Skip to content

chore (deps): bump the patch-updates group across 1 directory with 11 updates - #22

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/patch-updates-fd6522a685
Open

chore (deps): bump the patch-updates group across 1 directory with 11 updates#22
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/patch-updates-fd6522a685

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 14, 2026

Copy link
Copy Markdown

Bumps the patch-updates group with 11 updates in the / directory:

Package From To
bson 7.3.1 7.3.2
dompurify 3.4.12 3.4.13
highlight.js 11.11.1 11.11.2
kbpgp 2.1.17 2.1.18
moment-timezone 0.6.2 0.6.3
ngeohash 0.6.3 0.6.4
protobufjs 8.7.1 8.7.2
@codemirror/view 6.43.6 6.43.8
grunt 1.6.2 1.6.3
html-webpack-plugin 5.6.7 5.6.8
postcss 8.5.19 8.5.26

Updates bson from 7.3.1 to 7.3.2

Release notes

Sourced from bson's releases.

v7.3.2

7.3.2 (2026-07-31)

The MongoDB Node.js team is pleased to announce version 7.3.2 of the bson package!

Release Notes

calculateObjectSize() now returns accurate byte counts for Int32 and BSONSymbol

Previously, each Int32 or BSONSymbol value caused a 12-byte overcount.

calculateObjectSize() now yields proper size calculations on ES Map's

This release of js-bson fixes an issue where we were incorrectly considering ES Map objects inside calculateObjectSize. This issue did not impact serialization, just size calculation.

Fixed incorrect date boundary in relaxed EJSON

This release of js-bson fixes an issue where the date boundary for relaxed EJSON was incorrectly set to a date 5 hours after the maximum limit of 10,000 AD.

Fixed an issue with ObjectId initialization in Cloudflare Workers

This release of js-bson fixes an issue where we were making crypto calls during module initialization, which is forbidden by Cloudflare Workers and other environments.

Memory optimization via smaller ObjectIds

ObjectId now stores its 12 bytes as four inline integers instead of a Uint8Array, cutting per-ObjectId memory by about 63% (and roughly 45 to 47% across large result sets) with no serialization slowdown. Deep equality and cloning are preserved (assert.deepStrictEqual, and lodash isEqual / cloneDeep).

Thanks to @​spokodev for contributing their fixes! (NODE-7631 (#901), NODE-7645 (#917), NODE-7646 (#910))

Bug Fixes

  • NODE-7631: count Int32 and BSONSymbol in calculateObjectSize (#901) (7f948a6)
  • NODE-7645: use the first instant of year 10000 as the relaxed EJSON date bound (#917) (9272c9a)
  • NODE-7646: count ES Map entries in calculateObjectSize (#910) (8d28b12)
  • NODE-7667: remove early initialization from ObjectId (#916) (665286f)

Performance Improvements

  • NODE-6246: store ObjectId bytes as four packed integers (#893) (a84229c)

Documentation

We invite you to try the bson library immediately, and report any issues to the NODE project.

Changelog

Sourced from bson's changelog.

7.3.2 (2026-07-31)

Bug Fixes

  • NODE-7631: count Int32 and BSONSymbol in calculateObjectSize (#901) (7f948a6)
  • NODE-7645: use the first instant of year 10000 as the relaxed EJSON date bound (#917) (9272c9a)
  • NODE-7646: count ES Map entries in calculateObjectSize (#910) (8d28b12)
  • NODE-7667: remove early initialization from ObjectId (#916) (665286f)

Performance Improvements

  • NODE-6246: store ObjectId bytes as four packed integers (#893) (a84229c)
Commits
  • 9cd2e68 chore(main): release 7.3.2 (#902)
  • 9272c9a fix(NODE-7645): use the first instant of year 10000 as the relaxed EJSON date...
  • 8d28b12 fix(NODE-7646): count ES Map entries in calculateObjectSize (#910)
  • 665286f fix(NODE-7667): remove early initialization from ObjectId (#916)
  • 1fc57e4 chore(NODE-7681): allow git fetch for npm12 (#914)
  • 57b5bf0 chore: use bundled version of NPM (#913)
  • a84229c perf(NODE-6246): store ObjectId bytes as four packed integers (#893)
  • 7f948a6 fix(NODE-7631): count Int32 and BSONSymbol in calculateObjectSize (#901)
  • See full diff in compare view

Updates dompurify from 3.4.12 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

  • Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
  • Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
  • Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
  • Bumped several dependencies where possible
Commits

Updates highlight.js from 11.11.1 to 11.11.2

Release notes

Sourced from highlight.js's releases.

v11.11.2 - This Summer's Hottest Release

Happy belated Summer Solstice to all who celebrate. This is a maintenance release that includes all of the merged PRs through July 2025 (last year).

[!NOTE]

As you may have noticed, highlight.js has been inactive since last summer, through no one's fault; maintaining open source projects is time-consuming. I'll be doing my best to keep the lights on around here, but I'll need the community's help. If you are interested in helping review pull requests, contributing, or even becoming a maintainer, speak up in highlightjs/highlight.js#1678.

[!IMPORTANT]

The 11.11.2 Git tag was published on June 22, 2026, and the npm package was published on August 11, 2026. For any cautious onlookers, nothing malicious has happened. In December 2025, npm revoked all classic tokens for improved security. Since we haven't had a release since July 2025, I didn't notice that our release pipeline was broken because it uses a now-revoked token. Pull request #4427 was opened to fix our release pipeline, and it took some time to get things right. Version 11.11.2 was published to npm after the PR was merged and we had a successful run of the new release workflow.

If you see two 11.11.2 releases on your GitHub feed circa June 2026, this was an accident by a maintainer. A 11.11.2 tag was created prematurely on GitHub and caused a run failure during the release pipeline since all work to bump the release had not been completed. There was no version 11.11.2 that was accidentally published to npm or the CDNs; therefore, the Git tag has been recreated to point to f273f007f85e2096de41c42bf40b870dcb5a5a05.

Parser Engine:

  • fix illegal handling at end of input code [Josh Goebel][]

New Grammars:

  • added 3rd party Aiken grammar to SUPPORTED_LANGUAGES [Josh Marchand][]
  • added 3rd party VoltScript grammar to SUPPORTED_LANGUAGES [Chester Moses][]
  • added 3rd party Gleam grammar to SUPPORTED_LANGUAGES [Filip Hoffmann][]
  • added 3rd party Magik grammar to SUPPORTED_LANGUAGES [Sebastiaan Speck][]
  • added 3rd party Prisma grammar to SUPPORTED_LANGUAGES [SungHyun Kim][]
  • added 3rd party Bicep grammar to SUPPORTED_LANGUAGES [Anthony Martin][]
  • added 3rd party L4 grammar to SUPPORTED_LANGUAGES [Thomas Gorissen][]
  • added 3rd party Abc Notation grammar to SUPPORTED_LANGUAGES [NriotHrreion][]

Core Grammars:

  • fix(cpp) exclude keywords from function calls [Eisenwave][]
  • enh(csp) add missing directives / keywords from MDN (7 more) [Max Liashuk][]
  • enh(ada) add new parallel keyword, allow [] for Ada 2022 [Max Reznik][]
  • fix(javascript) correctly highlight 'for await' again [wolfgang42][]
  • fix(diff) fix unified diff hunk header regex to allow unpaired numbers [Chris Wilson][]
  • enh(php) support single line and hash comments in attributes, constructor and functions [Antoine Musso][]
  • fix(ex) adds support for ?' char literal and missing defguardp keyword [Kevin Bloch][]
  • enh(json) add json5 support [Kerry Shetline][]
  • fix(csharp) Support digit separators [te-ing][]
  • fix(css) unicode-range parsing, issue #4253 [Kerry Shetline][]

Documentation:

  • update link to Odin grammar to maintained version [Marian Pekár][]
  • fix type highlight deprecated message [Brandon Dong][]
  • fixed typo and incorrect git command [SungHyun Kim][]
  • fix CONTRIBUTING.md broken badge link [SungHyun Kim][]
  • alphabetized languages + upper-cased BASIC in SUPPORTED_LANGUAGES.md [Adam Lui][]

... (truncated)

Changelog

Sourced from highlight.js's changelog.

Version 11.11.2

Parser Engine:

  • fix illegal handling at end of input code Josh Goebel

New Grammars:

  • added 3rd party Aiken grammar to SUPPORTED_LANGUAGES [Josh Marchand][]
  • added 3rd party VoltScript grammar to SUPPORTED_LANGUAGES [Chester Moses][]
  • added 3rd party Gleam grammar to SUPPORTED_LANGUAGES [Filip Hoffmann][]
  • added 3rd party Magik grammar to SUPPORTED_LANGUAGES [Sebastiaan Speck][]
  • added 3rd party Prisma grammar to SUPPORTED_LANGUAGES [SungHyun Kim][]
  • added 3rd party Bicep grammar to SUPPORTED_LANGUAGES [Anthony Martin][]
  • added 3rd party L4 grammar to SUPPORTED_LANGUAGES [Thomas Gorissen][]
  • added 3rd party Abc Notation grammar to SUPPORTED_LANGUAGES [NriotHrreion][]

Core Grammars:

  • fix(cpp) exclude keywords from function calls Eisenwave
  • enh(csp) add missing directives / keywords from MDN (7 more) [Max Liashuk][]
  • enh(ada) add new parallel keyword, allow [] for Ada 2022 [Max Reznik][]
  • fix(javascript) correctly highlight 'for await' again [wolfgang42][]
  • fix(diff) fix unified diff hunk header regex to allow unpaired numbers [Chris Wilson][]
  • enh(php) support single line and hash comments in attributes, constructor and functions [Antoine Musso][]
  • fix(ex) adds support for ?' char literal and missing defguardp keyword [Kevin Bloch][]
  • enh(json) add json5 support [Kerry Shetline][]
  • fix(csharp) Support digit separators [te-ing][]
  • fix(css) unicode-range parsing, issue #4253 [Kerry Shetline][]

Documentation:

  • update link to Odin grammar to maintained version Marian Pekár
  • fix type highlight deprecated message Brandon Dong
  • fixed typo and incorrect git command [SungHyun Kim][]
  • fix CONTRIBUTING.md broken badge link [SungHyun Kim][]
  • alphabetized languages + upper-cased BASIC in SUPPORTED_LANGUAGES.md [Adam Lui][]
  • deduplicate JSON from SUPPORTED_LANGUAGES [Lukasz Czajczyk][]

Themes:

  • Fix: cybertopia themes render correctly in shadow DOM [hbgl][]
  • added "vs Dark " theme [Twineee1][]

CONTRIBUTORS

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for highlight.js since your current version.


Updates kbpgp from 2.1.17 to 2.1.18

Changelog

Sourced from kbpgp's changelog.

2.1.18 (2026-08-06)

  • Fix error path in bzip2 causing uncaught exceptions during Compressed packet processing.
Commits

Updates moment-timezone from 0.6.2 to 0.6.3

Release notes

Sourced from moment-timezone's releases.

Release 0.6.3

  • Updated data to IANA TZDB 2026c. #1148
Changelog

Sourced from moment-timezone's changelog.

0.6.3 2026-07-19

  • Updated data to IANA TZDB 2026c. #1148
Commits

Updates ngeohash from 0.6.3 to 0.6.4

Commits
  • 748bcd3 chore: bump version
  • 4802e61 chore: update tests
  • 88847b0 Merge pull request #46 from gaoflow/fix/odd-bitdepth-int-decode
  • faa7061 fix: correct integer geohash decode for odd bitDepth
  • 683b0fb Merge pull request #45 from lofimichael/patch-1
  • d99b34c Added clarification to geohash.bboxes
  • 5aa6e88 (fix) use dedicated browserify script
  • 972d918 Merge pull request #40 from ilancoulon/master
  • 87ca0f9 asserting numberOfChars for bboxes is not negative
  • 034d85b Throwing error when using bboxes with numberOfChars === 0
  • See full diff in compare view

Updates protobufjs from 8.7.1 to 8.7.2

Release notes

Sourced from protobufjs's releases.

protobufjs: v8.7.2

8.7.2 (2026-08-08)

Bug Fixes

  • Also use TextDecoder for loose UTF-8 decoding (#2408) (5851a3b)
  • Parse numeric defaults according to field type (#2402) (bb2d836)
  • Parse numeric descriptor defaults by field type (#2406) (09f24ec)
  • preserve first enum alias from JSON descriptors (#2389) (8304739)
  • Preserve negative zero in codegen formatters (#2403) (92ddc9b)
  • Preserve non-finite defaults in toObject (#2393) (a38b925)

Performance Improvements

  • Optimize writer allocs and packed varint reads (#2405) (64cc8f1)
Changelog

Sourced from protobufjs's changelog.

8.7.2 (2026-08-08)

Bug Fixes

  • Also use TextDecoder for loose UTF-8 decoding (#2408) (5851a3b)
  • Parse numeric defaults according to field type (#2402) (bb2d836)
  • Parse numeric descriptor defaults by field type (#2406) (09f24ec)
  • preserve first enum alias from JSON descriptors (#2389) (8304739)
  • Preserve negative zero in codegen formatters (#2403) (92ddc9b)
  • Preserve non-finite defaults in toObject (#2393) (a38b925)

Performance Improvements

  • Optimize writer allocs and packed varint reads (#2405) (64cc8f1)
Commits
  • 91cdef0 chore: release master (#2391)
  • c362fe3 chore(deps-dev): Bump shell-quote from 1.8.4 to 1.10.0 (#2399)
  • 7999776 chore(deps-dev): Bump browserify-sign from 4.2.1 to 4.2.6 (#2398)
  • 549aa7a chore(deps): Bump linkify-it from 5.0.1 to 5.0.2 in /cli (#2397)
  • 5851a3b fix: Also use TextDecoder for loose UTF-8 decoding (#2408)
  • aca5b83 docs: Clarify README
  • adce445 chore(deps): update dev dependencies (#2395)
  • a38b925 fix: Preserve non-finite defaults in toObject (#2393)
  • 09f24ec fix: Parse numeric descriptor defaults by field type (#2406)
  • 64cc8f1 perf: Optimize writer allocs and packed varint reads (#2405)
  • Additional commits viewable in compare view

Updates @codemirror/view from 6.43.6 to 6.43.8

Commits

Updates grunt from 1.6.2 to 1.6.3

Changelog

Sourced from grunt's changelog.

v1.6.3

Commits

Updates html-webpack-plugin from 5.6.7 to 5.6.8

Changelog

Sourced from html-webpack-plugin's changelog.

5.6.8 (2026-07-25)

Bug Fixes

  • extend @​rspack/core peer dependency range (#1893) (8057b14)
Commits

Updates postcss from 8.5.19 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

Changelog

Sourced from postcss's changelog.

8.5.26

  • Fixed list.split() regression (by @​lazerg).
  • Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

  • Fixed 8.5.17 visitor regression.
  • Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

  • Preserve the BOM after the processing (by @​hdimer).

8.5.23

  • Do not load source map without opts.from for security reasons.

8.5.22

8.5.21

8.5.20

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore (deps): bump the patch-updates group across 1 directory with 11…
40188aa 
… updates

Bumps the patch-updates group with 11 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [bson](https://github.com/mongodb/js-bson) | `7.3.1` | `7.3.2` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.12` | `3.4.13` |
| [highlight.js](https://github.com/highlightjs/highlight.js) | `11.11.1` | `11.11.2` |
| [kbpgp](https://github.com/keybase/kbpgp) | `2.1.17` | `2.1.18` |
| [moment-timezone](https://github.com/moment/moment-timezone) | `0.6.2` | `0.6.3` |
| [ngeohash](https://github.com/sunng87/node-geohash) | `0.6.3` | `0.6.4` |
| [protobufjs](https://github.com/protobufjs/protobuf.js) | `8.7.1` | `8.7.2` |
| [@codemirror/view](https://github.com/codemirror/view) | `6.43.6` | `6.43.8` |
| [grunt](https://github.com/gruntjs/grunt) | `1.6.2` | `1.6.3` |
| [html-webpack-plugin](https://github.com/jantimon/html-webpack-plugin) | `5.6.7` | `5.6.8` |
| [postcss](https://github.com/postcss/postcss) | `8.5.19` | `8.5.26` |



Updates `bson` from 7.3.1 to 7.3.2
- [Release notes](https://github.com/mongodb/js-bson/releases)
- [Changelog](https://github.com/mongodb/js-bson/blob/main/HISTORY.md)
- [Commits](mongodb/js-bson@v7.3.1...v7.3.2)

Updates `dompurify` from 3.4.12 to 3.4.13
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.12...3.4.13)

Updates `highlight.js` from 11.11.1 to 11.11.2
- [Release notes](https://github.com/highlightjs/highlight.js/releases)
- [Changelog](https://github.com/highlightjs/highlight.js/blob/main/CHANGES.md)
- [Commits](highlightjs/highlight.js@11.11.1...11.11.2)

Updates `kbpgp` from 2.1.17 to 2.1.18
- [Changelog](https://github.com/keybase/kbpgp/blob/master/CHANGELOG.md)
- [Commits](keybase/kbpgp@v2.1.17...v2.1.18)

Updates `moment-timezone` from 0.6.2 to 0.6.3
- [Release notes](https://github.com/moment/moment-timezone/releases)
- [Changelog](https://github.com/moment/moment-timezone/blob/develop/changelog.md)
- [Commits](moment/moment-timezone@0.6.2...0.6.3)

Updates `ngeohash` from 0.6.3 to 0.6.4
- [Commits](sunng87/node-geohash@0.6.3...v0.6.4)

Updates `protobufjs` from 8.7.1 to 8.7.2
- [Release notes](https://github.com/protobufjs/protobuf.js/releases)
- [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md)
- [Commits](protobufjs/protobuf.js@protobufjs-v8.7.1...protobufjs-v8.7.2)

Updates `@codemirror/view` from 6.43.6 to 6.43.8
- [Changelog](https://github.com/codemirror/view/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codemirror/view/commits)

Updates `grunt` from 1.6.2 to 1.6.3
- [Release notes](https://github.com/gruntjs/grunt/releases)
- [Changelog](https://github.com/gruntjs/grunt/blob/main/CHANGELOG.md)
- [Commits](gruntjs/grunt@v1.6.2...v1.6.3)

Updates `html-webpack-plugin` from 5.6.7 to 5.6.8
- [Release notes](https://github.com/jantimon/html-webpack-plugin/releases)
- [Changelog](https://github.com/jantimon/html-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](jantimon/html-webpack-plugin@v5.6.7...v5.6.8)

Updates `postcss` from 8.5.19 to 8.5.26
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.19...8.5.26)

---
updated-dependencies:
- dependency-name: bson
  dependency-version: 7.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: dompurify
  dependency-version: 3.4.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: highlight.js
  dependency-version: 11.11.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: kbpgp
  dependency-version: 2.1.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: moment-timezone
  dependency-version: 0.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: ngeohash
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: protobufjs
  dependency-version: 8.7.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: "@codemirror/view"
  dependency-version: 6.43.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: grunt
  dependency-version: 1.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: html-webpack-plugin
  dependency-version: 5.6.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
- dependency-name: postcss
  dependency-version: 8.5.26
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants