chore(deps): bump the minor-and-patch group across 1 directory with 9 updates by dependabot[bot] · Pull Request #1442 · owncloud/market

dependabot · 2026-06-25T05:01:28Z

Bumps the minor-and-patch group with 9 updates in the / directory:

Package	From	To
axios	`1.16.0`	`1.18.1`
core-js	`3.48.0`	`3.49.0`
less	`4.5.1`	`4.6.7`
sass	`1.97.3`	`1.101.0`
pug	`3.0.3`	`3.0.4`
uglify-js	`3.17.4`	`3.19.3`
uikit	`3.24.2`	`3.25.20`
vue-template-compiler	`2.5.21`	`2.7.16`
webpack	`5.105.2`	`5.108.4`

Updates axios from 1.16.0 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)

Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)

Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)

AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@webdevelopersrinu (#10913)

@sijie-Z (#10993)

@bartlomieju (#11023)

@JSap0914 (#11019)

Full Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

v1.18.0 — June 13, 2026

This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.

🔒 Security Fixes

Redirect Header Safety: Added Node HTTP adapter support for stripping caller-specified sensitive headers on cross-origin redirects, helping prevent custom auth headers such as API keys from leaking to another origin. (#10892)

URL And Request Hardening: Rejects malformed http: and https: URLs that omit // with ERR_INVALID_URL, while tightening prototype-pollution-safe config reads, stream size limits, FormData depth handling, data URL sizing, and local NO_PROXY matching. (#11000)

🐛 Bug Fixes

Status Validation: Added transitional.validateStatusUndefinedResolves so applications can opt in to treating validateStatus: undefined like the option was omitted, while validateStatus: null remains the explicit way to accept every status. (#10899)

🔧 Maintenance & Chores

Documentation: Published the v1.17.0 release notes, fixed a changelog typo, clarified the package update PR policy, and marked the proxy request config as Node.js-only in the advanced docs. (#10984, #10988, #10992, #10995)

Dependencies: Bumped @babel/core, @babel/preset-env, @commitlint/cli, @commitlint/config-conventional, @rollup/plugin-babel, @rollup/plugin-commonjs, @vitest/browser, @vitest/browser-playwright, eslint, lint-staged, rollup, vitest, and actions/checkout. (#10989, #10996, #10997)

Release Metadata: Prepared the 1.18.0 release by updating package metadata and the runtime VERSION value. (#11003)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@drori12 (#10984)

@eyupcanakman (#10899)

@Adi-Beker (#10995)

Full Changelog

v1.17.0 — June 1, 2026

This release adds Node HTTP zstd decompression, hardens config and release workflows, and fixes authentication, header, proxy, and type-handling regressions.

🔒 Security Fixes

Config Hardening: Guarded socketPath, params, and paramsSerializer reads with own-property checks to prevent inherited prototype values from affecting request behavior, including SSRF-sensitive paths. (#10901, #10922)

Release Publishing: Switched the publish workflow to npm staged publishing for safer, auditable package releases with provenance. (#10926)

🚀 New Features

HTTP Compression: Added Node HTTP adapter support for zstd response decompression, with transitional.advertiseZstdAcceptEncoding controlling whether zstd is advertised in Accept-Encoding. (#6792, #10920)

🐛 Bug Fixes

Authentication Handling: Restored Basic auth on same-origin Node redirects while continuing to strip credentials cross-origin, and aligned the fetch adapter with HTTP adapter behavior for URL-embedded Basic auth. (#10929, #10896)

... (truncated)

Commits

a209bfb chore(release): prepare release 1.18.1 (#11027)
fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
cf1306a docs: add Deno to install instructions (#11023)
b32880a fix: incorrect use of error (#11021)
1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
30499d6 fix: various runtime crashes and type definition mismatches (#10959)
20ce9c4 fix(http): defer env proxy handling to Node (#10942)
e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
Additional commits viewable in compare view

Updates core-js from 3.48.0 to 3.49.0

Changelog

Sourced from core-js's changelog.

3.49.0 - 2026.03.16

Changes v3.48.0...v3.49.0 (373 commits)

Iterator.range updated following the actual spec version

Throw a RangeError on NaN start / end / step

Allow null as optionOrStep

Improved accuracy of Math.{ asinh, atanh } polyfills with big and small values

Improved accuracy of Number.prototype.toExponential polyfills with big and small values

Improved performance of atob, btoa, Uint8Array.fromHex, Uint8Array.prototype.setFromHex, and Uint8Array.prototype.toHex, #1503, #1464, #1510, thanks @johnzhou721

Minor performance optimization polyfills of methods from Map upsert proposal

Polyfills of methods from Map upsert proposal from the pure version made generic to make it work with polyfilled and native collections

Wrap Symbol.for in Symbol.prototype.description polyfill for correct handling of empty string descriptions

Fixed a modern Safari bug in Array.prototype.includes with sparse arrays and fromIndex

Fixed one more case (Iterator.prototype.take) of a V8 ~ Chromium < 126 bug

Forced replacement of Iterator.{ concat, zip, zipKeyed } in the pure version for ensuring proper wrapped Iterator instances as the result

Fixed proxying .return() on exhausted iterator from some methods of iterator helpers polyfill to the underlying iterator

Fixed double .return() calling in case of throwing error in this method in the internal iterate helper that affected some polyfills

Fixed closing iterator on IteratorValue errors in the internal iterate helper that affected some polyfills

Fixed iterator closing in Array.from polyfill on failure to create array property

Fixed order of arguments validation in Array.fromAsync polyfill

Fixed a lack of counter validation on MAX_SAFE_INTEGER in Array.fromAsync polyfill

Fixed order of arguments validation in Array.prototype.flat polyfill

Fixed handling strings as iterables in Iterator.{ zip, zipKeyed } polyfills

Fixed some cases of iterators closing in Iterator.{ zip, zipKeyed } polyfills

Fixed validation of iterators .next() results an objects in Iterator.{ zip, zipKeyed } polyfills

Fixed a lack of early error in Iterator.concat polyfill on primitive as an iterator

Fixed buffer mutation exposure in Iterator.prototype.windows polyfill

Fixed iterator closing in Set.prototype.{ isDisjointFrom, isSupersetOf } polyfill

Fixed (updated following the final spec) one more case Set.prototype.difference polyfill with updating this

Fixed DataView.prototype.setFloat16 polyfill in (0, 1) range

Fixed order of arguments validation in String.prototype.{ padStart, padEnd } polyfills

Fixed order of arguments validation in String.prototype.{ startsWith, endsWith } polyfills

Fixed some cases of Infinity handling in String.prototype.substr polyfill

Fixed String.prototype.repeat polyfill with a counter exceeding 2 ** 32

Fixed some cases of chars case in escape polyfill

Fixed named backreferences in RegExp NCG polyfill

Fixed some cases of RegExp NCG polyfill in combination with other types of groups

Fixed some cases of RegExp NCG polyfill in combination with dotAll

Fixed String.prototype.replace with sticky polyfill, #810, #1514

Fixed RegExp sticky polyfill with alternation

Fixed handling of some line terminators in case of multiline + sticky mode in RegExp polyfill

Fixed .input slicing on result object with RegExp sticky mode polyfill

Fixed handling of empty groups with global and unicode modes in polyfills

Fixed URLSearchParam.prototype.delete polyfill with duplicate key-value pairs

Fixed possible removal of unnecessary entries in URLSearchParam.prototype.delete polyfill with second argument

Fixed an error in some cases of non-special URLs without a path in the URL polyfill

Fixed some percent encode cases / character sets in the URL polyfill

Fixed parsing of non-IPv4 hosts ends in a number in the URL polyfill

Fixed some cases of '' and null host handling in the URL polyfill

Fixed host parsing with hostname = host:port in the URL polyfill

Fixed host inheritance in some cases of file scheme in the URL polyfill

... (truncated)

Commits

80adfc4 v3.49.0
0ad3e00 fix a modern Safari bug in Array.prototype.includes with sparse arrays and ...
853bfa4 update some links
b4d723f fix a lack of counter validation on MAX_SAFE_INTEGER in Array.fromAsync p...
e276676 fix parsing of non-IPv4 hosts ends in a number in the URL polyfill
dd1cfba fix order of arguments validation in String.prototype.{ padStart, padEnd } ...
b952c5f add an extra protection to configurator
e490caf Fix for #810 (#1514)
10b4e86 drop an unneeded comment
28cf2e9 feat: Improve performance of Uint8Array Hex functions (#1510)
Additional commits viewable in compare view

Updates less from 4.5.1 to 4.6.7

Release notes

Sourced from less's releases.

Release v4.6.7

Changes

See CHANGELOG.md for details.

Installation
npm install less@4.6.7
Release v4.6.6

Changes

See CHANGELOG.md for details.

Installation
npm install less@4.6.6
Release v4.6.5

Changes

See CHANGELOG.md for details.

Installation
npm install less@4.6.5
Release v4.6.3

Changes

See CHANGELOG.md for details.

Installation
npm install less@4.6.3
Release v4.6.0

Changes

See CHANGELOG.md for details.

Installation

... (truncated)

Changelog

Sourced from less's changelog.

v4.6.7 (2026-06-20)

Changes

#4457 Fix failing "Request Copilot review" CI job (@app/copilot-swe-agent)

#4451 chore: release v4.6.6 (@app/github-actions)

v4.6.6 (2026-06-14)

Changes

#4450 fix: use printf for PR body to avoid YAML indentation error in run block (@matthew-dean)

#4449 fix: correct push event typo in create-release-pr workflow (pus → push:) (@matthew-dean)

#4446 fix: avoid TypeError on nested @supports with dumpLineNumbers (@sarathfrancis90)

#4441 Preserve spacing for container feature functions (@puneetdixit200)

#4440 chore: prevent dependency lifecycle scripts (@puckowski)

#4437 docs: fix incorrect contributor attributions in v4.6.0 changelog (@barry3406)

#4434 fix(issue#4316): color calc inside from expression (@puckowski)

v4.6.5 (2026-06-13)

Bug Fixes

#4444 Fix browser export interop by routing bundlers to CJS-typed UMD artifact (@Copilot)

#4427 Fix parenthesis in media query (@puckowski)

#4421 Fix not keyword silently ignored when used without parentheses in conditions (@Copilot)

#4426 Upgrade make-dir to v4 to fix security vulnerability (@jorenbroekema)

Maintenance

#4447 Automate CHANGELOG generation in release workflow (@matthew-dean)

#4448 Add continue-on-error to copilot-review CI job (@matthew-dean)

#4445 Fix Playwright chromium install hang on Node current/lts/* (@matthew-dean)

#4431 PR-based release flow for alpha branches (@Copilot)

#4430 Ensure npm publish is always backed by a GitHub tag, release, and version-bump commit (@Copilot)

#4432 Update packageManager to pnpm@9.15.9 to match lockfileVersion 9.0 (@Copilot)

#4420 Regression test for @container mixin parameter variable resolution (@Copilot)

v4.6.4 (2026-03-13)

Tests

#4422 Add coverage for :is()/:matches()/:where() containing nested :has() selectors and comma-separated lists (@Copilot)

v4.6.3 (2026-03-11)

Bug Fixes

... (truncated)

Commits

8ae2cc3 chore: release v4.6.7 (#4458)
91b2919 Fix failing "Request Copilot review" CI job (#4457)
7787557 chore: release v4.6.6 (#4451)
888f687 Preserve spacing for container feature functions (#4441)
d03e7a4 fix: avoid crash on nested @supports with dumpLineNumbers (#4446)
83bc8d4 fix(issue#4316): color calc inside from expression (#4434)
eeb335a chore: prevent dependency lifecycle scripts (#4440)
06428b3 docs: fix incorrect contributor attributions in v4.6.0 changelog (#4437)
d904698 fix: use printf for PR body to avoid YAML indentation error in run block (#4450)
7a0dd6d fix: correct push event typo in create-release-pr workflow (pus → push:) (#4449)
Additional commits viewable in compare view

Updates sass from 1.97.3 to 1.101.0

Release notes

Sourced from sass's releases.

Dart Sass 1.101.0

To install Sass 1.101.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Potentially breaking bug fix: The Node package importer now properly supports resolving import-only variants of Sass files declared in the exports, sass, and style fields of package.json. Previously, these files were ignored even when loaded via @import, so any code relying on loading module-system-only files this way may break.

See the full changelog for changes in earlier releases.

Dart Sass 1.100.0

To install Sass 1.100.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

See the Sass website for details.

See the full changelog for changes in earlier releases.

Dart Sass 1.99.0

To install Sass 1.99.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

Add support for parent selectors (&) at the root of the document. These are emitted as-is in the CSS output, where they're interpreted as the scoping root.

User-defined functions named calc or clamp are no longer forbidden. If such a function exists without a namespace in the current module, it will be used instead of the built-in calc() or clamp() function.

User-defined functions whose names begin with - and end with -expression, -url, -and, -or, or -not are no longer forbidden. These were originally intended to match vendor prefixes, but in practice no vendor prefixes for these functions ever existed in real browsers.

User-defined functions named EXPRESSION, URL, and ELEMENT, those that begin with - and end with -ELEMENT, as well as the same names with some lowercase letters are now deprecated, These are names conflict with plain CSS functions that have special syntax.

See the Sass website for details.

In a future release, calls to functions whose names begin with - and end with -expression and -url will no longer have special parsing. For now, these calls are deprecated if their behavior will change in the future.

See the Sass website for details.

... (truncated)

Changelog

Sourced from sass's changelog.

1.101.0

Potentially breaking bug fix: The Node package importer now properly supports resolving import-only variants of Sass files declared in the exports, sass, and style fields of package.json. Previously, these files were ignored even when loaded via @import, so any code relying on loading module-system-only files this way may break.

1.100.0

Writing two compound selectors adjacent to one another without any whitespace between them, such as [class]a, is now deprecated. This was always an error in CSS and Sass only supported it by mistake.

See the Sass website for details.

1.99.0

Add support for parent selectors (&) at the root of the document. These are emitted as-is in the CSS output, where they're interpreted as the scoping root.

User-defined functions named calc or clamp are no longer forbidden. If such a function exists without a namespace in the current module, it will be used instead of the built-in calc() or clamp() function.

User-defined functions whose names begin with - and end with -expression, -url, -and, -or, or -not are no longer forbidden. These were originally intended to match vendor prefixes, but in practice no vendor prefixes for these functions ever existed in real browsers.

User-defined functions named EXPRESSION, URL, and ELEMENT, those that begin with - and end with -ELEMENT, as well as the same names with some lowercase letters are now deprecated, These are names conflict with plain CSS functions that have special syntax.

See the Sass website for details.

In a future release, calls to functions whose names begin with - and end with -expression and -url will no longer have special parsing. For now, these calls are deprecated if their behavior will change in the future.

See the Sass website for details.

Calls to functions whose names begin with - and end with -progid:... are deprecated.

... (truncated)

Commits

63b9922 Load import-only files through package.json exports (#2772)
c7e9947 Migrate from bufbuild/buf-setup-action to bufbuild/buf-action (#2773)
7674a4c Bump postcss from 8.5.13 to 8.5.15 in /pkg/sass-parser (#2774)
5fd18c7 Bump node engine requirement to >=20.19.0 and chokidar requirement to ^5.0.0 ...
8c1d984 Deprecate adjacent compound selectors (#2765)
8e5f718 Bump postcss from 8.5.12 to 8.5.13 in /pkg/sass-parser (#2767)
1447f9b Bump postcss from 8.5.8 to 8.5.12 in /pkg/sass-parser (#2766)
83c39fe Support the top-level parent selector (#2758)
ec85871 Bump EndBug/add-and-commit from 9 to 10 (#2756)
a604acd [Function Name] Implement changes (#2731)
Additional commits viewable in compare view

Updates pug from 3.0.3 to 3.0.4

Release notes

Sourced from pug's releases.

pug-code-gen@3.0.4

Bug Fixes

Ensure doctype option is properly validated (#3468)

pug@3.0.4

Bug Fixes

Update pug-code-gen to ensure doctype option is properly validated (#3468)

Commits

c323ed3 ci: fix permissions
94d731f fix: doctype option was not validated correctly (#3468)
See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pug since your current version.

Updates uglify-js from 3.17.4 to 3.19.3

Release notes

Sourced from uglify-js's releases.

v3.19.3

Bug Fixes

assignment operator (abefd944eaebfd20d7f01e75353de2c5260bd586, cf87290819d87bfec842503ae655eafeffd5bdb6)

function call (4a92cdc4807a01bcaba9003a45a0e13c46653a8f)

function literal (303417cb64f145b52d8162ad2ffb8a48c56aac38)

property accessor (f34fbb2c36b2fd1cfe38aa12d103cdeb3916c73d, 23f98ba3e19b30bfd47de7c1a4740f8aa442b333, abefd944eaebfd20d7f01e75353de2c5260bd586, cf87290819d87bfec842503ae655eafeffd5bdb6)

v3.19.2

Features

improve compression of logical expressions (c7152b5e6618089c359d8f6c944572997271cfc9, cd0a8ec757156737a71be697b0cdd4a95a2dd6ab)

simplify collapsed assignment expressions (76803d6b45421699e201fbc4ee3173af1b1033df)

convert function literals to arrow functions (22550741b913e3c9fcdc3cf39395a8020c77c5f5)

support ascii_only on template literals (4661b3472e228c056f273977319009d6103feaff)

improve generation of Unicode escape sequences (80ebacbf51ccf449d47f5ce5a41fffeae4f9c454)

Bug Fixes

destructuring syntax (d82b7de5e885da712b43703810a521f22820ee26)

if statement (69f4e3a419fc1328eacadf89cbbece0497ad8957)

logical operator (69f4e3a419fc1328eacadf89cbbece0497ad8957)

optional chaining operator (15c8edb7564a0ab825fce19517f96e8d377a01a8, 8bbbc5178ebee10eb9fa69a706b29f40cc2aa3b9, 69f4e3a419fc1328eacadf89cbbece0497ad8957)

property accessor (e9cf8deb3352935328671df92ae21bf7b1e8a3b0)

switch statement (69f4e3a419fc1328eacadf89cbbece0497ad8957)

try statement (4bf9a4f0954c3fb2b2b2ab9d2def03cebbf0ac7b, 69f4e3a419fc1328eacadf89cbbece0497ad8957)

v3.19.1

Features

simplify nullish comparison of complex expressions (7a4fb85404f44bbf2e4db5892eb32b698bc53b6e)

Bug Fixes

if statement (fac0aa2b8aca8605835e604afe8b39903cc89b75)

switch statement (12475763a60ef92fed1cd625bbb0064c347cc84c, fac0aa2b8aca8605835e604afe8b39903cc89b75)

v3.19.0

Features

eliminate side-effect-free property access (9c80456634550045b51e921e59deb61e4e1dcab7, 95d3ede664598916e6dced8a5e0f5003efd3c77a, 205a1d1f19cfc128018cfd822c3332e6ee0a831f, 124c4d3fe364c825488528f9d90b68cb3b48178d)

improve hoist_vars efficiency (ce8ef52e2bcad2747b803faad68ab9c78cadf4d9)

improve compression around built-in function (8c5a899986e7f66cadd76bfcbd7c017e03508d36)

improve deconstruction of singular destructuring assignment (8c5a899986e7f66cadd76bfcbd7c017e03508d36)

Bug Fixes

... (truncated)

Commits

3ea33af v3.19.3
cf87290 fix corner case in collapse_vars (#5928)
4a92cdc fix corner case in collapse_vars (#5926)
23f98ba improve fix for #5917 (#5921)
abefd94 fix corner case in unused (#5920)
f34fbb2 fix corner case in reduce_vars (#5919)
303417c fix corner cases in collapse_vars & reduce_vars (#5916)
52b6852 v3.19.2
80ebacb generate shorter unicode escape sequence (#5914)
69f4e3a fix corner case in reduce_vars (#5913)
Additional commits viewable in compare view

Updates uikit from 3.24.2 to 3.25.20

Release notes

Sourced from uikit's releases.

v3.25.20

Fixed

Fix video links in docs

v3.25.19

Fixed

Fix release

v3.25.18

Fixed

Fix reactivity in Slider component

v3.25.17

Fixed

Fix active state for Filter controls that combine filtering and sorting

Fix Ken Burns effect not restarting in Safari in Slideshow component

v3.25.16

Fixed

Fix negative numbers sorted incorrectly in Filter component

Fix Modal component stealing focus from overlays rendered outside the modal

Fix component root class not removed after disconnect

v3.25.15

Fixed

Fix issue with build process

v3.25.14

Fixed

Fix boundary option in Dropnav component

v3.25.13

Fixed

Fix regression in Accordion component

v3.25.12

Fixed

Fix accordion causes page to scroll to the top initially in Firefox

Fix visible slides set to inert when `active: first` in Slider component

v3.25.11

... (truncated)

Changelog

Sourced from uikit's changelog.

3.25.20 (July 14, 2026)

Fixed

Fix video links in docs

3.25.19 (June 24, 2026)

Fixed

Fix release

3.25.18 (June 24, 2026)

Fixed

Fix reactivity in Slider component

3.25.17 (May 28, 2026)

Fixed

Fix active state for Filter controls that combine filtering and sorting

Fix Ken Burns effect not restarting in Safari in Slideshow component

3.25.16 (April 21, 2026)

Fixed

Fix negative numbers sorted incorrectly in Filter component

Fix Modal component stealing focus from overlays rendered outside the modal

Fix component root class not removed after disconnect

3.25.15 (April 9, 2026)

Fixed

Fix issue with build process

3.25.14 (March 27, 2026)

Fixed

Fix boundary option in Dropnav component

3.25.13 (February 23, 2026)

Fixed

Fix regression in Accordion component

... (truncated)

Commits

45cc430 Merge branch 'release/v3.25.20'
aed23d0 v3.25.20
e9f0a30 chore: changelog
7b45767 update video in tests
a023f17 pnpm: bump prettier from 3.9.4 to 3.9.5 in the dev-dependencies group
a8950dc chore: update publish workflow actions
471bc6d pnpm: bump the dev-dependencies group with 6 updates
9f0b35d Merge tag 'v3.25.19' into develop
5c170fa Merge branch 'release/v3.25.19'
e950f20 v3.25.19
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uikit since your current version.

Updates vue-template-compiler from 2.5.21 to 2.7.16

Release notes

Sourced from vue-template-compiler's releases.

v2.7.16 "Swan Song"

This is the final release for Vue 2.

Vue 2 will reach End of Life on December 31st, 2023. For more details, please read this blog post.

Please refer to CHANGELOG.md for details.

v2.7.16-beta.2

Please refer to CHANGELOG.md for details.

v2.7.16-beta.1

Please refer to CHANGELOG.md for details.

v2.7.15

Please refer to CHANGELOG.md for details.

v2.7.14

Please refer to CHANGELOG.md for details.

v2.7.13

Please refer to CHANGELOG.md for details.

v2.7.12

Please refer to CHANGELOG.md for details.

v2.7.11

Please refer to CHANGELOG.md for details.

v2.7.10

Please refer to CHANGELOG.md for details.

v2.7.9

Please refer to CHANGELOG.md for details.

v2.7.8

Please refer to CHANGELOG.md for details.

v2.7.7

Please refer to CHANGELOG.md for details.

v2.7.6

Please refer to CHANGELOG.md for details.

v2.7.5

Please refer to CHANGELOG.md for details.

v2.7.4

Please refer to CHANGELOG.md for details.

v2.7.3

... (truncated)

Changelog

Sourced from vue-template-compiler's changelog.

2.7.16 Swan Song (2023-12-24)

Bug Fixes

lifecycle: ensure component effect scopes are disconnected (56ce7f8), closes #13134

2.7.16-beta.2 (2023-12-14)

Bug Fixes

account for nested render calls (db9c566), closes #13131

types: export more types for v3 alignment (jsx / component options) (895669f), closes #13078 #13128

2.7.16-beta.1 (2023-12-08)

Bug Fixes

compiler-sfc: check template ref usage, (#12985) (83d9535), closes #12984

compiler-sfc: fix rewriteDefault edge cases (25f97a5), closes #13060 #12892 #12906

keep-alive: fix keep-alive memory leak (2632249), closes #12827

keep-alive: fix memory leak without breaking transition tests (e0747f4)

props: should not unwrap props that are raw refs (08382f0), closes #12930

shallowReactive: should track value if already reactive when set in shallowReactive (0ad8e8d)

style: always set new styles (f5ef882), closes #12901 #12946

types: fix shallowRef's return type (#12979) (a174c29), closes #12978

types: fix type augmentation and compiler-sfc types w/moduleResolution: bundler (#13107) (de0b97b), closes #13106

types: provide types for built-in components (3650c12), closes #13002

types: type VNodeChildren should allow type number (#13067) (24fcf69), closes #12973

utils: unwrap refs when stringifying values in template (ae3e4b1), closes #12884 #12888

watch: new property addition should trigger deep watcher with getter (6d857f5), closes #12967 #12972

2.7.15 (2023-10-23)

Bug Fixes

compiler-sfc: add semicolon after defineProps statement (#12879) (51fef2c)

compiler-sfc: fix macro usage in multi-variable declaration (#12873) (d27c128)

compiler-sfc: Optimize the value of emitIdentifier (#12851) (bb59751)

compiler-sfc: Resolve object expression parsing errors in v-on (#12862) (b8c8b3f)

lifecycle: scope might changed when call hook (#13070) (74ca5a1)

... (truncated)

Commits

13f4e7d... Description has been truncated

phil-davis · 2026-06-25T05:05:29Z

https://github.com/owncloud/market/actions/runs/28148026431/job/83359279478?pr=1442

Error: 

Vue packages version mismatch:

- vue@2.5.21 (/home/runner/work/market/market/node_modules/vue/dist/vue.runtime.common.js)
- vue-template-compiler@2.7.16 (/home/runner/work/market/market/node_modules/vue-template-compiler/package.json)

This may cause things to work incorrectly. Make sure to use the same version for both.

It looks like dependabot needs to also update vue

DeepDiver1975 · 2026-07-13T11:00:08Z

Holding: CI is failing (not a rebase conflict). Failing: CLI acceptance tests / Acceptance tests (8.3, mariadb:10.6), build / Build. A rebase won't fix this — needs a human/upstream fix.

phil-davis · 2026-07-13T11:04:44Z

needs a human/upstream fix

It needs dependabot to also put vue 2.7.16 into this PR. Surely the bot is smart enough to do that?

phil-davis · 2026-07-16T09:30:57Z

@dependabot recreate

… updates Bumps the minor-and-patch group with 9 updates in the / directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `1.16.0` | `1.18.1` | | [core-js](https://github.com/zloirock/core-js/tree/HEAD/packages/core-js) | `3.48.0` | `3.49.0` | | [less](https://github.com/less/less.js) | `4.5.1` | `4.6.7` | | [sass](https://github.com/sass/dart-sass) | `1.97.3` | `1.101.0` | | [pug](https://github.com/pugjs/pug) | `3.0.3` | `3.0.4` | | [uglify-js](https://github.com/mishoo/UglifyJS) | `3.17.4` | `3.19.3` | | [uikit](https://github.com/uikit/uikit) | `3.24.2` | `3.25.20` | | [vue-template-compiler](https://github.com/vuejs/vue) | `2.5.21` | `2.7.16` | | [webpack](https://github.com/webpack/webpack) | `5.105.2` | `5.108.4` | Updates `axios` from 1.16.0 to 1.18.1 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.16.0...v1.18.1) Updates `core-js` from 3.48.0 to 3.49.0 - [Release notes](https://github.com/zloirock/core-js/releases) - [Changelog](https://github.com/zloirock/core-js/blob/master/CHANGELOG.md) - [Commits](https://github.com/zloirock/core-js/commits/v3.49.0/packages/core-js) Updates `less` from 4.5.1 to 4.6.7 - [Release notes](https://github.com/less/less.js/releases) - [Changelog](https://github.com/less/less.js/blob/master/CHANGELOG.md) - [Commits](less/less.js@v4.5.1...v4.6.7) Updates `sass` from 1.97.3 to 1.101.0 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](sass/dart-sass@1.97.3...1.101.0) Updates `pug` from 3.0.3 to 3.0.4 - [Release notes](https://github.com/pugjs/pug/releases) - [Commits](https://github.com/pugjs/pug/compare/pug@3.0.3...pug@3.0.4) Updates `uglify-js` from 3.17.4 to 3.19.3 - [Release notes](https://github.com/mishoo/UglifyJS/releases) - [Commits](mishoo/UglifyJS@v3.17.4...v3.19.3) Updates `uikit` from 3.24.2 to 3.25.20 - [Release notes](https://github.com/uikit/uikit/releases) - [Changelog](https://github.com/uikit/uikit/blob/develop/CHANGELOG.md) - [Commits](uikit/uikit@v3.24.2...v3.25.20) Updates `vue-template-compiler` from 2.5.21 to 2.7.16 - [Release notes](https://github.com/vuejs/vue/releases) - [Changelog](https://github.com/vuejs/vue/blob/main/CHANGELOG.md) - [Commits](vuejs/vue@v2.5.21...v2.7.16) Updates `webpack` from 5.105.2 to 5.108.4 - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.105.2...v5.108.4) --- updated-dependencies: - dependency-name: axios dependency-version: 1.18.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: core-js dependency-version: 3.49.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: less dependency-version: 4.6.7 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: pug dependency-version: 3.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: sass dependency-version: 1.101.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: uglify-js dependency-version: 3.19.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: uikit dependency-version: 3.25.19 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: vue-template-compiler dependency-version: 2.7.16 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: webpack dependency-version: 5.107.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

to match vue-template-compiler. Signed-off-by: Phillip Davis <phil@jankaritech.com>

phil-davis · 2026-07-16T09:38:46Z

I added a commit to bump vue to 2.7.16 the same as vue-template-compiler

dependabot Bot added dependencies javascript Pull requests that update Javascript code labels Jun 25, 2026

dependabot Bot force-pushed the dependabot/npm_and_yarn/minor-and-patch-e95c615f15 branch from 3655f7c to 6c1efc3 Compare July 12, 2026 22:03

dependabot Bot requested a review from a team as a code owner July 12, 2026 22:03

dependabot Bot force-pushed the dependabot/npm_and_yarn/minor-and-patch-e95c615f15 branch 2 times, most recently from 4f5794d to f6a11c7 Compare July 16, 2026 09:20

dependabot Bot force-pushed the dependabot/npm_and_yarn/minor-and-patch-e95c615f15 branch from f6a11c7 to e7c19e2 Compare July 16, 2026 09:32

chore(deps): bump vue to 2.7.16

3789170

to match vue-template-compiler. Signed-off-by: Phillip Davis <phil@jankaritech.com>

phil-davis approved these changes Jul 16, 2026

View reviewed changes

phil-davis merged commit c2de3d0 into master Jul 16, 2026
13 checks passed

phil-davis deleted the dependabot/npm_and_yarn/minor-and-patch-e95c615f15 branch July 16, 2026 09:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the minor-and-patch group across 1 directory with 9 updates#1442

chore(deps): bump the minor-and-patch group across 1 directory with 9 updates#1442
phil-davis merged 2 commits into
masterfrom
dependabot/npm_and_yarn/minor-and-patch-e95c615f15

dependabot Bot commented on behalf of github Jun 25, 2026 •

edited

Loading

Uh oh!

phil-davis commented Jun 25, 2026

Uh oh!

DeepDiver1975 commented Jul 13, 2026

Uh oh!

phil-davis commented Jul 13, 2026

Uh oh!

phil-davis commented Jul 16, 2026

Uh oh!

phil-davis commented Jul 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v1.18.1 — June 21, 2026

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.18.0 — June 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

Changelog

v1.18.0 — June 13, 2026

🔒 Security Fixes

🐛 Bug Fixes

🔧 Maintenance & Chores

🌟 New Contributors

v1.17.0 — June 1, 2026

🔒 Security Fixes

🚀 New Features

🐛 Bug Fixes

3.49.0 - 2026.03.16

Release v4.6.7

Changes

Installation

Release v4.6.6

Changes

Installation

Release v4.6.5

Changes

Installation

Release v4.6.3

Changes

Installation

Release v4.6.0

Changes

Installation

v4.6.7 (2026-06-20)

Changes

v4.6.6 (2026-06-14)

Changes

v4.6.5 (2026-06-13)

Bug Fixes

Maintenance

v4.6.4 (2026-03-13)

Tests

v4.6.3 (2026-03-11)

Bug Fixes

Dart Sass 1.101.0

Changes

Dart Sass 1.100.0

Changes

Dart Sass 1.99.0

Changes

1.101.0

1.100.0

1.99.0

pug-code-gen@3.0.4

Bug Fixes

pug@3.0.4

Bug Fixes

v3.19.3

Bug Fixes

v3.19.2

Features

Bug Fixes

v3.19.1

Features

Bug Fixes

v3.19.0

Features

Bug Fixes

v3.25.20

Fixed

v3.25.19

Fixed

v3.25.18

Fixed

v3.25.17

dependabot Bot commented on behalf of github Jun 25, 2026 •

edited

Loading