Skip to content

build(deps-dev): bump the development group across 1 directory with 4 updates - #291

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-5c4cc8b84f
Closed

build(deps-dev): bump the development group across 1 directory with 4 updates#291
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-5c4cc8b84f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the development group with 4 updates in the / directory: lucide, markdown-it, pele and playwright.

Updates lucide from 1.56.0 to 1.61.0

Release notes

Sourced from lucide's releases.

Version 1.61.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.60.0...1.61.0

Version 1.60.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.59.0...1.60.0

Version 1.59.0

What's Changed

Full Changelog: lucide-icons/lucide@1.58.0...1.59.0

Version 1.58.0

What's Changed

... (truncated)

Commits

Updates markdown-it from 15.0.2 to 15.0.3

Changelog

Sourced from markdown-it's changelog.

[15.0.3] - 2026-10-16

Changed

  • Updated dependencies.

Fixed

  • Enforce the 999 Unicode code point limit for reference definition labels, partially addressing #1213.
  • Require whitespace before multiline reference titles.

Security

  • Fixed quadratic complexity when parsing multiline reference definitions.
  • Fixed quadratic complexity when parsing unclosed inline HTML comments, processing instructions, declarations and CDATA sections.
Commits

Updates pele from 1.6.0 to 1.10.0

Release notes

Sourced from pele's releases.

1.10.0

  • %% comments no longer remove the character before it, so set A%% note keeps A and A->>B:%% note keeps the :. This applies to Venn, sequence, XY chart, quadrant, gantt, journey and timeline diagrams. A line that worked only because a comment removed a stray : or , is now a syntax error. #64
  • title with nothing after it on its line sets no title, instead of taking the next line as the title and dropping it. This applies to Venn, sequence, gantt, C4, journey and timeline diagrams. #66
  • Error messages show entity codes as written, such as [#35](https://github.com/obsidianmd/pele/issues/35);x, instead of internal placeholders. Lines and columns count the source as written, including front matter, comments, directives and blank lines. #63 #67 #73
  • Sankey: a value that doesn't start with a number, such as abc, is a syntax error instead of an empty flow. 50% still reads as 50. #60
  • Sankey: entity codes in prefix and suffix are decoded in value labels, as in tooltips. #59
  • XY chart: explicit y bounds that both clamp to the same limit fall back to the data range instead of drawing NaN. #56
  • Radar: values near the largest double are drawn in proportion instead of at the center. #74
  • The edge-limit error now states only the limit. #52

1.9.1

  • Rendered SVG no longer contains U+FFFE, U+FFFF or unpaired surrogate halves, so it is always valid XML. #72
  • Style values that contain control characters, or other characters XML doesn't allow, are now ignored instead of written with those characters removed.
  • Links and images now strip U+FFFE, U+FFFF and unpaired surrogate halves before their scheme is checked, as they already did for control characters.
  • Internal links are checked against the note name as a browser reads it, and get no href if that check fails. Their href and data-href are unchanged otherwise.
  • Event modeling: long data, note and specification lines now wrap without splitting emoji.

1.9.0

  • Labels support more HTML tags: <sub> and <sup> for subscript and superscript, <code>, <kbd>, <samp> and <tt> in the monospace font, <u> and <ins> underlined, and <var>, <cite> and <dfn> in italics. #50 #27
  • Labels keep text that looks like a tag but isn't HTML, so List<T> no longer renders as List. #31
  • Labels wrap at zero-width spaces and soft hyphens (&shy;), and wrapped lines sit closer together. #44
  • Class diagrams wrap separate groups of classes into rows to fit maxWidth instead of shrinking. #23
  • Sankey links use a gradient from source to target color when the diagram has an idPrefix. Node names accept Unicode, and labels avoid neighboring columns and shrink in narrow or crowded charts. #9 #47
  • State diagrams use flowchart.curve for transitions, matching Mermaid. #21
  • C4 relation labels no longer cover the elements they connect, and only diagrams that start with a C4 keyword are detected as C4. #2 #22
  • Quadrant point labels keep clear of quadrant titles and the chart's edge. #38
  • mount() no longer causes "ResizeObserver loop" errors when a diagram is resized. #37
  • Added --pele-zoom-cursor to set the cursor on zoom buttons.

1.8.0

  • Added a math render option for typesetting $$...$$ labels. Pele doesn't include a typesetter, so hosts must supply a resolver that returns SVG, or MathML/HTML, and its size. Labels show the TeX source when no resolver is given. Math works in the same diagram types as Mermaid 12.1: flowchart, swimlane, sequence, state, class, ER, mindmap, kanban, block, requirement and use case. Exported types: MathResolver and MathMarkup. #36
  • Diagrams with subgraphs now have fewer edge crossings. Edges between groups, and edges from several groups into one node, are ordered using the layout of the whole drawing. #3
  • HTML bold and italic now continue across <br> line breaks, so <b>First<br/>Second</b> is bold on both lines. #39
  • Entity codes now accept HTML5 aliases such as #lcub; and #verbar;. #41
  • Each entity code is now decoded only once, so #amp;lt; renders as &lt;, matching Mermaid. #42
  • Sequence: a message to self with a label taller than its loop no longer overlaps the next message. #10
  • Timeline: in top-to-bottom timelines, the line from a period to its first event is now straight when the two boxes differ in height. #11

1.7.0

  • Added mermaidType to render() results, parse() models and PeleError that returns Mermaid's type such as flowchart-v2 for graph TD or classDiagram for classDiagram. #30
  • parse() now returns ParsedDiagramModel, a DiagramModel with mermaidType. render() still accepts any DiagramModel.
  • Chinese and Japanese labels now wrap between characters, so long labels no longer stretch diagrams. Closing punctuation stays on the line it follows. #16
Commits
  • 4eff76f Release: 1.10.0
  • 4226947 Tests: Cover TreeView box-drawing error positions after front matter
  • d7bf613 TreeView: Locate box-drawing errors in the source as written
  • 00ef295 Tests: Cover Usecase JSON errors after entity codes
  • d909c73 Usecase: Report JSON errors in the text as written
  • ba59e6b Tests: Cover Agentflow metadata error positions after a directive
  • 81922d6 Agentflow: Locate metadata errors in the source as written
  • 50d198f Errors: Record entity code edits only while locating an error
  • e7ae93c Errors: Show names in Radar, Venn and Pie errors as written
  • 489b2a0 Tests: Cover error positions after a brace with trailing blanks
  • Additional commits viewable in compare view

Updates playwright from 1.64.0 to 1.64.1

Release notes

Sourced from playwright's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)
Commits
  • cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
  • 866cbb8 chore: mark v1.64.1 (#43354)
  • 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
  • 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
  • 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps-dev): bump the development group across 1 directory with 4…
e4e0235 
… updates

Bumps the development group with 4 updates in the / directory: [lucide](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide), [markdown-it](https://github.com/markdown-it/markdown-it), [pele](https://github.com/obsidianmd/pele) and [playwright](https://github.com/microsoft/playwright).


Updates `lucide` from 1.56.0 to 1.61.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.61.0/packages/lucide)

Updates `markdown-it` from 15.0.2 to 15.0.3
- [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md)
- [Commits](markdown-it/markdown-it@15.0.2...15.0.3)

Updates `pele` from 1.6.0 to 1.10.0
- [Release notes](https://github.com/obsidianmd/pele/releases)
- [Commits](obsidianmd/pele@1.6.0...1.10.0)

Updates `playwright` from 1.64.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.64.0...v1.64.1)

---
updated-dependencies:
- dependency-name: lucide
  dependency-version: 1.61.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: markdown-it
  dependency-version: 15.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
- dependency-name: pele
  dependency-version: 1.10.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: playwright
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 27, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 27, 2026 18:54
@steipete steipete mentioned this pull request Oct 27, 2026
Merged
steipete added a commit that referenced this pull request Oct 27, 2026
@steipete @dependabot
build(deps): patch Markdown parser and refresh docs tooling (#292)
95f378c 
Patch both markdown-it denial-of-service advisories with 15.0.3 and refresh Carapace, icons, animation and browser tooling under the two-day cooldown. Consolidates #283 and #291. Generated docs remain untouched.

Proof: independent P3 review clean; 294 helper/browser and 138 translation tests covered; complete 15,541-page shell build and smoke passed on Linux; exact-head Docs Code CI, browser/Worker validation, CodeQL and workflow shell checks passed.

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@steipete

steipete commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

Thanks! This update landed in #292, including both markdown-it security fixes. Exact-head Docs Code CI, browser/Worker validation, CodeQL, workflow checks, the full remote shell build/smoke, and independent P3 review passed. Closing this superseded PR.

@steipete steipete closed this Oct 27, 2026
@dependabot @github

dependabot Bot commented on behalf of github Oct 27, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/development-5c4cc8b84f branch October 27, 2026 22:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete