chore(deps): bump the minor-and-patch group with 11 updates by dependabot[bot] · Pull Request #23 · ManuelGil/vscode-json-flow

dependabot · 2026-05-11T10:48:27Z

Bumps the minor-and-patch group with 11 updates:

Package	From	To
fast-xml-parser	`5.7.2`	`5.7.3`
react	`19.2.5`	`19.2.6`
react-colorful	`5.6.1`	`5.7.0`
react-dom	`19.2.5`	`19.2.6`
tailwind-merge	`3.5.0`	`3.6.0`
vscode-marketplace-client	`1.2.1`	`1.2.2`
yaml	`2.8.4`	`2.9.0`
@biomejs/biome	`2.4.14`	`2.4.15`
@types/node	`22.19.17`	`22.19.18`
postcss	`8.5.13`	`8.5.14`
vite	`7.3.2`	`7.3.3`

Updates fast-xml-parser from 5.7.2 to 5.7.3

Release notes

Sourced from fast-xml-parser's releases.

fix minor old bugs and update builder

fix: alwaysCreateTextNode should create text node when attributes are present for self closing node

fix stop node expression when ns prefix is removed (found by iruizsalinas)

update XML Builder to 1.1.7

mark addEntity deprecated

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

*5.8.0

integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)

This will consider xml-version as well. '1.0' is default

update strnum to 2.3.0

You can set octal and binary parsing which is bydeault off

update fast-xml-builder to 1.2.0

can sanitize tag names if found invalid

fix format output

5.7.3 / 2006-05-05

fix: alwaysCreateTextNode should create text node when attributes are present for self closing node

fix stop node expression when ns prefix is removed (found by iruizsalinas)

update XML Builder to 1.1.7

mark addEntity deprecated

5.7.2 / 2026-04-25

allow numerical external entity for backward compatibility

fix #705: attributesGroupName working with preserveOrder

fix #817: stackoverflow when tag expression is very long

5.7.1 / 2026-04-20

fix typo in CJS typing file

5.7.0 / 2026-04-17

Use @nodable/entities v2.1.0

breaking changes

single entity scan. You're not allowed to user entity value to form another entity name.

you cant add numeric external entity

entity error message when expantion limit is crossed might change

typings are updated for new options related to process entity

please follow documentation of @nodable/entities for more detail.

performance

if processEntities is false, then there should not be impact on performance.

if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%

if processEntities is true, and you pass entity decoder separately

if no entity then performance should be same as before

if there are entities then performance should be increased from past versions

ignoreAttributes is not required to be set to set xml version for NCR entity value

update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

5.6.0 / 2026-04-15

fix: entity replacement for numeric entities

use @nodable/entities to replace entities

this may change some error messages related to entities expansion limit or inavlid use

post check would be exposed in future version

... (truncated)

Commits

d6d8042 update to release
d263370 remove dev dependency 'he'
f9c9a2c update builder to 1.1.7
b65da87 update changelog and mark addEntity deprecated
c2ca631 update fxb
da75191 fix stop node expression when ns prefix is removed
31bbc99 fix: alwaysCreateTextNode should create text node when attributes are present...
dab327a remove unnecessary
ab04eeb update docs
383cb3f Revise security information for v6 release
See full diff in compare view

Updates react from 19.2.5 to 19.2.6

Release notes

Sourced from react's releases.

19.2.6 (May 6th, 2026)

React Server Components

Type hardening and performance improvements (#36425 by @eps1lon and @unstubbable)

Commits

eaf3e95 Version 19.2.6
See full diff in compare view

Updates react-colorful from 5.6.1 to 5.7.0

Release notes

Sourced from react-colorful's releases.

v5.7.0 (onChangeEnd)

Added onChangeEnd callback that fires when the user finishes changing a color (on mouse up, touch end, or arrow key up). Useful for undo/redo, saving to a database, or other expensive operations. (via #230)
<HexColorPicker
  color={color}
  onChange={setColor}
  onChangeEnd={(color) => saveToDatabase(color)}
/>
v5.6.2 (React 19 support)

Fix React 19 TypeScript compatibility (via #229)

Commits

See full diff in compare view

Updates react-dom from 19.2.5 to 19.2.6

Release notes

Sourced from react-dom's releases.

19.2.6 (May 6th, 2026)

React Server Components

Type hardening and performance improvements (#36425 by @eps1lon and @unstubbable)

Commits

eaf3e95 Version 19.2.6
See full diff in compare view

Updates tailwind-merge from 3.5.0 to 3.6.0

Release notes

Sourced from tailwind-merge's releases.

v3.6.0

New Features

Add support for Tailwind CSS v4.3 by @dcastil in dcastil/tailwind-merge#677

Add postfixLookupClassGroups option to config to support Tailwind utilities where a slash is part of the full class name, like named container queries

Add support for readonly array values by @unional in dcastil/tailwind-merge#652

Documentation

Fix broken links in README by @maurer2 in dcastil/tailwind-merge#662

Other

Harden internal CI pipeline security by omitting git checkout by @dcastil, suggested by @kyletaylored in dcastil/tailwind-merge@6b2499c

Full Changelog: dcastil/tailwind-merge@v3.5.0...v3.6.0

Thanks to @brandonmcconnell, @manavm1990, @langy, @roboflow, @syntaxfm, @getsentry, @codecov, a private sponsor, @block, @openclaw, @sourcegraph, @mike-healy and more via @thnxdev for sponsoring tailwind-merge! ❤️

Commits

d54f7e5 v3.6.0
638871a Update README to add info about Tailwind CSS v4.3 support
39fc7b5 Revert "v3.6.0"
bd8390f v3.6.0
802877c add v3.6.0 changelog
a35feda Merge pull request #665 from dcastil/renovate/rollup-plugin-babel-7.x
940389c Merge pull request #667 from dcastil/renovate/release-drafter-release-drafter...
005af6d pin to specific version
5816ced implement breaking changes
17041e1 Merge pull request #676 from dcastil/dependabot/npm_and_yarn/babel/plugin-tra...
Additional commits viewable in compare view

Updates vscode-marketplace-client from 1.2.1 to 1.2.2

Release notes

Sourced from vscode-marketplace-client's releases.

v1.2.2

Full Changelog: ManuelGil/vscode-marketplace-client@v1.2.1...v1.2.2

Changelog

Sourced from vscode-marketplace-client's changelog.

[1.2.2] - 2026-05-06

Added

Exported QueryFlag from the package entry point.

Changed

Improved domain error consistency.

Reduced redundant marketplace requests during VSIX downloads.

Fixed

Improved handling of malformed marketplace responses.

Updated README examples and installation instructions.

Commits

1a21210 chore: 🔖 release 1.2.2
7fe3674 refactor: ♻️ improve package stability and pnpm support
See full diff in compare view

Updates yaml from 2.8.4 to 2.9.0

Release notes

Sourced from yaml's releases.

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

fix: Avoid calling Array.prototype.push.apply() with large source array

fix(lexer): Avoid recursive calls that may exhaust the call stack

Commits

ddb21b0 2.9.0
167365b docs: Clarify that not all errors can be avoided
6eca2a7 fix: Avoid calling Array.prototype.push.apply() with large source array
0543cd5 fix(lexer): Avoid recursive calls that may exhaust the call stack
See full diff in compare view

Updates @biomejs/biome from 2.4.14 to 2.4.15

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.4.15

2.4.15

Patch Changes
#9394 ba3480e Thanks @dyc3! - Added the nursery rule useTestHooksInOrder in the test domain. The rule enforces that Jest/Vitest lifecycle hooks (beforeAll, beforeEach, afterEach, afterAll) are declared in the order they execute, making test setup and teardown easier to reason about.
#10254 e0a54cc Thanks @dyc3! - Added a new nursery rule useVueNextTickPromise, which enforces Promise syntax when using Vue nextTick.

For example, the following snippet triggers the rule:
import { nextTick } from "vue";
nextTick(() => {
updateDom();
});
#10219 64aee45 Thanks @dyc3! - Added a new nursery rule noVueVOnNumberValues, that disallows deprecated number modifiers on Vue v-on directives.

For example, the following snippet triggers the rule:
<input @keyup.13="submit" />
#10195 7b8d4e1 Thanks @dyc3! - Added the new nursery rule useVueValidVFor, which validates Vue v-for directives and reports invalid aliases, missing component keys, and keys that do not use iteration variables.

#10238 1110256 Thanks @dyc3! - Added the recommended nursery rule noVueImportCompilerMacros, which disallows importing Vue compiler macros such as defineProps from vue because they are automatically available.

#10201 1a08f89 Thanks @realknove! - Fixed #10193: style/useReadonlyClassProperties no longer reports class properties as readonly-able when they are assigned inside arrow callbacks nested in class property initializers.

#9574 3bd2b6a Thanks @Conaclos! - Fixed #9530. The diagnostics of organizeImports are now more detailed and more precise. They are also better at localizing where the issue is.
#10205 a704a6c Thanks @Conaclos! - Fixed #10185. `organizeImports now errors when it encounters an unknown predefined group.

The following configuration is now reported as invalid because :INEXISTENT: is an unknown predefined group.
{
  "assist": {
    "actions": {
      "source": {
        "organizeImports": { "options": { "groups": [":INEXISTENT:"] } }
      }
    }
  }
}

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.4.15

Patch Changes
#9394 ba3480e Thanks @dyc3! - Added the nursery rule useTestHooksInOrder in the test domain. The rule enforces that Jest/Vitest lifecycle hooks (beforeAll, beforeEach, afterEach, afterAll) are declared in the order they execute, making test setup and teardown easier to reason about.
#10254 e0a54cc Thanks @dyc3! - Added a new nursery rule useVueNextTickPromise, which enforces Promise syntax when using Vue nextTick.

For example, the following snippet triggers the rule:
import { nextTick } from "vue";
nextTick(() => {
updateDom();
});
#10219 64aee45 Thanks @dyc3! - Added a new nursery rule noVueVOnNumberValues, that disallows deprecated number modifiers on Vue v-on directives.

For example, the following snippet triggers the rule:
<input @keyup.13="submit" />
#10195 7b8d4e1 Thanks @dyc3! - Added the new nursery rule useVueValidVFor, which validates Vue v-for directives and reports invalid aliases, missing component keys, and keys that do not use iteration variables.

#10238 1110256 Thanks @dyc3! - Added the recommended nursery rule noVueImportCompilerMacros, which disallows importing Vue compiler macros such as defineProps from vue because they are automatically available.

#10201 1a08f89 Thanks @realknove! - Fixed #10193: style/useReadonlyClassProperties no longer reports class properties as readonly-able when they are assigned inside arrow callbacks nested in class property initializers.

#9574 3bd2b6a Thanks @Conaclos! - Fixed #9530. The diagnostics of organizeImports are now more detailed and more precise. They are also better at localizing where the issue is.
#10205 a704a6c Thanks @Conaclos! - Fixed #10185. `organizeImports now errors when it encounters an unknown predefined group.

The following configuration is now reported as invalid because :INEXISTENT: is an unknown predefined group.
{
  "assist": {
    "actions": {
      "source": {
        "organizeImports": { "options": { "groups": [":INEXISTENT:"] } }
      }
    }
  }
}

... (truncated)

Commits

9dd3271 ci: release (#10210)
7b8d4e1 feat(lint/html/vue): add useVueValidVFor (#10195)
ba3480e feat(lint/js): add useTestHooksInOrder (#9394)
e0a54cc feat(lint/js/vue): add useVueNextTickPromise (#10254)
1110256 feat(lint/vue): add noVueImportCompilerMacros (#10238)
7f7419c fix: grammar in extends docstring (#10263)
0ae5840 feat(lint/js): add useThisForClassMethods (#9807)
83f7385 feat(lint/js): add noBaseToString (#9838)
64aee45 feat(lint/html/vue): add noVueVOnNumberValues (#10219)
See full diff in compare view

Updates @types/node from 22.19.17 to 22.19.18

Commits

See full diff in compare view

Updates postcss from 8.5.13 to 8.5.14

Release notes

Sourced from postcss's releases.

8.5.14

Fixed custom syntax regression (by @43081j).

Changelog

Sourced from postcss's changelog.

8.5.14

Fixed custom syntax regression (by @43081j).

Commits

3ec1394 Release 8.5.14 version
f2bb827 Update dependencies
d75953d Merge pull request #2084 from 43081j/raw-raws-rawing
68bd213 fix: always call raw to retrieve raw values
See full diff in compare view

Updates vite from 7.3.2 to 7.3.3

Release notes

Sourced from vite's releases.

v7.3.3

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

7.3.3 (2026-05-07)

Bug Fixes

avoid destructure lowering for newer safari (#22346) (5ab51c0)

Commits

ca31424 release: v7.3.3
5ab51c0 fix: avoid destructure lowering for newer safari (#22346)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group with 11 updates: | Package | From | To | | --- | --- | --- | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.7.2` | `5.7.3` | | [react](https://github.com/facebook/react/tree/HEAD/packages/react) | `19.2.5` | `19.2.6` | | [react-colorful](https://github.com/omgovich/react-colorful) | `5.6.1` | `5.7.0` | | [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) | `19.2.5` | `19.2.6` | | [tailwind-merge](https://github.com/dcastil/tailwind-merge) | `3.5.0` | `3.6.0` | | [vscode-marketplace-client](https://github.com/ManuelGil/vscode-marketplace-client) | `1.2.1` | `1.2.2` | | [yaml](https://github.com/eemeli/yaml) | `2.8.4` | `2.9.0` | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.14` | `2.4.15` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `22.19.17` | `22.19.18` | | [postcss](https://github.com/postcss/postcss) | `8.5.13` | `8.5.14` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.2` | `7.3.3` | Updates `fast-xml-parser` from 5.7.2 to 5.7.3 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.7.2...v5.7.3) Updates `react` from 19.2.5 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react) Updates `react-colorful` from 5.6.1 to 5.7.0 - [Release notes](https://github.com/omgovich/react-colorful/releases) - [Changelog](https://github.com/omgovich/react-colorful/blob/master/CHANGELOG.md) - [Commits](https://github.com/omgovich/react-colorful/commits/5.7.0) Updates `react-dom` from 19.2.5 to 19.2.6 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/v19.2.6/packages/react-dom) Updates `tailwind-merge` from 3.5.0 to 3.6.0 - [Release notes](https://github.com/dcastil/tailwind-merge/releases) - [Commits](dcastil/tailwind-merge@v3.5.0...v3.6.0) Updates `vscode-marketplace-client` from 1.2.1 to 1.2.2 - [Release notes](https://github.com/ManuelGil/vscode-marketplace-client/releases) - [Changelog](https://github.com/ManuelGil/vscode-marketplace-client/blob/main/CHANGELOG.md) - [Commits](ManuelGil/vscode-marketplace-client@v1.2.1...v1.2.2) Updates `yaml` from 2.8.4 to 2.9.0 - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v2.8.4...v2.9.0) Updates `@biomejs/biome` from 2.4.14 to 2.4.15 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.15/packages/@biomejs/biome) Updates `@types/node` from 22.19.17 to 22.19.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `postcss` from 8.5.13 to 8.5.14 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.13...8.5.14) Updates `vite` from 7.3.2 to 7.3.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v7.3.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.3.3/packages/vite) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.7.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: react dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: react-colorful dependency-version: 5.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: react-dom dependency-version: 19.2.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: tailwind-merge dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: vscode-marketplace-client dependency-version: 1.2.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: yaml dependency-version: 2.9.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: "@biomejs/biome" dependency-version: 2.4.15 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: "@types/node" dependency-version: 22.19.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: postcss dependency-version: 8.5.14 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: vite dependency-version: 7.3.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-05-11T10:48:28Z

Labels

The following labels could not be found: dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

ManuelGil merged commit 953d148 into main May 11, 2026
1 check passed

dependabot Bot deleted the dependabot/npm_and_yarn/main/minor-and-patch-3c8f77386e branch May 11, 2026 13:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the minor-and-patch group with 11 updates#23

chore(deps): bump the minor-and-patch group with 11 updates#23
ManuelGil merged 1 commit into
mainfrom
dependabot/npm_and_yarn/main/minor-and-patch-3c8f77386e

dependabot Bot commented on behalf of github May 11, 2026

Uh oh!

dependabot Bot commented on behalf of github May 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 11, 2026

fix minor old bugs and update builder

19.2.6 (May 6th, 2026)

React Server Components

v5.7.0 (onChangeEnd)

v5.6.2 (React 19 support)

19.2.6 (May 6th, 2026)

React Server Components

v3.6.0

New Features

Documentation

Other

v1.2.2

[1.2.2] - 2026-05-06

Added

Changed

Fixed

v2.9.0

Biome CLI v2.4.15

2.4.15

Patch Changes

2.4.15

Patch Changes

8.5.14

8.5.14

v7.3.3

7.3.3 (2026-05-07)

Bug Fixes

Uh oh!

dependabot Bot commented on behalf of github May 11, 2026

Labels

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant