Bump the dependencies group with 6 updates

[dependabot]

Bumps the dependencies group with 6 updates:

Package	From	To
@types/node	26.5.1	26.6.1
@types/selenium-webdriver	4.35.6	4.35.7
autoprefixer	10.5.6	10.6.1
prettier	3.9.6	3.9.8
sass	1.104.0	1.104.1
webpack	5.110.3	5.111.1

Updates @types/node from 26.5.1 to 26.6.1

Commits

• See full diff in compare view

Updates @types/selenium-webdriver from 4.35.6 to 4.35.7

Commits

• See full diff in compare view

Updates autoprefixer from 10.5.6 to 10.6.1

Release notes

Sourced from autoprefixer's releases.

10.6.1

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

• Added initial-letter support (by @​thomasmattheussen).

Changelog

Sourced from autoprefixer's changelog.

10.6.1

• Fixed grid gap set with the row-gap and column-gap longhands (by dualfroz).

10.6.0 “Post tenebras lux”

• Added initial-letter support (by @​thomasmattheussen).

Commits

• c99614d Release 10.6.1 version
• f1d08cb Update dependencies
• cf1ebcb Fix grid gap inheritance from row-gap and column-gap longhands (#1557)
• e1212dc Release 10.6.0 version
• dac3c5f Add support for prefixing initial-letter (#1556)
• See full diff in compare view

Updates prettier from 3.9.6 to 3.9.8

Release notes

Sourced from prettier's releases.

3.9.8

• Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

🔗 Changelog

3.9.7

• Support Angular 22.2
• Fix regressions in v3.9

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.8

diff

Markdown: Don't let Liquid objects interrupt paragraphs (#20087 by @​seiyab)

<!-- Input -->
If `module` is not a [`WebAssembly.Module`](https://github.com/prettier/prettier/blob/main/en-US/docs/WebAssembly/Reference/JavaScript_interface/Module) object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.7 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.
<!-- Prettier 3.9.8 -->
If module is not a WebAssembly.Module object instance, a
{{jsxref("TypeError")}} is thrown.

3.9.7

diff

Markdown: Prevent indentation drift in list-item code blocks (#19647, #19990 by @​Austin1serb, @​giaBaoJS)

<!-- Input -->
- [x] short first line.
  second paragraph at six spaces that wraps
  onto another line here.

<!-- Prettier 3.9.6 -->

 
short first line.
second paragraph at six spaces that wraps
    onto another line here.



<!-- Prettier 3.9.7 -->

 
short first line.
second paragraph at six spaces that wraps
onto another line here.

JavaScript: Fix embedded template literal idempotency (#19725 by @​fisker)

... (truncated)

Commits

• 4f2ab67 Release 3.9.8
• 3d82af8 Update Regex related dependencies (#20082)
• 5ec8db1 [3.9.x] Markdown: Don't let Liquid objects interrupt paragraphs (#20087)
• 5b142ed Release Release @​prettier/plugin-hermes@​0.2.3, @​prettier/plugin-oxc@​0.2.3, an...
• 0df8eb8 Bump Prettier dependency to 3.9.7
• 3cf6c8c Clean changelog_unreleased
• 0449af3 Release 3.9.7
• 43cd5b0 Allow verify markdown test with mdx parser
• ab8c911 Fix test on Node.js v26 (#19927)
• 4a5adf9 Fix tests
• Additional commits viewable in compare view

Updates sass from 1.104.0 to 1.104.1

Release notes

Sourced from sass's releases.

Dart Sass 1.104.1

To install Sass 1.104.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Fix a bug where loud comments before @use rules could be emitted multiple times under certain circumstances.

• Fix a bug in which an invalid selector at the end of an indented syntax stylesheet would cause the parser to crash instead of emitting a useful error message.

Command Line Interface

• Many-to-many compilations no longer compile any files that appear in the output directory if the output directory is also within the source directory. This fixes a bug where --watch mode could enter an infinite loop recompiling the same CSS file over and over.

• Sass now sets the modification time of output files to the time compilation started rather than the time it ended. This ensures that, if a source file is modified during compilation, --watch and --update mode will recompile the outputs to include the new source file contents.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.104.1

• Fix a bug where loud comments before @use rules could be emitted multiple times under certain circumstances.

• Fix a bug in which an invalid selector at the end of an indented syntax stylesheet would cause the parser to crash instead of emitting a useful error message.

Command Line Interface

• Many-to-many compilations no longer compile any files that appear in the output directory if the output directory is also within the source directory. This fixes a bug where --watch mode could enter an infinite loop recompiling the same CSS file over and over.

• Sass now sets the modification time of output files to the time compilation started rather than the time it ended. This ensures that, if a source file is modified during compilation, --watch and --update mode will recompile the outputs to include the new source file contents.

Commits

• da84fb5 Fix --watch not recompiling sources modified during a compilation (#2850)
• 8a287a7 Merge pull request #2859 from sass/fix-auto-merge
• 6033b46 Add explicit versions to .github/util actions
• cc71d43 Only auto-merge dependabot PRs once the tests pass
• 49ddc4f Revert "Bump dart-lang/setup-dart in /.github/util/initialize"
• 71a127d Avoid duplicating loud comments that appear before @use (#2854)
• f19baab Merge pull request #2857 from sass/dependabot/github_actions/dot-github/util/...
• f5263e2 Bump dart-lang/setup-dart in /.github/util/initialize
• 3018c0d Merge pull request #2856 from sass/dependabot/github_actions/dart-lang/setup-...
• 5d74adb Bump dart-lang/setup-dart from 1.8.0 to 1.8.1
• Additional commits viewable in compare view

Updates webpack from 5.110.3 to 5.111.1

Release notes

Sourced from webpack's releases.

v5.111.1

Patch Changes

• Throw on a write to an imported binding without losing concatenation. (by @​alexander-akait in #22141)

• Keep the </html> a page was written with, whatever opened the element. (by @​aryanraj45 in #22103)

• Look an attribute up by what its value decodes to, not how it was spelled. (by @​aryanraj45 in #22107)

• Minify HTML by what a value says rather than how it was spelled. (by @​alexander-akait in #22154)

• Follow HTML template form and frameset rules during tree construction. (by @​dependabot in #22129)

• Keep the whitespace calc() needs around + and - in a custom property. (by @​alexander-akait in #22150)

• Keep an attribute's delimiter and spell its value back where quoting is frozen. (by @​alexander-akait in #22119)

• Rewrite an attribute value the source spelled with character references. (by @​aryanraj45 in #22110)

• Unquote an HTML attribute value carrying a vertical tab. (by @​alexander-akait in #22162)

• Keep a shadow's spread and canonicalize a merged selector list. (by @​alexander-akait in #22101)

• Leave out an implied tag and merge adjacent runs on the first pass. (by @​aryanraj45 in #22121)

• Minify in one pass what a second pass of the CSS minifier used to find. (by @​alexander-akait in #22106)

• Cover the CSS lookup tables no stylesheet in the corpus reaches. (by @​aryanraj45 in #22126)

• Keep initial where an engine reads the property's initial keyword apart. (by @​aryanraj45 in #22128)

• Join the CSS rules a cut leaves adjacent, and keep a value an escape ate. (by @​alexander-akait in #22108)

• Drop the dead CSS a cut leaves, and join more of the blocks that print alike. (by @​alexander-akait in #22111)

• Run the printer equivalence suite against Firefox as well as Chrome. (by @​aryanraj45 in #22151)

• Finish in one CSS pass the joins, drops and collapses left to a second. (by @​alexander-akait in #22117)

• Move the context module sources into lib/context/. (by @​alexander-akait in #22115)

• Declare loader context types in JSDoc instead of hand-written .d.ts files. (by @​alexander-akait in #22116)

• Emit a failing module's stack relative, and name what a tap failed with. (by @​alexander-akait in #22122)

• Finish in one CSS pass the drops, layer gathers and joins left to a second. (by @​alexander-akait in #22120)

• Speed up CSS parsing by stepping over dropped selector preludes in bytes. (by @​alexander-akait in #22142)

• Record hoisted, module and block declarations while parsing, not by re-walking. (by @​alexander-akait in #22147)

... (truncated)

Changelog

Sourced from webpack's changelog.

5.111.1

Patch Changes

• Throw on a write to an imported binding without losing concatenation. (by @​alexander-akait in #22141)

• Keep the </html> a page was written with, whatever opened the element. (by @​aryanraj45 in #22103)

• Look an attribute up by what its value decodes to, not how it was spelled. (by @​aryanraj45 in #22107)

• Minify HTML by what a value says rather than how it was spelled. (by @​alexander-akait in #22154)

• Follow HTML template form and frameset rules during tree construction. (by @​dependabot in #22129)

• Keep the whitespace calc() needs around + and - in a custom property. (by @​alexander-akait in #22150)

• Keep an attribute's delimiter and spell its value back where quoting is frozen. (by @​alexander-akait in #22119)

• Rewrite an attribute value the source spelled with character references. (by @​aryanraj45 in #22110)

• Unquote an HTML attribute value carrying a vertical tab. (by @​alexander-akait in #22162)

• Keep a shadow's spread and canonicalize a merged selector list. (by @​alexander-akait in #22101)

• Leave out an implied tag and merge adjacent runs on the first pass. (by @​aryanraj45 in #22121)

• Minify in one pass what a second pass of the CSS minifier used to find. (by @​alexander-akait in #22106)

• Cover the CSS lookup tables no stylesheet in the corpus reaches. (by @​aryanraj45 in #22126)

• Keep initial where an engine reads the property's initial keyword apart. (by @​aryanraj45 in #22128)

• Join the CSS rules a cut leaves adjacent, and keep a value an escape ate. (by @​alexander-akait in #22108)

• Drop the dead CSS a cut leaves, and join more of the blocks that print alike. (by @​alexander-akait in #22111)

• Run the printer equivalence suite against Firefox as well as Chrome. (by @​aryanraj45 in #22151)

• Finish in one CSS pass the joins, drops and collapses left to a second. (by @​alexander-akait in #22117)

• Move the context module sources into lib/context/. (by @​alexander-akait in #22115)

• Declare loader context types in JSDoc instead of hand-written .d.ts files. (by @​alexander-akait in #22116)

• Emit a failing module's stack relative, and name what a tap failed with. (by @​alexander-akait in #22122)

• Finish in one CSS pass the drops, layer gathers and joins left to a second. (by @​alexander-akait in #22120)

• Speed up CSS parsing by stepping over dropped selector preludes in bytes. (by @​alexander-akait in #22142)

... (truncated)

Commits

• 5a10675 chore(release): new release (#22105)
• 9c448c4 test: consolidate loose harness files under test/harness (#22163)
• a947604 fix(html): unquote an attribute value carrying a vertical tab (#22162)
• db556f3 test: run the printer equivalence suite against Gecko in CI (#22155)
• d174cdf perf(css): drop a fallback every browserslist target reads past (#22158)
• 39f14f2 refactor(javascript): declare block bindings from the parse (#22161)
• 0835411 test: move suite drivers into test/templates (#22159)
• b48cd77 fix(html): minify by what a value says rather than how it was spelled (#22154)
• a774f10 test: define the webpack major instead of bundling package.json (#22160)
• 4b2eed0 docs: report only what needs a decision while watching a PR (#22156)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[psiinon]

Checkmarx One – Scan Summary & Details – 8b6a9884-2809-462a-b9d2-5f569211bc16

---

New Issues (4 out of 4)

Checkmarx found the following issues in this Pull Request

Severity: 2 High · 2 Medium

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2026-93687	Npm-braces-3.0.3	details Description: Braces contain a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace pattern... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
2		CVE-2026-93690	Npm-uri-js-4.4.1	details Description: uri-js through 4.4.1 contains a denial of service vulnerability in the "removeDotSegments" function that loops infinitely when a path segment begin... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
3		CVE-2026-86472	Npm-fast-uri-3.1.7	details Recommended version: 3.1.8 Description: fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions prior to 2.4.7, 3.0.0 prior to 3.1.8, and 4.0.0... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package
4		CVE-2026-93751	Npm-uri-js-4.4.1	details Description: uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package

---

Use @Checkmarx to take action directly from this PR:

• Rescan the PR

Try it: @Checkmarx how can you help? · @Checkmarx rescan this PR

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.