alex/opengist
Watch
1
0
Fork
You've already forked opengist
 0
Code Issues 1 Pull requests 3 Projects Packages 1 Activity Actions

fix(deps): update all non-major dependencies #31

Merged
alex merged 1 commit from renovate/all-non-major-dependencies into devel 2026-07-13 08:54:14 +00:00
Conversation 0 Commits 1 Files changed 5 +21 -25
alex commented 2026-07-11 02:09:24 +00:00
Owner
Copy link

This PR contains the following updates:

Package Change Age Confidence Type Update
dompurify 3.4.11 → 3.4.12 age confidence devDependencies patch
github.com/labstack/echo/v4 v4.15.0 → v4.15.4 age confidence require patch
github.com/labstack/echo/v5 v5.2.1 → v5.3.0 age confidence require minor
github.com/yuin/goldmark v1.8.2 → v1.8.4 age confidence require patch
marked (source) 18.0.5 → 18.0.6 age confidence devDependencies patch
postgresql (source) 18.7.12 → 18.7.13 age confidence patch
vite (source) 8.1.3 → 8.1.4 age confidence devDependencies patch

Release Notes

cure53/DOMPurify (dompurify)

v3.4.12: DOMPurify 3.4.12

Compare Source

  • Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
  • Hardened the handling of hooks removing elements, @​mkrause-bee360
  • Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
  • Hardened the handling of declarative partial updates
  • Updated the documentation is several spots, README, wiki, etc.
  • Bumped several dependencies where possible
labstack/echo (github.com/labstack/echo/v4)

v4.15.4

Compare Source

Security

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#​3016, released in v5.2.1). Thanks to @​a-tt-om and @​oran-gugu for reporting.

Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent.

Given following situation:

// 0.
// given folder structure:
// private.txt
// public/
// public/index.html
// public/text.txt
// public/admin/private.txt

// 1. share `public/` folder contents from the server root. This folder actually contains subfolder `admin` which
// contents we want to forbid from downloading
e.Static("/", "public")

// 2. naively assume that everything under /admin folder is now forbidden
e.GET("/admin/*", func(c *Context) error {
    return ErrForbidden
})

Then requests to /admin%2fprivate.txt would not be matched to GET /admin/* route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file.

Note: this way of "guarding" subfolders will never work for for paths like /assets/../admin%2fprivate.txt which will path.Clean("/assets/../admin%2fprivate.txt") to /admin/private.txt and are servable if static file serving is configured to unescape paths.

If you want to guard routes - use middlewares on Static* methods and before Static middleware.

Breaking change / migration: If you serve files whose names contain URL-encoded characters (e.g., /hello%20world.txt → hello world.txt), you must now opt in:

	e := echo.New()
	e.EnablePathUnescapingStaticFiles = true  // <-- enable old behavior
	e.Static("/", "public")

for static middleware

	e.Use(middleware.StaticWithConfig(middleware.StaticConfig{
		EnablePathUnescaping: true, // <-- enable old behavior
	}))

Full Changelog: https://github.com/labstack/echo/compare/v4.15.3...v4.15.4

v4.15.3: - Static encoded-separator route bypass fix (GHSA-vfp3-v2gw-7wfq)

Compare Source

Security

  • fix(static): reject encoded path separators that bypass route-level middleware by @​vishr in #​3011

Fixes GHSA-vfp3-v2gw-7wfq: an encoded path separator (%2F or %5C) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both StaticDirectoryHandler (used by Static/StaticFS) and the Static middleware are affected. Backport of the v5 fix (#​3009, released in v5.2.0). Thanks to @​a-tt-om and @​oran-gugu for reporting.

Full Changelog: https://github.com/labstack/echo/compare/v4.15.2...v4.15.3

v4.15.2: - Context.Scheme() header validation

Compare Source

Security

Thanks to @​shblue21 for reporting this issue.

