[dependabot]

Bumps the npm_and_yarn group with 4 updates in the / directory: @vue/server-renderer, brace-expansion, postcss-selector-parser and source-map-js.

Updates @vue/server-renderer from 3.5.38 to 3.5.44

Release notes

Sourced from @​vue/server-renderer's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.43

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.41

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.40

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.39

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from @​vue/server-renderer's changelog.

3.5.44 (2026-10-13)

Bug Fixes

• compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)
• compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723
• compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)
• compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)
• compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602
• custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775
• hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)
• KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710
• reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643
• reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009
• reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)
• reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792
• runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632
• runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551
• runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728
• runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)
• runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)
• runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)
• server-renderer: propagate async setup errors (#15857) (6930374), closes #15716
• ssr: honor falsy vnode content overrides (#15769) (c11c5c8)
• suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639
• suspense: skip rendering async components unmounted while pending (4ab865a)
• teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817
• transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531
• transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500

3.5.43 (2026-09-17)

Bug Fixes

• compiler-sfc: ignore comment delimiters inside strings and url() when parsing css vars (#15548) (2fde323)
• compiler-sfc: prepend semicolon for await in switch case (#15498) (9a1df69), closes #15495
• compiler-sfc: restore await scope when leaving nested blocks (5409708), closes #15465
• compiler-sfc: reuse parsed parent configs across tsconfig walks (fix #15478) (#15480) (d6febaa)
• hydration: run leave hooks for hydration placeholders (#15431) (5dda192)
• reactivity: preserve readonly wrappers in array copy methods (#15469) (599f35b)
• runtime-core: unmount v-once children after parent rerenders (#15435) (d720338)
• shared: handle circular references in looseEqual (#15499) (718f782), closes #15496
• shared: preserve comment-like text in style values (#15471) (b9456cb)
• suspense: don't drop nested suspense patches during hydration (#15429) (76d42dc)
• suspense: keep the boundary pending while its branch is patched (#15411) (bfcfe9e), closes #7506
• suspense: patch a hydrating boundary's pending branch in place (#15432) (2cde6f7)
• suspense: unmount the DOM an interrupted async component claimed (#15430) (fb9b45c)
• types: keep optional props when a runtime prop uses a generic PropType (#15523) (243aabc), closes #9546

3.5.42 (2026-08-27)

... (truncated)

Commits

• bf5f0dd release: v3.5.44
• 6930374 fix(server-renderer): propagate async setup errors (#15857)
• c11c5c8 fix(ssr): honor falsy vnode content overrides (#15769)
• ad19e7d fix(runtime-core): render nothing for an invalid v-for range in production (#...
• a084e44 fix(runtime-dom): treat playsinline as a boolean attribute (#15627)
• 5be58b4 release: v3.5.43
• d63616c release: v3.5.42
• a2b40db fix(server-renderer): reject CR in attribute names (#15266)
• d2c458b release: v3.5.41
• 4e467d7 fix(ssr): normalize hidden states during hydration (#13125)
• Additional commits viewable in compare view

Updates brace-expansion from 5.0.8 to 5.0.12

Commits

• f341015 5.0.12
• 33a5ef1 Merge commit from fork
• 8247927 5.0.11
• 935d78f Merge commit from fork
• df7682f 5.0.10
• 1ade9de npm run format
• 6735c94 Merge commit from fork
• 4e70465 chore: ensure prettier formatting (#154)
• fd7a5e3 Bump ip-address from 10.2.0 to 10.4.0 (#152)
• 1790143 Bump uuid and @​tapjs/processinfo (#120)
• Additional commits viewable in compare view

Updates postcss-selector-parser from 7.1.4 to 7.1.6

Release notes

Sourced from postcss-selector-parser's releases.

7.1.6

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5

• fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

Changelog

Sourced from postcss-selector-parser's changelog.

7.1.6 - 2026-09-03

• fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (GHSA-rj75-hqrm-r3gf, reported by Wayde Shi)

7.1.5 - 2026-08-07

• fix: don't treat a non-prefix token before | as a namespace (#324 by @​spokodev)
• fix: preserve whitespace before a * namespace in attribute selectors (#325 by @​spokodev)
• fix: TypeError on unclosed [, ( and trailing | (#330 by @​theRizwan)

Commits

• 4eb3468 7.1.6
• 62b1917 fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability
• e33e9bc 7.1.5
• 6f4e6c1 fix: TypeError on unclosed [, ( and trailing | (#330)
• 4d8437f fix: preserve whitespace before a * namespace in attribute selectors (#325)
• e2f9029 fix: don't treat a non-prefix token before | as a namespace (#324)
• dd50ee1 chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (#331)
• 7e3abb2 chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (#328)
• See full diff in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Commits

• 0a1d334 1.2.2
• 4c6fa26 Update changelog
• cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
• 7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.