chore(deps): bump the minor-and-patch group across 1 directory with 4 updates

[dependabot]

Bumps the minor-and-patch group with 4 updates in the / directory: happy-dom, sass-embedded, js-yaml and @zip.js/zip.js.

Updates happy-dom from 20.11.1 to 20.11.2

Release notes

Sourced from happy-dom's releases.

v20.11.2

👷‍♂️ Patch fixes

• MutationObserver callback being GC'd due to orphaned WeakRef - By @​mixelburg in task #2264

Commits

• 576a8bc fix: #2264 MutationObserver callback being GC'd due to orphaned WeakRef (#2...
• 084afd6 chore: #2251 Updates the contribution guidelines (#2252)
• See full diff in compare view

Updates sass-embedded from 1.100.0 to 1.102.0

Changelog

Sourced from sass-embedded's changelog.

1.102.0

• Use the 2.4 gamma transfer function for rec2020, as specified by the latest draft of CSS Color 4.

1.101.7

• No user-visible changes.

1.101.6

• No user-visible changes.

1.101.5

• No user-visible changes.

1.101.4

• Avoid emitting rgb() or rgba() functions with non-percent decimal channels. Older browsers only support integer values or (potentially decimal) percentages for these functions, so in order to preserve backwards-compatibility while retaining full precision for modern browsers, legacy colors that contain at least one non-integer channel will now use percentages for their channels (for example, rgb(0%, 100%, 50%) rather than rgb(0, 255, 127.5)).

• Fix a bug where the values of plain-CSS if() expressions were emitted using their meta.inspect() format rather than their CSS serialization format.

1.101.3

• No user-visible changes.

1.101.2

• Fix a bug where the deprecation warning for vendor-prefixed expression() functions would incorrectly indicate whether or not the function would be invalid Sass in Dart Sass 2.0.0.

1.101.1

• Sass stack trace entries are now always either absolute URLs, absolute paths, or paths relative to the current working directory. Previously, if a stylesheet was loaded using a relative URL (as from a load path), that relative URL was listed even if it couldn't be resolved relative to the current working directory. However, this created potential ambiguities, so this behavior has been removed.

Command Line Interface

... (truncated)

Commits

• 07d7803 Update Dart Sass version and release
• de6ceb9 Use gamma 2.40 for display-referred rec2020 (#418)
• 7932fd8 Update Dart Sass version and release
• 4377858 Bump actions/setup-node from 6 to 7 (#440)
• 3994086 Bump @​types/node from 25.9.5 to 26.1.1 (#437)
• e4321a1 Reformat with the latest Prettier (#436)
• 09219c4 Bump actions/checkout from 6 to 7 (#433)
• feda063 Bump typescript from 5.9.3 to 6.0.3 (#430)
• 3f30582 Update Dart Sass version and release
• See full diff in compare view

Updates js-yaml from 5.2.3 to 5.3.0

Changelog

Sourced from js-yaml's changelog.

[5.3.0] - 2026-08-14

This release focuses on reworking the documentation and making small architectural improvements before moving forward.

Added

• Added completely new documentation.
• Exported DUMP_SCHEMA, the default schema used by the dumper.
• Added YAMLException.throwAt() for throwing an error at a source position.

Changed

• Changed flat constant exports to grouped exports: EVENT_ID, SCALAR_STYLE, COLLECTION_STYLE, and CHOMPING_MODE, along with their value types. The old exports are still preserved, but deprecated.
• Made identify mandatory for custom tag definitions. Use identify: () => false for load-only tags.

Deprecated

• Deprecated flat constant exports. Use grouped ones instead.

Removed

• Removed the MERGE_KEY export (not used anymore after last fixes).

Fixed

• Validate << sequence items at merge time, so aliased merge sources are checked too.
• Resolve << outside of a mapping key as the plain string '<<', matching v4, instead of leaking an internal symbol into the result.

Commits

• 04db458 5.3.0 released
• 22ce0a0 Changelog update
• fae37b8 fix: << outside a mapping key no longer leaks the internal merge symbol
• b62ef83 fix: validate << sequence items at merge time, so aliased sources are check...
• cc665ec docs: review and update annotations
• 2aa24a6 Changelog update
• eec6902 Restore deprecated parser constant exports
• 03397ac Move throwErrorAt to YAMLException as throwAt
• d9dd2c7 docs: new condensed theme
• 0f898e6 docs: annotation tweaks
• Additional commits viewable in compare view

Updates @zip.js/zip.js from 2.8.34 to 2.8.49

Release notes

Sourced from @​zip.js/zip.js's releases.

v2.8.49

What's Changed in v2.8.49

Compatibility improvements

• The embedded JavaScript deflate engine is now compiled with an ES2019 target. It no longer contains nullish coalescing operators, which require Chromium 80. As a result, the WebAssembly and "native" builds now work down to Chromium 76 instead of 80 (see #669). The compatibility table on https://gildas-lormeau.github.io/zip.js/ has been updated accordingly
• Fixed a regression introduced in v2.8.18: when the worker script passed via workerURI could not be started as a module worker, zip.js fell back silently to inline workers instead of retrying with a classic worker. Browsers without module worker support, e.g. Chromium 76 to 79, now load external worker scripts again
• Codecs registered with registerCodec() and a codecURI now run inline transparently when the web worker cannot import the codec module, e.g. on browsers which do not support import() in workers like Chromium 76 to 79 and Firefox 102 to 113. Setting useWebWorkers to false is no longer needed on these browsers

These changes were verified by running the test suite on real Chromium 76, 79 and 80 builds. Known limitation on Chromium 76 to 79: aborting operations in progress has no effect because these versions ignore the signal option of pipeTo(). The data read or written remains correct.

Full Changelog: gildas-lormeau/zip.js@v2.8.48...v2.8.49

v2.8.48

Bug fixes

• Fixed reading and writing data when the global stream classes are polyfilled, e.g. with web-streams-polyfill on Firefox 79. Reading a zip file from a stream, Entry#arrayBuffer(), createBlobTempStream() and the filesystem API could fail or hang because zip.js consumed streams internally with the native Response constructor or ReadableStream#pipeTo(), which do not accept polyfilled streams. With the polyfill loaded, the whole test suite now passes in an environment without TransformStream. Thanks to @​danny0838 for running the test suite on older browsers (#669)
• Fixed the generation of temporary file names in createOPFSTempStream() and createSyncAccessHandleTempStream() when crypto.randomUUID is unavailable, e.g. in Chrome 67 to 91 or Safari 14.1 to 15.3

Other changes

• Browser tests requiring a feature the browser does not support, e.g. CompressionStream or OPFS, are now reported as skipped instead of failing, which makes the test results meaningful on older browsers
• New npm run serve-tests script to run the tests manually in a browser, and a new README documenting how to run and write tests

Full Changelog: gildas-lormeau/zip.js@v2.8.47...v2.8.48

v2.8.47

What's Changed in v2.8.47

New features

• New signCentralDirectory option in ZipWriter#close() to sign zip files. The function receives the raw data of the central directory records and returns the data of a digital signature record, e.g. a PKCS#7 signature, written between the central directory and the end of central directory record. The signature is exposed by the new digitalSignature property of ZipReader, along with the new directoryOffset and directoryLength properties to locate the signed data and verify it. zip.js stores the data as-is and does not implement the signature computation itself
• New decryptCentralDirectory option in ZipReader to read zip files with an encrypted central directory, as defined in the Strong Encryption Specification of the ZIP format specification. The function receives the raw data stored in place of the central directory and the encryption metadata exposed in a DirectoryEncryptionInfo object, and returns the decrypted central directory records. Without this option, reading such zip files throws an ERR_ENCRYPTED_CENTRAL_DIRECTORY error. zip.js provides the encrypted data and the related metadata but does not implement the decryption itself
• All the user-facing error message constants are now exported, e.g. ERR_INVALID_UID, ERR_INVALID_MSDOS_ATTRIBUTES, ERR_ENTRY_EXISTS, ERR_UNSUPPORTED_CRYPTO_API and ERR_WORKER_STARTUP_TIMEOUT. This allows comparing error.message with the constants instead of hardcoding the messages

Other changes

• Improved browser testing, thanks to @​danny0838 (#672): module import errors are now reported in the test results, and the new withStreamsPolyfill URL parameter runs the test suite with web-streams-polyfill on browsers missing TransformStream

Full Changelog: gildas-lormeau/zip.js@v2.8.46...v2.8.47

v2.8.46

What's Changed in v2.8.46

New features

• New createWorker option in configure() to create the web workers, taking precedence over workerURI. It enables the standard bundler pattern new Worker(new URL("./zip-worker.js", import.meta.url), { type: "module" }), letting bundlers like webpack and Vite detect the worker script statically and compile it with its imports into a separate asset
• New initWorker() function exposed by the new @zip.js/zip.js/worker entry point to write custom worker scripts. It can register alternative implementations of CompressionStream/DecompressionStream used to compress/decompress data, e.g. based on fflate, and an init hook called with the configuration, e.g. to load a WebAssembly module. The API reference of initWorker() includes a complete example based on fflate. Existing custom worker scripts relying on the initModule convention keep working
• New @zip.js/zip.js/lib/zip-core-custom.js entry point offering the full API without embedding any web worker code or deflate implementation. Combined with createWorker and a custom worker script, the compression engine of your choice ships only once, in the worker script
• New CompressionStreamFallback and DecompressionStreamFallback options in configure() replacing the deprecated CompressionStreamZlib and DecompressionStreamZlib options. The new names reflect the role of these implementations: the fallback used when useCompressionStream is set to false or when the Compression Streams API is unavailable

... (truncated)

Commits

• d8d6aa7 bump up version
• cfb4f04 update markdown doc
• c9b7333 run registered codecs inline when workers cannot import them
• e0cebec restore the worker global in the polyfill test
• bc348eb fix classic worker fallback when module workers are unsupported
• 14876cd update embedded deflate engine (es2019 target)
• d02d45e skip worker tests when workers lack native streams
• 8b2752f bump up version
• b678e8b update markdown doc
• 73cfa02 fix fixtures description in tests readme
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[kw-security]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.