Full Changelog: https://github.com/labstack/echo/compare/v4.15.1...v4.15.2

v4.15.1

Compare Source

What's Changed

  • CSRF: support older token-based CSRF protection handler that want to render token into template by @​aldas in #​2905

Full Changelog: https://github.com/labstack/echo/compare/v4.15.0...v4.15.1

yuin/goldmark (github.com/yuin/goldmark)

v1.8.4

Compare Source

fix: disable svg in data:image urls

v1.8.3

Compare Source

Full Changelog: https://github.com/yuin/goldmark/compare/v1.8.2...v1.8.3

markedjs/marked (marked)

v18.0.6

Compare Source

Bug Fixes
  • Avoid O(n^2) backtracking in inline link href regex (#​4013) (a009808)
  • Fix ordered lists after blockquotes (#​4003) (33928d0)
  • keep trailing text on HTML block close line for PI, declarations, and CDATA (#​3991) (bbb84c8)
vitejs/vite (vite)

v8.1.4

Compare Source

Features
Bug Fixes
Documentation
Miscellaneous Chores
Code Refactoring
Tests
Build System

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • "before 5am"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | Type | Update | |---|---|---|---|---|---| | [dompurify](https://github.com/cure53/DOMPurify) | [`3.4.11` → `3.4.12`](https://renovatebot.com/diffs/npm/dompurify/3.4.11/3.4.12) | ![age](https://developer.mend.io/api/mc/badges/age/npm/dompurify/3.4.12?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/dompurify/3.4.11/3.4.12?slim=true) | devDependencies | patch | | [github.com/labstack/echo/v4](https://github.com/labstack/echo) | `v4.15.0` → `v4.15.4` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2flabstack%2fecho%2fv4/v4.15.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2flabstack%2fecho%2fv4/v4.15.0/v4.15.4?slim=true) | require | patch | | [github.com/labstack/echo/v5](https://github.com/labstack/echo) | `v5.2.1` → `v5.3.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2flabstack%2fecho%2fv5/v5.3.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2flabstack%2fecho%2fv5/v5.2.1/v5.3.0?slim=true) | require | minor | | [github.com/yuin/goldmark](https://github.com/yuin/goldmark) | `v1.8.2` → `v1.8.4` | ![age](https://developer.mend.io/api/mc/badges/age/go/github.com%2fyuin%2fgoldmark/v1.8.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/github.com%2fyuin%2fgoldmark/v1.8.2/v1.8.4?slim=true) | require | patch | | [marked](https://marked.js.org) ([source](https://github.com/markedjs/marked)) | [`18.0.5` → `18.0.6`](https://renovatebot.com/diffs/npm/marked/18.0.5/18.0.6) | ![age](https://developer.mend.io/api/mc/badges/age/npm/marked/18.0.6?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/marked/18.0.5/18.0.6?slim=true) | devDependencies | patch | | [postgresql](https://github.com/bitnami/charts) ([source](https://github.com/bitnami/charts/tree/HEAD/bitnami/postgresql)) | `18.7.12` → `18.7.13` | ![age](https://developer.mend.io/api/mc/badges/age/docker/registry-1.docker.io%2fbitnamicharts%2fpostgresql/18.7.13?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/docker/registry-1.docker.io%2fbitnamicharts%2fpostgresql/18.7.12/18.7.13?slim=true) | | patch | | [vite](https://vite.dev) ([source](https://github.com/vitejs/vite/tree/HEAD/packages/vite)) | [`8.1.3` → `8.1.4`](https://renovatebot.com/diffs/npm/vite/8.1.3/8.1.4) | ![age](https://developer.mend.io/api/mc/badges/age/npm/vite/8.1.4?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/vite/8.1.3/8.1.4?slim=true) | devDependencies | patch | --- ### Release Notes <details> <summary>cure53/DOMPurify (dompurify)</summary> ### [`v3.4.12`](https://github.com/cure53/DOMPurify/releases/tag/3.4.12): DOMPurify 3.4.12 [Compare Source](https://github.com/cure53/DOMPurify/compare/3.4.11...3.4.12) - Fixed an issue where a hook would not get called for custom elements, thanks [@&#8203;Rikuxx0](https://github.com/Rikuxx0) - Hardened the handling of hooks removing elements, [@&#8203;mkrause-bee360](https://github.com/mkrause-bee360) - Added support for a few new SVG attributes, thanks [@&#8203;cbn-falias](https://github.com/cbn-falias) & [@&#8203;Develop-KIM](https://github.com/Develop-KIM) - Hardened the handling of declarative partial updates - Updated the documentation is several spots, README, wiki, etc. - Bumped several dependencies where possible </details> <details> <summary>labstack/echo (github.com/labstack/echo/v4)</summary> ### [`v4.15.4`](https://github.com/labstack/echo/releases/tag/v4.15.4) [Compare Source](https://github.com/labstack/echo/compare/v4.15.3...v4.15.4) **Security** Fixes [GHSA-vfp3-v2gw-7wfq](https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq): an encoded path separator (`%2F` or `%5C`) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both `StaticDirectoryHandler` (used by `Static`/`StaticFS`) and the `Static` middleware are affected. Backport of the v5 fix ([#&#8203;3016](https://github.com/labstack/echo/pull/3016), released in v5.2.1). Thanks to [@&#8203;a-tt-om](https://github.com/a-tt-om) and [@&#8203;oran-gugu](https://github.com/oran-gugu) for reporting. *** Make serving static file releated methods and middleware not unescape path by default - so how the way Router interprets paths and Static methods/middleware is consistent. Given following situation: ```go // 0. // given folder structure: // private.txt // public/ // public/index.html // public/text.txt // public/admin/private.txt // 1. share `public/` folder contents from the server root. This folder actually contains subfolder `admin` which // contents we want to forbid from downloading e.Static("/", "public") // 2. naively assume that everything under /admin folder is now forbidden e.GET("/admin/*", func(c *Context) error { return ErrForbidden }) ``` Then requests to `/admin%2fprivate.txt` would not be matched to `GET /admin/*` route (routing does not look unescaped path) and static file serving will use unescaped path to serve the file. Note: this way of "guarding" subfolders will never work for for paths like `/assets/../admin%2fprivate.txt` which will `path.Clean("/assets/../admin%2fprivate.txt")` to `/admin/private.txt` and are servable if static file serving is configured to unescape paths. If you want to guard routes - use middlewares on `Static*` methods and before `Static` middleware. **Breaking change / migration:** If you serve files whose names contain URL-encoded characters (e.g., `/hello%20world.txt` → `hello world.txt`), you must now opt in: ```go e := echo.New() e.EnablePathUnescapingStaticFiles = true // <-- enable old behavior e.Static("/", "public") ``` for static middleware ```go e.Use(middleware.StaticWithConfig(middleware.StaticConfig{ EnablePathUnescaping: true, // <-- enable old behavior })) ``` **Full Changelog**: <https://github.com/labstack/echo/compare/v4.15.3...v4.15.4> ### [`v4.15.3`](https://github.com/labstack/echo/releases/tag/v4.15.3): - Static encoded-separator route bypass fix (GHSA-vfp3-v2gw-7wfq) [Compare Source](https://github.com/labstack/echo/compare/v4.15.2...v4.15.3) #### Security - fix(static): reject encoded path separators that bypass route-level middleware by [@&#8203;vishr](https://github.com/vishr) in [#&#8203;3011](https://github.com/labstack/echo/pull/3011) Fixes [GHSA-vfp3-v2gw-7wfq](https://github.com/labstack/echo/security/advisories/GHSA-vfp3-v2gw-7wfq): an encoded path separator (`%2F` or `%5C`) in a static file URL could bypass route-level middleware (e.g. authentication on a sibling route) and disclose static files. Both `StaticDirectoryHandler` (used by `Static`/`StaticFS`) and the `Static` middleware are affected. Backport of the v5 fix ([#&#8203;3009](https://github.com/labstack/echo/pull/3009), released in v5.2.0). Thanks to [@&#8203;a-tt-om](https://github.com/a-tt-om) and [@&#8203;oran-gugu](https://github.com/oran-gugu) for reporting. **Full Changelog**: <https://github.com/labstack/echo/compare/v4.15.2...v4.15.3> ### [`v4.15.2`](https://github.com/labstack/echo/releases/tag/v4.15.2): - Context.Scheme() header validation [Compare Source](https://github.com/labstack/echo/compare/v4.15.1...v4.15.2) **Security** - `Context.Scheme()` should validate values taken from header by [@&#8203;aldas](https://github.com/aldas) in [#&#8203;2962](https://github.com/labstack/echo/pull/2962) Thanks to [@&#8203;shblue21](https://github.com/shblue21) for reporting this [issue](https://github.com/labstack/echo/issues/2952). **Full Changelog**: <https://github.com/labstack/echo/compare/v4.15.1...v4.15.2> ### [`v4.15.1`](https://github.com/labstack/echo/releases/tag/v4.15.1) [Compare Source](https://github.com/labstack/echo/compare/v4.15.0...v4.15.1) #### What's Changed - CSRF: support older token-based CSRF protection handler that want to render token into template by [@&#8203;aldas](https://github.com/aldas) in [#&#8203;2905](https://github.com/labstack/echo/pull/2905) **Full Changelog**: <https://github.com/labstack/echo/compare/v4.15.0...v4.15.1> </details> <details> <summary>yuin/goldmark (github.com/yuin/goldmark)</summary> ### [`v1.8.4`](https://github.com/yuin/goldmark/releases/tag/v1.8.4) [Compare Source](https://github.com/yuin/goldmark/compare/v1.8.3...v1.8.4) fix: disable svg in data:image urls ### [`v1.8.3`](https://github.com/yuin/goldmark/releases/tag/v1.8.3) [Compare Source](https://github.com/yuin/goldmark/compare/v1.8.2...v1.8.3) **Full Changelog**: <https://github.com/yuin/goldmark/compare/v1.8.2...v1.8.3> - fix: [#&#8203;556](https://github.com/yuin/goldmark/issues/556) </details> <details> <summary>markedjs/marked (marked)</summary> ### [`v18.0.6`](https://github.com/markedjs/marked/releases/tag/v18.0.6) [Compare Source](https://github.com/markedjs/marked/compare/v18.0.5...v18.0.6) ##### Bug Fixes - Avoid O(n^2) backtracking in inline link href regex ([#&#8203;4013](https://github.com/markedjs/marked/issues/4013)) ([a009808](https://github.com/markedjs/marked/commit/a0098085f4ff80392cc5221ed803083d3b576904)) - Fix ordered lists after blockquotes ([#&#8203;4003](https://github.com/markedjs/marked/issues/4003)) ([33928d0](https://github.com/markedjs/marked/commit/33928d06634570d44c3426f4f48615f4c0a30b11)) - keep trailing text on HTML block close line for PI, declarations, and CDATA ([#&#8203;3991](https://github.com/markedjs/marked/issues/3991)) ([bbb84c8](https://github.com/markedjs/marked/commit/bbb84c88cf3a187c93fbc8966002164d229eba62)) </details> <details> <summary>vitejs/vite (vite)</summary> ### [`v8.1.4`](https://github.com/vitejs/vite/blob/HEAD/packages/vite/CHANGELOG.md#small-814-2026-07-09-small) [Compare Source](https://github.com/vitejs/vite/compare/v8.1.3...v8.1.4) ##### Features - **legacy:** prefer oxc as minifier (fix [#&#8203;21973](https://github.com/vitejs/vite/issues/21973)) ([#&#8203;22468](https://github.com/vitejs/vite/issues/22468)) ([ab5dafa](https://github.com/vitejs/vite/commit/ab5dafa8e66296ef201f615489fb57954bb740ce)) ##### Bug Fixes - **build:** add workaround for building on stackblitz ([#&#8203;22840](https://github.com/vitejs/vite/issues/22840)) ([575c32c](https://github.com/vitejs/vite/commit/575c32c29925c554f4ef4068738ab89c6878f615)) - **build:** keep `import.meta.url` in preload function as-is ([#&#8203;22839](https://github.com/vitejs/vite/issues/22839)) ([f1f90ed](https://github.com/vitejs/vite/commit/f1f90ed4742b3cf453428c7e581a6016a4d47321)) - **deps:** update all non-major dependencies ([#&#8203;22865](https://github.com/vitejs/vite/issues/22865)) ([d4295a9](https://github.com/vitejs/vite/commit/d4295a9ffce428c0e51892373e00c07fccc0498a)) - **deps:** update rolldown-related dependencies ([#&#8203;22866](https://github.com/vitejs/vite/issues/22866)) ([7cf07e4](https://github.com/vitejs/vite/commit/7cf07e4c5f7a6af276012e0c2ec06e08499e951e)) - **html:** avoid backtracking in import-only check ([#&#8203;22848](https://github.com/vitejs/vite/issues/22848)) ([b5868c0](https://github.com/vitejs/vite/commit/b5868c01a124d345664450aaebd677bfba964c05)) - **optimizer:** avoid optimizer run for transform request before init ([#&#8203;22852](https://github.com/vitejs/vite/issues/22852)) ([72a5e21](https://github.com/vitejs/vite/commit/72a5e2192506f51a5efd09c059815a5c43a9eacb)) - **ssr:** align named export function call stacktrace column with Node ([#&#8203;22829](https://github.com/vitejs/vite/issues/22829)) ([173a1b6](https://github.com/vitejs/vite/commit/173a1b648c321e0f836e5a94fc47c4fa9b081bfc)) - strip pure CSS chunk imports when chunkImportMap is enabled ([#&#8203;22841](https://github.com/vitejs/vite/issues/22841)) ([648bd04](https://github.com/vitejs/vite/commit/648bd04933093d0aac9565f21a49811437776886)) ##### Documentation - fix incorrect `@default` for `server.cors` ([#&#8203;22859](https://github.com/vitejs/vite/issues/22859)) ([70435b2](https://github.com/vitejs/vite/commit/70435b2551ee4fe3a0d55c8a3bb61b96f44d2763)) ##### Miscellaneous Chores - **deps:** update dependency postcss-modules to v9 ([#&#8203;22867](https://github.com/vitejs/vite/issues/22867)) ([a9539d6](https://github.com/vitejs/vite/commit/a9539d69efc7a4ccf988bbf5da31c2b416ba990e)) ##### Code Refactoring - eliminate ineffectiveDynamicImport warn ([#&#8203;22876](https://github.com/vitejs/vite/issues/22876)) ([ea22fb3](https://github.com/vitejs/vite/commit/ea22fb352aad9a42c0a9d08f39d8a0bae8c111a5)) ##### Tests - avoid warnings ([#&#8203;22851](https://github.com/vitejs/vite/issues/22851)) ([af21ab6](https://github.com/vitejs/vite/commit/af21ab68adac3380dc9a854d2fe3f776654301cd)) ##### Build System - remove the custom onLog function ([#&#8203;22878](https://github.com/vitejs/vite/issues/22878)) ([2c4a217](https://github.com/vitejs/vite/commit/2c4a217a63dc0a7fcb10bc710a988f32b173f481)) - replace deprecated `onwarn` with `onLog` ([#&#8203;22741](https://github.com/vitejs/vite/issues/22741)) ([c581b55](https://github.com/vitejs/vite/commit/c581b5588cb8e94603d17bce2ff9fec8e8e0a3bf)) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - "before 5am" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNTEuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI1MS4wIiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWwiLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIl19-->
alex force-pushed renovate/all-non-major-dependencies from d102dbf1ad to e33f72d1e7 2026-07-12 02:02:55 +00:00 Compare
alex force-pushed renovate/all-non-major-dependencies from e33f72d1e7 to 7fd8129a44 2026-07-13 02:02:54 +00:00 Compare
alex merged commit 3b25f48781 into devel 2026-07-13 08:54:14 +00:00
alex deleted branch renovate/all-non-major-dependencies 2026-07-13 08:54:14 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
dependencies
Renovate stuff

No labels
dependencies
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
alex/opengist!31
No description provided.