preserve SSR nodes when renaming
e85eed7
@imzyb
fix: mirror upstream in fork sync workflow
ac7ceb0
@imzyb
chore: reduce fork sync schedule frequency
c237e44
@imzyb
fix: use Clash UA for clash subscription links
7b5ea91
@imzyb
fix: honor custom subscription user agent
a732663
@imzyb
fix: skip fork sync when workflow permission is missing
0a5559b
@imzyb
fix: forward custom UA through fetch proxy
446648e
@irol765
Merge branch 'imzyb:main' into main
0560fce
@imzyb
test: cover fetch proxy user agent forwarding
283c7f1
@irol765
fix(quanx): resolve subscription generation syntax and parsing errors
0ed26c7
@imzyb
docs: use Node.js fetch proxy for raw IP subscriptions
4efbbaa
@irol765
Merge branch 'imzyb:main' into fix/quanx-subscription
d4bb36c
@imzyb
Merge pull request imzyb#335 from irol765/fix/quanx-subscription
3f28b87 
Quantumult X 订阅更新失败分析与修复报告
@imzyb
fix: ensure valid mihomo and surge outputs
df4ba7d
@imzyb
fix: improve relay policy chaining outputs
92731a2
@imzyb
fix: simplify relay chain selection UX
62ff652
@imzyb
fix: remove relay landing selector
2344fc5
@imzyb
fix: gate mihomo relay chaining
c28bf63
@imzyb
fix: make relay fallback safe for clash templates
13c3516
@imzyb
fix: expose relay auto and manual exits
4a33d79
hermes-agent and others added 24 commits July 6, 2026 15:12
@hermes-agent
fix(imzyb#403): 为 sing-box Android 导出完整 tun 入站配置
aba865e
@hermes-agent
feat(imzyb#386): 支持自定义节点地区覆盖规则
f95190b
@hermes-agent
feat: add external management api mvp
3a49195
@hermes-agent
feat: add external api settings ui
92fdb74
@hermes-agent
docs: add external management api reference
c37da11
@hermes-agent
feat: add external subscription refresh operations
d20c4e7
@hermes-agent
feat: expand external api validation and refresh
485f7eb
@hermes-agent
docs: add external api usage guide
95abec6
@hermes-agent
docs: add external api doc links to readme
6963933
@hermes-agent
[verified] fix subscription conversion links
a3f1e02
@hermes-agent
fix: preserve Clash fields and update sing-box DNS
defac53
@hermes-agent
fix: use sing-box Shadowsocks plugin fields
5a5241b
@hermes-agent
feat: expand builtin AI routing
1510d83
@hermes-agent
fix: route grok domain to AI group
9367bd0
@codex
feat: parse handshake-timeout parameter for Hysteria2 nodes
7e9ac44
@imzyb
Merge pull request imzyb#425 from zhaxg/main
76809de 
feat: support handshake-timeout parameter for Hysteria2 nodes
@hermes-agent
fix(singbox): replace deprecated geoip route rule with rule_set for s…
e6d44eb 
…ing-box 1.12+

Sing-box 1.12.0 removed the  field in route rules. The
GEOIP,CN,DIRECT rule was being translated to
which causes sing-box 1.14 Android to fail on subscription import
with: 'geoip database is deprecated in sing-box 1.8.0 and removed
in sing-box 1.12.0'.

Fix: translate GEOIP to  for sing-box
format, and add the  remote rule source pointing to
SagerNet/sing-geoip rule-set. The generated config now uses
 with a remote binary  file, compatible
with sing-box 1.12+.

Fixes imzyb#424: sing-box 1.14 安卓端添加订阅报错
@hermes-agent
feat(settings): add default locale setting in basic settings
6e4f18e 
Add a 'Default display language' setting at the top of Basic
Settings page, persisted to backend storage. The setting value
(zh-CN or en-US) is applied on settings page load via setLocale(),
which also writes to localStorage for subsequent page visits.

Changes:
- default-settings.js: add defaultLocale: 'zh-CN'
- BasicSettings.vue: add language selector as first card
- useSettingsLogic.js: import setLocale, apply on load
- messages.js: add i18n keys for both locales
- Update test to include defaultLocale prop
EnvyBackyard EnvyBackyard
fix(rename): preserve regex capture groups
bd5bfbf
@imzyb
Merge pull request imzyb#431 from EnvyBackyard/fix/regex-capture-groups
38570dc 
fix(rename): preserve regex capture groups
@Ink-lotus
docs(dns): add custom DNS templates design spec and implementation plan
e19f211
@Ink-lotus
feat(dns): add custom DNS template library for built-in rendering
a71d203 
Provide reusable DNS template library (KV key misub_dns_templates_v1, API
/api/dns_templates) with per-client overrides for Clash/Sing-Box/Surge/Loon/
Quantumult X built-in generators. Global "3. DNS 配置" in the transform card
and per-profile three-way selection (default/global/template) resolve via
builtinOptions.customDns; empty falls back to built-in default, parse errors
silently retain defaults. WebDAV backup carries dnsTemplates for parity.
@Ink-lotus
fix(dns): harden template persistence and selection
6a364da
@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 10 u…
293f589 
…pdates

Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.5` | `3.4.12` |
| [js-yaml](https://github.com/nodeca/js-yaml) | `4.1.1` | `4.3.0` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.3` | `8.2.0` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.0.16` | `4.1.10` |
| [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.1.0` | `2.1.4` |
| [esbuild](https://github.com/evanw/esbuild) | `0.27.3` | `0.28.1` |
| [sharp](https://github.com/lovell/sharp) | `0.34.5` | `0.35.2` |



Updates `dompurify` from 3.4.5 to 3.4.12
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.5...3.4.12)

Updates `js-yaml` from 4.1.1 to 4.3.0
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](nodeca/js-yaml@4.1.1...4.3.0)

Updates `vite` from 7.3.3 to 8.2.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite)

Updates `vitest` from 4.0.16 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

Updates `vitest` from 4.0.16 to 4.1.10
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.10/packages/vitest)

Updates `brace-expansion` from 2.1.0 to 2.1.4
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](juliangruber/brace-expansion@v2.1.0...v2.1.4)

Updates `esbuild` from 0.27.3 to 0.28.1
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md)
- [Commits](evanw/esbuild@v0.27.3...v0.28.1)

Updates `postcss` from 8.5.15 to 8.5.25
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.15...8.5.25)

Updates `sharp` from 0.34.5 to 0.35.2
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.34.5...v0.35.2)

Updates `undici` from 7.24.8 to 7.28.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.24.8...v7.28.0)

Updates `ws` from 8.20.1 to 8.21.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.20.1...8.21.0)

---
updated-dependencies:
- dependency-name: dompurify
  dependency-version: 3.4.12
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: js-yaml
  dependency-version: 4.3.0
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-version: 8.2.0
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-version: 4.1.10
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: brace-expansion
  dependency-version: 2.1.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-version: 8.5.25
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: sharp
  dependency-version: 0.35.2
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-version: 7.28.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.21.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 4, 2026
@dependabot dependabot Bot mentioned this pull request Aug 4, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@imzyb @irol765 @hermes-agent @DiaMeoww @Sinemp @codex @Ink-lotus