Skip to content

build(deps): bump the npm-versions group across 1 directory with 4 updates - #144

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-versions-cce758fb3c
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-versions-cce758fb3c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the npm-versions group with 4 updates in the / directory: handlebars, @types/node, sourcey and vitest.

Updates handlebars from 4.7.9 to 4.7.10

Release notes

Sourced from handlebars's releases.

v4.7.10

  • security: Sanitize the source map URL when minifying - f37c599
  • security: Iterate lazily in #each and strip whitespace in linear time - 812c226
  • security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
  • security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
  • security: Only compile partials that are template strings - c28ee7a
  • security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
  • security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
  • Clarify that --root does not restrict filesystem access - 0fcf25c
  • Bump minimist to ^1.2.8 - ea8ed82
  • Fix Ruby component publishing documentation - d069c1c
  • Fix Composer component definition - 6714e07

Compatibility notes:

  • {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.10 - October 5th, 2026

  • security: Sanitize the source map URL when minifying - f37c599
  • security: Iterate lazily in #each and strip whitespace in linear time - 812c226
  • security: Escape <!-- and <script in precompiled output - 609d1b1 GHSA-xw65-4hp5-5hc7
  • security: Don't trust special properties on context data - ceec388 GHSA-p8wg-vrv2-v86f
  • security: Only compile partials that are template strings - c28ee7a
  • security: Only dispatch known node types in the Compiler and Visitor - 7d501a5
  • security: Validate AST values in the compiler instead of the parser - 703fdcc GHSA-8r5x-fm3f-whwj
  • Clarify that --root does not restrict filesystem access - 0fcf25c
  • Bump minimist to ^1.2.8 - ea8ed82
  • Fix Ruby component publishing documentation - d069c1c
  • Fix Composer component definition - 6714e07

Compatibility notes:

  • {{#each}} iterates iterables such as Map, Set and generators lazily, like for...of, instead of copying them into an array first. Values added to the iterable while the block renders are now visited too.

Commits

Commits
  • 45ce152 v4.7.10
  • e47b236 Update release notes
  • f37c599 Sanitize the source map URL when minifying
  • 812c226 Iterate lazily in #each and strip whitespace in linear time
  • 609d1b1 Escape <!-- and <script in precompiled output
  • ceec388 Don't trust special properties on context data
  • c28ee7a Only compile partials that are template strings
  • 7d501a5 Only dispatch known node types in the Compiler and Visitor
  • 703fdcc Validate AST values in the compiler instead of the parser
  • 0fcf25c Clarify that --root does not restrict filesystem access
  • Additional commits viewable in compare view

Updates @types/node from 26.6.3 to 26.6.5

Commits

Updates sourcey from 3.8.2 to 3.9.2

Release notes

Sourced from sourcey's releases.

v3.9.2

Added

  • A site's own components live in components/, beside its config, each file named for the component it is. An HTML file is drawn as written, with what a page puts inside it where it writes <slot />, and a .tsx or .jsx file is a Preact component, drawn with Sourcey's own Preact so the site installs none. A file with a built-in's name replaces the built-in. Head, Banner, ContentEnd and BodyEnd add to every page, for analytics and the like, and Header and Footer replace the theme's. componentsDir names another folder, or false for none.
  • A not-found page marks its root <html data-sourcey-page="not-found">, so a site's analytics can count missing pages.
  • feedback: true ends each documentation, reference and changelog page by asking "Was this page helpful?" in the page's language. An answer shows its note and dispatches a sourcey:feedback event, { value, page }, which the site's own script sends where it keeps feedback; Sourcey sends nothing. A site can name its own title, ratings, values, icons and notes, and frontmatter feedback: false leaves it off a page. sourcey migrate mkdocs carries Material's feedback question and hide: [feedback].
  • Each build reports a link to a path on the site that no page, file or redirect answers, and brokenLinks: "error" has sourcey build stop on one before writing anything; the dev server reports them either way. Docusaurus's onBrokenLinks: "throw", its default, and MkDocs's strict: true migrate to "error".
  • A github navbar link with stats: true shows its repository's latest release, stars and forks, read from GitHub when the site builds, with GITHUB_TOKEN when set. When GitHub does not answer, the build warns and draws the plain link.
  • navigation.breadcrumbs: true opens each documentation and reference page with the way to it: the site's home, its tab and each section around it, linked where a section has a page of its own. sourcey migrate turns it on where Material's navigation.path or Docusaurus's breadcrumbs drew one.
  • lastUpdated: true dates each documentation page and changelog by its file's last commit, beside "Edit this page" in the page's language, and in the sitemap. A shallow checkout stops the build rather than dating every page by its one commit. sourcey migrate carries MkDocs's git revision date plugins, Docusaurus's showLastUpdateTime and Starlight's lastUpdated.
  • Git graphs (gitGraph) are drawn, as Mermaid reads and lays them out: a lane for each branch, merges, reverts, highlights, cherry-picks and tags, left to right, top to bottom or bottom to top. Sourcey had shown their source. They come with @sourcey/beautiful-mermaid 1.1.6.
  • Footnotes, written as GitHub writes them ([^label] and [^label]: note), are numbered in reading order across the page and drawn at its end with a link back. They had shown as text. sourcey migrate mkdocs writes Material's annotations as footnotes.
  • sourcey migrate mkdocs carries site_author, Material's Google or custom analytics and extra_javascript into the site's components, and sourcey migrate docusaurus carries headTags, stylesheets, scripts and Google Analytics. Both had listed them as not carried over.

Changed

  • "Edit this page" opens the page's file on GitHub, which anyone can read, with GitHub's editor one click away for whoever can edit. It had opened the editor itself, which sends a visitor who is not signed in, and every crawler, to GitHub's sign-in page. API source links are built the same way.

Fixed

  • A page of the site's own (layout: page) keeps its text to a reading measure, while HTML its author draws keeps the page's width. Its lines had run the window's width.
  • A diagram's frontmatter title, such as a pie chart's, is drawn as its title, as Mermaid draws it. It had been left out.
  • A component written in a sentence draws what it holds as part of the sentence, where a site's component had drawn it as a paragraph inside the sentence.
  • A site's component named for a built-in, such as Note or Card, is drawn and exported as the site's own wherever it appears. A page's Markdown copy had read it as the built-in it replaced, and stopped the build.
  • In the dark theme, a diagram's "Diagram source" and the note under a diagram that could not be drawn are lighter, and keep AA contrast on the darkest backgrounds a site sets.
  • The Nix flake reads its dependencies from package-lock.json, so it builds at every commit. It had pinned their hash by hand, which broke whenever a dependency moved.

v3.9.1

Added

  • navbar.links takes a menu, { type: "menu", label, links }: links under one label that open below it in the header and stand under the label in the mobile drawer. NavbarLink, NavbarMenu and NavbarEntry are exported for configurations written in parts.
  • A page's frontmatter editUrl names its own edit address, for a page edited outside the site's repository, and editUrl: false leaves the link off.
  • A code block names its fence's language on its element, as data-language, so a site's stylesheet can label each block by its language.
  • sourcey migrate docusaurus carries more of a site across. Each of a docs instance's sidebars becomes a named section of the navigation, open while the reader is in it, where several had run together. A navbar dropdown becomes a menu and a doc item a link, custom_edit_url becomes editUrl, @theme/CodeBlock becomes a fenced code block and @theme/ThemedImage a figure with its light and dark pictures, and useBaseUrl() with static arguments keeps its address. Each document is read through the site's own markdown.preprocessor, as Docusaurus reads it.
  • A migration writes what a page draws from static data as the content it draws: a list made with .map(), the page's own components and helpers, conditional JSX and export const values, whether written in the page or imported from the project. Anything that reads something else still stops the migration.

Changed

  • Mermaid diagrams are read by Mermaid's own parser and laid out as Mermaid lays them out, by @sourcey/beautiful-mermaid: flowcharts, state, class, ER, sequence, Gantt, pie and mindmap diagrams. A page carries one drawing for both themes, in the page's colours and set in Inter, and a drawing wider than the column shrinks to fit down to 80% of its size, then scrolls.
  • Sourcey runs on Node.js 22.22.2 or later, 24.15 or later, or 26, as the DOM its diagrams are read in (jsdom 30) does. It had run on 22.19. Its dependencies are current, among them Mermaid 12, Preact 11 and satori 0.63.
  • An author's HTML keeps more of its inline style: type, margins and padding, borders, shadows, flex and grid tracks, overflow, object fit and placement within the content, with colours as rgb(), hsl(), color-mix(), gradients or theme variables. A style that fixes an element to the window, raises it above the page's layers, pulls it back with a negative offset or loads anything is still removed. A responsive video had shown as a small frame of the browser's default size.
  • A component or directive written in a list item's text, indented up to three spaces, stays in the item with what follows it, as CommonMark and MDX read it. It had ended the list.

Fixed

  • Text read from Markdown for search, descriptions, changelog entries and exports holds the characters a reader sees. 3.9.0 wrote quotes and ampersands in a changelog's text as &[#39](https://github.com/sourcey/sourcey/issues/39);, &quot; and &amp;, and indexed a page without a description by the first 200 characters of its HTML, cut mid-word. A release's Markdown export keeps its entries' inline code and links.
  • A field of the type it sits in links to that type. A fresh install of 3.9.0, which resolves json-schema-ref-parser 16.0.5, had read it as any.
  • A component written inside an author's HTML block, such as an icon in a <div>, renders there, where it had shown as a stray number.
  • A site's component draws the nodes its resolve returned, as renderHtml arranges them. Text written for readers alone had shown on the page, and what the page wrote inside the component had been left out.
  • Two tabs that share a label stay two tabs, where the header had shown the first twice and the second's pages had no sidebar. The sidebar opens every section on the way to a section's own page, and previous and next read a section's own page before the pages it holds and lead from a page listed again in another section to its neighbours there.

... (truncated)

Changelog

Sourced from sourcey's changelog.

3.9.2 - 2026-10-26

Added

  • A site's own components live in components/, beside its config, each file named for the component it is. An HTML file is drawn as written, with what a page puts inside it where it writes <slot />, and a .tsx or .jsx file is a Preact component, drawn with Sourcey's own Preact so the site installs none. A file with a built-in's name replaces the built-in. Head, Banner, ContentEnd and BodyEnd add to every page, for analytics and the like, and Header and Footer replace the theme's. componentsDir names another folder, or false for none.
  • A not-found page marks its root <html data-sourcey-page="not-found">, so a site's analytics can count missing pages.
  • feedback: true ends each documentation, reference and changelog page by asking "Was this page helpful?" in the page's language. An answer shows its note and dispatches a sourcey:feedback event, { value, page }, which the site's own script sends where it keeps feedback; Sourcey sends nothing. A site can name its own title, ratings, values, icons and notes, and frontmatter feedback: false leaves it off a page. sourcey migrate mkdocs carries Material's feedback question and hide: [feedback].
  • Each build reports a link to a path on the site that no page, file or redirect answers, and brokenLinks: "error" has sourcey build stop on one before writing anything; the dev server reports them either way. Docusaurus's onBrokenLinks: "throw", its default, and MkDocs's strict: true migrate to "error".
  • A github navbar link with stats: true shows its repository's latest release, stars and forks, read from GitHub when the site builds, with GITHUB_TOKEN when set. When GitHub does not answer, the build warns and draws the plain link.
  • navigation.breadcrumbs: true opens each documentation and reference page with the way to it: the site's home, its tab and each section around it, linked where a section has a page of its own. sourcey migrate turns it on where Material's navigation.path or Docusaurus's breadcrumbs drew one.
  • lastUpdated: true dates each documentation page and changelog by its file's last commit, beside "Edit this page" in the page's language, and in the sitemap. A shallow checkout stops the build rather than dating every page by its one commit. sourcey migrate carries MkDocs's git revision date plugins, Docusaurus's showLastUpdateTime and Starlight's lastUpdated.
  • Git graphs (gitGraph) are drawn, as Mermaid reads and lays them out: a lane for each branch, merges, reverts, highlights, cherry-picks and tags, left to right, top to bottom or bottom to top. Sourcey had shown their source. They come with @sourcey/beautiful-mermaid 1.1.6.
  • Footnotes, written as GitHub writes them ([^label] and [^label]: note), are numbered in reading order across the page and drawn at its end with a link back. They had shown as text. sourcey migrate mkdocs writes Material's annotations as footnotes.
  • sourcey migrate mkdocs carries site_author, Material's Google or custom analytics and extra_javascript into the site's components, and sourcey migrate docusaurus carries headTags, stylesheets, scripts and Google Analytics. Both had listed them as not carried over.

Changed

  • "Edit this page" opens the page's file on GitHub, which anyone can read, with GitHub's editor one click away for whoever can edit. It had opened the editor itself, which sends a visitor who is not signed in, and every crawler, to GitHub's sign-in page. API source links are built the same way.

Fixed

  • A page of the site's own (layout: page) keeps its text to a reading measure, while HTML its author draws keeps the page's width. Its lines had run the window's width.
  • A diagram's frontmatter title, such as a pie chart's, is drawn as its title, as Mermaid draws it. It had been left out.
  • A component written in a sentence draws what it holds as part of the sentence, where a site's component had drawn it as a paragraph inside the sentence.
  • A site's component named for a built-in, such as Note or Card, is drawn and exported as the site's own wherever it appears. A page's Markdown copy had read it as the built-in it replaced, and stopped the build.
  • In the dark theme, a diagram's "Diagram source" and the note under a diagram that could not be drawn are lighter, and keep AA contrast on the darkest backgrounds a site sets.
  • The Nix flake reads its dependencies from package-lock.json, so it builds at every commit. It had pinned their hash by hand, which broke whenever a dependency moved.

3.9.1 - 2026-10-25

Added

  • navbar.links takes a menu, { type: "menu", label, links }: links under one label that open below it in the header and stand under the label in the mobile drawer. NavbarLink, NavbarMenu and NavbarEntry are exported for configurations written in parts.
  • A page's frontmatter editUrl names its own edit address, for a page edited outside the site's repository, and editUrl: false leaves the link off.
  • A code block names its fence's language on its element, as data-language, so a site's stylesheet can label each block by its language.
  • sourcey migrate docusaurus carries more of a site across. Each of a docs instance's sidebars becomes a named section of the navigation, open while the reader is in it, where several had run together. A navbar dropdown becomes a menu and a doc item a link, custom_edit_url becomes editUrl, @theme/CodeBlock becomes a fenced code block and @theme/ThemedImage a figure with its light and dark pictures, and useBaseUrl() with static arguments keeps its address. Each document is read through the site's own markdown.preprocessor, as Docusaurus reads it.
  • A migration writes what a page draws from static data as the content it draws: a list made with .map(), the page's own components and helpers, conditional JSX and export const values, whether written in the page or imported from the project. Anything that reads something else still stops the migration.

Changed

  • Mermaid diagrams are read by Mermaid's own parser and laid out as Mermaid lays them out, by @sourcey/beautiful-mermaid: flowcharts, state, class, ER, sequence, Gantt, pie and mindmap diagrams. A page carries one drawing for both themes, in the page's colours and set in Inter, and a drawing wider than the column shrinks to fit down to 80% of its size, then scrolls.
  • Sourcey runs on Node.js 22.22.2 or later, 24.15 or later, or 26, as the DOM its diagrams are read in (jsdom 30) does. It had run on 22.19. Its dependencies are current, among them Mermaid 12, Preact 11 and satori 0.63.
  • An author's HTML keeps more of its inline style: type, margins and padding, borders, shadows, flex and grid tracks, overflow, object fit and placement within the content, with colours as rgb(), hsl(), color-mix(), gradients or theme variables. A style that fixes an element to the window, raises it above the page's layers, pulls it back with a negative offset or loads anything is still removed. A responsive video had shown as a small frame of the browser's default size.
  • A component or directive written in a list item's text, indented up to three spaces, stays in the item with what follows it, as CommonMark and MDX read it. It had ended the list.

Fixed

  • Text read from Markdown for search, descriptions, changelog entries and exports holds the characters a reader sees. 3.9.0 wrote quotes and ampersands in a changelog's text as &[#39](https://github.com/sourcey/sourcey/issues/39);, &quot; and &amp;, and indexed a page without a description by the first 200 characters of its HTML, cut mid-word. A release's Markdown export keeps its entries' inline code and links.
  • A field of the type it sits in links to that type. A fresh install of 3.9.0, which resolves json-schema-ref-parser 16.0.5, had read it as any.
  • A component written inside an author's HTML block, such as an icon in a <div>, renders there, where it had shown as a stray number.

... (truncated)

Commits
  • c64b1d8 fix(nix): read the flake's dependencies from the lockfile
  • 344c41a fix(a11y): name a GitHub link by the figures it shows, and lighten dark diagr...
  • 4aff7ea fix(diagrams): draw a git graph the same on every build
  • 0b047bb fix(dates): write a UTC commit date one way whatever git built it
  • 5d4035b chore(release): prepare 3.9.2
  • d0df92c feat(diagrams): draw git graphs with @​sourcey/beautiful-mermaid 1.1.5
  • 1780977 fix(pages): keep a site page's text to a reading measure, and drop a breadcru...
  • 3e84fa6 perf: read git history and GitHub's numbers while pages load, and draw what e...
  • 8597190 fix(diagrams): title a diagram by its frontmatter, as Mermaid does
  • 8efdacb feat(links): report links to nothing the site publishes, and stop the build o...
  • Additional commits viewable in compare view

Updates vitest from 5.0.2 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 28, 2026
…dates

Bumps the npm-versions group with 4 updates in the / directory: [handlebars](https://github.com/handlebars-lang/handlebars.js), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [sourcey](https://github.com/sourcey/sourcey) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `handlebars` from 4.7.9 to 4.7.10
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.10/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.7.9...v4.7.10)

Updates `@types/node` from 26.6.3 to 26.6.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `sourcey` from 3.8.2 to 3.9.2
- [Release notes](https://github.com/sourcey/sourcey/releases)
- [Changelog](https://github.com/sourcey/sourcey/blob/main/CHANGELOG.md)
- [Commits](sourcey/sourcey@v3.8.2...v3.9.2)

Updates `vitest` from 5.0.2 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.6.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-versions
- dependency-name: handlebars
  dependency-version: 4.7.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-versions
- dependency-name: sourcey
  dependency-version: 3.9.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-versions
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-versions
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/npm-versions-cce758fb3c branch from c4aa849 to 0aa9911 Compare October 29, 2026 08:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants