Bump the npm_and_yarn group across 1 directory with 8 updates by dependabot[bot] · Pull Request #16 · modelcontextprotocol/ext-tasks

dependabot · 2026-08-20T02:35:18Z

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package	From	To
mermaid	`11.15.0`	`11.17.0`
@hono/node-server	`1.19.14`	`1.19.17`
brace-expansion	`2.1.0`	`2.1.4`
brace-expansion	`5.0.6`	`5.0.9`
dompurify	`3.4.12`	`3.4.14`
fast-uri	`3.1.2`	`3.1.5`
hono	`4.12.30`	`4.13.3`
ip-address	`10.2.0`	`10.5.0`
postcss	`8.5.15`	`8.5.26`

Updates mermaid from 11.15.0 to 11.17.0

Release notes

Sourced from mermaid's releases.

mermaid@11.17.0

Minor Changes

#7842 3670b4e Thanks @filipsajdak! - feat(c4): render C4 elements through the unified shape system, using the new person shape

#7812 cdfc0ea Thanks @knsv-bot! - feat(class): route classDiagram to the unified (v2) renderer by default

Set class: { defaultRenderer: 'dagre-d3' } in the config to restore the legacy renderer.

#7785 c45cde9 Thanks @knsv-bot! - feat(flowchart): add collapsible flowchart subgraphs via subgraphId@{ view: collapsed }

#7828 8eb3afc Thanks @knsv-bot! - feat(elk): add elk.keepEntryNodeOnTop config option to keep a recursive flow's entry node on top

#7803 74e44eb Thanks @knsv-bot! - feat(elk): add elk.nodePlacementAlignment config option

#7792 ea55b31 Thanks @RodrigojndSantos! - feat(er): add subgraph support to ER diagrams.

#7970 a2c0fb6 Thanks @filipsajdak! - feat(flowchart): add folder, bucket, console (terminal window) and browser shapes

#7842 ae3e115 Thanks @filipsajdak! - feat(flowchart): add person shape (circular head above a rounded body), usable in flowcharts via A@{ shape: person }

#7724 0fd7a9f Thanks @xdumaine! - feat(xyChart): add legends for named line and bar series

Patch Changes

#7847 215fe89 Thanks @filipsajdak! - fix(c4): named attributes such as $tags, $link and $sprite are no longer clobbered to undefined when they arrive in an earlier positional slot of Person/System/Container/Component/Boundary/Rel statements.

#7871 8d874c4 Thanks @knsv-bot! - fix(flowchart): stop dagre layout from spamming warn-level logs on every node/edge/cluster

#8071 b3d1f63 Thanks @pbrolin47! - fix(block): sibling blocks overlapping in block diagrams when one has a label wider than 200px

#7870 71b8843 Thanks @knsv-bot! - fix: a RangeError: Invalid array length crash when rendering certain edges.

#7924 9cbef5d Thanks @nightt5879! - fix(treeView): icons disappearing after strict security sanitization.

#7850 a34cbf0 Thanks @aloisklink! - fix(block): allow classdefs to update text color

#7937 f9cbe1e Thanks @filipsajdak! - fix(dagre): let a diagram's own nodeSpacing/rankSpacing take effect in the unified dagre layout

#8005 90eeece Thanks @pbrolin47! - fix(flowchart): reverts the behavior change from #7672 (fix/4648-directions), since arrows between subgraphs are broken

#7951 afa2f80 Thanks @aloisklink! - perf: use fastdom to batch DOM measurements (up to 25% speedup)

Updated dependencies [e848423]:

@mermaid-js/parser@1.2.1

mermaid@11.16.1

Patch Changes

#8022 12d472c Thanks @aloisklink! - fix: handle CSS sibling combinators in compileCSS

... (truncated)

Commits

293b1c1 Merge pull request #8074 from mermaid-js/changeset-release/master
f484a36 Version Packages
0a07bf6 Bump layout-elk version (#8078)
1127c5f Merge pull request #8071 from mermaid-js/release/11.17.0
8628ef1 docs: remove C4 typescript conversion changeset
349ebd3 docs: remove non-user visible changeset
b5a744a docs: scope to all v11.17.0 changeset messages
4150c73 Make changesets less verbose
7ba4b6f [autofix.ci] apply automated fixes
b3d1f63 Fixed block rendering due to failing SS in applitools
Additional commits viewable in compare view

Updates @hono/node-server from 1.19.14 to 1.19.17

Commits

71941da 1.19.17
0208500 ci: add stage option for publishing (#386)
cbdf713 1.19.16
86e96c2 ci: add an action for trusted publisher (#385)
99c1a1a ci: run on v1.x branch pushes
84cb2ee Merge commit from fork
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @hono/node-server since your current version.

Updates brace-expansion from 2.1.0 to 2.1.4

Release notes

Sourced from brace-expansion's releases.

v2.1.1

Backport v5.0.6 change to v2 (#109) c3a817c

juliangruber/brace-expansion@v2.1.0...v2.1.1

Commits

b25213d 2.1.4
1e30c93 Merge commit from fork
878df39 2.1.3
c8bd93c npm ignore .claude
d13ff45 fix: backport GHSA-mh99-v99m-4gvg (#130)
9e67a3b 2.1.2
835d6be fix: v2 backport for CVE-2026-13149 (#123)
64b71d3 2.1.1
c3a817c Backport v5.0.6 change to v2 (#109)
See full diff in compare view

Updates brace-expansion from 5.0.6 to 5.0.9

Release notes

Sourced from brace-expansion's releases.

v2.1.1

Backport v5.0.6 change to v2 (#109) c3a817c

juliangruber/brace-expansion@v2.1.0...v2.1.1

Commits

b25213d 2.1.4
1e30c93 Merge commit from fork
878df39 2.1.3
c8bd93c npm ignore .claude
d13ff45 fix: backport GHSA-mh99-v99m-4gvg (#130)
9e67a3b 2.1.2
835d6be fix: v2 backport for CVE-2026-13149 (#123)
64b71d3 2.1.1
c3a817c Backport v5.0.6 change to v2 (#109)
See full diff in compare view

Updates dompurify from 3.4.12 to 3.4.14

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.14

Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @AlirezaRouhbakhsh

Fixed a couple of edge cases with mixed document contexts, thanks @fishjojo1

Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @Jaybhade

Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation

Updated the documentation in several spots, README, wiki, etc., thanks @Akokonunes

Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

Fixed an issue with hook removal during IN_PLACE sanitization, thanks @koyokr

Fixed an issue with hooks potentially bypassing the clone guard, thanks @AkshayjainG

Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @AkshayjainG

Bumped several dependencies where possible

Commits

4e6fe24 release: 3.4.14 (#1587)
3067f77 release: 3.4.13 (#1562)
See full diff in compare view

Updates fast-uri from 3.1.2 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

Commits

5e179cb Bumped v3.1.5
2cad02d Merge commit from fork
6aeece6 Bumped v3.1.4
2d50fba fix: reject literal backslash in URI authority
0549fe3 Bumped v3.1.3
2a6d357 Merge commit from fork
See full diff in compare view

Updates hono from 4.12.30 to 4.13.3

Release notes

Sourced from hono's releases.

v4.13.3

What's Changed

fix(client): prevent URL corruption when replaceUrlParam contains $ replacement tokens in honojs/hono#5227

fix(etag): copy pending stream bytes in honojs/hono#5239

fix(etag): avoid skipping headers when filtering 304 response headers in honojs/hono#5234

fix(cors): append Origin to Vary header on OPTIONS preflight in honojs/hono#5235

docs(context): add custom headers append option example to Context JSDoc in honojs/hono#5248

fix(trie-router): match suffix wildcard routes in honojs/hono#5236

fix(pattern-router/linear-router): prevent prefix overmatch on wildcard routes in honojs/hono#5252

fix(csrf): exempt OPTIONS request from CSRF validation in honojs/hono#5250

fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expand IPv6 in honojs/hono#5247

feat(pretty-json): support structured JSON content-types (+json) in honojs/hono#5226

Full Changelog: honojs/hono@v4.13.2...v4.13.3

v4.13.2

What's Changed

fix(secure-headers): output standard empty parentheses () instead of none for disabled Permissions-Policy directives in honojs/hono#5197

fix(jsx): render async children of document metadata tags instead of [object Promise] in honojs/hono#5204

fix(etag): resolve incorrect incremental hashing for chunked responses in honojs/hono#5199

fix(client): serialize multiple cookies correctly in honojs/hono#5202

fix(etag): stabilize digest across stream chunks in honojs/hono#5205

fix(url): strip trailing question mark correctly for optional params with regex quantifiers in honojs/hono#5209

perf(cors): pre-join static array header options during initialization in honojs/hono#5210

fix(client): send falsy JSON bodies in honojs/hono#5215

feat(secure-headers): add missing W3C Permissions-Policy directives in honojs/hono#5214

Full Changelog: honojs/hono@v4.13.1...v4.13.2

v4.13.1

What's Changed

fix(trie-router): count every slash a pattern consumes by @Jaybhade in honojs/hono#5189

fix(utils/stream): re-acquire writer lock when pipe() throws by @Sriharsha-dev369 in honojs/hono#4988

fix(etag): skip unsafe methods or error responses on non-* case by @na-trium-144 in honojs/hono#5196

New Contributors

@Jaybhade made their first contribution in honojs/hono#5189

@Sriharsha-dev369 made their first contribution in honojs/hono#4988

Full Changelog: honojs/hono@v4.13.0...v4.13.1

v4.13.0

Hono v4.13.0 is now available!

The highlight of this release is performance: a batch of low-level optimizations makes the core request/response path significantly faster — up to 1.25x on common routes in our benchmark. This release also adds first-class support for the HTTP QUERY method, defined in RFC 10008, a new Method Not Allowed middleware, and more.

Performance improvements

This release includes a series of small optimizations: skipping unnecessary Headers allocations, replacing regex tests with indexOf, allocating internal state lazily, and more.

... (truncated)

Commits

0293343 4.13.3
5ad469a feat(pretty-json): support structured JSON content-types (+json) (#5226)
c91ec9b fix(utils/ipaddr): avoid truncation on embedded IPv4 addresses in expandIPv6 ...
eea9735 fix(csrf): exempt OPTIONS request from CSRF validation (#5250)
a194628 fix(pattern-router/linear-router): prevent prefix overmatch on wildcard route...
63bbcf5 fix(trie-router): match suffix wildcard routes (#5236)
ef0739d docs(context): add custom headers append option example to Context JSDoc (#5248)
8bf03c3 fix(cors): append Origin to Vary header on OPTIONS preflight (#5235)
546eca0 fix(etag): avoid skipping headers when filtering 304 response headers (#5234)
7195c24 fix(etag): copy pending stream bytes (#5239)
Additional commits viewable in compare view

Updates ip-address from 10.2.0 to 10.5.0

Release notes

Sourced from ip-address's releases.

v10.5.0

What's Changed

Honor the fromURL graceful-failure contract for non-IPv6 hosts by @beaugunderson in beaugunderson/ip-address#218

Correct the documentation where it disagreed with the library by @beaugunderson in beaugunderson/ip-address#219

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

Add GitHub Actions CI by @beaugunderson in beaugunderson/ip-address#213

Keep the package loadable on node 12, and enforce it by @beaugunderson in beaugunderson/ip-address#216

Validate the byte arrays Address6 is given by @beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

ef98e0a 10.5.0
9fd1110 Correct the documentation where it disagreed with the library (#219)
d478737 Honor the fromURL graceful-failure contract for non-IPv6 hosts (#218)
fbb8db2 10.4.0
45a2b11 Validate the byte arrays Address6 is given (#217)
bac8810 Keep the package loadable on node 12, and enforce it (#216)
9b3d848 Add a security policy and a README section on security posture
e84a7b3 Order the README API reference Address4, Address6, AddressError
015160b Collapse each class in the README API reference
34061a8 Pin checkout and setup-node to commits in the release job
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates postcss from 8.5.15 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

Fixed putting parent-less node in nodes of new node (by @MahinAnowar).

Fixed computing offset in positionBy() (by @greymoth-jp).

Fixed rangeBy() on index: 0 (by @sarathfrancis90).

Changelog

Sourced from postcss's changelog.

8.5.26

Fixed list.split() regression (by @lazerg).

Track symlinks in path protection in source map loading (by @drengir1).

8.5.25

Fixed 8.5.17 visitor regression.

Fixed list.split() for non-string values (by @amir-rezaei).

8.5.24

Preserve the BOM after the processing (by @hdimer).

8.5.23

Do not load source map without opts.from for security reasons.

8.5.22

Fixed custom property losing semicolon before a comment (by @sarathfrancis90).

8.5.21

Fixed childless at-rule losing semicolon before comment (by @sarathfrancis90).

Fixed docs (by @isker).

8.5.20

Fixed missing space if AtRule#params is set after (by @sarathfrancis90).

Fixed mixing AST error on warnings (by @MahinAnowar).

8.5.19

Fixed cleaning before for new nodes inserted to Root (by @MahinAnowar).

8.5.18

Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

Fixed Maximum call stack size exceeded error.

Fixed Prototype hijacking for postcss.fromJSON().

Fixed Input#origin() for unmapped end position (by @chatman-media).

8.5.16

Fixed Input#origin() position (by @mizdra).

Fixed raws after rehydrating a JSON AST (by @sarathfrancis90).

... (truncated)

Commits

07b2577 Release 8.5.26 version
47de6b9 Update CI
1493a83 Fix Rule#selectors losing the empty selector (#2129)
180db16 Typo
29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
3ba8f84 Update dependencies
87e72f6 Update lock file
caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
3609b6f Explain how to type plugin options
fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [mermaid](https://github.com/mermaid-js/mermaid) | `11.15.0` | `11.17.0` | | [@hono/node-server](https://github.com/honojs/node-server) | `1.19.14` | `1.19.17` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.1.0` | `2.1.4` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.6` | `5.0.9` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.12` | `3.4.14` | | [fast-uri](https://github.com/fastify/fast-uri) | `3.1.2` | `3.1.5` | | [hono](https://github.com/honojs/hono) | `4.12.30` | `4.13.3` | | [ip-address](https://github.com/beaugunderson/ip-address) | `10.2.0` | `10.5.0` | | [postcss](https://github.com/postcss/postcss) | `8.5.15` | `8.5.26` | Updates `mermaid` from 11.15.0 to 11.17.0 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.15.0...mermaid@11.17.0) Updates `@hono/node-server` from 1.19.14 to 1.19.17 - [Release notes](https://github.com/honojs/node-server/releases) - [Commits](honojs/node-server@v1.19.14...v1.19.17) Updates `brace-expansion` from 2.1.0 to 2.1.4 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.0...v2.1.4) Updates `brace-expansion` from 5.0.6 to 5.0.9 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v2.1.0...v2.1.4) Updates `dompurify` from 3.4.12 to 3.4.14 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.12...3.4.14) Updates `fast-uri` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](fastify/fast-uri@v3.1.2...v3.1.5) Updates `hono` from 4.12.30 to 4.13.3 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.12.30...v4.13.3) Updates `ip-address` from 10.2.0 to 10.5.0 - [Release notes](https://github.com/beaugunderson/ip-address/releases) - [Commits](beaugunderson/ip-address@v10.2.0...v10.5.0) Updates `postcss` from 8.5.15 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.15...8.5.26) --- updated-dependencies: - dependency-name: mermaid dependency-version: 11.17.0 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@hono/node-server" dependency-version: 1.19.17 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.1.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.9 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: dompurify dependency-version: 3.4.14 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hono dependency-version: 4.13.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip-address dependency-version: 10.5.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-version: 8.5.26 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 20, 2026

LucaButBoring approved these changes Aug 20, 2026

View reviewed changes

LucaButBoring merged commit dcc8d2b into main Aug 20, 2026
2 checks passed

LucaButBoring deleted the dependabot/npm_and_yarn/npm_and_yarn-3f33e09374 branch August 20, 2026 03:12

Navigation Menu

Uh oh!

Bump the npm_and_yarn group across 1 directory with 8 updates - #16

Bump the npm_and_yarn group across 1 directory with 8 updates#16
LucaButBoring merged 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-3f33e09374

dependabot Bot commented on behalf of github Aug 20, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 20, 2026

mermaid@11.17.0

Minor Changes

Patch Changes

mermaid@11.16.1

Patch Changes

v2.1.1

v2.1.1

DOMPurify 3.4.14

DOMPurify 3.4.13

v3.1.5

⚠️ Security Warning

v3.1.4

⚠️ Security Release

v3.1.3

⚠️ Security Release

v4.13.3

What's Changed

v4.13.2

What's Changed

v4.13.1

What's Changed

New Contributors

v4.13.0

Performance improvements

v10.5.0

What's Changed

v10.4.0

What's Changed

v10.3.1

v10.3.0

v10.2.2

v10.2.1

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

8.5.26

8.5.25

8.5.24

8.5.23

8.5.22

8.5.21

8.5.20

8.5.19

8.5.18

8.5.17

8.5.16

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant