build(deps): bump the runtime group with 8 updates by dependabot[bot] · Pull Request #76 · DeepMyst/Mysti

dependabot · 2026-11-01T16:11:36Z

Bumps the runtime group with 8 updates:

Package	From	To
@babel/parser	`8.0.6`	`8.0.8`
@babel/types	`8.0.6`	`8.0.8`
@modelcontextprotocol/sdk	`1.32.0`	`1.32.2`
dompurify	`3.4.16`	`3.4.17`
marked	`18.0.14`	`18.1.2`
mermaid	`12.1.0`	`12.2.0`
@vscode/vsce	`4.0.0`	`4.1.0`
jsdom	`30.1.1`	`30.1.3`

Updates @babel/parser from 8.0.6 to 8.0.8

Release notes

Sourced from @babel/parser's releases.

v8.0.8 (2026-10-23)

Thanks @bhushan4work and @webdevelopersrinu for your first PRs!

👓 Spec Compliance

babel-parser

#18366 fix(parser): disallow named specifiers after * as ns (@JLHwung)

#18336 fix(parser): disallow const x followed by linebreak and of (@JLHwung)

#18343 fix(parser): reject delete (x) when createParenthesizedExpressions: true (@JLHwung)

#18276 fix: report expression errors in object literals used as member base (@JLHwung)

#18286 Disallow arrow functions as new callee and await operand (@JLHwung)

#18309 Disallow call expressions as arrow function parameters in sloppy mode (@JLHwung)

#18315 Disallow eval and arguments as class names (@JLHwung)

🐛 Bug Fix

babel-parser

#18392 fix(parser): set phase: null for non-deferred imports with deferredImportEvaluation (#18313) (@bhushan4work)

#18344 fix(parser): ASI between arrow body and /= regex (@JLHwung)

#18342 fix(parser): allow arguments as a label in class (@JLHwung)

#18365 fix(parser): allow ASI between property init and escaped in (@JLHwung)

#18327 fix(parser): register function id in labeled function declaration (@JLHwung)

#18323 Skip HTML-like comments in the parser's character lookahead (@JLHwung)

#18322 Allow ASI after export default from without exportDefaultFrom (@JLHwung)

babel-helpers, babel-plugin-transform-destructuring, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3, babel-runtime

#18186 Fix _arrayWithHoles bypassing custom Symbol.iterator on array-backed Proxies (@webdevelopersrinu)

babel-plugin-transform-typescript, babel-types

#18380 fix(types): visit decorators of TSParameterProperty (@JLHwung)

babel-plugin-transform-block-scoping

#18331 fix: wrap enclosing loop when a nested for head closure captures its bindings (@joellemd)

🏠 Internal

babel-plugin-transform-classes

#18383 Remove internal usage of loose in class transform (@nicolo-ribaudo)

🔬 Output optimization

babel-plugin-transform-spread

#18318 Avoid arrayLikeToArray for spreading literals (@nicolo-ribaudo)

Committers: 7

Babel Bot (@babel-bot)

Bhushan Agrawal (@bhushan4work)

Huáng Jùnliàng (@JLHwung)

Joelle Mahfoud (@joellemd)

Nicolò Ribaudo (@nicolo-ribaudo)

Srinu desetti (@webdevelopersrinu)

@liuxingbaoyu

v8.0.7 (2026-10-07)

Thanks @brunoborta, @CINC0S, @hoobnn, and @jpradelle for your first PRs!

... (truncated)

Changelog

Sourced from @babel/parser's changelog.

v8.0.8 (2026-10-23)

👓 Spec Compliance

babel-parser

#18366 fix(parser): disallow named specifiers after * as ns (@JLHwung)

#18336 fix(parser): disallow const x followed by linebreak and of (@JLHwung)

#18343 fix(parser): reject delete (x) when createParenthesizedExpressions: true (@JLHwung)

#18276 fix: report expression errors in object literals used as member base (@JLHwung)

#18286 Disallow arrow functions as new callee and await operand (@JLHwung)

#18309 Disallow call expressions as arrow function parameters in sloppy mode (@JLHwung)

#18315 Disallow eval and arguments as class names (@JLHwung)

🐛 Bug Fix

babel-parser

#18392 fix(parser): set phase: null for non-deferred imports with deferredImportEvaluation (#18313) (@bhushan4work)

#18344 fix(parser): ASI between arrow body and /= regex (@JLHwung)

#18342 fix(parser): allow arguments as a label in class (@JLHwung)

#18365 fix(parser): allow ASI between property init and escaped in (@JLHwung)

#18327 fix(parser): register function id in labeled function declaration (@JLHwung)

#18323 Skip HTML-like comments in the parser's character lookahead (@JLHwung)

#18322 Allow ASI after export default from without exportDefaultFrom (@JLHwung)

babel-helpers, babel-plugin-transform-destructuring, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3, babel-runtime

#18186 Fix _arrayWithHoles bypassing custom Symbol.iterator on array-backed Proxies (@webdevelopersrinu)

babel-plugin-transform-typescript, babel-types

#18380 fix(types): visit decorators of TSParameterProperty (@JLHwung)

babel-plugin-transform-block-scoping

#18331 fix: wrap enclosing loop when a nested for head closure captures its bindings (@joellemd)

🏠 Internal

babel-plugin-transform-classes

#18383 Remove internal usage of loose in class transform (@nicolo-ribaudo)

🔬 Output optimization

babel-plugin-transform-spread

#18318 Avoid arrayLikeToArray for spreading literals (@nicolo-ribaudo)

v8.0.7 (2026-10-07)

🐛 Bug Fix

babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env

#18295 Bump regexpu-core to 6.5.3 (@JLHwung)

babel-plugin-transform-for-of

#18292 Skip for await in transform-for-of (@brunoborta)

babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3

#18283 Fix asyncIterator helper forwarding .throw() to .return() (@brunoborta)

babel-parser

#18288 fix(parser): allow await as a function expression name inside async arrow (@JLHwung)

babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3

#18284 Guard @@toPrimitive usage in toPrimitive helper (@nicolo-ribaudo)

babel-plugin-transform-block-scoping

#18195 fix: closures in for-loop init capture wrong binding (@joelle-a-dev)

... (truncated)

Commits

2208401 v8.0.8
44e867b fix(parser): set phase: null for eafer imports (#18392)
3524342 fix(parser): disallow named specifiers after * as ns (#18366)
656585c fix(parser): disallow const x followed by linebreak and of (#18336)
bad0a65 fix(parser): ASI between arrow body and /= regex (#18344)
2f65825 fix(parser): allow arguments as a label in class (#18342)
6cd3db7 fix(parser): allow ASI between property init and escaped in (#18365)
93e39e4 fix(parser): reject delete (x) when createParenthesizedExpressions: true (#18...
0ca5fda fix(parser): register function id in labeled function declaration (#18327)
0915316 Skip HTML-like comments in the parser's character lookahead (#18323)
Additional commits viewable in compare view

Updates @babel/types from 8.0.6 to 8.0.8

Release notes

Sourced from @babel/types's releases.

v8.0.8 (2026-10-23)

Thanks @bhushan4work and @webdevelopersrinu for your first PRs!

👓 Spec Compliance

babel-parser

#18366 fix(parser): disallow named specifiers after * as ns (@JLHwung)

#18336 fix(parser): disallow const x followed by linebreak and of (@JLHwung)

#18343 fix(parser): reject delete (x) when createParenthesizedExpressions: true (@JLHwung)

#18276 fix: report expression errors in object literals used as member base (@JLHwung)

#18286 Disallow arrow functions as new callee and await operand (@JLHwung)

#18309 Disallow call expressions as arrow function parameters in sloppy mode (@JLHwung)

#18315 Disallow eval and arguments as class names (@JLHwung)

🐛 Bug Fix

babel-parser

#18392 fix(parser): set phase: null for non-deferred imports with deferredImportEvaluation (#18313) (@bhushan4work)

#18344 fix(parser): ASI between arrow body and /= regex (@JLHwung)

#18342 fix(parser): allow arguments as a label in class (@JLHwung)

#18365 fix(parser): allow ASI between property init and escaped in (@JLHwung)

#18327 fix(parser): register function id in labeled function declaration (@JLHwung)

#18323 Skip HTML-like comments in the parser's character lookahead (@JLHwung)

#18322 Allow ASI after export default from without exportDefaultFrom (@JLHwung)

babel-helpers, babel-plugin-transform-destructuring, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3, babel-runtime

#18186 Fix _arrayWithHoles bypassing custom Symbol.iterator on array-backed Proxies (@webdevelopersrinu)

babel-plugin-transform-typescript, babel-types

#18380 fix(types): visit decorators of TSParameterProperty (@JLHwung)

babel-plugin-transform-block-scoping

#18331 fix: wrap enclosing loop when a nested for head closure captures its bindings (@joellemd)

🏠 Internal

babel-plugin-transform-classes

#18383 Remove internal usage of loose in class transform (@nicolo-ribaudo)

🔬 Output optimization

babel-plugin-transform-spread

#18318 Avoid arrayLikeToArray for spreading literals (@nicolo-ribaudo)

Committers: 7

Babel Bot (@babel-bot)

Bhushan Agrawal (@bhushan4work)

Huáng Jùnliàng (@JLHwung)

Joelle Mahfoud (@joellemd)

Nicolò Ribaudo (@nicolo-ribaudo)

Srinu desetti (@webdevelopersrinu)

@liuxingbaoyu

v8.0.7 (2026-10-07)

Thanks @brunoborta, @CINC0S, @hoobnn, and @jpradelle for your first PRs!

... (truncated)

Changelog

Sourced from @babel/types's changelog.

v8.0.8 (2026-10-23)

👓 Spec Compliance

babel-parser

#18366 fix(parser): disallow named specifiers after * as ns (@JLHwung)

#18336 fix(parser): disallow const x followed by linebreak and of (@JLHwung)

#18343 fix(parser): reject delete (x) when createParenthesizedExpressions: true (@JLHwung)

#18276 fix: report expression errors in object literals used as member base (@JLHwung)

#18286 Disallow arrow functions as new callee and await operand (@JLHwung)

#18309 Disallow call expressions as arrow function parameters in sloppy mode (@JLHwung)

#18315 Disallow eval and arguments as class names (@JLHwung)

🐛 Bug Fix

babel-parser

#18392 fix(parser): set phase: null for non-deferred imports with deferredImportEvaluation (#18313) (@bhushan4work)

#18344 fix(parser): ASI between arrow body and /= regex (@JLHwung)

#18342 fix(parser): allow arguments as a label in class (@JLHwung)

#18365 fix(parser): allow ASI between property init and escaped in (@JLHwung)

#18327 fix(parser): register function id in labeled function declaration (@JLHwung)

#18323 Skip HTML-like comments in the parser's character lookahead (@JLHwung)

#18322 Allow ASI after export default from without exportDefaultFrom (@JLHwung)

babel-helpers, babel-plugin-transform-destructuring, babel-plugin-transform-modules-commonjs, babel-runtime-corejs3, babel-runtime

#18186 Fix _arrayWithHoles bypassing custom Symbol.iterator on array-backed Proxies (@webdevelopersrinu)

babel-plugin-transform-typescript, babel-types

#18380 fix(types): visit decorators of TSParameterProperty (@JLHwung)

babel-plugin-transform-block-scoping

#18331 fix: wrap enclosing loop when a nested for head closure captures its bindings (@joellemd)

🏠 Internal

babel-plugin-transform-classes

#18383 Remove internal usage of loose in class transform (@nicolo-ribaudo)

🔬 Output optimization

babel-plugin-transform-spread

#18318 Avoid arrayLikeToArray for spreading literals (@nicolo-ribaudo)

v8.0.7 (2026-10-07)

🐛 Bug Fix

babel-helper-create-regexp-features-plugin, babel-plugin-transform-dotall-regex, babel-plugin-transform-unicode-sets-regex, babel-preset-env

#18295 Bump regexpu-core to 6.5.3 (@JLHwung)

babel-plugin-transform-for-of

#18292 Skip for await in transform-for-of (@brunoborta)

babel-helpers, babel-plugin-transform-async-generator-functions, babel-runtime-corejs3

#18283 Fix asyncIterator helper forwarding .throw() to .return() (@brunoborta)

babel-parser

#18288 fix(parser): allow await as a function expression name inside async arrow (@JLHwung)

babel-helpers, babel-plugin-transform-class-properties, babel-plugin-transform-modules-systemjs, babel-runtime-corejs3

#18284 Guard @@toPrimitive usage in toPrimitive helper (@nicolo-ribaudo)

babel-plugin-transform-block-scoping

#18195 fix: closures in for-loop init capture wrong binding (@joelle-a-dev)

... (truncated)

Commits

2208401 v8.0.8
c897d1e fix(types): visit decorators of TSParameterProperty (#18380)
See full diff in compare view

Updates @modelcontextprotocol/sdk from 1.32.0 to 1.32.2

Release notes

Sourced from @modelcontextprotocol/sdk's releases.

1.32.2

What's Changed

fix: add explicit | undefined to Transport optional properties (v1.x backport of #1766) by @kishormorol in modelcontextprotocol/typescript-sdk#2814

[v1.x] fix: allow registering after connect() when the capability was declared by @claude[bot] in modelcontextprotocol/typescript-sdk#2958

chore: bump version to 1.32.2 by @claude[bot] in modelcontextprotocol/typescript-sdk#3089

New Contributors

@kishormorol made their first contribution in modelcontextprotocol/typescript-sdk#2814

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

1.32.1

What's Changed

[v1.x] docs: state the principles in CLAUDE.md by @claude[bot] in modelcontextprotocol/typescript-sdk#2939

[v1.x] docs: point the README at v2 and say what v1.x supports by @claude[bot] in modelcontextprotocol/typescript-sdk#2942

chore: bump version to 1.32.1 by @claude[bot] in modelcontextprotocol/typescript-sdk#2954

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

Commits

3b73021 chore: bump version to 1.32.2 (#3089)
fa56d81 [v1.x] fix: allow registering after connect() when the capability was declare...
6919e95 fix: add explicit | undefined to Transport optional properties (v1.x backport...
ff07b00 chore: bump version to 1.32.1 (#2954)
8a74d50 [v1.x] docs: point the README at v2 and say what v1.x supports (#2942)
a8cf503 [v1.x] docs: state the principles in CLAUDE.md (#2939)
See full diff in compare view

Updates dompurify from 3.4.16 to 3.4.17

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.17

Fixed an issue with IN_PLACE, SAFE_FOR_TEMPLATES and shadow roots, thanks @manus-pi

Fixed IN_PLACE handling of nodes that hooks or custom elements tough during sanitization, thanks @uttej-badwane

Fixed the SMIL attributeName guard in XHTML mode, thanks @Koukyosyumei

Hardened several smaller edge cases (namespaces, literal-text elements, isValidAttribute()), thanks @artiphishell

Added a purify-edge test runner as a compatibility check, thanks @anzal1

Clarified the IN_PLACE documentation in the README about possible risks

Updated several dependencies

Commits

a77a3e7 release: 3.4.17 (#1672)
See full diff in compare view

Updates marked from 18.0.14 to 18.1.2

Release notes

Sourced from marked's releases.

v18.1.2

18.1.2 (2026-10-26)

Bug Fixes

allow a tab or end of input after a type 6 html block tag name (#4128) (e09c40d)

apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145) (5d8e234)

cli: await config functions before parsing (#4138) (3a11ad1)

cli: create no-clobber output files atomically (#4135) (e7c4f64)

do not continue a block quote paragraph from a whitespace-only line (#4134) (42f34a8)

expand a tab after the block quote marker to the next tab stop (#4110) (2d3899b)

honor per-call async options when composing hooks (#4139) (379be9d)

keep a line starting with # but no space in the list item (#4127) (6b63189)

keep duplicate link definitions in the tokens (#4132) (2784acc)

keep lazy lines after a list in a nested blockquote (#4137) (38c7e55)

keep lazy setext underlines in list items as text (#4126) (398234c)

render nested image alt formatting as plain text (#4131) (15f59bb)

stop an unclosed inline raw tag from unescaping later blocks (#4130) (4562b6f)

Performance Improvements

~16% faster parsing by skipping em/strong masking for runs without *, _ or ~ (#4142) (f0fd3e0)

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

cli: honor an explicitly empty string input (#4113) (ec3a4e5)

end blockquote before a lazy line after a heading, hr or html block (#4115) (9e64a6a)

keep a backslash in a code span from hiding emphasis (#4117) (6a57018)

keep a decoded character reference from forming a new one (#4111) (6bbac0c), closes #38 #112

let indented and type 3-5 html blocks interrupt a paragraph (#4124) (eaa1fff)

make walkTokens linear by appending values in place (#4121) (627d9ae), closes #4120

match pre, script, style and textarea as whole tag names (#4114) (0db74cb)

preserve enclosing link state after parsing images (#4123) (cc07bb9)

respect tab stops in list continuation indentation (#4119) (4bd2528)

Performance Improvements

avoid repeated raw string copies in nested lists (#4082) (7e8754d)

v18.1.0

18.1.0 (2026-10-05)

... (truncated)

Commits

5beecae chore(release): 18.1.2 [skip ci]
c1e6ca1 chore(deps): update deps (#4168)
3a01ac4 chore: test:redos -> test:recheck (#4167)
15f59bb fix: render nested image alt formatting as plain text (#4131)
2d3899b fix: expand a tab after the block quote marker to the next tab stop (#4110)
e09c40d fix: allow a tab or end of input after a type 6 html block tag name (#4128)
398234c fix: keep lazy setext underlines in list items as text (#4126)
6b63189 fix: keep a line starting with # but no space in the list item (#4127)
5d8e234 fix: apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145)
3a11ad1 fix(cli): await config functions before parsing (#4138)
Additional commits viewable in compare view

Updates mermaid from 12.1.0 to 12.2.0

Release notes

Sourced from mermaid's releases.

mermaid@12.2.0

Minor Changes

#8394 6ac38cb Thanks @jackroberts236! - feat: Add opt-in mindmap coloring by hierarchy depth using mindmap.colorBy: depth and the existing theme palette.

Patch Changes

#8409 419ee68 Thanks @ashishjain0512! - fix: size circle and double-circle nodes from their label instead of minNodeWidth, and trim neo circle padding

#8395 2fb3ff1 Thanks @ashishjain0512! - fix: ELK no longer straightens an edge terminal when that would put a label over another edge, or an edge through a label

#8394 cbf89ab Thanks @jackroberts236! - fix: Keep mindmap HTML labels readable in the neo look on themes that repaint node backgrounds

#8390 430ac9b Thanks @ashishjain0512! - fix: Centre mindmap node labels when htmlLabels is false

#8161 d7532ed Thanks @filipsajdak! - fix: scope a swimlane cluster's DOM id like every other cluster, so two diagrams on one page do not collide

#8270 ad8d61a Thanks @filipsajdak! - fix(rendering): clip an edge for the layout engine that drew it, so a diagram pinning its own engine (bpmn, swimlanes) still renders when the configured default is another one

#8383 9d41c0f Thanks @filipsajdak! - fix(swimlanes): split shared terminal lanes again after crossing cleanup, so an edge that detours around another lane no longer ends on the same attachment point as a neighbouring edge

#8384 6c67397 Thanks @filipsajdak! - fix(swimlanes): move a lane's title band clear of an edge that crosses it, in LR diagrams whose lanes carry no direction of their own and when the edge runs along the band's border

#8366 40124c3 Thanks @SwastikTripathi! - fix: swimlane nodes with no edges keep their source order inside a lane instead of being sorted by ID

Commits

1fb7869 Merge pull request #8432 from mermaid-js/changeset-release/master
34772ca Version Packages
42292ea Merge pull request #8428 from mermaid-js/release/12.2.0
e6c8059 Wrong version set previously
6c55f56 Set mermaid version when Coloring by depth supported in Mindmap
5a0d8cf Fix missing parallel uploads
788f396 Update according to discussion with core-team members
33d0a49 Merge pull request #8411 from mermaid-js/renovate/npm-katex-vulnerability
6538fde Update dependency katex to ^0.18.0 [SECURITY]
ba3022d Merge pull request #8398 from mermaid-js/pebr/12.1.0-tmp
Additional commits viewable in compare view

Updates @vscode/vsce from 4.0.0 to 4.1.0

Release notes

Sourced from @vscode/vsce's releases.

v4.1.0

Changes:

#1348: cli: Show OIDC publishing in help

#1346: Set npm minimum release age and apply audit fixes

#1345: publish: send X-Market-CI-Provider header with Marketplace requests

#1342: chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 in the github-actions group

#1335: chore(deps-dev): bump fast-uri from 3.1.6 to 3.1.8

#1338: chore(deps): bump brace-expansion

#1337: oidc: align token exchange with the Marketplace contract

#1332: Update qs transitive dependency to 6.16.0

This list of changes was auto generated.

v4.0.1-6

Changes:

#1348: cli: Show OIDC publishing in help

This list of changes was auto generated.

v4.0.1-5

Changes:

#1346: Set npm minimum release age and apply audit fixes

#1345: publish: send X-Market-CI-Provider header with Marketplace requests

This list of changes was auto generated.

v4.0.1-4

Changes:

#1342: chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 in the github-actions group

This list of changes was auto generated.

v4.0.1-3

Changes:

#1335: chore(deps-dev): bump fast-uri from 3.1.6 to 3.1.8

... (truncated)

Commits

33c66df Show OIDC publishing in help (#1348)
cc5321a Set npm minimum release age and apply audit fixes (#1346)
402a12c Merge pull request #1345 from microsoft/benibenj/agents/ci-provider-header-lo...
b84c665 Send CI provider header with Marketplace requests
aeed595 chore(deps): bump actions/setup-node (#1342)
04811a9 chore(deps-dev): bump fast-uri from 3.1.6 to 3.1.8 (#1335)
19b4ca9 chore(deps): bump brace-expansion (#1338)
0765451 Merge pull request #1337 from microsoft/benibenj/agents/oidc-vsce-endpoint-up...
c960f2e Update OIDC exchange to the final Marketplace contract
c1eebf3 Update qs transitive dependency to 6.16.0 (#1332)
See full diff in compare view

Updates jsdom from 30.1.1 to 30.1.3

Release notes

Sourced from jsdom's releases.

v30.1.3

Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@scttcper, @asamuzaK)

Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@scttcper)

Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.

Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.

Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@rnavarro)

Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.

Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.

Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.

Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.

Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.

Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.

Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.

Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.

Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@asamuzaK)

v30.1.2

Updated URLs to support Unicode v18.0.0 in internationalized domain names.

Reduced package size and memory use for CSS property definitions. (@scttcper)

Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@cmdcolin)

Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@scttcper)

Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.

Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.

Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@asamuzaK)

Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@asamuzaK)

Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.

Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().

Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@scttcper)

Fixed retained ...
Description has been truncated

Bumps the runtime group with 8 updates: | Package | From | To | | --- | --- | --- | | [@babel/parser](https://github.com/babel/babel/tree/HEAD/packages/babel-parser) | `8.0.6` | `8.0.8` | | [@babel/types](https://github.com/babel/babel/tree/HEAD/packages/babel-types) | `8.0.6` | `8.0.8` | | [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.32.0` | `1.32.2` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.16` | `3.4.17` | | [marked](https://github.com/markedjs/marked) | `18.0.14` | `18.1.2` | | [mermaid](https://github.com/mermaid-js/mermaid) | `12.1.0` | `12.2.0` | | [@vscode/vsce](https://github.com/Microsoft/vsce) | `4.0.0` | `4.1.0` | | [jsdom](https://github.com/jsdom/jsdom) | `30.1.1` | `30.1.3` | Updates `@babel/parser` from 8.0.6 to 8.0.8 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.8/packages/babel-parser) Updates `@babel/types` from 8.0.6 to 8.0.8 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v8.0.8/packages/babel-types) Updates `@modelcontextprotocol/sdk` from 1.32.0 to 1.32.2 - [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases) - [Commits](modelcontextprotocol/typescript-sdk@1.32.0...1.32.2) Updates `dompurify` from 3.4.16 to 3.4.17 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.16...3.4.17) Updates `marked` from 18.0.14 to 18.1.2 - [Release notes](https://github.com/markedjs/marked/releases) - [Commits](markedjs/marked@v18.0.14...v18.1.2) Updates `mermaid` from 12.1.0 to 12.2.0 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@12.1.0...mermaid@12.2.0) Updates `@vscode/vsce` from 4.0.0 to 4.1.0 - [Release notes](https://github.com/Microsoft/vsce/releases) - [Commits](microsoft/vscode-vsce@v4.0.0...v4.1.0) Updates `jsdom` from 30.1.1 to 30.1.3 - [Release notes](https://github.com/jsdom/jsdom/releases) - [Commits](jsdom/jsdom@v30.1.1...v30.1.3) --- updated-dependencies: - dependency-name: "@babel/parser" dependency-version: 8.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime - dependency-name: "@babel/types" dependency-version: 8.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime - dependency-name: "@modelcontextprotocol/sdk" dependency-version: 1.32.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime - dependency-name: dompurify dependency-version: 3.4.17 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: runtime - dependency-name: marked dependency-version: 18.1.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: runtime - dependency-name: mermaid dependency-version: 12.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: runtime - dependency-name: "@vscode/vsce" dependency-version: 4.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: runtime - dependency-name: jsdom dependency-version: 30.1.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: runtime ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 1, 2026

Navigation Menu

Repository navigation

build(deps): bump the runtime group with 8 updates - #76

build(deps): bump the runtime group with 8 updates#76
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/runtime-1f5a184356

dependabot Bot commented on behalf of github Nov 1, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Nov 1, 2026

v8.0.8 (2026-10-23)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

🔬 Output optimization

Committers: 7

v8.0.7 (2026-10-07)

v8.0.8 (2026-10-23)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

🔬 Output optimization

v8.0.7 (2026-10-07)

🐛 Bug Fix

v8.0.8 (2026-10-23)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

🔬 Output optimization

Committers: 7

v8.0.7 (2026-10-07)

v8.0.8 (2026-10-23)

👓 Spec Compliance

🐛 Bug Fix

🏠 Internal

🔬 Output optimization

v8.0.7 (2026-10-07)

🐛 Bug Fix

1.32.2

What's Changed

New Contributors

1.32.1

What's Changed

DOMPurify 3.4.17

v18.1.2

18.1.2 (2026-10-26)

Bug Fixes

Performance Improvements

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

Performance Improvements

v18.1.0

18.1.0 (2026-10-05)

mermaid@12.2.0

Minor Changes

Patch Changes

v4.1.0

Changes:

v4.0.1-6

Changes:

v4.0.1-5

Changes:

v4.0.1-4

Changes:

v4.0.1-3

Changes:

v30.1.3

v30.1.2

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants