build(deps): bump the npm_and_yarn group across 2 directories with 5 updates by dependabot[bot] · Pull Request #5 · nrupala/vault-tracker

dependabot · 2026-04-03T02:42:13Z

Bumps the npm_and_yarn group with 1 update in the / directory: electron.
Bumps the npm_and_yarn group with 5 updates in the /apps/vault-tracker directory:

Package	From	To
electron	`41.0.2`	`41.0.3`
@xmldom/xmldom	`0.8.11`	`0.8.12`
brace-expansion	`5.0.4`	`5.0.5`
brace-expansion	`1.1.12`	`1.1.13`
brace-expansion	`2.0.2`	`2.0.3`
flatted	`3.4.1`	`3.4.2`
picomatch	`4.0.3`	`4.0.4`

Updates electron from 41.0.2 to 41.0.3

Release notes

Sourced from electron's releases.

electron v41.0.3

Release Notes for v41.0.3

Fixes

Added additional ASAR support to additional fs copy methods. #50286 (Also in 39, 40, 42)

Fixed an issue where some DevTools functionality didn't work as expected. #50276 (Also in 40, 42)

Fixed user resizing of transparent windows on win32 platform. #50298 (Also in 39, 40, 42)

Other Changes

Updated Chromium to 146.0.7680.80. #50262

Documentation

Documentation changes: #50293

Commits

44bc2c8 fix: user resizable transparent windows on win32 (#50298)
4e9e733 test: fix esm issue in node-spec-runner (#50295)
cd88382 fix: add ASAR support to additional copy methods (#50286)
105c559 docs: update the example of webContents.setWindowOpenHandler to cla… (#50293)
90b3a23 build: remove redundant bits of ncrypto node patch (#50279)
21f9474 chore: bump chromium to 146.0.7680.80 (41-x-y) (#50262)
c3e397e fix: prefer browser runtime over node in DevTools HostRuntime detection (#50276)
d84dca2 build: skip archiving patch conflict fix artifact (#50257)
bb20d0c docs: point pull requests guide to build tools (#50253)
c66fc55 chore: bump chromium to 146.0.7680.76 (41-x-y) (#50244)
Additional commits viewable in compare view

Updates electron from 41.0.2 to 41.0.3

Release notes

Sourced from electron's releases.

electron v41.0.3

Release Notes for v41.0.3

Fixes

Added additional ASAR support to additional fs copy methods. #50286 (Also in 39, 40, 42)

Fixed an issue where some DevTools functionality didn't work as expected. #50276 (Also in 40, 42)

Fixed user resizing of transparent windows on win32 platform. #50298 (Also in 39, 40, 42)

Other Changes

Updated Chromium to 146.0.7680.80. #50262

Documentation

Documentation changes: #50293

Commits

44bc2c8 fix: user resizable transparent windows on win32 (#50298)
4e9e733 test: fix esm issue in node-spec-runner (#50295)
cd88382 fix: add ASAR support to additional copy methods (#50286)
105c559 docs: update the example of webContents.setWindowOpenHandler to cla… (#50293)
90b3a23 build: remove redundant bits of ncrypto node patch (#50279)
21f9474 chore: bump chromium to 146.0.7680.80 (41-x-y) (#50262)
c3e397e fix: prefer browser runtime over node in DevTools HostRuntime detection (#50276)
d84dca2 build: skip archiving patch conflict fix artifact (#50257)
bb20d0c docs: point pull requests guide to build tools (#50253)
c66fc55 chore: bump chromium to 146.0.7680.76 (41-x-y) (#50244)
Additional commits viewable in compare view

Updates @xmldom/xmldom from 0.8.11 to 0.8.12

Release notes

Sourced from @xmldom/xmldom's releases.

0.8.12

Commits

Fixed

preserve trailing whitespace in ProcessingInstruction data [#962](https://github.com/xmldom/xmldom/issues/962) / [#42](https://github.com/xmldom/xmldom/issues/42)

Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp

Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @thesmartshadow, @stevenobiajulu, for your contributions

xmldom/xmldom#357

Changelog

Sourced from @xmldom/xmldom's changelog.

0.8.12

Fixed

preserve trailing whitespace in ProcessingInstruction data [#962](https://github.com/xmldom/xmldom/issues/962) / [#42](https://github.com/xmldom/xmldom/issues/42)

Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp

Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @thesmartshadow, @stevenobiajulu, for your contributions

Commits

189cb78 0.8.12
ed08df7 fix: XML injection via unsafe CDATA serialization (GHSA-wh4c-j3r5-mjhp) (#968)
a5b929b chore: clean up generated test artefacts before running ci-local
4e37a20 ci: run format:check in lint job
ac0ac77 chore: ignore generated files when checking formatting
968c893 chore: add local CI script and format:check script
ac40424 fix: preserve trailing whitespace in ProcessingInstruction data (#962)
cece752 chore: add .nvmrc pointing to node version 18
cbf44d9 docs: improve links to changes in most recent release
See full diff in compare view

Maintainer changes

This version was pushed to npm by karfau, a new releaser for @xmldom/xmldom since your current version.

Updates brace-expansion from 5.0.4 to 5.0.5

Commits

8793901 5.0.5
9a02af5 Merge commit from fork
daa71bc Bump tar from 7.5.10 to 7.5.11 (#92)
799e5f7 Bump tar from 7.5.9 to 7.5.10 (#90)
See full diff in compare view

Updates brace-expansion from 1.1.12 to 1.1.13

Commits

8793901 5.0.5
9a02af5 Merge commit from fork
daa71bc Bump tar from 7.5.10 to 7.5.11 (#92)
799e5f7 Bump tar from 7.5.9 to 7.5.10 (#90)
See full diff in compare view

Updates brace-expansion from 2.0.2 to 2.0.3

Commits

8793901 5.0.5
9a02af5 Merge commit from fork
daa71bc Bump tar from 7.5.10 to 7.5.11 (#92)
799e5f7 Bump tar from 7.5.9 to 7.5.10 (#90)
See full diff in compare view

Updates flatted from 3.4.1 to 3.4.2

Commits

3bf0909 3.4.2
885ddcc fix CWE-1321
0bdba70 added flatted-view to the benchmark
See full diff in compare view

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

e5474fc Publish 4.0.4
4516eb5 Merge commit from fork
5eceecd Merge commit from fork
0db7dd7 Run benchmark again against latest minimatch version (#161)
9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
2661f23 fix typo in globstars.js test name (#138)
1798b07 docs: fix makeRe example (#143)
9d76bc5 chore: undocument removed options (#146)
e4d718b Remove unused time-require (#160)
38dffeb chore(deps): pin dependencies (#158)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 1 update in the / directory: [electron](https://github.com/electron/electron). Bumps the npm_and_yarn group with 5 updates in the /apps/vault-tracker directory: | Package | From | To | | --- | --- | --- | | [electron](https://github.com/electron/electron) | `41.0.2` | `41.0.3` | | [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.8.11` | `0.8.12` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `5.0.4` | `5.0.5` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.12` | `1.1.13` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `2.0.2` | `2.0.3` | | [flatted](https://github.com/WebReflection/flatted) | `3.4.1` | `3.4.2` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.4` | Updates `electron` from 41.0.2 to 41.0.3 - [Release notes](https://github.com/electron/electron/releases) - [Commits](electron/electron@v41.0.2...v41.0.3) Updates `electron` from 41.0.2 to 41.0.3 - [Release notes](https://github.com/electron/electron/releases) - [Commits](electron/electron@v41.0.2...v41.0.3) Updates `@xmldom/xmldom` from 0.8.11 to 0.8.12 - [Release notes](https://github.com/xmldom/xmldom/releases) - [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md) - [Commits](xmldom/xmldom@0.8.11...0.8.12) Updates `brace-expansion` from 5.0.4 to 5.0.5 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.4...v5.0.5) Updates `brace-expansion` from 1.1.12 to 1.1.13 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.4...v5.0.5) Updates `brace-expansion` from 2.0.2 to 2.0.3 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v5.0.4...v5.0.5) Updates `flatted` from 3.4.1 to 3.4.2 - [Commits](WebReflection/flatted@v3.4.1...v3.4.2) Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.4) --- updated-dependencies: - dependency-name: electron dependency-version: 41.0.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: electron dependency-version: 41.0.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@xmldom/xmldom" dependency-version: 0.8.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 5.0.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 1.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-version: 2.0.3 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 3, 2026

dependabot bot mentioned this pull request Apr 3, 2026

build(deps): bump the npm_and_yarn group across 1 directory with 4 updates #4

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the npm_and_yarn group across 2 directories with 5 updates#5

build(deps): bump the npm_and_yarn group across 2 directories with 5 updates#5
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-68a67aed93

dependabot bot commented on behalf of github Apr 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot bot commented on behalf of github Apr 3, 2026

electron v41.0.3

Release Notes for v41.0.3

Fixes

Other Changes

Documentation

electron v41.0.3

Release Notes for v41.0.3

Fixes

Other Changes

Documentation

0.8.12

Fixed

0.8.12

Fixed

4.0.4

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants