build(deps): bump the npm-minor-patch group across 1 directory with 2 updates

[dependabot]

Bumps the npm-minor-patch group with 2 updates in the / directory: jszip and mammoth.

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

• Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)
• Add missing types for JSZip.defaults. Fixes #690 (see #927)
• Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)

Commits

• 020fa33 Release preparation for 3.10.2 (#974)
• d38fda5 Fix cross-realm binary type detection in getTypeOf (#578)
• e682f9a Fix grunt build rebundling existing dist via browser field (#971)
• 5adef36 Add missing types for JSZip.defaults (#927)
• 41a1342 Fix blob support in Node.js 18 and up (#955)
• 643714a Move all continuous integration to GitHub Actions (#942)
• 418c11f Upgrade Playwright to the latest version (#940)
• 2ceb998 Create FUNDING.yml
• See full diff in compare view

Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.

Updates mammoth from 1.11.0 to 1.13.0

Changelog

Sourced from mammoth's changelog.

1.13.0

• Replace the use of bluebird with native promises.

  This is arguably a breaking change: however, the return value of functions such as convertToHtml() was only documented as a promise, rather than as a bluebird promise.

  The only exception is that the docs previously used .done(): therefore, when returning promises from the API to external users, a done method is added.

  Any callers that rely on bluebird promises can convert the returned promise into a bluebird promise using bluebird.Promise.resolve().

• Read the children of w:customXml elements.

• Handle paragraphs and runs that have been moved and tracked as a revision.

• Improve escaping in Markdown writer. This avoids some cases where source documents could inject arbitrary HTML into the converted document.

1.12.3

• Avoid excessive backtracking when parsing an unterminated string with many escape sequences. The previous behaviour would allow maliciously crafted documents to cause a denial of service.

  Note that it is still strongly recommended to process untrusted documents in a separate thread with a timeout to avoid potential similar issues.

• Handle complex field separator and end characters without corresponding start characters.

1.12.2

• Avoid prototype pollution when reading the styles defined in a document. This avoids an issue where a maliciously crafted document could be used to set externalFileAccess to true.

1.12.1

• Fix: on Windows, when an image's content type includes a backslash in the subpart, files may be written outside of the directory set by --output-dir.

• Detect and ignore numbering levels that use numStyleLink to refer to themselves.

1.12.0

... (truncated)

Commits

• 791a189 Bump version to 1.13.0
• 4abdfe2 Clarify implication of markdown escaping
• 8e6e755 Escape markdown image alt text and src
• 9463f5c Escape markdown link hrefs
• d302d07 Escape HTML IDs in markdown writer
• 671dbb6 Handle paragraphs and runs that have been moved and tracked as a revision
• d157374 Read the children of w:customXml elements
• 2a489fb Mark up code fragment in README
• adc5749 Update dingbat-to-unicode to 1.0.2
• c0dce8c Remove dependency on path-is-absolute
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions