chore(deps): bump the npm_and_yarn group across 3 directories with 3 updates by dependabot[bot] · Pull Request #5832 · microsoft/BotFramework-WebChat

dependabot · 2026-05-18T19:04:42Z

Bumps the npm_and_yarn group with 1 update in the / directory: markdown-it.
Bumps the npm_and_yarn group with 1 update in the /packages/component directory: markdown-it.
Bumps the npm_and_yarn group with 1 update in the /packages/embed directory: @babel/runtime.

Updates markdown-it from 13.0.2 to 14.1.1

Changelog

Sourced from markdown-it's changelog.

[14.1.1] - 2026-01-11

Security

Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @ltduc147 for report.

[14.1.0] - 2024-03-19

Changed

Updated CM spec compatibility to 0.31.2, #1009.

Fixed

Fixed quadratic complexity when parsing references, #996.

Fixed quadratic output size with pathological user input in tables, #1000.

[14.0.0] - 2023-12-08

Changed

Drop ancient browsers support (use .fromCodePoint and other features).

Rewrite to ESM (including all plugins/deps). CJS fallback still available. No signatures changed, except markdown-it-emoji plugin.

Dropped dist/ folder from repo, build on package publish.

Set punicode.js as external dependency.

Fixed

Html tokens inside img alt are now rendered as their original text, #896.

Hardbreaks inside img alt are now rendered as newlines.

Commits

b4a9b65 14.1.1 released
4b4bbca Fixed perf regression in linkify-it wrapper
d2782d8 Add supplementary example-driven documentation (#1092)
0fe7ccb 14.1.0 released
a367c44 Fix typo in comments of text.mjs (#1015)
7ad8179 add changelog
5e90063 simplify logic in scanDelims
d7ce5ec Merge pull request #1009 from notriddle/spec-0.31.2
0bfc57d Update spec to 0.31.2
cd24778 Update to comply with spec 0.31.2
Additional commits viewable in compare view

Updates markdown-it from 13.0.2 to 14.1.1

Changelog

Sourced from markdown-it's changelog.

[14.1.1] - 2026-01-11

Security

Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @ltduc147 for report.

[14.1.0] - 2024-03-19

Changed

Updated CM spec compatibility to 0.31.2, #1009.

Fixed

Fixed quadratic complexity when parsing references, #996.

Fixed quadratic output size with pathological user input in tables, #1000.

[14.0.0] - 2023-12-08

Changed

Drop ancient browsers support (use .fromCodePoint and other features).

Rewrite to ESM (including all plugins/deps). CJS fallback still available. No signatures changed, except markdown-it-emoji plugin.

Dropped dist/ folder from repo, build on package publish.

Set punicode.js as external dependency.

Fixed

Html tokens inside img alt are now rendered as their original text, #896.

Hardbreaks inside img alt are now rendered as newlines.

Commits

b4a9b65 14.1.1 released
4b4bbca Fixed perf regression in linkify-it wrapper
d2782d8 Add supplementary example-driven documentation (#1092)
0fe7ccb 14.1.0 released
a367c44 Fix typo in comments of text.mjs (#1015)
7ad8179 add changelog
5e90063 simplify logic in scanDelims
d7ce5ec Merge pull request #1009 from notriddle/spec-0.31.2
0bfc57d Update spec to 0.31.2
cd24778 Update to comply with spec 0.31.2
Additional commits viewable in compare view

Updates markdown-it from 13.0.2 to 14.1.1

Changelog

Sourced from markdown-it's changelog.

[14.1.1] - 2026-01-11

Security

Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @ltduc147 for report.

[14.1.0] - 2024-03-19

Changed

Updated CM spec compatibility to 0.31.2, #1009.

Fixed

Fixed quadratic complexity when parsing references, #996.

Fixed quadratic output size with pathological user input in tables, #1000.

[14.0.0] - 2023-12-08

Changed

Drop ancient browsers support (use .fromCodePoint and other features).

Rewrite to ESM (including all plugins/deps). CJS fallback still available. No signatures changed, except markdown-it-emoji plugin.

Dropped dist/ folder from repo, build on package publish.

Set punicode.js as external dependency.

Fixed

Html tokens inside img alt are now rendered as their original text, #896.

Hardbreaks inside img alt are now rendered as newlines.

Commits

b4a9b65 14.1.1 released
4b4bbca Fixed perf regression in linkify-it wrapper
d2782d8 Add supplementary example-driven documentation (#1092)
0fe7ccb 14.1.0 released
a367c44 Fix typo in comments of text.mjs (#1015)
7ad8179 add changelog
5e90063 simplify logic in scanDelims
d7ce5ec Merge pull request #1009 from notriddle/spec-0.31.2
0bfc57d Update spec to 0.31.2
cd24778 Update to comply with spec 0.31.2
Additional commits viewable in compare view

Updates markdown-it from 13.0.2 to 14.1.1

Changelog

Sourced from markdown-it's changelog.

[14.1.1] - 2026-01-11

Security

Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @ltduc147 for report.

[14.1.0] - 2024-03-19

Changed

Updated CM spec compatibility to 0.31.2, #1009.

Fixed

Fixed quadratic complexity when parsing references, #996.

Fixed quadratic output size with pathological user input in tables, #1000.

[14.0.0] - 2023-12-08

Changed

Drop ancient browsers support (use .fromCodePoint and other features).

Rewrite to ESM (including all plugins/deps). CJS fallback still available. No signatures changed, except markdown-it-emoji plugin.

Dropped dist/ folder from repo, build on package publish.

Set punicode.js as external dependency.

Fixed

Html tokens inside img alt are now rendered as their original text, #896.

Hardbreaks inside img alt are now rendered as newlines.

Commits

b4a9b65 14.1.1 released
4b4bbca Fixed perf regression in linkify-it wrapper
d2782d8 Add supplementary example-driven documentation (#1092)
0fe7ccb 14.1.0 released
a367c44 Fix typo in comments of text.mjs (#1015)
7ad8179 add changelog
5e90063 simplify logic in scanDelims
d7ce5ec Merge pull request #1009 from notriddle/spec-0.31.2
0bfc57d Update spec to 0.31.2
cd24778 Update to comply with spec 0.31.2
Additional commits viewable in compare view

Updates markdown-it from 13.0.2 to 14.1.1

Changelog

Sourced from markdown-it's changelog.

[14.1.1] - 2026-01-11

Security

Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @ltduc147 for report.

[14.1.0] - 2024-03-19

Changed

Updated CM spec compatibility to 0.31.2, #1009.

Fixed

Fixed quadratic complexity when parsing references, #996.

Fixed quadratic output size with pathological user input in tables, #1000.

[14.0.0] - 2023-12-08

Changed

Drop ancient browsers support (use .fromCodePoint and other features).

Rewrite to ESM (including all plugins/deps). CJS fallback still available. No signatures changed, except markdown-it-emoji plugin.

Dropped dist/ folder from repo, build on package publish.

Set punicode.js as external dependency.

Fixed

Html tokens inside img alt are now rendered as their original text, #896.

Hardbreaks inside img alt are now rendered as newlines.

Commits

b4a9b65 14.1.1 released
4b4bbca Fixed perf regression in linkify-it wrapper
d2782d8 Add supplementary example-driven documentation (#1092)
0fe7ccb 14.1.0 released
a367c44 Fix typo in comments of text.mjs (#1015)
7ad8179 add changelog
5e90063 simplify logic in scanDelims
d7ce5ec Merge pull request #1009 from notriddle/spec-0.31.2
0bfc57d Update spec to 0.31.2
cd24778 Update to comply with spec 0.31.2
Additional commits viewable in compare view

Updates markdown-it from 13.0.2 to 14.1.1

Changelog

Sourced from markdown-it's changelog.

[14.1.1] - 2026-01-11

Security

Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @ltduc147 for report.

[14.1.0] - 2024-03-19

Changed

Updated CM spec compatibility to 0.31.2, #1009.

Fixed

Fixed quadratic complexity when parsing references, #996.

Fixed quadratic output size with pathological user input in tables, #1000.

[14.0.0] - 2023-12-08

Changed

Drop ancient browsers support (use .fromCodePoint and other features).

Rewrite to ESM (including all plugins/deps). CJS fallback still available. No signatures changed, except markdown-it-emoji plugin.

Dropped dist/ folder from repo, build on package publish.

Set punicode.js as external dependency.

Fixed

Html tokens inside img alt are now rendered as their original text, #896.

Hardbreaks inside img alt are now rendered as newlines.

Commits

b4a9b65 14.1.1 released
4b4bbca Fixed perf regression in linkify-it wrapper
d2782d8 Add supplementary example-driven documentation (#1092)
0fe7ccb 14.1.0 released
a367c44 Fix typo in comments of text.mjs (#1015)
7ad8179 add changelog
5e90063 simplify logic in scanDelims
d7ce5ec Merge pull request #1009 from notriddle/spec-0.31.2
0bfc57d Update spec to 0.31.2
cd24778 Update to comply with spec 0.31.2
Additional commits viewable in compare view

Updates @babel/runtime from 7.17.2 to 7.26.10

Release notes

Sourced from @babel/runtime's releases.

v7.26.10 (2025-03-11)

Thanks @jordan-choi and @mmmsssttt404 for your first PRs!

This release includes a fix for GHSA-968p-4wvh-cqc8, a security vulnerability which affects the .replace method of transpiled regular expressions that use named capturing groups.

👓 Spec Compliance

babel-parser

#17159 Disallow decorator in array pattern (@JLHwung)

🐛 Bug Fix

babel-parser, babel-template

#17164 Fix: always initialize ExportDeclaration attributes (@JLHwung)

babel-core

#17142 fix: "Map maximum size exceeded" in deepClone (@liuxingbaoyu)

babel-parser, babel-plugin-transform-typescript

#17154 Update typescript parser tests (@JLHwung)

babel-traverse

#17151 fix: Should not evaluate vars in child scope (@liuxingbaoyu)

babel-generator

#17153 fix: Correctly generate abstract override (@liuxingbaoyu)

babel-parser

#17107 Fix source type detection when parsing TypeScript (@JLHwung)

babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3

#17173 Fix processing of replacement pattern with named capture groups (@mmmsssttt404)

💅 Polish

babel-standalone

#17158 Avoid warnings when re-bundling @babel/standalone with webpack (@liuxingbaoyu)

🏠 Internal

babel-parser

#17160 Left-value parsing cleanup (@JLHwung)

Committers: 6

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

Yunyoung Jordan Choi (@jordan-choi)

@liuxingbaoyu

@mmmsssttt404

v7.26.9 (2025-02-14)

🐛 Bug Fix

babel-types

#17103 fix: Definition for TSPropertySignature.kind (@liuxingbaoyu)

babel-generator, babel-types

#17062 Print TypeScript optional/definite in ClassPrivateProperty (@jamiebuilds-signal)

... (truncated)

Commits

e1ce99d v7.26.10
d5952e8 Fix processing of replacement pattern with named capture groups (#17173)
64bca7b v7.26.9
2d95140 v7.26.7
63d3038 v7.26.0
b07957e v7.25.9
af91759 fix: Accidentally publishing useless files (#16917)
2533cfb v7.25.7
69d65f1 [babel 8] Require Node.js ^18.20.0 || ^20.17.0 || >=22.8.0 (#16800)
2f72b97 v7.25.6
Additional commits viewable in compare view

Updates @babel/runtime from 7.17.2 to 7.26.10

Release notes

Sourced from @babel/runtime's releases.

v7.26.10 (2025-03-11)

Thanks @jordan-choi and @mmmsssttt404 for your first PRs!

This release includes a fix for GHSA-968p-4wvh-cqc8, a security vulnerability which affects the .replace method of transpiled regular expressions that use named capturing groups.

👓 Spec Compliance

babel-parser

#17159 Disallow decorator in array pattern (@JLHwung)

🐛 Bug Fix

babel-parser, babel-template

#17164 Fix: always initialize ExportDeclaration attributes (@JLHwung)

babel-core

#17142 fix: "Map maximum size exceeded" in deepClone (@liuxingbaoyu)

babel-parser, babel-plugin-transform-typescript

#17154 Update typescript parser tests (@JLHwung)

babel-traverse

#17151 fix: Should not evaluate vars in child scope (@liuxingbaoyu)

babel-generator

#17153 fix: Correctly generate abstract override (@liuxingbaoyu)

babel-parser

#17107 Fix source type detection when parsing TypeScript (@JLHwung)

babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3

#17173 Fix processing of replacement pattern with named capture groups (@mmmsssttt404)

💅 Polish

babel-standalone

#17158 Avoid warnings when re-bundling @babel/standalone with webpack (@liuxingbaoyu)

🏠 Internal

babel-parser

#17160 Left-value parsing cleanup (@JLHwung)

Committers: 6

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

Yunyoung Jordan Choi (@jordan-choi)

@liuxingbaoyu

@mmmsssttt404

v7.26.9 (2025-02-14)

🐛 Bug Fix

babel-types

#17103 fix: Definition for TSPropertySignature.kind (@liuxingbaoyu)

babel-generator, babel-types

#17062 Print TypeScript optional/definite in ClassPrivateProperty (@jamiebuilds-signal)

... (truncated)

Commits

e1ce99d v7.26.10
d5952e8 Fix processing of replacement pattern with named capture groups (#17173)
64bca7b v7.26.9
2d95140 v7.26.7
63d3038 v7.26.0
b07957e v7.25.9
af91759 fix: Accidentally publishing useless files (#16917)
2533cfb v7.25.7
69d65f1 [babel 8] Require Node.js ^18.20.0 || ^20.17.0 || >=22.8.0 (#16800)
2f72b97 v7.25.6
Additional commits viewable in compare view

Updates @babel/runtime from 7.17.2 to 7.26.10

Release notes

Sourced from @babel/runtime's releases.

v7.26.10 (2025-03-11)

Thanks @jordan-choi and @mmmsssttt404 for your first PRs!

This release includes a fix for GHSA-968p-4wvh-cqc8, a security vulnerability which affects the .replace method of transpiled regular expressions that use named capturing groups.

👓 Spec Compliance

babel-parser

#17159 Disallow decorator in array pattern (@JLHwung)

🐛 Bug Fix

babel-parser, babel-template

#17164 Fix: always initialize ExportDeclaration attributes (@JLHwung)

babel-core

#17142 fix: "Map maximum size exceeded" in deepClone (@liuxingbaoyu)

babel-parser, babel-plugin-transform-typescript

#17154 Update typescript parser tests (@JLHwung)

babel-traverse

#17151 fix: Should not evaluate vars in child scope (@liuxingbaoyu)

babel-generator

#17153 fix: Correctly generate abstract override (@liuxingbaoyu)

babel-parser

#17107 Fix source type detection when parsing TypeScript (@JLHwung)

babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3

#17173 Fix processing of replacement pattern with named capture groups (@mmmsssttt404)

💅 Polish

babel-standalone

#17158 Avoid warnings when re-bundling @babel/standalone with webpack (@liuxingbaoyu)

🏠 Internal

babel-parser

#17160 Left-value parsing cleanup (@JLHwung)

Committers: 6

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

Yunyoung Jordan Choi (@jordan-choi)

@liuxingbaoyu

@mmmsssttt404

v7.26.9 (2025-02-14)

🐛 Bug Fix

babel-types

#17103 fix: Definition for TSPropertySignature.kind (@liuxingbaoyu)

babel-generator, babel-types

#17062 Print TypeScript optional/definite in ClassPrivateProperty (@jamiebuilds-signal)

... (truncated)

Commits

e1ce99d v7.26.10
d5952e8 Fix processing of replacement pattern with named capture groups (#17173)
64bca7b v7.26.9
2d95140 v7.26.7
63d3038 v7.26.0
b07957e v7.25.9
af91759 fix: Accidentally publishing useless files (#16917)
2533cfb v7.25.7
69d65f1 [babel 8] Require Node.js ^18.20.0 || ^20.17.0 || >=22.8.0 (#16800)
2f72b97 v7.25.6
Additional commits viewable in compare view

Updates @babel/runtime from 7.17.2 to 7.26.10

Release notes

Sourced from @babel/runtime's releases.

v7.26.10 (2025-03-11)

Thanks @jordan-choi and @mmmsssttt404 for your first PRs!

This release includes a fix for GHSA-968p-4wvh-cqc8, a security vulnerability which affects the .replace method of transpiled regular expressions that use named capturing groups.

👓 Spec Compliance

babel-parser

#17159 Disallow decorator in array pattern (@JLHwung)

🐛 Bug Fix

babel-parser, babel-template

#17164 Fix: always initialize ExportDeclaration attributes (@JLHwung)

babel-core

#17142 fix: "Map maximum size exceeded" in deepClone (@liuxingbaoyu)

babel-parser, babel-plugin-transform-typescript

#17154 Update typescript parser tests (@JLHwung)

babel-traverse

#17151 fix: Should not evaluate vars in child scope (@liuxingbaoyu)

babel-generator

#17153 fix: Correctly generate abstract override (@liuxingbaoyu)

babel-parser

#17107 Fix source type detection when parsing TypeScript (@JLHwung)

babel-helpers, babel-runtime, babel-runtime-corejs2, babel-runtime-corejs3

#17173 Fix processing of replacement pattern with named capture groups (@mmmsssttt404)

💅 Polish

babel-standalone

#17158 Avoid warnings when re-bundling @babel/standalone with webpack (@liuxingbaoyu)

🏠 Internal

babel-parser

#17160 Left-value parsing cleanup (@JLHwung)

Committers: 6

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

Yunyoung Jordan Choi (@jordan-choi)

@liuxingbaoyu

@mmmsssttt404

v7.26.9 (2025-02-14)

🐛 Bug Fix

babel-types

#17103 fix: Definition for TSPropertySignature.kind (@liuxingbaoyu)

babel-generator, babel-types

#17062 Print TypeScript optional/definite in ClassPrivateProperty (@jamiebuilds-signal)

... (truncated)

Commits

e1ce99d v7.26.10
d5952e8 Fix processing of replacement pattern with named capture groups (#17173)
64bca7b v7.26.9
2d95140 v7.26.7
63d3038 v7.26.0
b07957e v7.25.9
af91759 fix: Accidentally publishing useless files (#16917)
2533cfb v7.25.7
69d65f1 [babel 8] Require Node.js ^18.20.0 || ^20.17.0 || >=22.8.0 (#16800)
2f72b97 v7.25.6
Additional commits viewable in compare view

Updates sanitize-html from 2.17.1 to 2.17.4

Changelog

Sourced from sanitize-html's changelog.

2.17.4

Changes

sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

2.17.3 (2026-04-15)

Security

Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.

2.17.2 (2026-03-19)

Changes

Upgrade htmlparser2 from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g., &[#0000001](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html/issues/0000001)) that previously bypassed javascript: URL detection. Also fixes double-encoding of entities inside raw text elements like textarea and option.

Commits

See full diff in compare view

Updates sanitize-html from 2.17.1 to 2.17.4

Changelog

Sourced from sanitize-html's changelog.

2.17.4

Changes

sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

2.17.3 (2026-04-15)

Security

Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.

2.17.2 (2026-03-19)

Changes

Upgrade htmlparser2 from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g., &[#0000001](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html/issues/0000001)) that previously bypassed javascript: URL detection. Also fixes double-encoding of entities inside raw text elements like textarea and option.

Commits

See full diff in compare view

Updates sanitize-html from 2.17.1 to 2.17.4

Changelog

Sourced from sanitize-html's changelog.

2.17.4

Changes

sanitize-html and launder now share a single implementation of naughtyHref, based on that which previously existed in sanitize-html.

Security

Security vulnerability: the xmp tag could be used to pass forbidden markup through sanitize-html, even when xmp itself is not explicitly allowed All users of sanitize-html should update immediately. Thanks to Vincenzo Turturro for reporting the vulnerability.

2.17.3 (2026-04-15)

Security

Fix vulnerability introduced in version 2.17.2 that allowed XSS attacks if the developer chose to permit option tags. There was no vulnerability when not explicitly allowing option tags.

2.17.2 (2026-03-19)

Changes

Upgrade htmlparser2 from 8.x to 10.1.0. This improves security by correctly decoding zero-padded numeric character references (e.g., &[#0000001](https://github.com/apostrophecms/apostrophe/tree/HEAD/packages/sanitize-html/issues/0000001)) that previously bypassed javascript: URL detection. Also fixes double-encoding of entities inside raw text elements like textarea and option.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 1 update in the / directory: [markdown-it](https://github.com/markdown-it/markdown-it). Bumps the npm_and_yarn group with 1 update in the /packages/component directory: [markdown-it](https://github.com/markdown-it/markdown-it). Bumps the npm_and_yarn group with 1 update in the /packages/embed directory: [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime). Updates `markdown-it` from 13.0.2 to 14.1.1 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@13.0.2...14.1.1) Updates `markdown-it` from 13.0.2 to 14.1.1 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@13.0.2...14.1.1) Updates `markdown-it` from 13.0.2 to 14.1.1 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@13.0.2...14.1.1) Updates `markdown-it` from 13.0.2 to 14.1.1 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@13.0.2...14.1.1) Updates `markdown-it` from 13.0.2 to 14.1.1 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@13.0.2...14.1.1) Updates `markdown-it` from 13.0.2 to 14.1.1 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@13.0.2...14.1.1) Updates `@babel/runtime` from 7.17.2 to 7.26.10 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.26.10/packages/babel-runtime) Updates `@babel/runtime` from 7.17.2 to 7.26.10 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.26.10/packages/babel-runtime) Updates `@babel/runtime` from 7.17.2 to 7.26.10 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.26.10/packages/babel-runtime) Updates `@babel/runtime` from 7.17.2 to 7.26.10 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.26.10/packages/babel-runtime) Updates `sanitize-html` from 2.17.1 to 2.17.4 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html) Updates `sanitize-html` from 2.17.1 to 2.17.4 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html) Updates `sanitize-html` from 2.17.1 to 2.17.4 - [Changelog](https://github.com/apostrophecms/apostrophe/blob/main/packages/sanitize-html/CHANGELOG.md) - [Commits](https://github.com/apostrophecms/apostrophe/commits/HEAD/packages/sanitize-html) --- updated-dependencies: - dependency-name: markdown-it dependency-version: 14.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: markdown-it dependency-version: 14.1.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/runtime" dependency-version: 7.26.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/runtime" dependency-version: 7.26.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/runtime" dependency-version: 7.26.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/runtime" dependency-version: 7.26.10 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sanitize-html dependency-version: 2.17.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI review requested due to automatic review settings May 18, 2026 19:04

dependabot Bot requested review from a-b-r-o-w-n and compulim as code owners May 18, 2026 19:04

dependabot Bot added the dependencies Pull requests that update a dependency file label May 18, 2026

dependabot Bot requested review from cwhitten and srinaath as code owners May 18, 2026 19:04

dependabot Bot added the javascript Pull requests that update javascript code label May 18, 2026

dependabot Bot requested a review from tdurnford as a code owner May 18, 2026 19:04

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 18, 2026

Copilot AI reviewed May 18, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 3 directories with 3 updates#5832

chore(deps): bump the npm_and_yarn group across 3 directories with 3 updates#5832
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-c330a05137

dependabot Bot commented on behalf of github May 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot Bot commented on behalf of github May 18, 2026

[14.1.1] - 2026-01-11

Security

[14.1.0] - 2024-03-19

Changed

Fixed

[14.0.0] - 2023-12-08

Changed

Fixed

[14.1.1] - 2026-01-11

Security

[14.1.0] - 2024-03-19

Changed

Fixed

[14.0.0] - 2023-12-08

Changed

Fixed

[14.1.1] - 2026-01-11

Security

[14.1.0] - 2024-03-19

Changed

Fixed

[14.0.0] - 2023-12-08

Changed

Fixed

[14.1.1] - 2026-01-11

Security

[14.1.0] - 2024-03-19

Changed

Fixed

[14.0.0] - 2023-12-08

Changed

Fixed

[14.1.1] - 2026-01-11

Security

[14.1.0] - 2024-03-19

Changed

Fixed

[14.0.0] - 2023-12-08

Changed

Fixed

[14.1.1] - 2026-01-11

Security

[14.1.0] - 2024-03-19

Changed

Fixed

[14.0.0] - 2023-12-08

Changed

Fixed

v7.26.10 (2025-03-11)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

🏠 Internal

Committers: 6

v7.26.9 (2025-02-14)

🐛 Bug Fix

v7.26.10 (2025-03-11)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

🏠 Internal

Committers: 6

v7.26.9 (2025-02-14)

🐛 Bug Fix

v7.26.10 (2025-03-11)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

🏠 Internal

Committers: 6

v7.26.9 (2025-02-14)

🐛 Bug Fix

v7.26.10 (2025-03-11)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

🏠 Internal

Committers: 6