fix(deps): update all non-major dependencies with stable versions (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/core@<8.0.0 (source)	>=8.0.0 → >=8.0.1
@evilmartians/lefthook	^2.1.9 → ^2.1.10
@stylistic/stylelint-plugin	^5.2.0 → ^5.2.1
@types/node (source)	^24.13.2 → ^24.13.3
@vitejs/plugin-vue (source)	^6.0.7 → ^6.0.8
@vitest/ui (source)	^3.2.6 → ^3.2.7
autoprefixer	^10.5.1 → ^10.5.3
bn.js@<4.12.3	>=5.2.3 → >=5.2.5
bn.js@>=5.0.0 <5.2.3	[>=5.2.3 → >=5.2.5](https://renovatebot.com/diffs/npm/bn.js@>=5.0.0 <5.2.3/5.2.3/5.2.5)
immutable@>=5.0.0 <5.1.8 (source)	[>=5.1.8 → >=5.1.9](https://renovatebot.com/diffs/npm/immutable@>=5.0.0 <5.1.8/5.1.8/5.1.9)
markdown-it	^14.2.0 → ^14.3.0
picomatch@<2.3.2	>=4.0.4 → >=4.0.5
qs@>=6.7.0 <=6.15.1	[>=6.15.2 → >=6.15.3](https://renovatebot.com/diffs/npm/qs@>=6.7.0 <=6.15.1/6.15.2/6.15.3)
sanitize-html (source)	^2.17.5 → ^2.17.6
sanitize-html@=2.17.3 (source)	>=2.17.5 → >=2.17.6
semantic-release	^25.0.5 → ^25.0.7
vite (source)	^7.3.5 → ^7.3.6
vite-plugin-vue-devtools (source)	^8.1.3 → ^8.1.5
vite@>=7.0.0 <=7.3.4 (source)	[>=7.3.5 → >=7.3.6](https://renovatebot.com/diffs/npm/vite@>=7.0.0 <=7.3.4/7.3.5/7.3.6)
vitest@<3.2.6 (source)	>=3.2.6 → >=3.2.7
vue (source)	^3.5.38 → ^3.5.39
vue-tsc (source)	^3.3.5 → ^3.3.7
ws@>=8.0.0 <8.21.0	[>=8.21.0 → >=8.21.1](https://renovatebot.com/diffs/npm/ws@>=8.0.0 <8.21.0/8.21.0/8.21.1)

---

Release Notes

babel/babel (@​babel/core@<8.0.0)

v8.0.1

Compare Source

💥 Breaking Change

• babel-core, babel-plugin-transform-object-rest-spread, babel-plugin-transform-runtime, babel-preset-env, babel-standalone
  • #​18079 Actually remove preset-env's useBuiltIns (@​nicolo-ribaudo)

evilmartians/lefthook (@​evilmartians/lefthook)

v2.1.10

Compare Source

• deps: July 2026 (#​1463) by @​mrexox
• feat: AI coding agents integration (#​1448) by @​viralpraxis
• docs: fix language (#​1453) by @​pflanze
• fix: make test suite stable when NO_COLOR is set (#​1449) by @​viralpraxis
• deps: June 2026 (#​1447) by @​mrexox
• deps: migrate shellescape to al.essio.dev/pkg/shellescape (#​1443) by @​maguowei
• docs: upgrade docmd (#​1442) by @​mrexox
• docs: use single quotes in example to handle filepaths with $ by @​mrexox

vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.8

Features

• plugin-vue: add forced vapor mode option (#​766) (d59c3c0)

Bug Fixes

• deps: update all non-major dependencies (#​781) (d369e5a)

vitest-dev/vitest (@​vitest/ui)

v3.2.7

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v3]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10679 (b795e)

    View changes on GitHub

postcss/autoprefixer (autoprefixer)

v10.5.3

Compare Source

• Fixed brackets and gradient parser (@​alanturing881).

indutny/bn.js (bn.js@<4.12.3)

v5.2.5

Compare Source

• fix: correct divRound rounding for negative operands (#​320)
• fix: normalize sign when imuln multiplies by zero (#​321)

v5.2.4

Compare Source

• fix: clear surplus words in inotn so notn(width) stays below 2 ** width (#​319)

immutable-js/immutable-js (immutable@>=5.0.0 <5.1.8)

v5.1.9

Compare Source

• fix(List): a List grown past 32 elements while all its values are undefined no longer reads those values back as null (affected get, iteration, toArray, equals and hashCode)

micromatch/picomatch (picomatch@<2.3.2)

v4.0.5

Compare Source

ljharb/qs (qs@>=6.7.0 <=6.15.1)

v6.15.3

Compare Source

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#​559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#​558)

apostrophecms/apostrophe (sanitize-html)

v2.17.6

Fixes

• Allow transformTags to emit text when textFilter is set, even if the tag is initially empty. This is consistent with the documentation. Thanks to spokodev for the fix.

Security

• Fixed an XSS/allowlist bypass in which the contents of a raw-text element (textarea or xmp) nested inside an svg or math root were re-emitted without HTML-escaping. sanitize-html treated that content as inert raw text because htmlparser2 10.x classified raw-text elements by tag name and ignored the namespace, but a real HTML5 parser treats textarea/xmp as ordinary foreign elements inside SVG/MathML and re-parses their contents as live markup. As a result, markup and event-handler attributes that the allowlist never permitted (for example <svg><textarea><img src=x onerror=alert(1)>) could survive sanitization and execute in the browser. This is now fixed on two fronts: htmlparser2 was upgraded to 12.x, which is namespace-aware and parses textarea/xmp inside SVG/MathML as ordinary elements, so their non-allowlisted children (such as the injected img) are dropped by the allowlist instead of being preserved as raw text; and any raw-text content sanitize-html still emits for these tags (at HTML integration points such as foreignObject/mtext, or outside foreign content) is always HTML-escaped. The default configuration is not affected; the precondition is an allowedTags that includes svg or math together with textarea or xmp. Thanks to khoadb175 for responsibly disclosing the vulnerability.
• Fixed a mutation-XSS / allowedTags bypass affecting configurations that allow the textarea or xmp raw-text tags. htmlparser2 10.x did not recognize an end tag with a trailing solidus (e.g. </textarea/>) as closing the element, so it kept the following markup as raw text, but a spec-compliant browser treats </textarea/> as a valid close and parses that markup as a live element. Because raw-text content was re-emitted without escaping, a payload such as <textarea></textarea/><img src=x onerror=...> could smuggle non-allowlisted, executable markup through the sanitizer. The default configuration was not affected. This is now defended at two layers: htmlparser2 was upgraded to 12.x, whose tokenizer closes these end tags correctly, and the raw text sanitize-html emits for these tags is always escaped so no < can reopen a tag when the output is re-parsed (textarea, an RCDATA element whose entities htmlparser2 decodes, is escaped like normal text, while xmp, a raw-text element, has only its angle brackets escaped to avoid double-encoding already-encoded entities). Because htmlparser2 is ESM-only from version 11 onward, sanitize-html now requires Node.js >=22.12.0 (the first 22.x release in which require() of an ES module is available unflagged). Thanks to bibu123456 for reporting the vulnerability and Kayiz-PT for coordinating the disclosure (GHSA-jxwj-j7wr-gfrw).

semantic-release/semantic-release (semantic-release)

v25.0.7

Compare Source

Bug Fixes

• argument Injection via repositoryUrl in package.json (#​4245) (c46dbda)

v25.0.6

Compare Source

Bug Fixes

• ensure encoded secrets get masked (8e28dd3)

vitejs/vite (vite@>=7.0.0 <=7.3.4)

v7.3.6

Compare Source

Please refer to CHANGELOG.md for details.

vuejs/language-tools (vue-tsc)

v3.3.7

Compare Source

language-core

• fix: wrap single expression event handlers to avoid ASI after return (#​6115) - Thanks to @​KazariEX!

typescript-plugin

• fix: filter const globals from template completions

websockets/ws (ws@>=8.0.0 <8.21.0)

v8.21.1

Compare Source

Bug fixes

• Empty fragments are now counted toward the limit (a2f4e7c).
• The default values of the maxBufferedChunks and maxFragments options have
  been reduced (f197ac6).

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • Monday through Friday (* * * * 1-5)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[kongponents-bot]

🎉 This PR is included in version 1.109.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[kongponents-bot]

Install the preview package from this PR

@kong/spec-renderer@pr-899