Bump the npm_and_yarn group across 1 directory with 6 updates by dependabot[bot] · Pull Request #303 · timothydodd/MailVoid

dependabot · 2026-10-11T04:35:33Z

Bumps the npm_and_yarn group with 6 updates in the /src/MailVoidWeb directory:

Package	From	To
@angular/router	`22.1.1`	`22.2.0`
@modelcontextprotocol/sdk	`1.29.0`	`removed`
@vitest/mocker	`4.1.10`	`5.0.3`
brace-expansion	`5.0.9`	`5.0.12`
fast-uri	`3.1.5`	`3.1.8`
source-map-js	`1.2.1`	`1.2.2`

Updates @angular/router from 22.1.1 to 22.2.0

Release notes

Sourced from @angular/router's releases.

22.2.0

compiler

Commit Description

allow template to access private props

do not encapsulate nested selectors if parent contains ::ng-deep

scope nested CSS rules

compiler-cli

Commit Description

add strictUnclaimedEventNames option to catch misspelled output bindings

scope type-checking of keyed defer blocks

deduplicate deferred imports across multiple blocks

core

Commit Description

add ErrorBoundary programmatic APIs (#70463)

add utility for testing directives

allow reading Injector from a view or content query

support annotations in WebMCP tool declarations

cancel leave animations in nested views during list reordering

support function and signal bindings in animate.enter and animate.leave

update FakeNavigation to match WHATWG HTML spec

forms

Commit Description

allow permanent hidden fields in signal forms

hard-code readOnlyHint and untrustedContentHint for WebMCP implicit signal forms

language-service

Commit Description

add support for @boundary blocks (#70463)

router

Commit Description

add containsTree as public API

allow throwing RedirectCommand to trigger redirects

expose router resources in public API

stabilize auto cleanup injectors feature

determine blocking state solely by resource loading status

expose reload method on ActivatedRoute resources

maintain frozen state on rollback until resource loading completes

mark router_resource module-level symbols as side-effect free

VSCode Extension: 22.2.0

fix(vscode-extension): Support inlay hint in inline templates (c11920da48)

fix(vscode-extension): provide folding ranges for templates with interpolated strings (5c927fba0d)

fix(vscode-extension): handle template literals when detecting supported decorator fields (f2cf65a898)

feat(language-service): add support for @boundary blocks (#70463) (f4a5650ed9)

... (truncated)

Commits

52c33bc refactor(router): clean up route resource implementation and test helpers
5af6121 fix(router): avoid dense elements allocation for numeric URL keys
954f6af test(router): Fix broken test
6f5a4a0 fix(router): expose reload method on ActivatedRoute resources
51f056f docs(router): clarify route resource parameters
f829afa docs(router): name UrlHandlingStrategy.extract in the Navigation docs
f825c9b docs: fix API links that point at missing member anchors
2dcdf9a fix(router): mark router_resource module-level symbols as side-effect free
2c6c67b fix(router): maintain frozen state on rollback until resource loading completes
4380e68 docs(router): update scroll restoration example
Additional commits viewable in compare view

Removes @modelcontextprotocol/sdk

Updates @vitest/mocker from 4.1.10 to 5.0.3

Release notes

Sourced from @vitest/mocker's releases.

v5.0.3

   🐞 Bug Fixes

Isolate result.status between repeats runs - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)

Don't print an interceptor warning in browser mode - by @sheremet-va in vitest-dev/vitest#11377 (15cc0)

Don't retry when test.fails expectedly failed - by @hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)

Scope cache key generators to projects - by @ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)

browser:

Delay server listen until tests start running - by @sheremet-va in vitest-dev/vitest#11366 (7d8ed)

Check mock path boundaries - by @saryn17, Ryosei Sato and @sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)

Keep config of browser-consumed environments - by @kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)

Ignore page crash while cancelling - by @sheremet-va in vitest-dev/vitest#11386 (7c367)

toMatchScreenshot uses wrong reference on retried tests - by @macarie in vitest-dev/vitest#11393 (c22ab)

cache:

Revalidate imports of cached modules - by @sheremet-va in vitest-dev/vitest#11381 (38f98)

deps:

Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE - by @AriPerkkio in vitest-dev/vitest#11403 (f6c9a)

expect:

Pass current equality testers to expect.extend asymmetric matchers - by @hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)

jsdom:

Support Blob on jsdom 30.1 - by @sheremet-va in vitest-dev/vitest#11379 (6c49b)

pool:

Preserve unique pool ids when groupOrder is set - by @mtorp in vitest-dev/vitest#11392 (50312)

ui:

Split-pane handle overlapping iframe - by @macarie in vitest-dev/vitest#11221 (f91db)

vitest:

Remove root temp dir on close - by @abhinav-phi in vitest-dev/vitest#11248 (7c711)

vm:

Do not optimize deps from index.html - by @ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)

Don't reuse scripts across vite environments - by @MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

    View changes on GitHub

v5.0.2

   🐞 Bug Fixes

Bind process in case global is overwritten - by @AriPerkkio in vitest-dev/vitest#11343 (0b792)

detect-async-leaks:

Ignore process.stdio handles - by @AriPerkkio in vitest-dev/vitest#11333 (0fd6b)

expect:

Fix toMatchObject with asymmetric matchers - by @ShreeBohara, Claude Opus 5, @hi-ogawa, Hiroshi Ogawa and Codex (GPT-5) in vitest-dev/vitest#11100 (42523)

jsdom:

Fix Request with Blob body on jsdom 28+ - by @harshit-d3v in vitest-dev/vitest#11295 (d1c3e)

reporter:

agent to respect --silent - by @Raj4478 and @AriPerkkio in vitest-dev/vitest#11271 (5b95e)

reporters:

Handle concurrent createReport calls - by @7rulnik in vitest-dev/vitest#11278 (e8e55)

hanging-process to use ESM entrypoint - by @AriPerkkio in vitest-dev/vitest#11316 (4e91e)

spy:

Fix stack overflow when spying Set.prototype.add - by @fengmk2 in vitest-dev/vitest#11299 (a0a93)

... (truncated)

Commits

33cadea chore: release v5.0.3 (#11409)
15cc006 fix: don't print an interceptor warning in browser mode (#11377)
1c3888b fix(browser): check mock path boundaries (fix #11361) (#11362)
a029e76 chore: migrate to oxc (#11367)
428e2e5 chore: release v5.0.2 (#11357)
03630a5 chore: release v5.0.1 (#11275)
f441c6f chore: release v5.0.0 (#11130)
897f51f chore: release v5.0.0-rc.4 (#11107)
7db80dc chore: release v5.0.0-rc.3 (#11089)
732df2c fix(deps): update all non-major dependencies (#11043)
Additional commits viewable in compare view

Updates brace-expansion from 5.0.9 to 5.0.12

Commits

f341015 5.0.12
33a5ef1 Merge commit from fork
8247927 5.0.11
935d78f Merge commit from fork
df7682f 5.0.10
1ade9de npm run format
6735c94 Merge commit from fork
4e70465 chore: ensure prettier formatting (#154)
fd7a5e3 Bump ip-address from 10.2.0 to 10.4.0 (#152)
1790143 Bump uuid and @tapjs/processinfo (#120)
See full diff in compare view

Updates fast-uri from 3.1.5 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()

GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references

GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding

GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization

GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits

ead3ab7 Bumped v3.1.8
c88b59e fix: normalize decoded reg-name case
412e40a Bumped v3.1.7
9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
6f970b2 Bumped v3.1.6
d941579 fix: never run IDN canonicalization on bracketed IP literals
c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
37f3417 Merge commit from fork
607bfbe Merge commit from fork
Additional commits viewable in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @xfournet

Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

Reported by @waydeshi in #76. A fix was also proposed by @aniebiet in #78.

Commits

0a1d334 1.2.2
4c6fa26 Update changelog
cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 6 updates in the /src/MailVoidWeb directory: | Package | From | To | | --- | --- | --- | | [@angular/router](https://github.com/angular/angular/tree/HEAD/packages/router) | `22.1.1` | `22.2.0` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `removed` | | [@vitest/mocker](https://github.com/vitest-dev/vitest/tree/HEAD/packages/mocker) | `4.1.10` | `5.0.3` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.9` | `5.0.12` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.5` | `3.1.8` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | Updates `@angular/router` from 22.1.1 to 22.2.0 - [Release notes](https://github.com/angular/angular/releases) - [Commits](https://github.com/angular/angular/commits/v22.2.0/packages/router) Removes `@modelcontextprotocol/sdk` Updates `@vitest/mocker` from 4.1.10 to 5.0.3 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.3/packages/mocker) Updates `brace-expansion` from 5.0.9 to 5.0.12 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.9...v5.0.12) Updates `fast-uri` from 3.1.5 to 3.1.8 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.5...v3.1.8) Updates `source-map-js` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: "@angular/router" dependency-version: 22.2.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@modelcontextprotocol/sdk" dependency-version: dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@vitest/mocker" dependency-version: 5.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.8 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-11T18:34:43Z

Looks like these dependencies are no longer updatable, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 11, 2026

dependabot Bot closed this Oct 11, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/src/MailVoidWeb/npm_and_yarn-6aab2ff44f branch October 11, 2026 18:34

Navigation Menu

Repository navigation

Bump the npm_and_yarn group across 1 directory with 6 updates - #303

Bump the npm_and_yarn group across 1 directory with 6 updates#303
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/MailVoidWeb/npm_and_yarn-6aab2ff44f

dependabot Bot commented on behalf of github Oct 11, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Commit	Description
	allow template to access private props
	do not encapsulate nested selectors if parent contains ::ng-deep
	scope nested CSS rules

Commit	Description
	add strictUnclaimedEventNames option to catch misspelled output bindings
	scope type-checking of keyed defer blocks
	deduplicate deferred imports across multiple blocks

Commit	Description
	add ErrorBoundary programmatic APIs (#70463)
	add utility for testing directives
	allow reading `Injector` from a view or content query
	support annotations in WebMCP tool declarations
	cancel leave animations in nested views during list reordering
	support function and signal bindings in animate.enter and animate.leave
	update FakeNavigation to match WHATWG HTML spec

Commit	Description
	allow permanent hidden fields in signal forms
	hard-code `readOnlyHint` and `untrustedContentHint` for WebMCP implicit signal forms

Commit	Description
	add containsTree as public API
	allow throwing RedirectCommand to trigger redirects
	expose router resources in public API
	stabilize auto cleanup injectors feature
	determine blocking state solely by resource loading status
	expose reload method on ActivatedRoute resources
	maintain frozen state on rollback until resource loading completes
	mark router_resource module-level symbols as side-effect free

Conversation

dependabot Bot commented on behalf of github Oct 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

22.2.0

compiler

compiler-cli

core

forms

language-service

router

VSCode Extension: 22.2.0

v5.0.3

🐞 Bug Fixes

View changes on GitHub

v5.0.2

🐞 Bug Fixes

v3.1.8

⚠️ Security Warning

v3.1.7

⚠️ Security Warning

v3.1.6

⚠️ Security Warning

v1.2.2

1.2.2

Uh oh!

dependabot Bot commented on behalf of github Oct 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 11, 2026 •

edited

Loading