fix(deps): update all non-major dependencies with stable versions (patch)

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
dompurify@<3.2.4	>=3.2.4 → >=3.2.7
eslint (source)	^9.39.1 → ^9.39.2
eslint-plugin-vue (source)	^10.6.1 → ^10.6.2
form-data@>=4.0.0 <4.0.4	[>=4.0.4 → >=4.0.5](https://renovatebot.com/diffs/npm/form-data@&gt;&#x3D;4.0.0 <4.0.4/4.0.4/4.0.5)
sass	^1.94.2 → ^1.94.3
vue (source)	^3.5.25 → ^3.5.26
vue-tsc (source)	^3.1.5 → ^3.1.8
vue@>=2.0.0-alpha.1 <3.0.0-alpha.0 (source)	[>=3.0.0-alpha.0 → >=3.0.11](https://renovatebot.com/diffs/npm/vue@&gt;&#x3D;2.0.0-alpha.1 <3.0.0-alpha.0/3.0.0-alpha.0/3.0.11)

---

Release Notes

cure53/DOMPurify (dompurify@<3.2.4)

v3.2.7: DOMPurify 3.2.7

Compare Source

• Added new attributes and elements to default allow-list, thanks @​elrion018
• Added tagName parameter to custom element attributeNameCheck, thanks @​nelstrom
• Added better check for animated href attributes, thanks @​llamakko
• Updated and improved the bundled types, thanks @​ssi02014
• Updated several tests to better align with new browser encoding behaviors
• Improved the handling of potentially risky content inside CDATA elements, thanks @​securityMB & @​terjanq
• Improved the regular expression for raw-text elements to cover textareas, thanks @​securityMB & @​terjanq

v3.2.6: DOMPurify 3.2.6

Compare Source

• Fixed several typos and removed clutter from our documentation, thanks @​Rotzbua
• Added matrix: as an allowed URI scheme, thanks @​kleinesfilmroellchen
• Added better config hardening against prototype pollution, thanks @​EffectRenan
• Added better handling of attribute removal, thanks @​michalnieruchalski-tiugo
• Added better configuration for aggressive mXSS scrubbing behavior, thanks @​BryanValverdeU
• Removed the script that caused the fake entry CVE-2025-48050

v3.2.5: DOMPurify 3.2.5

Compare Source

• Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
• Added ESM type imports in source, removes patch function, thanks @​donmccurdy
• Added script to verify various TypeScript configurations, thanks @​reduckted
• Added more modern browsers to the Karma launchers list
• Added Node 23.x to tested runtimes, removed Node 17.x
• Fixed the generation of source maps, thanks @​reduckted
• Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
• Fixed a few typos in the README file

eslint/eslint (eslint)

v9.39.2

Compare Source

vuejs/eslint-plugin-vue (eslint-plugin-vue)

v10.6.2

Compare Source

Patch Changes

• Fixed false positives in non-intersecting conditions in vue/no-duplicate-class-names and correctly detect duplicates in combining expressions (#​2980)
• Fixed false positives for TSImportType in vue/script-indent rule (#​2969)
• Improved performance and type safety in vue/prefer-use-template-ref (#​2982)

form-data/form-data (form-data@>=4.0.0 <4.0.4)

v4.0.5

Compare Source

Commits

• [Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076
• [Dev Deps] update @ljharb/eslint-config, eslint 5822467
• [Fix] set Symbol.toStringTag in the proper place 76d0dee

sass/dart-sass (sass)

v1.94.3

Compare Source

• Fix the span reported for standalone % expressions followed by whitespace.

vuejs/core (vue)

v3.5.26

Compare Source

Bug Fixes

• compat: fix compat handler of draggable (#​12445) (ed85953), closes #​12444
• compat: handle v-model deprecation warning with missing appContext (#​14203) (945a543), closes #​14202
• compiler-sfc: demote const reactive bindings used in v-model (#​14214) (e24ff7d), closes #​11265 #​11275
• compiler-ssr: handle ssr attr fallthrough when preserve whitespace (#​12304) (4783118), closes #​8072
• hmr: handle cached text node update (#​14134) (69ce3c7), closes #​14127
• keep-alive: use resolved component name for async components in cache pruning (#​14212) (dfe667c), closes #​14210
• runtime-core: ensure correct anchor el for deeper unresolved async components (#​14182) (f5b3bf2), closes #​14173
• runtime-core: handle patch stable fragment edge case (#​12411) (94aeb64), closes #​12410
• runtime-core: pass component instance to flushPreFlushCbs on unmount (#​14221) (e857e12), closes #​14215

Performance Improvements

• compiler-core: use binary-search to get line and column (#​14222) (1904053)

vuejs/language-tools (vue-tsc)

v3.1.8

Compare Source

Features

• feat(vscode): support multiline attribute for <script> and <style> tag (#​5830) - Thanks to @​serkodev!
• feat(vscode): supports format with selected range (#​5761) - Thanks to @​serkodev!
• feat(language-service): add tsconfig-based document link support for Pug

Bug Fixes

• fix(language-core): limit the range of parseDiagnostics checks (#​5823)
• fix(language-core): restore default import bindings for template scope (#​5824) - Thanks to @​serkodev!
• fix(typescript-plugin): get preferences and formatOptions in tsserver (#​5829)
• fix(language-core): avoid generating component options within the setup scope (#​5832)

Other Changes

• perf(language-core): dedupe component options generation (#​5831)

v3.1.7

Compare Source

v3.1.6

Compare Source

Features

• feat(vscode): add settings to enable per-block formatting (#​5784) - Thanks to @​serkodev!
• feat(language-service): enhanced component auto import (#​5790)
• feat(component-meta): add component name and description fields (#​5797)
• feat(typescript-plugin): add support for template "Add Import" quick fix (#​5799) - Thanks to @​serkodev!
• feat(typescript-plugin): mapping JSDoc informations from <script setup> (#​5805)
• feat(vscode): support tsdk path for Eclipse Theia (#​5806) - Thanks to @​serkodev!

Bug Fixes

• fix(language-service): ignore intrinsic elements when detect tag name casing (#​5771)
• fix(language-core): createParsedCommandLineByJson parsed incorrect options since v3.1.5 (#​5768 (comment))
• fix(vscode): make vue.server.path compatible with Windows (#​5772)
• fix(vscode): analyze interpolation highlight ranges based on AST (#​5777)
• fix(vscode): sync latest vscode html language configuration (#​5740)
• fix(language-core): enhance getVIfNode to support v-else-if directives (#​5765) - Thanks to @​serkodev!
• fix(language-core): generate {} instead of its string value for style="..." (#​5781) - Thanks to @​KazariEX!
• fix(language-core): v-bind="$attrs" loses navigation when inferTemplateDollarAttrs is disabled (#​5783)
• fix(language-service): skip const props = completion in StringLiteral (#​5786)
• fix(language-core): unable to get completion for the second scoped class name
• fix(language-service): format components with HTML void-element names (#​5788) - Thanks to @​serkodev!
• fix(language-service): properly handle promise when resolving CSS links (#​5785)
• fix(language-core): infer $el type for generic components using inferComponentDollarEl (#​5794)
• fix(language-core): ensure <script> content generates before <script setup> (#​5795)
• fix(language-core): remove bypassDefineComponent hack for better JS support (#​4876) (#​5379)
• fix(language-core): Prettify<T> caused generic props gets inferred as unknown (#​5667) - Thanks to @​so1ve!
• fix(vscode): handle leading < as operator in SFC scripts (#​5801) - Thanks to @​serkodev!
• fix(vscode): patch isTypeScriptDocument in VSCode for typescript.preferences.autoImportSpecifierExcludeRegexes config support (#​5364)
• fix(language-core): ensure type consistency for optional boolean props (#​5803)
• fix(language-core): add compatibility for vapor attr (#​5496)
• fix(language-core): AST fault tolerance for key binding on template (#​5807)

Performance

• perf(language-core): reuse ts asts for :class - Thanks to @​KazariEX!

Other Changes

• Revert "refactor(typescript-plugin): remove go to definition trick for auto imported components (#​5733)"
• docs(typescript-plugin): update Neovim configuration link (#​5775) - Thanks to @​AlexVagrant!
• refactor(language-core): normalize template AST (#​5782)
• refactor(language-core): split style codegen (#​5787)
• refactor(language-core): remove debugger from virtual code for tsslint compatibility
• refactor(language-core): remove legacy navigation support in ref="xxx"
• refactor(language-core): reduce codegen options (#​5804)
• refactor(component-meta): deprecated rawType and __internal__.tsLs (#​5808)
• chore: update volar to 2.4.26
  • feat: fallback resolution mode for createResolveModuleName (volarjs/volar.js#293) (#​5644) - Thanks to @​serkodev!

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) in timezone America/New_York, Automerge - Monday through Friday ( * * * * 1-5 ) in timezone America/New_York.

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[netlify]

✅ Deploy Preview for kong-spec-editor ready!

Name	Link
🔨 Latest commit	cceff97
🔍 Latest deploy log	https://app.netlify.com/projects/kong-spec-editor/deploys/695f525714bafc0008466394
😎 Deploy Preview	https://deploy-preview-167--kong-spec-editor.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.