Bump the development group across 1 directory with 4 updates

[dependabot]

Bumps the development group with 4 updates in the / directory: @vitejs/plugin-react, marked, sanitize-html and vite.

Updates @vitejs/plugin-react from 6.1.1 to 6.1.2

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.2

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.2 (2026-10-05)

Fix HMR for compound components (#1484)

Adding or removing a component from a compound component was not handled, creating stale updates. Doing this now triggers hmr invalidate on the file and propagates the invalidation to importers.

Fix compiler.logDiagnostics option not working (#1483)

With oxc-transform-react >= 0.148, the logDiagnostics was not working. This version fixes it and requires oxc-transform-react >= 0.152 as a peer dependency if you are using the compiler option. compiler.logDiagnostics option is now deprecated and should be swapped for the builtin compiler.reportDiagnostics.

Disable refresh for non-jsx with compiler enabled (fix #1478) (#1485)

When the compiler was enabled, TS files could trigger fast refresh which would cause runtime errors. The logic now follows what the builtin oxc plugin in Vite does.

Commits

• ac47648 release: plugin-react@6.1.2 (#1491)
• 98277e7 fix(deps): update all non-major dependencies (#1486)
• 12eddea fix(hmr): better handle compound components (#1484)
• 3cfb1d1 fix(plugin-react): fix compiler.logDiagnostics (#1483)
• 6de9915 fix(plugin-react): disable refresh for non-jsx with compiler enabled (#1485)
• ee97d2f fix(deps): update all non-major dependencies (#1445)
• b0a014d chore: use Babel 8 for babel compiler playgrounds (#1460)
• 61b650f fix(deps): update react-related dependencies (#1452)
• 736efe2 chore(deps): update tsdown to v0.23 (#1451)
• See full diff in compare view

Updates marked from 18.0.13 to 18.1.0

Release notes

Sourced from marked's releases.

v18.1.0

18.1.0 (2026-10-05)

Bug Fixes

• avoid cubic backtracking on unicode whitespace in a link destination (#4106) (0d20220)
• load CLI configs with top-level await (#4100) (c61543e)
• reject unbalanced parentheses in link destinations (#4107) (3363c99)

Features

• add linkParenPossible to lexer state to fail fast for link token generation (#4070) (4ee44f7)

v18.0.14

18.0.14 (2026-09-22)

Bug Fixes

• allow indented lines in setext heading text (#4095) (7d05530)
• decode numeric character references in text (#4076) (cead8de)
• keep text after empty nested blockquote (#4101) (1b89557), closes #4098
• preserve internal tabs in list item content (#4086) (e136da7)
• strip whitespace when normalizing link reference labels (#4091) (c7ee43a)
• support GFM protocol autolinks (#4067) (7f7a496)

Commits

• e809386 chore(release): 18.1.0 [skip ci]
• 3363c99 fix: reject unbalanced parentheses in link destinations (#4107)
• 0d20220 fix: avoid cubic backtracking on unicode whitespace in a link destination (#4...
• c18a64f chore(deps): bump undici (#4122)
• 4ee44f7 feat: add linkParenPossible to lexer state to fail fast for link token genera...
• c61543e fix: load CLI configs with top-level await (#4100)
• ef0704c chore(release): 18.0.14 [skip ci]
• 23c82ad chore: update deps (#4108)
• 1b89557 fix: keep text after empty nested blockquote (#4101)
• 7f7a496 fix: support GFM protocol autolinks (#4067)
• Additional commits viewable in compare view

Updates sanitize-html from 2.17.7 to 2.18.0

Changelog

Sourced from sanitize-html's changelog.

2.18.0 (2026-09-30)

Adds

• Added a logger option: pass any console-shaped object, with debug, info, warn and error methods, and sanitize-html's own diagnostics are delivered to it rather than to the console, so an application with a logging pipeline of its own can route them. Missing methods, and no option at all, fall back to the console. Those messages also lost their decorative line breaks and warning icon, so each is now a single line of text; their wording is otherwise unchanged.

Fixes

• allowedSchemesByTag is now applied to srcset and imagesrcset URLs. Previously the per-tag lookup used the attribute name instead of the tag name, so these attributes always fell back to the global allowedSchemes and ignored a tag-specific scheme allowlist. Thanks to spokodev for the fix.
• Starting in version 2.17.6, sanitize-html began escaping any markup preserved inside a disallowed iframe tag, which was a change in behavior due to an upstream change in htmlparser2. This fix ensures such "fallback markup" is preserved without escaping, but also fully sanitized according to the same rules as the original input. Thanks to sumitjhacodes for the fix.

Security

• When meta was allowed together with its http-equiv and content attributes, the destination URL of a <meta http-equiv="refresh" content="0;url=..."> was never checked against allowedSchemes, because it is embedded in content rather than being an attribute of its own. So javascript:, data: and other disallowed destinations passed through. The refresh URL is now extracted the way browsers do it, allowing for the different spellings, separators, quoting and letter case of url=, and checked against allowedSchemes (or allowedSchemesByTag.meta). If it is rejected, or the content cannot be parsed as a refresh, the content attribute is removed. content on other meta elements is unchanged. The default configuration does not allow meta and was not affected (CWE-79, CWE-601, GHSA-cv27-6wvh-8x7j).

  Thanks to adrbogacz for reporting the vulnerability.

• When noscript is listed in nonTextTags, the discarded region could end too early. Browsers with scripting enabled treat <noscript> content as raw text up to the first </noscript>, but the underlying parser treats it as markup, so an end tag for an enclosing element inside <noscript> closed it implicitly and the rest of its content was emitted as ordinary sanitized markup. The discard region now continues until the point where a browser would end the <noscript> element, while implied closes of other nonTextTags such as <option> behave as before (CWE-79, CWE-436, GHSA-x3q4-9hxx-gx8m).

  Thanks to joaquiniglesiaslug for reporting the vulnerability.

• The check that drops SVG animation elements (animate, animateColor, animateMotion, animateTransform, set) when they retarget a URL attribute such as href compared the full tag name, so a namespace-prefixed spelling like svg:animate was not recognized when such tags were allowed (for example with allowedTags: false). In XML serializations such as XHTML or standalone SVG, the prefixed element is a real animation element and could retarget a link to a javascript: URL after sanitization. The element and attributeName are now matched by their local names, ignoring any prefix (CWE-79, CWE-184, GHSA-374f-7chj-9948).

  Thanks to Kai Aizen (SnailSploit) for reporting the vulnerability.

Commits

• 9500b8b Latest reconciliation Q3 2026 (#5635)
• See full diff in compare view

Updates vite from 8.3.0 to 8.3.3

Release notes

Sourced from vite's releases.

v8.3.3

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

v8.3.2

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

v8.3.1

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.3 (2026-10-06)

Bug Fixes

• deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
• html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
• server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
• server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

8.3.2 (2026-10-01)

Bug Fixes

• build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)
• bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)
• bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)
• deps: update all non-major dependencies (#23601) (9944fa6)
• deps: update rolldown-related dependencies (#23602) (88c1741)
• html: resolve percent-encoded srcset urls (#23609) (53f1ce7)
• limit size of object and array printing via forwardConsole (#23565) (e64a587)
• merge build.rolldownOptions.output.minify correctly (#23536) (bba3bb8)
• optimize-deps: avoid "unsupported" warnings for browser:false mappings (#23590) (5e4b9ca)
• optimizer: preserve excluded optional peer require fallbacks (#23600) (a2bd6fa)
• pass queries to renderBuiltUrl (#23586) (744269e)
• server: handle file watcher errors without crashing (#23503) (6894f5c)
• server: release previous environments after initialization (#23499) (5a3a010)
• ssr: encode whitespace in module runner sourceURL (#23513) (bbc8812)
• worker: align worker urls in client and server when using terser (#23614) (24bd331)

Performance Improvements

• avoid encoding intermediate source maps (#23461) (89574f6)
• build: avoid quadratic link scan in the preload helper (#23510) (cf5c028)
• only register time middleware when debug logging is enabled (#23621) (94d0080)

Documentation

• fix dead og-image PNG links in vite6/vite7 changelog entries (#23594) (1929b4c)

Miscellaneous Chores

• deps: update vitest monorepo to v5 (#23604) (24339f4)

Code Refactoring

• use tinyexec instead of cross-spawn (#23583) (db915e5)

Tests

• bundled-dev: accept a rolldown dev runtime with no helper imports (#23606) (634745d)

8.3.1 (2026-09-24)

... (truncated)

Commits

• fea5b21 release: v8.3.3 (#23657)
• c3e06f9 fix(server): store ids to safeModulePaths rather than URLs (#23656)
• ba8b7ab fix(server): check fs.serve for ?vite-wasm-instance (#23655)
• 22fd1d5 fix(deps): update launch-editor to v2.14.2 (#23654)
• 7dafd8e fix(html): filename passed to transformIndexHtml should not include queries (...
• 1003321 release: v8.3.2 (#23623)
• 24bd331 fix(worker): align worker urls in client and server when using terser (#23614)
• 94d0080 perf: only register time middleware when debug logging is enabled (#23621)
• 89574f6 perf: avoid encoding intermediate source maps (#23461)
• 5a3a010 fix(server): release previous environments after initialization (#23499)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ithaca-odyssey	Ready	Preview	Oct 9, 2026 2:06pm UTC