Skip to content

build(deps): bump the patch group across 1 directory with 5 updates - #5465

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/patch-44c1aed88c
Closed

build(deps): bump the patch group across 1 directory with 5 updates#5465
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/patch-44c1aed88c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the patch group with 5 updates in the / directory:

Package From To
dayjs 1.11.21 1.11.23
jose 6.2.3 6.2.10
sharp 0.35.2 0.35.4
vue 3.5.38 3.5.42
vitest 4.1.9 4.1.11

Updates dayjs from 1.11.21 to 1.11.23

Release notes

Sourced from dayjs's releases.

v1.11.23

1.11.23 (2026-08-17)

Bug Fixes

  • plugin: timezone plugin prevent RangeError for invalid Day.js values (#3180) (dad46e6)
  • plugin: timezone plugin prevent RangeError for invalid Day.js values (#3180) (#3181) (2a3785f)

v1.11.22

1.11.22 (2026-08-16)

Bug Fixes

  • plugin: timezone compute instance .tz() offset without host DST (#3174) (e27ee80), closes #3169
Changelog

Sourced from dayjs's changelog.

1.11.23 (2026-08-17)

Bug Fixes

  • plugin: timezone plugin prevent RangeError for invalid Day.js values (#3180) (dad46e6)
  • plugin: timezone plugin prevent RangeError for invalid Day.js values (#3180) (#3181) (2a3785f)

1.11.22 (2026-08-16)

Bug Fixes

  • plugin: timezone compute instance .tz() offset without host DST (#3174) (e27ee80), closes #3169
Commits
  • 4549b8d chore(release): 1.11.23 [skip ci]
  • 2a3785f fix(plugin): timezone plugin prevent RangeError for invalid Day.js values (#3...
  • dad46e6 fix(plugin): timezone plugin prevent RangeError for invalid Day.js values (#3...
  • ae3a550 chore(release): 1.11.22 [skip ci]
  • accfc67 D2M (#3177)
  • e27ee80 fix(plugin): timezone compute instance .tz() offset without host DST (#3174)
  • 98364bc chore: update doc
  • f6a1556 chore: update doc
  • 6609c5e chore: update doc
  • See full diff in compare view

Updates jose from 6.2.3 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)
  • jwt: validate unsecured protected headers (230c14e)
  • key: validate generation and import options (15d880e)
  • reject mixed b64 modes for empty General JWS payloads (61a2ef7)
  • x509: reject DER truncated past its outer length (d8db9f6)

Documentation

  • jwks: correct cache timestamp units (01a44d9)

Refactor

  • jose: share binary input validation (eedb124)
  • jose: share compact token processing internals (85e30ed)
  • jwe: consolidate CBC decryption failures (1ee6f61)
  • jwe: specialize compact processing (a998927)
  • jwe: streamline single-recipient encryption (290aaa6)
  • jwks: compact JWK Set shape validation (930c7df), references Array#every
  • jwks: compact local key selection (4cb5ae5)
  • jwks: compact remote resolver state (ef5eaf4)
  • jws: specialize compact processing (021abf4)
  • jwt: compact claim validation helpers (f390683)
  • jwt: consolidate replicated claim checks (7dd5591)
  • jwt: share producer claim state (52ba159)
  • key: compact JWK algorithm selection (a6b29da)
  • key: compact secret length parsing (cc03be8)

6.2.9 (2026-08-15)

... (truncated)

Commits
  • 3eab152 chore(release): 6.2.10
  • 021abf4 refactor(jws): specialize compact processing
  • a998927 refactor(jwe): specialize compact processing
  • eedb124 refactor(jose): share binary input validation
  • 52ba159 refactor(jwt): share producer claim state
  • 85e30ed refactor(jose): share compact token processing internals
  • 0bd81d2 test(jose): cover hidden critical-header options
  • 9cf7876 test(jose): reject callable object impostors
  • f23cafd test(jose): preserve resolved key data properties
  • 1ee6f61 refactor(jwe): consolidate CBC decryption failures
  • Additional commits viewable in compare view

Updates sharp from 0.35.2 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

v0.35.4-rc.0

... (truncated)

Commits
  • 7f1a0a2 Release v0.35.4
  • f927818 Upgrade to sharp-libvips v1.3.3
  • e802092 Prerelease v0.35.4-rc.0
  • e13eb2f CI: Fix wasm32 build (#4589)
  • a82a0b3 Upgrade to libvips v8.18.6
  • 8044fe4 Bound resize dimensions to coordinate limit
  • 147f859 Docs: changelog entries for #4578 #4584
  • ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
  • 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
  • ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
  • Additional commits viewable in compare view

Updates vue from 3.5.38 to 3.5.42

Release notes

Sourced from vue's releases.

v3.5.42

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.41

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.40

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.39

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.42 (2026-08-27)

Bug Fixes

  • hydration: handle async component unmount before lazy hydration (#15252) (6e1814a)
  • hydration: handle moving unresolved async fragment (#15263) (a72036f)
  • runtime-core: avoid caching unmounted suspense children (#15291) (b535917), closes #15288
  • runtime-core: keep .trim result when combined with .number v-model modifier (#15346) (f8d42e1)
  • runtime-core: resolve $el for dev root comment fragment (#15313) (8654f35), closes #12680
  • runtime-dom: support !important on CSS custom properties in style binding (#15348) (31da934)
  • server-renderer: reject CR in attribute names (#15266) (a2b40db)
  • shared: correctly compare Map and Set values (#15328) (ef82a26), closes #15320
  • suspense: don't treat the leaving branch as the fallback while its mount is pending (#15333) (cd19745), closes #15332
  • v-model: re-sync select when model is overridden in change handler (#15298) (6eaecc1), closes #10505

3.5.41 (2026-08-05)

Bug Fixes

3.5.40 (2026-07-16)

Bug Fixes

3.5.39 (2026-06-25)

... (truncated)

Commits
  • d63616c release: v3.5.42
  • b8543dc Revert "fix(compiler-core): handle invalid static arg in same-name v-bind sho...
  • 3857716 fix(compiler-core): handle invalid static arg in same-name v-bind shorthand (...
  • 31da934 fix(runtime-dom): support !important on CSS custom properties in style bindin...
  • f8d42e1 fix(runtime-core): keep .trim result when combined with .number v-model modif...
  • cd19745 fix(suspense): don't treat the leaving branch as the fallback while its mount...
  • 8654f35 fix(runtime-core): resolve $el for dev root comment fragment (#15313)
  • ef82a26 fix(shared): correctly compare Map and Set values (#15328)
  • 6eaecc1 fix(v-model): re-sync select when model is overridden in change handler (#15298)
  • b535917 fix(runtime-core): avoid caching unmounted suspense children (#15291)
  • Additional commits viewable in compare view

Updates vitest from 4.1.9 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

    View changes on GitHub

v4.1.10

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • 9bd8d46 chore: release v4.1.11 (#10995)
  • 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
  • db616d2 chore: release v4.1.10 (#10718)
  • bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the patch group across 1 directory with 5 updates
4d4226e 
Bumps the patch group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [dayjs](https://github.com/iamkun/dayjs) | `1.11.21` | `1.11.23` |
| [jose](https://github.com/panva/jose) | `6.2.3` | `6.2.10` |
| [sharp](https://github.com/lovell/sharp) | `0.35.2` | `0.35.4` |
| [vue](https://github.com/vuejs/core) | `3.5.38` | `3.5.42` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.9` | `4.1.11` |



Updates `dayjs` from 1.11.21 to 1.11.23
- [Release notes](https://github.com/iamkun/dayjs/releases)
- [Changelog](https://github.com/iamkun/dayjs/blob/v1.11.23/CHANGELOG.md)
- [Commits](iamkun/dayjs@v1.11.21...v1.11.23)

Updates `jose` from 6.2.3 to 6.2.10
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.3...v6.2.10)

Updates `sharp` from 0.35.2 to 0.35.4
- [Release notes](https://github.com/lovell/sharp/releases)
- [Commits](lovell/sharp@v0.35.2...v0.35.4)

Updates `vue` from 3.5.38 to 3.5.42
- [Release notes](https://github.com/vuejs/core/releases)
- [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md)
- [Commits](vuejs/core@v3.5.38...v3.5.42)

Updates `vitest` from 4.1.9 to 4.1.11
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest)

---
updated-dependencies:
- dependency-name: dayjs
  dependency-version: 1.11.23
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch
- dependency-name: jose
  dependency-version: 6.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch
- dependency-name: sharp
  dependency-version: 0.35.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch
- dependency-name: vue
  dependency-version: 3.5.42
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: patch
- dependency-name: vitest
  dependency-version: 4.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added area/frontend Needs frontend code changes dependency-upgrade Dependency upgrade is needed labels Sep 2, 2026
@kestrabot kestrabot Bot added this to Pull Requests Sep 2, 2026
@github-project-automation github-project-automation Bot moved this to To review in Pull Requests Sep 2, 2026
@github-actions

github-actions Bot commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

🔦 Lighthouse Benchmark

Tested: http://localhost:8787 on 2026-09-02 06:16 UTC
Compared against main baseline from 2026-09-01

Scores (0–100, higher is better)

Page Performance Accessibility Best Practices SEO
Home 81 🟢 +17 84 54 92
Get Started 62 83 54 100
Pricing 98 92 54 100
Enterprise 97 83 54 100
Cloud 91 80 54 100
About Us 85 91 54 100
Docs Landing 96 🟢 +96 88 54 92
Contribute to Kestra (simple docs) 98 88 54 92
Flow (full featured docs) 95 90 54 92
Blog Index 66 91 54 100
Blog Post (sample) 89 88 54 100
VS Page (sample) 97 88 54 100
Plugins Landing 89 81 54 92
Plugin Page (sample) 94 88 54 100
Plugin Debug Page (sample) 92 88 54 100
Plugin Debug Return Page (sample) 92 88 58 100
Blueprints Landing 77 91 54 100
Blueprint Audit Logs CSV Export 0 0 0 0

Core Web Vitals (lower is better)

Page LCP FCP TBT CLS Speed Index
Home 1.39 s 0.65 s 305 ms 🟢 0.000 1.70 s
Get Started 2.03 s 0.64 s 850 ms 0.000 1.09 s
Pricing 1.09 s 0.56 s 55 ms 🔻 0.000 0.77 s
Enterprise 1.20 s 0.62 s 41 ms 🔻 0.003 0.76 s
Cloud 1.96 s 0.64 s 42 ms 🔻 0.001 0.96 s
About Us 2.72 s 0.68 s 26 ms 0.000 0.84 s
Docs Landing 0.98 s 0.54 s 131 ms 0.000 1.00 s
Contribute to Kestra (simple docs) 1.04 s 0.62 s 42 ms 🟢 0.003 0.79 s
Flow (full featured docs) 1.13 s 0.54 s 121 ms 0.000 1.13 s
Blog Index 15.62 s 0.60 s 35 ms 🟢 0.000 4.23 s 🔻
Blog Post (sample) 2.23 s 🔻 0.55 s 26 ms 0.000 0.75 s
VS Page (sample) 1.07 s 0.64 s 44 ms 0.064 0.74 s
Plugins Landing 0.96 s 0.61 s 136 ms 🔻 0.000 2.87 s
Plugin Page (sample) 0.94 s 0.58 s 35 ms 0.000 2.26 s
Plugin Debug Page (sample) 0.95 s 0.63 s 134 ms 🔻 0.000 2.20 s
Plugin Debug Return Page (sample) 0.93 s 0.63 s 119 ms 🔻 0.000 2.48 s
Blueprints Landing 2.41 s 1.03 s 38 ms 0.000 3.80 s
Blueprint Audit Logs CSV Export 0.00 s 0.00 s 0 ms 0.000 0.00 s
Legend

🟢 improved  ·  🔻 regressed  ·  (blank) no significant change
Score threshold: ±10 pts  ·  Metric threshold: ±30% of baseline

View full Lighthouse HTML report for a page

Full per-page Lighthouse Results (LHR) are attached as the lhr-reports artifact on this run. Download and unzip it, then open https://googlechrome.github.io/lighthouse/viewer/ and drop the <page>-lhr.json file into the page to see every audit, opportunity, and diagnostic.

@dependabot @github

dependabot Bot commented on behalf of github Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 7, 2026
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/patch-44c1aed88c branch September 7, 2026 14:35
@github-project-automation github-project-automation Bot moved this from To review to Done in Pull Requests Sep 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

area/frontend Needs frontend code changes dependency-upgrade Dependency upgrade is needed

Projects

Pull Requests
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants