[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: sanitize-html and serialize-javascript.

Updates sanitize-html from 2.17.7 to 2.18.1

Changelog

Sourced from sanitize-html's changelog.

2.18.1 (2026-10-14)

Changes

• Remove the deepmerge dependency, which was used only to combine tag-specific and * (all tags) entries in allowedClasses and allowedStyles. That is now done by a few lines of code within sanitize-html.

  This is not a fix for a vulnerability in sanitize-html. Security scanners such as Snyk now report CVE-2026-93753 in deepmerge, which can affect applications that merge untrusted objects, such as parsed JSON request bodies. sanitize-html only ever merged the developer's own configuration, never anything taken from the HTML being sanitized, so it was not exploitable through sanitize-html. Since we needed only a small part of what deepmerge does, we removed the dependency so that these reports no longer appear for sanitize-html users.

Security

• Since 2.18.0, the fallback markup of a discarded <iframe> was re-sanitized by a recursive call with no limit, one level per nested unclosed <iframe>. A few kilobytes of crafted input could throw RangeError: Maximum call stack size exceeded with the default options, and the nestingLimit option was not enforced across the fallback because each nested call started counting from zero. The fallback of a discarded <iframe> is still sanitized and kept, but only up to eight nested <iframe> elements (deeper fallback is escaped as text, as before 2.18.0), and the current nesting depth now carries into the nested call so nestingLimit applies to the whole output. Only 2.18.0 was affected, and the exception is thrown synchronously, so applications that catch errors from sanitizeHtml only lost the affected request (CWE-674, GHSA-c9rx-x947-fp3h).

  Thanks to hkmj19, JohnBeckley, and amikhailovstiltsoft for reporting the vulnerability.

2.18.0 (2026-09-30)

Adds

• Added a logger option: pass any console-shaped object, with debug, info, warn and error methods, and sanitize-html's own diagnostics are delivered to it rather than to the console, so an application with a logging pipeline of its own can route them. Missing methods, and no option at all, fall back to the console. Those messages also lost their decorative line breaks and warning icon, so each is now a single line of text; their wording is otherwise unchanged.

Fixes

• allowedSchemesByTag is now applied to srcset and imagesrcset URLs. Previously the per-tag lookup used the attribute name instead of the tag name, so these attributes always fell back to the global allowedSchemes and ignored a tag-specific scheme allowlist. Thanks to spokodev for the fix.
• Starting in version 2.17.6, sanitize-html began escaping any markup preserved inside a disallowed iframe tag, which was a change in behavior due to an upstream change in htmlparser2. This fix ensures such "fallback markup" is preserved without escaping, but also fully sanitized according to the same rules as the original input. Thanks to sumitjhacodes for the fix.

Security

• When meta was allowed together with its http-equiv and content attributes, the destination URL of a <meta http-equiv="refresh" content="0;url=..."> was never checked against allowedSchemes, because it is embedded in content rather than being an attribute of its own. So javascript:, data: and other disallowed destinations passed through. The refresh URL is now extracted the way browsers do it, allowing for the different spellings, separators, quoting and letter case of url=, and checked against allowedSchemes (or allowedSchemesByTag.meta). If it is rejected, or the content cannot be parsed as a refresh, the content attribute is removed. content on other meta elements is unchanged. The default configuration does not allow meta and was not affected (CWE-79, CWE-601, GHSA-cv27-6wvh-8x7j).

  Thanks to adrbogacz for reporting the vulnerability.

• When noscript is listed in nonTextTags, the discarded region could end too early. Browsers with scripting enabled treat <noscript> content as raw text up to the first </noscript>, but the underlying parser treats it as markup, so an end tag for an enclosing element inside <noscript> closed it implicitly and the rest of its content was emitted as ordinary sanitized markup. The discard region now continues until the point where a browser would end the <noscript> element, while implied closes of other nonTextTags such as <option> behave as before (CWE-79, CWE-436, GHSA-x3q4-9hxx-gx8m).

  Thanks to joaquiniglesiaslug for reporting the vulnerability.

• The check that drops SVG animation elements (animate, animateColor, animateMotion, animateTransform, set) when they retarget a URL attribute such as href compared the full tag name, so a namespace-prefixed spelling like svg:animate was not recognized when such tags were allowed (for example with allowedTags: false). In XML serializations such as XHTML or standalone SVG, the prefixed element is a real animation element and could retarget a link to a javascript: URL after sanitization. The element and attributeName are now matched by their local names, ignoring any prefix (CWE-79, CWE-184, GHSA-374f-7chj-9948).

  Thanks to Kai Aizen (SnailSploit) for reporting the vulnerability.

Commits

• a48dd9f Latest release q4 m1 2026: changelog, package.json (#5667)
• 06e4b37 Latest reconciliation q4 m1 2026 (#5664)
• 9500b8b Latest reconciliation Q3 2026 (#5635)
• See full diff in compare view

Updates serialize-javascript from 7.0.7 to 7.1.4

Release notes

Sourced from serialize-javascript's releases.

v7.1.4

What's Changed

• Fix methods containing nested functions and arrows by @​Shubham-Padkonde in yahoo/serialize-javascript#231
• docs: add SECURITY.md by @​redonkulus in yahoo/serialize-javascript#237
• release: v7.1.4 by @​redonkulus in yahoo/serialize-javascript#238

Note on method serialization

Concise methods ({ m() {} }), including async, generator and computed-key methods, are now serialized correctly when their bodies contain a nested arrow function or function declaration. Previously these were emitted unchanged, producing invalid output that failed to deserialize (#118). Class expressions continue to be emitted as-is.

Reporting security issues

This repo now has a security policy. Please report vulnerabilities privately through GitHub's private vulnerability reporting rather than public issues.

Full Changelog: yahoo/serialize-javascript@v7.1.3...v7.1.4

v7.1.3

See: GHSA-m5mm-p8h7-m29v

What's Changed

• fix: escape </script at the end of a serialized function body by @​redonkulus in yahoo/serialize-javascript#235
• Fix serialization of Dates with expanded ISO years by @​Shubham-Padkonde in yahoo/serialize-javascript#232
• fix: ignore functions without mutating input objects by @​Shubham-Padkonde in yahoo/serialize-javascript#233
• release: v7.1.3 by @​redonkulus in yahoo/serialize-javascript#236

Note on ignoreFunction

With ignoreFunction: true, function values are now omitted the same way JSON.stringify omits them, without deleting them from the input object. Functions inside arrays are emitted as null (previously this produced Array.prototype.slice.call(...) output).

New Contributors

• @​Shubham-Padkonde made their first contribution in yahoo/serialize-javascript#232

Full Changelog: yahoo/serialize-javascript@v7.1.2...v7.1.3

v7.1.2

See: GHSA-gfhx-hw2g-v5hg

v7.1.1

What's Changed

• fix: fix XSS bypass via split </script payload across function bodies by @​okuryu in yahoo/serialize-javascript#226
• release: v7.1.1 by @​okuryu in yahoo/serialize-javascript#227

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

v7.1.0

What's Changed

• feat: add Node.js 26 to test matrix by @​okuryu in yahoo/serialize-javascript#224
• release: v7.1.0 by @​okuryu in yahoo/serialize-javascript#225

... (truncated)

Commits

• 05c5ceb release: v7.1.4 (#238)
• fdb853d Fix methods containing nested functions and arrows (#231)
• f7dfeae docs: add SECURITY.md pointing to private vulnerability reporting (#237)
• 4d36b82 release: v7.1.3 (#236)
• 45e5397 fix: ignore functions without mutating input objects (#233)
• e978a1b fix: serialize Dates with expanded ISO years (#232)
• 2864b3c fix: escape </script at the end of a serialized function body (#235)
• 6a73fa1 release: v7.1.2
• 2bdbaaf Merge commit from fork
• 8c8caa7 release: v7.1.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: lichtblick-suite/lichtblick
• Branch: develop
• File: .coderabbit.yaml
• Commit: c852328
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: ded6f991-7810-4361-9923-aee30dfab19d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud