build(deps): bump the npm-all group across 1 directory with 17 updates

[dependabot]

Bumps the npm-all group with 17 updates in the /services/core/packages/webclient directory:

Package	From	To
@fontsource/roboto	5.2.10	5.3.0
dompurify	3.4.9	3.4.13
markdown-it	14.2.0	15.0.0
pinia	3.0.4	4.0.3
vue	3.5.38	3.5.41
vue-router	5.1.0	5.2.0
vuetify	4.1.1	4.1.9
@tsconfig/node22	22.0.5	22.0.6
@types/node	25.9.3	26.2.0
@vitejs/plugin-vue	6.0.7	6.0.8
eslint	10.4.1	10.8.1
eslint-config-vuetify	4.6.2	4.7.2
npm-run-all2	9.0.1	9.0.3
sass-embedded	1.100.0	1.102.0
typescript	6.0.3	7.0.2
unplugin-auto-import	21.0.0	21.1.0
vue-tsc	3.3.4	3.3.10

Updates @fontsource/roboto from 5.2.10 to 5.3.0

Commits

• See full diff in compare view

Updates dompurify from 3.4.9 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

DOMPurify 3.4.12

• Fixed an issue where a hook would not get called for custom elements, thanks @​Rikuxx0
• Hardened the handling of hooks removing elements, @​mkrause-bee360
• Added support for a few new SVG attributes, thanks @​cbn-falias & @​Develop-KIM
• Hardened the handling of declarative partial updates
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.10

• Refactored codebase for clarity: extracted the public type declarations into types.ts
• Decomposed the three largest sanitizer functions into focused helpers
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
• Reduced CI cost by running the full three-engine browser suite once per PR
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
• Documented the bench and test:happydom scripts in the README
• Completed the Attack Classes & Bypass History wiki page
• Bumped several dependencies where possible

Commits

• 3067f77 release: 3.4.13 (#1562)
• a9ca1e5 release: 3.4.12 (#1537)
• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• See full diff in compare view

Updates markdown-it from 14.2.0 to 15.0.0

Changelog

Sourced from markdown-it's changelog.

[15.0.0] - 2026-07-30

Added

• Exposed parser internals classes as static properties on markdownit.
• Bundled TypeScript declarations. Remove @types/markdown-it if you used it.
• Added the markdown-it/browser export with bundled ESM and UMD builds.
• Added colored CLI help on supported terminals via argparse 3.
• Added reference labels to link/image tokens, #938.
• Added reference_definition tokens. They remain stripped by default for backwards compatibility, #1055. Also adjusted the line-break heuristic to keep output exactly the same.

Changed

• [breaking] linkify-it => v6
  • No fuzzy links by default.
  • No auth part check by default.
  • Unicode punctuation terminates the link by default (should help with CJK).
  • See linkify-it changelog for other changes.
• Package root now resolves to prebuilt ESM and CJS files instead of raw sources. Distribution files were reorganized under dist/ and dist/browser/.
• Migrated to Typescript.
• entities => v8. Can be rolled back to v7 if compatibility issues happen.
• Moved validateLink, normalizeLink and normalizeLinkText from properties to prototype methods.
• Reworked issue templates and contribution guidelines.

Removed

• [breaking] Removed package-internal subpath exports (markdown-it/lib/* and similar). Use the static classes exposed on markdownit instead.
• [breaking] Removed obsolete StateBlock#ddIndent, #1139. Update markdown-it-deflist to keep it working.

Fixed

• Preserve a literal backslash before a terminating space in link destinations, matching CommonMark 6.3, #1188.
• Recognize lowercase declarations as HTML blocks, matching CommonMark 4.6, #1189.
• Require semicolons for named entities in all decoding paths, completing the fix for #1096.
• Enhanced the text_join rule to process image alt text.
• Include inline code content in image alt text, #1142.

[14.3.0] - 2026-07-02

Changed

• Reworked build pipeline & tools.

... (truncated)

Commits

• 157b33b 15..0.0 released
• f73cb76 doc: rename files
• 3bc8e2d Add TS types
• 2620dce Update contribution guidelines and issue templates
• 7d365fe doc: migration info
• 5c9b7ce Update changelog
• 5a996d5 doc: fix @example tags display
• f5083f4 doc: continue restructuring & theme fixing
• 54289c4 Show inline code content in image alt tag #1142
• 974e2d7 text_join rule fix: process image alt content too (fixes lost escapes and...
• Additional commits viewable in compare view

Updates pinia from 3.0.4 to 4.0.3

Commits

• 5d6ac5b ci: let pnpm version come from packageManager
• 35c334b release: pinia@4.0.3 @​pinia/nuxt@​1.0.2
• 6d5da49 chore: pnpm version
• f09d894 test: dedupe
• 3714487 fix: guard VUE_PROD_DEVTOOLS in dist output (#3168)
• b10e703 ci: fix branches
• 94ec8b1 ci: fix branches
• 9db7197 docs: add robots.txt and sitemap.xml (#3171)
• a94de27 feat(nuxt): declare Nuxt 5 compatibility (#3166)
• b19f9ba feat(playground): update to @​vue/repl v4 (#3163)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for pinia since your current version.

Updates vue from 3.5.38 to 3.5.41

Release notes

Sourced from vue's releases.

v3.5.41

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.40

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

v3.5.39

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.41 (2026-08-05)

Bug Fixes

• compiler-core: preserve vnode lifecycle in stable v-for (#11682) (02421cd), closes #9239 #12569
• compiler-sfc: handle transformed template AST after cache invalidation (#15136) (a4440c0), closes #15126 #15128
• custom-element: preserve nested async mount order (#15154) (71f9ff5), closes #15153
• custom-element: warn when props override native properties (#12125) (22b53ea), closes #12124
• runtime-core: avoid re-fetching resource props with unchanged values (#15105) (a7513a1)
• runtime-core: restore SSR setup state when handling async setup result (#15114) (b6191cb), closes #15113
• scheduler: avoid stack overflow when flushing very large post cb arrays (#15143) (c04a45d), closes #15142
• slots: handle nullish v-bind slot props (#15177) (2506700)
• ssr: normalize hidden states during hydration (#13125) (4e467d7)
• transition: support transition to teleport component child (#11959) (77061fe), closes #11910
• types: preserve defineModel inference with factory defaults (#15097) (0516c43), closes #15096
• v-model: preserve text input before hydration (#14411) (2468464), closes #14403

3.5.40 (2026-07-16)

Bug Fixes

• compiler-core: avoid leaking slot branch keys (#15051) (20c9d26), closes #15048
• hydration: pass namespace when patching dynamic props (#15082) (e0d2723), closes #15081 #15050
• reactivity: handle effect removal during scope stop (#15084) (378f978), closes #15083
• runtime-core: skip lazy hydration for detached roots (#15092) (97f3525), closes #15091
• runtime-core: unwind dangling blocks when slot content throws (#15071) (ddc132d), closes #15070
• runtime-dom: respect current select model type (#15010) (eb89e93), closes #15009
• server-renderer: handle errors in optimized component renders (#12601) (474907c), closes #12575
• server-renderer: remove package dependency cycle (#15063) (4d35eca)
• shared: prevent SSR comment escaping from creating closing delimiters (#15045) (bd962bb)
• types: don't constrain component $el type to Element (#15040) (164460a)

3.5.39 (2026-06-25)

Bug Fixes

• compiler-core: correct filter rewrite recursion (#14959) (be7ce31)
• hydration: force patch dynamic props when hydrating (#9083) (024cf06), closes #9033
• hydration: respect data-allow-mismatch on conditional branches (#12801) (164af63), closes #12782
• reactivity: avoid triggering effects when set fails (#14964) (e450973)
• runtime-core: handle non-isomorphic block element update (#15002) (932ddd0), closes #6385
• runtime-core: normalize function children for elements and Teleport (#9108) (2f374cd), closes #9107
• runtime-core: pause tracking when invoking function refs (#14985) (3ac052b)
• runtime-core: preserve once event listener name (#8341) (87b73b6), closes #8342
• runtime-dom: preserve option modifier event names (#8338) (4b659e6), closes #8334
• ssr: dedupe inherited scope ids during vnode rendering (#15005) (027da6b), closes #12159 #12175
• ssr: resolve nested async teleport content (#9431) (31d0f23), closes #6207
• teleport: handle teleport unmount edge case (#12705) (671997a), closes #12702
• types: support named tuple emits (#12676) (232f402), closes #12673

... (truncated)

Commits

• d2c458b release: v3.5.41
• 4e467d7 fix(ssr): normalize hidden states during hydration (#13125)
• 22b53ea fix(custom-element): warn when props override native properties (#12125)
• 02421cd fix(compiler-core): preserve vnode lifecycle in stable v-for (#11682)
• 2468464 fix(v-model): preserve text input before hydration (#14411)
• b67cfcf chore(deps): update actions/setup-node action to v7 (#15122)
• a7928a3 chore(deps): update all non-major dependencies (#15116)
• 5d0db08 chore(deps): update dependency jsdom to v30 (#15197)
• af6afaa chore(deps): update test (#15162)
• 3840dda chore(deps): update dependency postcss to v8.5.23 [security] (#15209)
• Additional commits viewable in compare view

Updates vue-router from 5.1.0 to 5.2.0

Release notes

Sourced from vue-router's releases.

v5.2.0

   🚀 Features

• Add helpful diagnostics  -  by @​posva in vuejs/router#2737 (628fe)

   🐞 Bug Fixes

• Allow pinia 4  -  by @​posva (16535)
• scroll: Ignore stale async scrollBehavior results  -  by @​baozjj and @​cursoragent in vuejs/router#2730 (303df)
• unplugin: Reject invalid hex digits in [x+hh] character codes  -  by @​greymoth-jp in vuejs/router#2744 (4d967)

    View changes on GitHub

Commits

• 6e5f8d2 release: vue-router@5.2.0
• 1653533 fix: allow pinia 4
• f634b2f docs: improve compat
• d4319be chore: up ts where possible
• b5b5f94 ci: pin image
• 680e905 ci: update playwright image
• 385ca6b chore: up lint, babel and others
• 92ff264 chore: up deps minor and patches
• feed382 ci: bump the actions group with 3 updates (#2745)
• 4d96741 fix(unplugin): reject invalid hex digits in [x+hh] character codes (#2744)
• Additional commits viewable in compare view

Updates vuetify from 4.1.1 to 4.1.9

Release notes

Sourced from vuetify's releases.

v4.1.9

🔧 Bug Fixes

• rounded: restore classes for side/corner values containing 0 (27962f3), closes #23090
• validation: consistently validate cleared fields (58b5537), closes #23084
• VDataTableVirtual: height accounting when expanding multiple rows (6f5f04b), closes #23014
• VSelect: focus correct item after opening with keyboard (Shadow DOM) (#23102) (8d15390), closes #23101
• VVirtualScroll: ignore zero-height items when estimating spacer (abe744e)

v4.1.8

🔧 Bug Fixes

• accept Vue 3.6 prereleases in the vue peer range (#23040) (831fb2d)
• theme: correct color-scheme for light theme (#23071) (9df2c71), closes #22119
• VFileUpload: avoid SSR hydration mismatch on empty file list (4cd5288), closes #23086
• VNumberInput: strip grouping separator before parsing number (94e94a9), closes #23050
• VOverlay: resolve ownership from the activator instead of aria-owns (a57ec6e), closes #23056
• VOverlay: correct viewport size for "desktop view" on Android (8849b6b), closes #22124

v4.1.7

🔧 Bug Fixes

• elevation: hover-elevation prop should not require elevation (378f593)
• VAutocomplete,VCombobox: camelize item props for prepend icon and avatar (8a20623), closes #20989
• VProgressLinear,VIconBtn: avoid Vite v8 dropping transition timing (f23af8a), closes #23046
• VStepperVerticalItem: unnecessary error color to step content (fce4eaa), closes #23032
• VStepperWindow/VTouch: guard against double teardown (#23030) (54a2b6a)
• VTextField: respect hide-details="auto" with counter (#22620) (a94efe4), closes #19998

v4.1.6

🔧 Bug Fixes

• defaults: keep nested root defaults through teleport reset (#23015) (3ad37e6), closes #23009 #22506 #21814
• VDataTableVirtual: avoid scroll glitches with expanded rows (#23014) (bb6d1ef), closes #20457
• VDialog: defer auto-focus until the inner field is focusable (8908e7e), closes #18456
• VDialog/VField/etc.: correct focus resolution in Shadow DOM (#23027) (27504ff)
• VImg: handle image ref deferred by Nuxt page transition (0f72baf), closes #23011
• VList: resolve keyboard navigation inside an open Shadow DOM (#23024) (48628c6)
• VListItem/VChip/VDatePickerHeader: only attach click when interactive (#23028) (47492b6), closes #22854
• VOverlay: unnecessary target attribute for CSS transitions (#22190) (e56352a)
• VSelect: release focus on first click outside (ff966d2), closes #22828
• VSelect: only focus first item when menu is opened with keyboard (4bb9151), closes #22283
• VSelect/VAutocomplete/VCombobox: reliable list with selection (#23029) (745dc9a), closes #22531 #22539 #21404 #20482
• VVirtualScroll: trim leading items when appending to bottom (1ac7cb7), closes #20959
• VVirtualScroll: recalculate visible items on item resize (#22938) (7bd046e), closes #22937

v4.1.5

🔧 Bug Fixes

• types: preserve RouteLocationRaw in emitted declarations (d4d7b4b), closes #22615

... (truncated)

Commits

• 83d7cd1 chore(release): publish v4.1.9
• 8d15390 fix(VSelect): focus correct item after opening with keyboard (Shadow DOM) (#2...
• 27962f3 fix(rounded): restore classes for side/corner values containing 0
• e314a21 docs: minor grammar fixes in descriptions and comments (#23089)
• 58b5537 fix(validation): consistently validate cleared fields
• abe744e fix(VVirtualScroll): ignore zero-height items when estimating spacer
• 6f5f04b fix(VDataTableVirtual): height accounting when expanding multiple rows
• 0ccc125 chore(release): publish v4.1.8
• a57ec6e fix(VOverlay): resolve ownership from the activator instead of aria-owns
• 831fb2d fix: accept Vue 3.6 prereleases in the vue peer range (#23040)
• Additional commits viewable in compare view

Updates @tsconfig/node22 from 22.0.5 to 22.0.6

Commits

• See full diff in compare view

Updates @types/node from 25.9.3 to 26.2.0

Commits

• See full diff in compare view

Updates @vitejs/plugin-vue from 6.0.7 to 6.0.8

Release notes

Sourced from @​vitejs/plugin-vue's releases.

plugin-vue@6.0.8

Please refer to CHANGELOG.md for details.

Changelog

Sourced from @​vitejs/plugin-vue's changelog.

6.0.8 (2026-07-14)

Features

• plugin-vue: add forced vapor mode option (#766) (d59c3c0)

Bug Fixes

• deps: update all non-major dependencies (#781) (d369e5a)

Commits

• d8ff7d0 release: plugin-vue@6.0.8
• d59c3c0 feat(plugin-vue): add forced vapor mode option (#766)
• d369e5a fix(deps): update all non-major dependencies (#781)
• See full diff in compare view

Updates eslint from 10.4.1 to 10.8.1

Release notes

Sourced from eslint's releases.

v10.8.1

Bug Fixes

• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173) (dongkyu lee)
• 151ba3f fix: false positives in getter-return and accessor-pairs (#21163) (Grit)
• 6898df9 fix: ignore meta-property names in id-denylist (#21166) (Pixel)
• 4d7db66 fix: ignore meta-property names in id-match (#21167) (Pixel)
• 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#20935) (kuldeep kumar)

Documentation

• 7d0cbf8 docs: Update README (GitHub Actions Bot)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183) (Lee Daeun)
• 678c90b docs: Update README (GitHub Actions Bot)
• 8a10424 docs: Update README (GitHub Actions Bot)
• 69bb948 docs: Update README (GitHub Actions Bot)

Chores

• 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196) (renovate[bot])
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191) (Lazizbek Ergashev)
• 5611035 test: add error locations info to no-void (#21185) (Lee Daeun)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176) (dependabot[bot])
• f131c03 chore: improve ecosystem test failure reporting (#20937) (crimsonjay0)
• 1f6edde chore: update ecosystem plugins (#21182) (ESLint Bot)
• d3266fb chore: unpin webpack dependency (#21172) (Francesco Trotta)
• 65a6519 chore: add allowScripts field to package.json (#21092) (GiHoon Noh)
• 22e5256 ci: add triage:no label to Dependabot PRs (#21141) (lumir)
• 55c9038 ci: bump actions/labeler from 6 to 7 (#21159) (dependabot[bot])
• 7280e78 chore: update dependency prettier to v3.9.6 (#21162) (renovate[bot])
• eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#21156) (Francesco Trotta)
• 60a178d chore: update ecosystem plugins (#21150) (ESLint Bot)
• f9f61dc test: add error locations to no-unreachable (#21151) (JIYEON)
• d086293 test: add error locations to no-undef (#21147) (JIYEON)
• cc01b67 test: add error locations to no-useless-catch (#21144) (devoil)
• 688e75e chore: add missing backticks in JSDoc (#21143) (Bo Hyun Kim)
• 7c1e175 test: add error locations to require-await (#21145) (Grit)
• 588a26d test: add error locations to no-extra-label (#21139) (dongkyu lee)
• 059aa89 test: add error locations to no-useless-concat (#21140) (dongkyu lee)
• 5a452a8 test: add error locations to no-const-assign (#21138) (dongkyu lee)

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

... (truncated)

Commits

• c049dc3 10.8.1
• a3f7826 Build: changelog update for 10.8.1
• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#21173)
• 0a14800 chore: update github/codeql-action action to v4.37.4 (#21196)
• 7d0cbf8 docs: Update README
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#21191)
• 5611035 test: add error locations info to no-void (#21185)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#21176)
• f131c03 chore: improve ecosystem test failure reporting (#20937)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#21183)
• Additional commits viewable in compare view

Updates eslint-config-vuetify from 4.6.2 to 4.7.2

Release notes

Sourced from eslint-config-vuetify's releases.

v4.7.2

   🐞 Bug Fixes

• vue: Correct condition for vue/block-lang  -  by @​J-Sek (b569f)

    View changes on GitHub

v4.7.1

   🐞 Bug Fixes

• Added missing package.json fields: bugs, homepage  -  by Omission Create Bot (5a8b2)
• Point types field to emitted declaration  -  by @​luuhongyii (c3d37)

    View changes on GitHub

v4.7.0

   🚀 Features

• regexp: Enable eslint-plugin-regexp flat/recommended  -  by @​johnleider in vuetifyjs/eslint-config-vuetify#56 (70b49)

    View changes on GitHub

Commits

• 7b01025 chore: release v4.7.2
• b569f10 fix(vue): correct condition for vue/block-lang
• e04268a docs: update Discord invite link to discord.gg/vuetify
• a85c42f chore: release v4.7.1
• 11573de build: update deps and fix lint warning
• c17d0ee style(utils): remove shebang and fix lint issues]
• c3d3761 fix: point types field to emitted declaration
• 5a8b24b fix: Added missing package.json fields: bugs, homepage
• 562bf16 chore: release v4.7.0
• 70b4926 feat(regexp): enable eslint-plugin-regexp flat/recommended (