Bump the npm_and_yarn group across 2 directories with 3 updates by dependabot[bot] · Pull Request #1358 · lichtblick-suite/lichtblick

dependabot · 2026-10-01T09:03:59Z

Bumps the npm_and_yarn group with 3 updates in the / directory: dompurify, moment and brace-expansion.
Bumps the npm_and_yarn group with 2 updates in the /packages/suite-base directory: dompurify and moment.

Updates dompurify from 3.4.11 to 3.4.16

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

Fixed a problem with IN_PLACE node removal when working with hooks, thanks @manus-pi

Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @h-t-m

Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @ssi02014

Migrated from rollup to rolldown because performance, thanks @ssi02014

Bumped several dependencies where possible

DOMPurify 3.4.15

Added better clobbering hardening when XML content is involved, thanks @gnyselcuk

Added several smaller hardening and edge-case improvements, thanks @leechristensen

Bumped several dependencies where possible

DOMPurify 3.4.14

Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @AlirezaRouhbakhsh

Fixed a couple of edge cases with mixed document contexts, thanks @fishjojo1

Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @Jaybhade

Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation

Updated the documentation in several spots, README, wiki, etc., thanks @Akokonunes

Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

Fixed an issue with hook removal during IN_PLACE sanitization, thanks @koyokr

Fixed an issue with hooks potentially bypassing the clone guard, thanks @AkshayjainG

Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @AkshayjainG

Bumped several dependencies where possible

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

Commits

b9b9d80 release: 3.4.16 (#1636)
1d7460c release: 3.4.15 (#1609)
4e6fe24 release: 3.4.14 (#1587)
3067f77 release: 3.4.13 (#1562)
a9ca1e5 release: 3.4.12 (#1537)
See full diff in compare view

Updates moment from 2.30.1 to 2.31.0

Release notes

Sourced from moment's releases.

2.31.0

Released Sep 14, 2026

Security fixes

Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

#6376 Prevent object prototype properties from being used as format tokens

#6386 Normalize lazy-loaded locale names

#6404 Fix parsing issue with eHHmm format

#6433 Ignore non-Moment arguments in min and max

#6434 Fix inherited lowercase long date formats

#6436 Reset locale parsing caches after updates

#6437 Fix weekday mismatch when the format only has part of a date

#6442 Fix locale('__proto__') corrupting the global locale

#6443 Avoid Object.assign in duration.humanize

#6446 Validate range when parsing a time zone offset

#6447 Include metadata in all-locales bundle

#6448 Apply postformat to locale relative time methods

#6450 Add stack traces to conditional deprecation warnings

New features

#6451 Add internal date-default hook for Moment Timezone

New locales

#6000: Pashto ('ps')

#6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

#5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time

#6197 Indonesian ('id'): Correct the abbreviation for August

#6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats

#6289 Swedish ('sv'): Correct the abbreviation for Thursday

#6306 Catalan ('ca'): Use typographic apostrophes in relative time

#6347 Swahili ('sw'): Correct the spelling of hour in calendar output

#6360 Ukrainian ('uk'): Use ISO week numbering

#6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names

#6371 Hungarian ('hu'): Preserve numeric values in relative seconds

#6391 Swahili ('sw'): Fix weekday and relative-time grammar

#6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots

#6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting

#6410 Polish ('pl'): Use genitive month names in dotted day formats

Changelog

Sourced from moment's changelog.

2.31.0

Released Sep 14, 2026

Security fixes

Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

#6376 Prevent object prototype properties from being used as format tokens

#6386 Normalize lazy-loaded locale names

#6404 Fix parsing issue with eHHmm format

#6433 Ignore non-Moment arguments in min and max

#6434 Fix inherited lowercase long date formats

#6436 Reset locale parsing caches after updates

#6437 Fix weekday mismatch when the format only has part of a date

#6442 Fix locale('__proto__') corrupting the global locale

#6443 Avoid Object.assign in duration.humanize

#6446 Validate range when parsing a time zone offset

#6447 Include metadata in all-locales bundle

#6448 Apply postformat to locale relative time methods

#6450 Add stack traces to conditional deprecation warnings

New features

#6451 Add internal date-default hook for Moment Timezone

New locales

#6000: Pashto ('ps')

#6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

#5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time

#6197 Indonesian ('id'): Correct the abbreviation for August

#6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats

#6289 Swedish ('sv'): Correct the abbreviation for Thursday

#6306 Catalan ('ca'): Use typographic apostrophes in relative time

#6347 Swahili ('sw'): Correct the spelling of hour in calendar output

#6360 Ukrainian ('uk'): Use ISO week numbering

#6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names

#6371 Hungarian ('hu'): Preserve numeric values in relative seconds

#6391 Swahili ('sw'): Fix weekday and relative-time grammar

#6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots

#6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting

#6410 Polish ('pl'): Use genitive month names in dotted day formats

Commits

15b45d4 [pkg] Build 2.31.0 (#6452)
631cd81 [pkg] Update changelog for upcoming release (#6394)
6caff9e Merge commit from fork
710703b [feature] Add internal date-default hook for Moment Timezone (#6451)
863ed94 [bugfix] Add stack traces to conditional deprecation warnings (#6450)
2c7abe1 [bugfix] Apply postformat to locale relative time methods (#6448)
9c45ac3 [bugfix] Include metadata in all-locales bundle (#6447)
f6eefc5 [bugfix] Validate timezone offset range (#6446)
136b441 [bugfix] Avoid Object.assign in duration.humanize (#6443)
0d10504 [bugfix] Fix locale('proto') corrupting the global locale (#6442)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for moment since your current version.

Updates brace-expansion from 1.1.18 to 1.1.21

Commits

8e81e18 1.1.21
ffdfa3e Merge commit from fork
c6513ad 1.1.20
1efee7c Merge commit from fork
a34340a 1.1.19
0bcbfc0 Merge commit from fork
See full diff in compare view

Updates dompurify from 3.4.13 to 3.4.16

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

Fixed a problem with IN_PLACE node removal when working with hooks, thanks @manus-pi

Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @h-t-m

Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @ssi02014

Migrated from rollup to rolldown because performance, thanks @ssi02014

Bumped several dependencies where possible

DOMPurify 3.4.15

Added better clobbering hardening when XML content is involved, thanks @gnyselcuk

Added several smaller hardening and edge-case improvements, thanks @leechristensen

Bumped several dependencies where possible

DOMPurify 3.4.14

Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @AlirezaRouhbakhsh

Fixed a couple of edge cases with mixed document contexts, thanks @fishjojo1

Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @Jaybhade

Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation

Updated the documentation in several spots, README, wiki, etc., thanks @Akokonunes

Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

Fixed an issue with hook removal during IN_PLACE sanitization, thanks @koyokr

Fixed an issue with hooks potentially bypassing the clone guard, thanks @AkshayjainG

Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @AkshayjainG

Bumped several dependencies where possible

DOMPurify 3.4.12

Fixed an issue where a hook would not get called for custom elements, thanks @Rikuxx0

Hardened the handling of hooks removing elements, @mkrause-bee360

Added support for a few new SVG attributes, thanks @cbn-falias & @Develop-KIM

Hardened the handling of declarative partial updates

Updated the documentation is several spots, README, wiki, etc.

Bumped several dependencies where possible

Commits

b9b9d80 release: 3.4.16 (#1636)
1d7460c release: 3.4.15 (#1609)
4e6fe24 release: 3.4.14 (#1587)
3067f77 release: 3.4.13 (#1562)
a9ca1e5 release: 3.4.12 (#1537)
See full diff in compare view

Updates moment from 2.30.1 to 2.31.0

Release notes

Sourced from moment's releases.

2.31.0

Released Sep 14, 2026

Security fixes

Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

#6376 Prevent object prototype properties from being used as format tokens

#6386 Normalize lazy-loaded locale names

#6404 Fix parsing issue with eHHmm format

#6433 Ignore non-Moment arguments in min and max

#6434 Fix inherited lowercase long date formats

#6436 Reset locale parsing caches after updates

#6437 Fix weekday mismatch when the format only has part of a date

#6442 Fix locale('__proto__') corrupting the global locale

#6443 Avoid Object.assign in duration.humanize

#6446 Validate range when parsing a time zone offset

#6447 Include metadata in all-locales bundle

#6448 Apply postformat to locale relative time methods

#6450 Add stack traces to conditional deprecation warnings

New features

#6451 Add internal date-default hook for Moment Timezone

New locales

#6000: Pashto ('ps')

#6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

#5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time

#6197 Indonesian ('id'): Correct the abbreviation for August

#6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats

#6289 Swedish ('sv'): Correct the abbreviation for Thursday

#6306 Catalan ('ca'): Use typographic apostrophes in relative time

#6347 Swahili ('sw'): Correct the spelling of hour in calendar output

#6360 Ukrainian ('uk'): Use ISO week numbering

#6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names

#6371 Hungarian ('hu'): Preserve numeric values in relative seconds

#6391 Swahili ('sw'): Fix weekday and relative-time grammar

#6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots

#6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting

#6410 Polish ('pl'): Use genitive month names in dotted day formats

Changelog

Sourced from moment's changelog.

2.31.0

Released Sep 14, 2026

Security fixes

Fix CVE-2026-17495 (GHSA-4p3w-j4w9-5jqw)

Bug fixes

#6376 Prevent object prototype properties from being used as format tokens

#6386 Normalize lazy-loaded locale names

#6404 Fix parsing issue with eHHmm format

#6433 Ignore non-Moment arguments in min and max

#6434 Fix inherited lowercase long date formats

#6436 Reset locale parsing caches after updates

#6437 Fix weekday mismatch when the format only has part of a date

#6442 Fix locale('__proto__') corrupting the global locale

#6443 Avoid Object.assign in duration.humanize

#6446 Validate range when parsing a time zone offset

#6447 Include metadata in all-locales bundle

#6448 Apply postformat to locale relative time methods

#6450 Add stack traces to conditional deprecation warnings

New features

#6451 Add internal date-default hook for Moment Timezone

New locales

#6000: Pashto ('ps')

#6278, #6379: Amharic (Ethiopia) ('am-et')

Updates to existing locales

#5404 Portuguese (Brazil) ('pt-br'): Fix wrong plural usage for time

#6197 Indonesian ('id'): Correct the abbreviation for August

#6217 Georgian ('ka') and Dutch (Belgium) ('nl-be'): Correct L date formats

#6289 Swedish ('sv'): Correct the abbreviation for Thursday

#6306 Catalan ('ca'): Use typographic apostrophes in relative time

#6347 Swahili ('sw'): Correct the spelling of hour in calendar output

#6360 Ukrainian ('uk'): Use ISO week numbering

#6370 Ukrainian ('uk'): Use U+02BC apostrophes in Friday names

#6371 Hungarian ('hu'): Preserve numeric values in relative seconds

#6391 Swahili ('sw'): Fix weekday and relative-time grammar

#6396 German ('de', 'de-at', 'de-ch'): Parse short months without trailing dots

#6409 Uzbek ('uz', 'uz-latn'): Fix past relative-time formatting

#6410 Polish ('pl'): Use genitive month names in dotted day formats

Commits

15b45d4 [pkg] Build 2.31.0 (#6452)
631cd81 [pkg] Update changelog for upcoming release (#6394)
6caff9e Merge commit from fork
710703b [feature] Add internal date-default hook for Moment Timezone (#6451)
863ed94 [bugfix] Add stack traces to conditional deprecation warnings (#6450)
2c7abe1 [bugfix] Apply postformat to locale relative time methods (#6448)
9c45ac3 [bugfix] Include metadata in all-locales bundle (#6447)
f6eefc5 [bugfix] Validate timezone offset range (#6446)
136b441 [bugfix] Avoid Object.assign in duration.humanize (#6443)
0d10504 [bugfix] Fix locale('proto') corrupting the global locale (#6442)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for moment since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 3 updates in the / directory: [dompurify](https://github.com/cure53/DOMPurify), [moment](https://github.com/moment/moment) and [brace-expansion](https://github.com/juliangruber/brace-expansion). Bumps the npm_and_yarn group with 2 updates in the /packages/suite-base directory: [dompurify](https://github.com/cure53/DOMPurify) and [moment](https://github.com/moment/moment). Updates `dompurify` from 3.4.11 to 3.4.16 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.11...3.4.16) Updates `moment` from 2.30.1 to 2.31.0 - [Release notes](https://github.com/moment/moment/releases) - [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md) - [Commits](moment/moment@2.30.1...2.31.0) Updates `brace-expansion` from 1.1.18 to 1.1.21 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.18...v1.1.21) Updates `dompurify` from 3.4.13 to 3.4.16 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.11...3.4.16) Updates `moment` from 2.30.1 to 2.31.0 - [Release notes](https://github.com/moment/moment/releases) - [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md) - [Commits](moment/moment@2.30.1...2.31.0) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.4.16 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: moment dependency-version: 2.31.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.21 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.16 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: moment dependency-version: 2.31.0 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-10-01T09:04:08Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: lichtblick-suite/lichtblick/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 2a609824-968e-411e-a94a-829505a85b27

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

lichtblick-bot · 2026-10-01T09:09:07Z

@dependabot squash and merge

sonarqubecloud · 2026-10-01T09:19:02Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 1, 2026

dependabot Bot mentioned this pull request Oct 1, 2026

Bump the npm_and_yarn group across 2 directories with 2 updates #1357

Closed

[dependabot skip] Fix yarn.lock

63cbb7a

lichtblick-bot dismissed their stale review via 63cbb7a October 1, 2026 09:09

lichtblick-bot previously approved these changes Oct 1, 2026

View reviewed changes

gabriela-almeida-ctw approved these changes Oct 13, 2026

View reviewed changes

gabriela-almeida-ctw merged commit ed49b59 into develop Oct 13, 2026
18 of 19 checks passed

gabriela-almeida-ctw deleted the dependabot/npm_and_yarn/npm_and_yarn-08fbf1af37 branch October 13, 2026 14:33

gabriela-almeida-ctw mentioned this pull request Oct 22, 2026

Release/minor #1373

Merged

2 of 4 tasks

Navigation Menu

Repository navigation

Bump the npm_and_yarn group across 2 directories with 3 updates - #1358

Bump the npm_and_yarn group across 2 directories with 3 updates#1358
gabriela-almeida-ctw merged 2 commits into
developfrom
dependabot/npm_and_yarn/npm_and_yarn-08fbf1af37

dependabot Bot commented on behalf of github Oct 1, 2026

Uh oh!

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading

Review skipped

Uh oh!

lichtblick-bot commented Oct 1, 2026

Uh oh!

sonarqubecloud Bot commented Oct 1, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot Bot commented on behalf of github Oct 1, 2026

DOMPurify 3.4.16

DOMPurify 3.4.15

DOMPurify 3.4.14

DOMPurify 3.4.13

DOMPurify 3.4.12

2.31.0

Security fixes

Bug fixes

New features

New locales

Updates to existing locales

2.31.0

Security fixes

Bug fixes

New features

New locales

Updates to existing locales

DOMPurify 3.4.16

DOMPurify 3.4.15

DOMPurify 3.4.14

DOMPurify 3.4.13

DOMPurify 3.4.12

2.31.0

Security fixes

Bug fixes

New features

New locales

Updates to existing locales

2.31.0

Security fixes

Bug fixes

New features

New locales

Updates to existing locales

Uh oh!

coderabbitai Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

lichtblick-bot commented Oct 1, 2026

Uh oh!

sonarqubecloud Bot commented Oct 1, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading