chore(deps): update dependency cron-parser to v5.6.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
cron-parser	5.6.0 → 5.6.1

---

Release Notes

harrisiirak/cron-parser (cron-parser)

v5.6.1

Compare Source

What's Changed

• fix: handle DST gap correctly and prevent iteration from stopping prematurely by @​cyber-hari in #​405
• fix: CronDate throws on .bind in bundled/CDN builds by @​harrisiirak in #​413
• fix: do not reject an out-of-range day of month when the day of week is restricted by @​spokodev in #​410

New Contributors

• @​cyber-hari made their first contribution in #​405
• @​spokodev made their first contribution in #​410

Full Changelog: harrisiirak/cron-parser@v5.6.0...v5.6.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cursor]

Security review — no findings

Scope: web/package-lock.json only — cron-parser 5.6.0 → 5.6.1 (patch).

Assessment: No medium, high, or critical vulnerabilities introduced or exposed by this change.

Why this is low risk:

• Application code unchanged. The only consumer is web/src/components/ScheduleForm.vue, which uses CronExpressionParser for client-side schedule UI (next-run preview, field parsing). Parsing is wrapped in try/catch; output is dates/UI state, not HTML or server commands.
• Server-side scheduling is separate. Cron execution and validation use github.com/robfig/cron/v3 (ValidateCronFormat in services/schedules/SchedulePool.go), not cron-parser.
• Upstream release is a bugfix patch. v5.6.1 addresses DST iteration, bundled-build .bind, and day-of-month validation — no security advisories.
• No known CVEs for cron-parser in npm audit / public vulnerability databases.

Prior threads: None from earlier automation runs; nothing to re-report.

  

_{Sent by Cursor Automation: Find vulnerabilities}