Bump the npm_and_yarn group across 38 directories with 20 updates

[dependabot]

Bumps the npm_and_yarn group with 1 update in the /database/BaijiMangaViewer directory: sharp.
Bumps the npm_and_yarn group with 5 updates in the /database/BatchLabs directory:

Package	From	To
@angular/common	4.3.5	20.3.28
@angular/compiler	4.3.5	20.3.27
@angular/core	4.3.5	20.3.28
extract-zip	1.6.8	2.0.1
immutable	3.8.4	5.1.9

Bumps the npm_and_yarn group with 1 update in the /database/Bdash directory: mysql2.
Bumps the npm_and_yarn group with 1 update in the /database/BitShares directory: immutable.
Bumps the npm_and_yarn group with 1 update in the /database/BotFramework-Emulator directory: xmldom.
Bumps the npm_and_yarn group with 1 update in the /database/Buckets directory: qs.
Bumps the npm_and_yarn group with 1 update in the /database/CPod directory: sanitize-html.
Bumps the npm_and_yarn group with 1 update in the /database/Jan directory: pacote.
Bumps the npm_and_yarn group with 1 update in the /database/Kanon directory: csv-parse.
Bumps the npm_and_yarn group with 1 update in the /database/Knowte directory: nanoid.
Bumps the npm_and_yarn group with 3 updates in the /database/Mindmapp directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 1 update in the /database/Mochi directory: csv-parse.
Bumps the npm_and_yarn group with 1 update in the /database/Mockman directory: multer.
Bumps the npm_and_yarn group with 1 update in the /database/MyDeck directory: jsondiffpatch.
Bumps the npm_and_yarn group with 3 updates in the /database/NanoVault directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 4 updates in the /database/ShuffleStudy directory: @angular/common, @angular/compiler, @angular/core and sanitize-html.
Bumps the npm_and_yarn group with 1 update in the /database/Shuttle directory: extract-zip.
Bumps the npm_and_yarn group with 4 updates in the /database/Sovren.Batch.Parser directory: @angular/common, @angular/compiler, @angular/core and @angular/platform-server.
Bumps the npm_and_yarn group with 2 updates in the /database/Station directory: sharp and immutable.
Bumps the npm_and_yarn group with 3 updates in the /database/Storaji directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 1 update in the /database/Tropy directory: sharp.
Bumps the npm_and_yarn group with 1 update in the /database/Tusk directory: decode-uri-component.
Bumps the npm_and_yarn group with 1 update in the /database/WebDesktop directory: multer.
Bumps the npm_and_yarn group with 1 update in the /database/Webchain_Wallet directory: immutable.
Bumps the npm_and_yarn group with 2 updates in the /database/Whalebird directory: sanitize-html and axios.
Bumps the npm_and_yarn group with 3 updates in the /database/Yaka directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 3 updates in the /database/ZooDemy directory: @angular/common, @angular/compiler and @angular/core.
Bumps the npm_and_yarn group with 4 updates in the /database/altair directory: @angular/common, @angular/compiler, @angular/core and @angular/platform-server.
Bumps the npm_and_yarn group with 1 update in the /database/cumulonimbus directory: sanitize-html.
Bumps the npm_and_yarn group with 1 update in the /database/falcon-sql-client directory: csv-parse.
Bumps the npm_and_yarn group with 1 update in the /database/hubii-core directory: immutable.
Bumps the npm_and_yarn group with 1 update in the /database/isle-editor directory: csv-parse.
Bumps the npm_and_yarn group with 1 update in the /database/laravel-kit directory: extract-zip.
Bumps the npm_and_yarn group with 1 update in the /database/polar-bookshelf directory: sanitize-html.
Bumps the npm_and_yarn group with 1 update in the /database/snapshot-slider directory: nodemailer.
Bumps the npm_and_yarn group with 2 updates in the /database/upterm directory: immutable and csv-parse.
Bumps the npm_and_yarn group with 1 update in the /database/zeltrez directory: axios.
Bumps the npm_and_yarn group with 1 update in the /database/zmNinja directory: cordova-plugin-inappbrowser.

Updates sharp from 0.17.3 to 0.35.4

Release notes

Sourced from sharp's releases.

v0.35.4

https://github.com/lovell/sharp-libvips/releases/tag/v1.3.3

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

v0.35.4-rc.0

• Upgrade to libvips v8.18.6 for upstream bug fixes.

• Bound resize dimensions to coordinate limit.

• Bound composite left and top to coordinate limit. #4564 @​metsw24-max

• Round palette bit depth up for png and gif colours. #4569 @​metsw24-max

• Ensure tiff.subifd input option is used. #4572 @​metsw24-max

• Ensure info.pages is correct when limiting input page range. #4578 @​metsw24-max

• Improve support for input Streams finishing before output is requested. #4584 @​Jaybhade

... (truncated)

Commits

• 7f1a0a2 Release v0.35.4
• f927818 Upgrade to sharp-libvips v1.3.3
• e802092 Prerelease v0.35.4-rc.0
• e13eb2f CI: Fix wasm32 build (#4589)
• a82a0b3 Upgrade to libvips v8.18.6
• 8044fe4 Bound resize dimensions to coordinate limit
• 147f859 Docs: changelog entries for #4578 #4584
• ee5bfb8 Tests: use yauzl directly rather than via extract-zip wrapper
• 7a77889 Bump uraimo/run-on-arch-action from 3.1.0 to 3.2.0 (#4588)
• ea5bef2 Improve support for input Streams finishing before output is requested (#4584)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for sharp since your current version.

Updates @angular/common from 4.3.5 to 20.3.28

Release notes

Sourced from @​angular/common's releases.

20.3.28

core

Commit	Description
	sanitize host bindings on concrete hosts

http

Commit	Description
	match header values exactly when deleting
	preserve immutability of materialized clones
	run root interceptors in the terminal request chain

20.3.27

compiler

Commit	Description
	disallow i18n event attributes
	restrict possible event handler check to property names longer than 2 characters

http

Commit	Description
	distinguish repeated transfer cache params

platform-server

Commit	Description
	update domino to latest version

20.3.26

compiler-cli

Commit	Description
	update babel dependencies to latest v7

core

Commit	Description
	avoid caching missing locale data
	reject dynamic script host elements

http

Commit	Description
	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Description
	preserve referrer in asset requests
	preserve referrer policy in asset requests

20.3.25

common

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/common's changelog.

20.3.28 (2026-08-13)

core

Commit	Type	Description
2f96c8020f	fix	sanitize host bindings on concrete hosts

http

Commit	Type	Description
969133d426	fix	match header values exactly when deleting
29dd26bd71	fix	preserve immutability of materialized clones
e4c416c20a	fix	run root interceptors in the terminal request chain

20.3.27 (2026-07-29)

compiler

Commit	Type	Description
5dbcd0ee16	fix	disallow i18n event attributes
db0d4a1a39	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
a64e2883e9	fix	distinguish repeated transfer cache params

platform-server

Commit	Type	Description
6f80cca0b8	fix	update domino to latest version

20.3.26 (2026-07-08)

compiler-cli

| Commit | Type | Description |

... (truncated)

Commits

• e4c416c fix(http): run root interceptors in the terminal request chain
• 969133d fix(http): match header values exactly when deleting
• 29dd26b fix(http): preserve immutability of materialized clones
• a64e288 fix(http): distinguish repeated transfer cache params
• b963f61 fix(http): prevent caching of responses with Set-Cookie headers
• 06be298 fix(http): preserve empty referrer option in HttpRequest
• 9f443bc fix(common): Limits date format string length
• fa940e1 fix(http): Rejects non-HTTP(S) URLs in JSONP requests
• 1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
• 566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​angular/common since your current version.

Updates @angular/compiler from 4.3.5 to 20.3.27

Release notes

Sourced from @​angular/compiler's releases.

20.3.27

compiler

Commit	Description
	disallow i18n event attributes
	restrict possible event handler check to property names longer than 2 characters

http

Commit	Description
	distinguish repeated transfer cache params

platform-server

Commit	Description
	update domino to latest version

20.3.26

compiler-cli

Commit	Description
	update babel dependencies to latest v7

core

Commit	Description
	avoid caching missing locale data
	reject dynamic script host elements

http

Commit	Description
	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Description
	preserve referrer in asset requests
	preserve referrer policy in asset requests

20.3.25

common

Commit	Description
	Limits date format string length
	skip transfer cache for uncacheable HTTP traffic
	use cryptographically secure SHA-256 for transfer cache key generation

compiler

Commit	Description
	sanitize two-way properties

core

Commit	Description
	harden TransferState restoration against DOM clobbering

... (truncated)

Changelog

Sourced from @​angular/compiler's changelog.

20.3.27 (2026-07-29)

compiler

Commit	Type	Description
5dbcd0ee16	fix	disallow i18n event attributes
db0d4a1a39	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
a64e2883e9	fix	distinguish repeated transfer cache params

platform-server

Commit	Type	Description
6f80cca0b8	fix	update domino to latest version

20.3.26 (2026-07-08)

compiler-cli

Commit	Type	Description
406aaa31e6	fix	update babel dependencies to latest v7

core

Commit	Type	Description
26831d0cbd	fix	avoid caching missing locale data
8eb7aea08b	fix	reject dynamic script host elements

http

Commit	Type	Description
b963f61028	fix	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Type	Description

... (truncated)

Commits

• db0d4a1 fix(compiler): restrict possible event handler check to property names longer...
• 5dbcd0e fix(compiler): disallow i18n event attributes
• a68ec70 fix(compiler): sanitize two-way properties
• d40acc6 fix(compiler): prevent namespaced SVG <style> elements from being stripped
• 7ae6381 test(compiler-cli): align ngtsc sanitization expectations with modern DOM sch...
• 36200bd test(core): update spec files to match 20.3.x limits and actual contexts (#68...
• 823b37f test(compiler): remove obsolete schema_extractor import (#68926)
• e345a58 fix(core): normalize tag names in runtime i18n attribute security context loo...
• 8f35b18 fix(compiler): normalize tag names with custom namespaces in DomElementSchema...
• 64a89e9 fix(compiler): sanitize dynamic href and xlink:href bindings on SVG a element...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​angular/compiler since your current version.

Updates @angular/core from 4.3.5 to 20.3.28

Release notes

Sourced from @​angular/core's releases.

20.3.28

core

Commit	Description
	sanitize host bindings on concrete hosts

http

Commit	Description
	match header values exactly when deleting
	preserve immutability of materialized clones
	run root interceptors in the terminal request chain

20.3.27

compiler

Commit	Description
	disallow i18n event attributes
	restrict possible event handler check to property names longer than 2 characters

http

Commit	Description
	distinguish repeated transfer cache params

platform-server

Commit	Description
	update domino to latest version

20.3.26

compiler-cli

Commit	Description
	update babel dependencies to latest v7

core

Commit	Description
	avoid caching missing locale data
	reject dynamic script host elements

http

Commit	Description
	prevent caching of responses with Set-Cookie headers

service-worker

Commit	Description
	preserve referrer in asset requests
	preserve referrer policy in asset requests

20.3.25

common

| Commit | Description |

... (truncated)

Changelog

Sourced from @​angular/core's changelog.

20.3.28 (2026-08-13)

core

Commit	Type	Description
2f96c8020f	fix	sanitize host bindings on concrete hosts

http

Commit	Type	Description
969133d426	fix	match header values exactly when deleting
29dd26bd71	fix	preserve immutability of materialized clones
e4c416c20a	fix	run root interceptors in the terminal request chain

20.3.27 (2026-07-29)

compiler

Commit	Type	Description
5dbcd0ee16	fix	disallow i18n event attributes
db0d4a1a39	fix	restrict possible event handler check to property names longer than 2 characters

http

Commit	Type	Description
a64e2883e9	fix	distinguish repeated transfer cache params

platform-server

Commit	Type	Description
6f80cca0b8	fix	update domino to latest version

20.3.26 (2026-07-08)

compiler-cli

| Commit | Type | Description |

... (truncated)

Commits

• 2f96c80 fix(core): sanitize host bindings on concrete hosts
• db0d4a1 fix(compiler): restrict possible event handler check to property names longer...
• 5dbcd0e fix(compiler): disallow i18n event attributes
• 8eb7aea fix(core): reject dynamic script host elements
• 26831d0 fix(core): avoid caching missing locale data
• ca48b47 fix(core): validate lowercase SVG animation attribute names (#69270)
• 1a62130 fix(common): use cryptographically secure SHA-256 for transfer cache key gene...
• 49368c1 fix(platform-server): harden platform location origin validation during SSR
• 566ad05 fix(common): skip transfer cache for uncacheable HTTP traffic
• 768a349 fix(core): harden TransferState restoration against DOM clobbering
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​angular/core since your current version.

Updates extract-zip from 1.6.8 to 2.0.1

Release notes

Sourced from extract-zip's releases.

2.0.1

Fixed

• stop using deprecated process.umask (#96)
• correct minimum Node version (>= 10.17.0) based on fs.promises stability (#105)

2.0.0

Changes

Added

• Promise-style API (#90)
• TypeScript definition (#92)

Changed

• Required Node 10.12 (#89). As a result, the mkdirp dependency was removed.
• Switched from concat-stream to get-stream (#90) to lower the number of transitive dependencies

Removed

• Callback-style API (#90)
• Support for Node < 10.12 (#89)

Internals

• Heavy refactors for code clarity
• Switched from tape to AVA for tests (#90)
• Switched from Travis CI to GitHub Actions
• Changed files are checked/fixed for lints via a pre-commit hook (#91)

Upgrade Guide

• This module has dropped support for versions of Node.js < 10.12.0.
• This module uses a Promise-based API instead of a callback-based API. If you still need to use a callback-based API, look into util.callbackify or similar functions.
• For TypeScript codebases, remove @types/extract-zip as a TypeScript definition is bundled with the module.

1.7.0

Added

• Error handler for zipfile object (#67)

Changed

• Don't pin dependency requirements to specific versions (#88)

Commits

• d641571 2.0.1
• 73f5065 build: don't package eslint config
• 30ee4e7 fix: correct minimum Node version based on fs.promises stability (#105)
• 7bef1ac build(deps-dev): upgrade eslint to ^7.2.0 & @typescript-eslint/* to ^3.2.0 (#...
• 93cf50a refactor: stop using deprecated process.umask (#96)
• d2b2bf8 build(ci): add Node.js 14 (#101)
• 946839d docs: fix example syntax (#100)
• eb3c1ed 2.0.0
• 27f3f85 feat: add TypeScript definition (#92)
• ef3995d build: lint ava tests (#91)
• Additional commits viewable in compare view

Updates immutable from 3.8.4 to 5.1.9

Release notes

Sourced from immutable's releases.

v5.1.9

What's Changed

• fix(List): preserve undefined values when grown past 32 elements by @​spokodev / @​jdeniau in immutable-js/immutable-js#2235 (originated from immutable-js/immutable-js#2230 )

Full Changelog: immutable-js/immutable-js@v5.1.8...v5.1.9

v5.1.8

What's Changed

• fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735
• perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

Full Changelog: immutable-js/immutable-js@v5.1.7...v5.1.8

v5.1.7

What's Changed

• fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in immutable-js/immutable-js#2227

internal

• Backport tests from 6.x branch by @​jdeniau in immutable-js/immutable-js#2199
• fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index by @​jdeniau in immutable-js/immutable-js#2203
• Better type for reduce if not ininitial value is given by @​jdeniau in immutable-js/immutable-js#2205
• Backport test from #2193 by @​jdeniau in immutable-js/immutable-js#2207
• backport tests from 6.x by @​jdeniau in immutable-js/immutable-js#2213
• Firefox link to non-French page by @​jdeniau in immutable-js/immutable-js#2219
• Bump esbuild and @​size-limit/preset-small-lib by @​dependabot[bot] in immutable-js/immutable-js#2217
• backport tests from #2210 by @​jdeniau in immutable-js/immutable-js#2214
• Bump shell-quote from 1.8.2 to 1.8.4 by @​dependabot[bot] in immutable-js/immutable-js#2211
• Bump @​tootallnate/once from 2.0.0 to 2.0.1 by @​dependabot[bot] in immutable-js/immutable-js#2190
• Bump minimatch from 9.0.5 to 9.0.9 by @​dependabot[bot] in immutable-js/immutable-js#2189
• Bump @​codemirror/theme-one-dark from 6.1.2 to 6.1.3 by @​dependabot[bot] in immutable-js/immutable-js#2168
• Bump form-data from 4.0.5 to 4.0.6 by @​dependabot[bot] in immutable-js/immutable-js#2220
• Bump typescript-eslint from 8.33.0 to 8.61.1 by @​dependabot[bot] in immutable-js/immutable-js#2222
• Bump @​rollup/plugin-commonjs from 28.0.2 to 29.0.3 by @​dependabot[bot] in immutable-js/immutable-js#2224

New Contributors

• @​chatman-media made their first contribution in immutable-js/immutable-js#2227

Full Changelog: immutable-js/immutable-js@v5.1.6...v5.1.7

v5.1.6

What's Changed

• fix(reverseFactory): read reversedSequence.size in __iterator instead of this by @​jdeniau in immutable-js/immutable-js#2196

... (truncated)

Changelog

Sourced from immutable's changelog.

5.1.9

• fix(List): a List grown past 32 elements while all its values are undefined no longer reads those values back as null (affected get, iteration, toArray, equals and hashCode)

5.1.8

• fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735
• perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

4.3.9

• fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735
• perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

5.1.7

• fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063
• fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203
• [TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

• fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

5.1.5

• Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

• Migrate some files to TS by @​jdeniau in immutable-js/immutable-js#2125
  • Iterator.ts
  • PairSorting.ts
  • toJS.ts
  • Math.ts
  • Hash.ts
• Extract CollectionHelperMethods and convert to TS by @​jdeniau in immutable-js/immutable-js#2131
• Use npm trusted publishing only to avoid token stealing.

Documentation

• Fix/a11y issues by @​lyannel in immutable-js/immutable-js#2136
• Doc add Map.get signature update by @​borracciaBlu in immutable-js/immutable-js#2138
• fix(doc):minor-issues#2132 by @​JayMeDotDot in immutable-js/immutable-js#2133
• Fix algolia search by @​jdeniau in immutable-js/immutable-js#2135
• Typo in OrderedMap by @​jdeniau in immutable-js/immutable-js#2144

Internal

• chore: Sort all imports and activate eslint import rule by @​jdeniau in immutable-js/immutable-js#2119

... (truncated)

Commits

• 329f7a6 5.1.9
• 21fabd9 changelog
• 009164f Merge pull request #2235 from immutable-js/fix/avoid-null-when-setsize33
• 5b65bfb fix(List): preserve undefined values when grown past 32 elements
• 50bf39e Update CHANGELOG.md for versions 5.1.8 and 4.3.9
• 6496539 5.1.8
• 808a83a Merge commit from fork
• e51d49f perf(Map): index large hash-collision buckets for faster lookups
• 25c58b0 fix typescript in tests
• a1a1ee4 Merge commit from fork
• Additional commits viewable in compare view

Updates mysql2 from 1.5.1 to 3.23.1

Release notes

Sourced from mysql2's releases.

v3.23.1

3.23.1 (2026-07-19)

Bug Fixes

• security: fix unbounded decompression of server-supplied compressed packets, reported by alanturing881 (7c48343)
• parser: call typeCast for NULL values in the binary protocol (#4394) (01f1092)

v3.23.0

3.23.0 (2026-07-13)

Features

• return unsafe integers inside JSON columns as exact strings with supportBigNumbers (#4388) (a26ff14)
• sql-escaper: add Temporal support when escaping values (#4392) (6b933f6)
• support MariaDB data types (UUID, INET4, INET6, VECTOR, JSON) via extended type metadata; run CI against MariaDB (#4373) (