chore(deps): update npm

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@babel/core (source)	^7.29.0 → ^7.29.7
@babel/eslint-parser (source)	^7.28.6 → ^7.29.7
@babel/helper-plugin-utils (source)	^7.28.6 → ^7.29.7
@babel/plugin-transform-runtime (source)	^7.29.0 → ^7.29.7
@babel/preset-env (source)	^7.29.2 → ^7.29.7
@babel/preset-react (source)	^7.28.5 → ^7.29.7
@rollup/plugin-commonjs (source)	^29.0.2 → ^29.0.3
@​splunk/dashboard-action-buttons	29.4.0 → 29.8.0
@​splunk/dashboard-context	29.4.0 → 29.8.0
@​splunk/dashboard-core	29.4.0 → 29.8.0
@​splunk/dashboard-definition	29.4.0 → 29.8.0
@​splunk/dashboard-event-handlers	29.4.0 → 29.8.0
@​splunk/dashboard-icons	29.4.0 → 29.8.0
@​splunk/dashboard-inputs	29.4.0 → 29.8.0
@​splunk/dashboard-layouts	29.4.0 → 29.8.0
@​splunk/dashboard-presets	29.4.0 → 29.8.0
@​splunk/dashboard-search	29.4.0 → 29.8.0
@​splunk/dashboard-state	29.4.0 → 29.8.0
@​splunk/dashboard-telemetry	29.4.0 → 29.8.0
@​splunk/dashboard-types	29.4.0 → 29.8.0
@​splunk/dashboard-ui	29.4.0 → 29.8.0
@​splunk/dashboard-utils	29.4.0 → 29.8.0
@​splunk/dashboard-validation	29.4.0 → 29.8.0
@​splunk/datasource-utils	29.4.0 → 29.8.0
@​splunk/datasources	29.4.0 → 29.8.0
@​splunk/eslint-config	^5.0.0 → ^5.1.0
@​splunk/react-events-viewer	^28.0.0 → ^28.9.0
@​splunk/react-icons	^5.2.0 → ^5.14.1
@​splunk/react-page	^8.0.0 → ^8.3.2
@​splunk/react-toast-notifications	^0.12.0 → ^0.13.0
@​splunk/react-ui	5.2.0 → 5.15.0
@​splunk/splunk-utils	^3.2.0 → ^3.4.0
@​splunk/themes	^1.2.0 → ^1.11.0
@​splunk/ui-utils	^1.10.0 → ^1.14.1
@​splunk/visualization-context	^28.4.0 → ^28.9.0
@​splunk/visualization-schemas	28.4.0 → 28.9.0
@storybook/addon-a11y (source)	^10.3.3 → ^10.5.10
@storybook/addon-links (source)	^10.3.3 → ^10.5.10
@storybook/builder-vite (source)	^10.3.3 → ^10.5.10
@storybook/react (source)	^10.3.3 → ^10.5.10
@storybook/react-vite (source)	^10.3.3 → ^10.5.10
@storybook/test-runner	^0.24.3 → ^0.24.4
@testing-library/user-event	^14.6.1 → ^14.6.6
@types/lodash (source)	^4.17.24 → ^4.17.25
@types/react (source)	^18.3.28 → ^18.3.31
@vitest/coverage-istanbul (source)	^4.1.2 → ^4.1.11
@xmldom/xmldom	^0.8.13 → ^0.9.12
ajv (source)	^8.18.0 → ^8.20.0
axios (source)	^1.14.0 → ^1.20.0
babel-jest (source)	^30.3.0 → ^30.4.1
esbuild	^0.28.0 → ^0.28.2
esbuild-loader	^4.4.2 → ^4.5.0
eslint-import-resolver-typescript	^4.4.4 → ^4.4.5
eslint-plugin-jest	^29.15.1 → ^29.16.2
eslint-plugin-storybook (source)	^10.3.3 → ^10.5.10
fast-uri	^3.1.2 → ^3.1.6
http-proxy-middleware	^3.0.5 → ^3.0.7
jest (source)	^30.3.0 → ^30.4.2
jest-environment-jsdom (source)	^30.3.0 → ^30.4.1
js-yaml	^4.1.1 → ^4.3.2
lodash (source)	^4.17.23 → ^4.18.1
msw (source)	^2.12.14 → ^2.15.0
msw-storybook-addon	^2.0.6 → ^2.0.7
postcss (source)	^8.5.10 → ^8.5.26
react-is (source)	^19.2.4 → ^19.2.8
react-router-dom (source)	7.18.0 → 7.18.2
rollup-plugin-license	^3.7.0 → ^3.7.1
semver	^7.7.4 → ^7.8.5
storybook (source)	^10.3.3 → ^10.5.10
uuid	^14.0.0 → ^14.0.2
vite (source)	^7.3.1 → ^7.3.6
vite-plugin-checker	^0.12.0 → ^0.14.5
vite-plugin-node-polyfills	^0.26.0 → ^0.28.0
vitest (source)	^4.1.2 → ^4.1.11
zod (source)	^4.3.6 → ^4.4.3

---

Release Notes

xmldom/xmldom (@​xmldom/xmldom)

v0.9.12

Compare Source

Fixed

• Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
• Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
• Security: HTML raw-text parsing no longer amplifies output on a missing or case-mismatched closing tag; the closing tag is matched case-insensitively per the WHATWG HTML RAWTEXT end-tag rule and a missing closing tag is handled explicitly, preventing a denial-of-service. Output for well-formed input is unchanged. GHSA-6mj3-qw4j-hgrw
• Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
• Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
• Security: the requireWellFormed serializer's element- and attribute-name validators no longer treat an interior line terminator as satisfying the name anchors, so a name containing a line terminator is rejected with InvalidStateError — closing a bypass of the XML QName check. GHSA-jxjr-3g7g-3944
• Security: the requireWellFormed serializer's DocType publicId/systemId validators no longer treat an interior line terminator as satisfying the anchor, so an identifier containing an ECMAScript line terminator is rejected with InvalidStateError — closing a bypass of the XML PubidLiteral/SystemLiteral check. GHSA-vr34-hp96-76pp
• Security: createElementNS(), createAttributeNS(), createDocumentType(), and createAttribute() now reject a name containing a line terminator with InvalidCharacterError, because name validation applies to the whole string — closing a creation-time bypass of the XML Name/QName production on the default serialization path. GHSA-3px3-54cx-rmw9
• Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content (a recoverable error in XML, a warning in HTML) instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's onError handler. GHSA-6h8r-xr42-gp59
• DOMExceptions raised during parsing are now reported as a fatalError, and the originating error is preserved as the cause on the resulting ParseError.

Chore

• updated dependencies

Thank you,
@​ericchiang,
@​KarimTantawey,
@​bhaswanthc,
@​arpitjain099,
@​Paranoidgrinch,
for your contributions

v0.9.11

Compare Source

Fixed

• Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm
• Security: the processing-instruction grammar regex no longer backtracks quadratically on an unterminated processing instruction (<?… with no closing ?>), preventing a denial-of-service (ReDoS) reachable from DOMParser.parseFromString with default options. GHSA-g53g-w8rj-fmg7
• CharacterData nodeValue and data are now kept in sync #990

Chore

• updated dependencies

Thank you,
@​bhaswanthc,
@​jmestwa-coder,
@​stevenobiajulu,
for your contributions

v0.9.10

Compare Source

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option. When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -- anywhere, ends with -, or contains characters outside the XML Char production
  • ProcessingInstruction: throws when target contains : or matches xml (case-insensitive), or data contains characters outside the XML Char production or contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById(), Node.prototype.isEqualNode()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw
• isEqualNode now correctly returns false for CDATASection nodes with different data

Deprecated

• The splitCDATASections serializer option is deprecated and will be removed in the next breaking release. The automatic splitting of "]]>" in CDATASection data was introduced as a workaround; use requireWellFormed: true or ensure CDATASection data does not contain "]]>" before serialization.

Chore

• updated dependencies

Thank you,
@​Jvr2022,
@​praveen-kv,
@​TharVid,
@​decsecre583,
@​tlsbollei,
@​KarimTantawey,
for your contributions

v0.9.9

Compare Source

Added

• implement ParentNode.children getter #960 / #410

Fixed

• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
• correctly traverse ancestor chain in Node.contains #931

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

• updated dependencies

Thank you,
@​stevenobiajulu,
@​yoshi389111,
@​thesmartshadow,
for your contributions

v0.9.8

Compare Source

Fixed

• fix: replace \u2029 as part of normalizeLineEndings #839 / #838
• perf: speed up line detection #847 / #838

Chore

• updated dependencies
• drop jazzer and rxjs devDependencies #845

Thank you,
@​kboshold,
@​Ponynjaa,
for your contributions.

v0.9.7

Compare Source

Added

• Implementation of hasAttributes #804

Fixed

• locator is now true even when other options are being used for the DOMParser #802 / #803
• allow case-insensitive DOCTYPE in HTML #817 / #819

Performance

• simplify DOM.compareDocumentPosition #805

Chore

• updated devDependencies

Thank you,
@​zorkow,
@​Ponynjaa,
@​WesselKroos,
for your contributions.

v0.9.6

Compare Source

Fixed

• lower error level for unicode replacement character #790 / #794 / #797

Chore

• updated devDependencies
• migrate renovate config #792

Thank you, @​eglitise, for your contributions.

v0.9.5

Compare Source

Fixed

• fix: re-index childNodes on insertBefore #763 / #766

Thank you,
@​mureinik,
for your contributions.

v0.9.4

Compare Source

Fixed

• restore performance for large amount of child nodes #748 / #760
• types: correct error handler level to warning (#​759) #754 / #759

Docs

• test: verify BOM handling #758

Thank you,
@​luffynando,
@​mattiasw,
@​JoinerDev,
for your contributions.

v0.9.3

Compare Source

Fixed

• restore more Node and ProcessingInstruction types #725 / #726
• getElements* methods return LiveNodeList<Element> #731 / #734
• Add more missing Node props #728, triggered by unclosed #724

Docs

• Update supported runtimes in readme (NodeJS >= 14.6 and other ES5 compatible runtimes)

Chore

• updates devDependencies

Thank you,
@​Ponynjaa,
@​ayZagen,
@​sserdyuk,
@​wydengyre,
@​mykola-mokhnach,
@​benkroeger,
for your contributions.

v0.9.2

Compare Source

Feature

• add Element.getElementsByClassName #722

Fixed

• add missing types for Document.documentElement and Element.tagName #721 #720

Thank you, @​censujiang, @​Mathias-S, for your contributions

v0.9.1

Compare Source

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option. When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -- anywhere, ends with -, or contains characters outside the XML Char production
  • ProcessingInstruction: throws when target contains : or matches xml (case-insensitive), or data contains characters outside the XML Char production or contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById(), Node.prototype.isEqualNode()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw
• isEqualNode now correctly returns false for CDATASection nodes with different data

Deprecated

• The splitCDATASections serializer option is deprecated and will be removed in the next breaking release. The automatic splitting of "]]>" in CDATASection data was introduced as a workaround; use requireWellFormed: true or ensure CDATASection data does not contain "]]>" before serialization.

Chore

• updated dependencies

Thank you,
@​Jvr2022,
@​praveen-kv,
@​TharVid,
@​decsecre583,
@​tlsbollei,
@​KarimTantawey,
for your contributions

v0.9.0

Compare Source

• Discussion
• Summary on dev.to

Features

• feat: expose all DOM level 2 element prototypes #637 / #40
• feat: add iterator function to NodeList and NamedNodeMap #634 / #633

Fixed

• parse empty/whitspace only doctype internal subset #692
• avoid prototype clash in namespace prefix #554
• report fatalError when doctype is inside elements #550

Other

• test: add fuzz target and regression tests #556
• chore: improve .gitignore and provide .envrc.template #697
• chore: Apply security best practices #546
• ci: check test coverage in PRs #524
• docs: add missing commas to readme #566
• docs: click to copy install command in readme #644
• docs: enhance jsdoc comments #511

Thank you, @​kboshold, @​edi9999, @​apupier,
@​shunkica, @​homer0, @​jhauga,
@​UdayKharatmol, for your contributions

axios/axios (axios)

v1.20.0

Compare Source

v1.20.0 — August 19, 2026

This release hardens runtime option handling, adds RFC 9110 status-code aliases, fixes Node.js and XHR reliability issues, and refreshes project tooling and documentation.

⚠️ Breaking Changes & Deprecations

• HTTP Status Naming: Added ContentTooLarge (413) and UnprocessableContent (422), while retaining PayloadTooLarge and UnprocessableEntity as backward-compatible deprecated aliases. (#​11082)

🔒 Security Fixes

• Runtime Option Handling: Hardened behavioral configuration reads against shared and foreign prototype pollution and normalized unsafe interceptor replacement objects. This also clarifies Fetch redirect and custom implementation behavior, HTTP/2 DNS and proxy handling, CIDR-based NO_PROXY matching, and malformed data URI rejection; see the PR for documented compatibility effects. (#​11141)

🐛 Bug Fixes

• Interceptor Lifecycle: Prevented unbounded handler-array growth by trimming trailing ejected interceptors without changing iteration semantics, and kept interceptor operations safe when the public handlers field is nullish. (#​11087, #​11118)
• Request Error Preservation: Prevented custom Error.prepareStackTrace implementations that return non-string values from replacing the original request failure with an unrelated TypeError. (#​11109)
• XHR Reliability: Navigation-canceled requests now reject with ECONNABORTED instead of resolving with status 0, while successful downloads flush their final progress callback during the live loadend dispatch. (#​11094, #​11121)
• Node.js Socket Memory: Removed request-context retention from per-socket error listeners, preventing completed response data from being pinned for the lifetime of pooled keep-alive sockets. (#​11091)
• Core Methods and HTTP Errors: Prevented structural method-header buckets from leaking into outgoing headers, standardized invalid DNS lookup and httpVersion failures as AxiosError.ERR_BAD_OPTION_VALUE, and corrected the timeoutErrorMessage merge strategy. (#​11096)

🔧 Maintenance & Chores

• Dependencies: Updated fast-uri, postcss, js-yaml, mocha, development-tooling groups, and GitHub Actions dependencies. (#​11092, #​11098, #​11099, #​11106, #​11107, #​11122, #​11123, #​11126, #​11127, #​11133, #​11140, #​11143, [#​11144]

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "every 2 weeks on Sunday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.