[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@hono/node-server@<2.0.5	>=2.1.0 → >=2.1.5
karma-jasmine-html-reporter	~2.2.0 → ~2.3.0
marked (source)	^18.0.9 → ^18.1.1
ngx-markdown	^22.0.0 → ^22.1.1
postcss (source)	^8.5.26 → ^8.5.30
serialize-javascript@>=5.0.0 <7.0.5	[>=7.1.0 → >=7.1.2](https://renovatebot.com/diffs/npm/serialize-javascript@>=5.0.0 <7.0.5/7.1.0/7.1.2)
ws@>=8.0.0 <8.21.0	[>=8.21.3 → >=8.22.0](https://renovatebot.com/diffs/npm/ws@>=8.0.0 <8.21.0/8.21.3/8.22.0)

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

⚠️ Renovate does not enforce Minimum Release Age for bump, lockfileUpdate, or rollback updates, so these are raised without a Minimum Release Age check. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

honojs/node-server (@​hono/node-server@<2.0.5)

v2.1.5

Compare Source

What's Changed

• fix(listener): abort the request signal when an HTTP/2 client resets the stream by @​affanmomin in #​404
• fix(serve-static): only serve GET and HEAD requests by @​usualoma in #​405

New Contributors

• @​affanmomin made their first contribution in #​404

Full Changelog: honojs/node-server@v2.1.4...v2.1.5

v2.1.4

Compare Source

What's Changed

• chore: allow hono v5 as a peer dependency by @​yusukebe in #​406

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

v2.1.3

Compare Source

Security fixes

serveStatic decodes the request path a second time, leading to bypass of middleware on static paths

Affects: @hono/node-server/serve-static. Fixes serveStatic decoding an already-decoded path, where a crafted request could be routed as one path and served as another, skipping middleware mounted on a static prefix. GHSA-rmxm-3fg6-px4f

serveStatic now rejects request paths that still contain % after decoding. To serve files whose names contain a literal %, set allowPercentInPath: true.

The same fix ships in hono v4.13.11.

v2.1.2

Compare Source

What's Changed

• ci: add autofix.ci by @​yusukebe in #​392
• fix: type error in early hints and add typecheck to CI by @​BlankParticle in #​390
• chore: add better benchmarks by @​BlankParticle in #​391
• docs(readme): update the benchmark by @​yusukebe in #​394
• test(request): accept asynchronous body read errors by @​usualoma in #​403
• fix(listener): avoid mutating response headers when setting Content-Length by @​usualoma in #​402

Full Changelog: honojs/node-server@v2.1.1...v2.1.2

v2.1.1

Compare Source

What's Changed

• perf: lazily materialize request headers by @​BlankParticle in #​389

Full Changelog: honojs/node-server@v2.1.0...v2.1.1

dfederm/karma-jasmine-html-reporter (karma-jasmine-html-reporter)

v2.3.0

Compare Source

Add Jasmine 7 compatibility

Full Changelog: dfederm/karma-jasmine-html-reporter@v2.2.0...v2.3.0

markedjs/marked (marked)

v18.1.1

Compare Source

Bug Fixes

• cli: honor an explicitly empty string input (#​4113) (ec3a4e5)
• end blockquote before a lazy line after a heading, hr or html block (#​4115) (9e64a6a)
• keep a backslash in a code span from hiding emphasis (#​4117) (6a57018)
• keep a decoded character reference from forming a new one (#​4111) (6bbac0c), closes #​38 #​112
• let indented and type 3-5 html blocks interrupt a paragraph (#​4124) (eaa1fff)
• make walkTokens linear by appending values in place (#​4121) (627d9ae), closes #​4120
• match pre, script, style and textarea as whole tag names (#​4114) (0db74cb)
• preserve enclosing link state after parsing images (#​4123) (cc07bb9)
• respect tab stops in list continuation indentation (#​4119) (4bd2528)

Performance Improvements

• avoid repeated raw string copies in nested lists (#​4082) (7e8754d)

v18.1.0

Compare Source

Bug Fixes

• avoid cubic backtracking on unicode whitespace in a link destination (#​4106) (0d20220)
• load CLI configs with top-level await (#​4100) (c61543e)
• reject unbalanced parentheses in link destinations (#​4107) (3363c99)

Features

• add linkParenPossible to lexer state to fail fast for link token generation (#​4070) (4ee44f7)

v18.0.14

Compare Source

Bug Fixes

• allow indented lines in setext heading text (#​4095) (7d05530)
• decode numeric character references in text (#​4076) (cead8de)
• keep text after empty nested blockquote (#​4101) (1b89557), closes #​4098
• preserve internal tabs in list item content (#​4086) (e136da7)
• strip whitespace when normalizing link reference labels (#​4091) (c7ee43a)
• support GFM protocol autolinks (#​4067) (7f7a496)

v18.0.13

Compare Source

Bug Fixes

• allow tabs in the thematic break that ends a list item (#​4087) (afbb27c)
• avoid O(n^2) scanning in reflinkSearch (#​4090) (c6a25bb)
• case fold reference link labels (#​4077) (aed9336)
• drop the leading whitespace after a hard line break (#​4075) (123ce04)
• match html block start conditions when ending a list item (#​4072) (c2facac)
• respect raw tokens when closing link labels (#​4066) (ef394f7)
• strip a tab that follows spaces in an indented code block (#​4080) (dbb393d)

v18.0.12

Compare Source

Bug Fixes

• allow a tab before the closing sequence of an ATX heading (#​4084) (4417582)
• allow one more level of nested brackets in a link label (#​4064) (37b28d8)
• do not add a newline to an empty code block (#​4073) (23b1706)
• escape character references in autolink destinations (#​4053) (8f432f0)
• reject GFM email autolink when the domain ends in _ or - (#​4063) (df57534)
• reject invalid characters in HTML tag names (#​4083) (300bb1d)
• remove up to the fence indentation from each content line (#​4074) (0244f08)

v18.0.11

Compare Source

Bug Fixes

• do not nest a link inside a link (#​4051) (e250e31)
• inlineTokens rebuilds the reflink-mask preamble per call (#​4040) (0653c24)
• keep emphasis in the text of a rejected reference link (#​4059) (b699db3)

v18.0.10

Compare Source

Bug Fixes

• keep the em/strong mask the same length as the source (#​4044) (681373c)
• parse EOF backtick fences after paragraphs (#​4039) (81bd750)
• place task checkboxes after list loose is finalized (#​4046) (b8cf7dc), closes #​4045

jfcere/ngx-markdown (ngx-markdown)

v22.1.1

Compare Source

Security fixes

• build(deps): bump fast-uri from 3.1.6 to 3.1.8 by @​dependabot[bot] in #​695
• build(deps): bump ip-address from 10.7.0 to 10.7.2 by @​dependabot[bot] in #​696
• build(deps-dev): bump brace-expansion from 1.1.18 to 1.1.21 by @​dependabot[bot] in #​697
• build(deps): bump dompurify from 3.4.14 to 3.4.16 by @​dependabot[bot] in #​698
• build(deps): bump hono from 4.13.5 to 4.13.13 by @​dependabot[bot] in #​700
• build(deps): bump proxy-addr from 2.0.7 to 2.0.8 by @​dependabot[bot] in #​704
• build(deps): bump source-map-js from 1.2.1 to 1.2.2 by @​dependabot[bot] in #​706
• build(deps): support KaTeX 0.18 in the library by @​jfcere in #​708

Full Changelog: jfcere/ngx-markdown@v22.1.0...v22.1.1

v22.1.0

Compare Source

New features and enhancements

• feat: remove zone.js dependency by @​Kirskov in #​692

Special Thanks

🥇 Thanks to @​Kirskov for his first contribution in #​692

Full Changelog: jfcere/ngx-markdown@v22.0.2...v22.1.0

v22.0.2

Compare Source

Fix a regression introduced in v22.0.1 that prevented KaTeX from rendering when marked-katex-extension and katex were installed and the katex attribute was enabled. This restores the previous KaTeX behaviour.

Bug fixes

• fix: restore KaTeX rendering when marked-katex-extension and katex are installed, by @​jfcere in #​691

Known limitation

Due to a limitation in Vite's handling of optional peer dependencies, applications that do not use KaTeX may still encounter a dev-server error when marked-katex-extension is not installed.

As a workaround, add the following to the build.options section of angular.json:

{
  "externalDependencies": [
    "marked-katex-extension"
  ]
}

Applications using the katex attribute still need to install both marked-katex-extension and katex.

A cleaner solution that allows KaTeX to be explicitly included or excluded will be provided in the next major version. The related issue #​681 has been reopened to track this follow-up work.

Full Changelog: jfcere/ngx-markdown@v22.0.1...v22.0.2

v22.0.1

Compare Source

New features and enhancements

• feat: add support for emoji-toolkit 11.0.0 by @​jfcere in #​689

Bug fixes

• fix: hide optional KaTeX peer import from Vite analysis by @​Steve0x2a in #​690

Security fixes

• build(deps): bump dompurify from 3.4.8 to 3.4.11 by @​dependabot[bot] in #​665
• build(deps): bump hono from 4.12.23 to 4.12.26 by @​dependabot[bot] in #​666
• build(deps): bump undici from 6.26.0 to 6.27.0 by @​dependabot[bot] in #​667
• build(deps): bump hono from 4.12.26 to 4.12.31 by @​dependabot[bot] in #​668
• build(deps): bump immutable from 5.1.6 to 5.1.9 by @​dependabot[bot] in #​669
• build(deps): bump dompurify from 3.4.11 to 3.4.12 by @​dependabot[bot] in #​670
• build(deps): bump tar from 7.5.16 to 7.5.21 by @​dependabot[bot] in #​671
• build(deps): bump fast-uri from 3.1.2 to 3.1.4 by @​dependabot[bot] in #​672
• build(deps): bump ws, engine.io and socket.io-adapter by @​dependabot[bot] in #​673
• build(deps): bump postcss from 8.5.15 to 8.5.25 by @​dependabot[bot] in #​674
• build(deps): bump ip-address from 10.2.0 to 10.4.0 by @​dependabot[bot] in #​676
• build(deps): bump fast-uri from 3.1.4 to 3.1.5 by @​dependabot[bot] in #​677
• chore(deps): update Angular from 22.0.0 to 22.1.4 by @​jfcere in #​688

Full Changelog: jfcere/ngx-markdown@v22.0.0...v22.0.1

postcss/postcss (postcss)

v8.5.30

Compare Source

• Fix broken map on </style> escaping (by @​Rufflet).

v8.5.29

Compare Source

• Improved </style> escaping (by @​choudhryfrompak).
• Fixed comments support in list.comma() and list.space() (by @​00200200).
• Fixed semicolon and custom property (by @​wahidrizka).

v8.5.28

Compare Source

• Fixes types regression.

v8.5.27

Compare Source

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

yahoo/serialize-javascript (serialize-javascript@>=5.0.0 <7.0.5)

v7.1.2

Compare Source

See: GHSA-gfhx-hw2g-v5hg

v7.1.1

Compare Source

What's Changed

• fix: fix XSS bypass via split </script payload across function bodies by @​okuryu in #​226
• release: v7.1.1 by @​okuryu in #​227

Full Changelog: yahoo/serialize-javascript@v7.1.0...v7.1.1

websockets/ws (ws@>=8.0.0 <8.21.0)

v8.22.0

Compare Source

Features

• Introduced the protocols option (8b918b0).

Bug fixes

• Calling websocket.close() with invalid arguments no longer transitions the
  state to WebSocket.CLOSING (#​2337).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 6am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud