Bump the client-v3-npm group across 1 directory with 8 updates

[dependabot]

Bumps the client-v3-npm group with 8 updates in the /client-v3 directory:

Package	From	To
dompurify	3.4.15	3.4.16
marked	18.0.13	18.0.14
yjs	13.6.32	13.6.33
@types/node	26.6.2	26.6.3
eslint-plugin-vue	10.11.0	10.11.1
prettier	3.9.8	3.9.9
sass	1.104.0	1.105.0
vite	8.3.0	8.3.1

Updates dompurify from 3.4.15 to 3.4.16

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.16

• Fixed a problem with IN_PLACE node removal when working with hooks, thanks @​manus-pi
• Fixed a problem with IN_PLACE sanitization and raw-text roots, thanks @​h-t-m
• Fixed a problem with ESM default exports landing in CommonJS declarations, thanks @​ssi02014
• Migrated from rollup to rolldown because performance, thanks @​ssi02014
• Bumped several dependencies where possible

Commits

• b9b9d80 release: 3.4.16 (#1636)
• See full diff in compare view

Updates marked from 18.0.13 to 18.0.14

Release notes

Sourced from marked's releases.

v18.0.14

18.0.14 (2026-09-22)

Bug Fixes

• allow indented lines in setext heading text (#4095) (7d05530)
• decode numeric character references in text (#4076) (cead8de)
• keep text after empty nested blockquote (#4101) (1b89557), closes #4098
• preserve internal tabs in list item content (#4086) (e136da7)
• strip whitespace when normalizing link reference labels (#4091) (c7ee43a)
• support GFM protocol autolinks (#4067) (7f7a496)

Commits

• ef0704c chore(release): 18.0.14 [skip ci]
• 23c82ad chore: update deps (#4108)
• 1b89557 fix: keep text after empty nested blockquote (#4101)
• 7f7a496 fix: support GFM protocol autolinks (#4067)
• 5196d98 docs: add commonmark and gfm as versions in demo (#4094)
• de2320a docs: add marked-gitlab to known extensions (#4092)
• 7d05530 fix: allow indented lines in setext heading text (#4095)
• c7ee43a fix: strip whitespace when normalizing link reference labels (#4091)
• cead8de fix: decode numeric character references in text (#4076)
• e136da7 fix: preserve internal tabs in list item content (#4086)
• Additional commits viewable in compare view

Updates yjs from 13.6.32 to 13.6.33

Release notes

Sourced from yjs's releases.

v13.6.33

• set currentTarget of deep events right before calling observers - fixes #768, closes #801 713a2895

Thanks to @​aartrost & @​dikshit-n for the fixes!

---

yjs/yjs@v13.6.32...v13.6.33

Commits

• 9ea3a4f 13.6.33
• 713a289 set currentTarget of deep events right before calling observers - fixes #768,...
• See full diff in compare view

Updates @types/node from 26.6.2 to 26.6.3

Commits

• See full diff in compare view

Updates eslint-plugin-vue from 10.11.0 to 10.11.1

Release notes

Sourced from eslint-plugin-vue's releases.

v10.11.1

Patch Changes

• Fixed vue/no-ref-object-reactivity-loss false negatives for values gotten in an immediately invoked function expression (IIFE) (#3115)
• Fixed vue/no-unused-properties false positive for props explicitly typed as never (#3113)
• Fixed vue/require-default-prop to no longer require a default value for defineModel (#3138)

Changelog

Sourced from eslint-plugin-vue's changelog.

10.11.1

Patch Changes

• Fixed vue/no-ref-object-reactivity-loss false negatives for values gotten in an immediately invoked function expression (IIFE) (#3115)
• Fixed vue/no-unused-properties false positive for props explicitly typed as never (#3113)
• Fixed vue/require-default-prop to no longer require a default value for defineModel (#3138)

Commits

• ec9c53a Version Packages (#3139)
• 50ffb7f docs: explain how to apply the configs to a subset of files (#3122)
• ad239b4 fix(no-unused-properties): ignore props typed as never (#3113)
• 24cb5bc fix(no-ref-object-reactivity-loss): improve IIFE handling (#3115)
• ef6f53e fix(require-default-prop): don't report on defineModel (#3138)
• 121030c Format changelog
• See full diff in compare view

Updates prettier from 3.9.8 to 3.9.9

Release notes

Sourced from prettier's releases.

3.9.9

• Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.9

diff

Markdown: Fix text with $ been incorrectly parsed as math syntax (#20140 by @​fisker)

<!-- Input -->
**Uses $FOO** from `a.sh` and `b.sh`, plus `$BAR` from `c.sh`, before anything else runs here.
<!-- Prettier 3.9.8 -->
Uses $FOO from a.sh and b.sh, plus $BARfromc.sh, before anything else runs here.
<!-- Prettier 3.9.9 -->
Uses $FOO from a.sh and b.sh, plus $BAR from c.sh, before anything else runs here.

Commits

• cdd17f2 Release 3.9.9
• dc7b896 Disable singleDollarTextMath in mdast-util-math (#20140)
• f9be58f Git blame ignore 3.9.8
• 88470cb Bump Prettier dependency to 3.9.8
• 9559cab Clean changelog_unreleased
• 4fc8ee8 Update dependents count
• See full diff in compare view

Updates sass from 1.104.0 to 1.105.0

Release notes

Sourced from sass's releases.

Dart Sass 1.105.0

To install Sass 1.105.0, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Add support for first-class modules. These can be accessed using the new meta.load() and meta.get-module() functions, and may be passed as the $module argument to numerous eisting sass:meta functions.

• Add the meta.css() mixin, which includes CSS from a first-class module.

JS API

• Add a SassModule class and a corresponding Value.assertModule() method.

Dart API

• Add a SassModule class and a corresponding Value.assertModule() method.

See the full changelog for changes in earlier releases.

Dart Sass 1.104.1

To install Sass 1.104.1, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.

Changes

• Fix a bug where loud comments before @use rules could be emitted multiple times under certain circumstances.

• Fix a bug in which an invalid selector at the end of an indented syntax stylesheet would cause the parser to crash instead of emitting a useful error message.

Command Line Interface

• Many-to-many compilations no longer compile any files that appear in the output directory if the output directory is also within the source directory. This fixes a bug where --watch mode could enter an infinite loop recompiling the same CSS file over and over.

• Sass now sets the modification time of output files to the time compilation started rather than the time it ended. This ensures that, if a source file is modified during compilation, --watch and --update mode will recompile the outputs to include the new source file contents.

See the full changelog for changes in earlier releases.

Changelog

Sourced from sass's changelog.

1.105.0

• Add support for first-class modules. These can be accessed using the new meta.load() and meta.get-module() functions, and may be passed as the $module argument to numerous eisting sass:meta functions.

• Add the meta.css() mixin, which includes CSS from a first-class module.

JS API

• Add a SassModule class and a corresponding Value.assertModule() method.

Dart API

• Add a SassModule class and a corresponding Value.assertModule() method.

1.104.1

• Fix a bug where loud comments before @use rules could be emitted multiple times under certain circumstances.

• Fix a bug in which an invalid selector at the end of an indented syntax stylesheet would cause the parser to crash instead of emitting a useful error message.

Command Line Interface

• Many-to-many compilations no longer compile any files that appear in the output directory if the output directory is also within the source directory. This fixes a bug where --watch mode could enter an infinite loop recompiling the same CSS file over and over.

• Sass now sets the modification time of output files to the time compilation started rather than the time it ended. This ensures that, if a source file is modified during compilation, --watch and --update mode will recompile the outputs to include the new source file contents.

Commits

• 4bf2b92 Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#2865)
• 850d57e [meta.load] Add support for meta.load() and related features (#2861)
• 6180be0 Bump postcss from 8.5.26 to 8.5.28 in /pkg/sass-parser (#2863)
• da84fb5 Fix --watch not recompiling sources modified during a compilation (#2850)
• 8a287a7 Merge pull request #2859 from sass/fix-auto-merge
• 6033b46 Add explicit versions to .github/util actions
• cc71d43 Only auto-merge dependabot PRs once the tests pass
• 49ddc4f Revert "Bump dart-lang/setup-dart in /.github/util/initialize"
• 71a127d Avoid duplicating loud comments that appear before @use (#2854)
• f19baab Merge pull request #2857 from sass/dependabot/github_actions/dot-github/util/...
• Additional commits viewable in compare view

Updates vite from 8.3.0 to 8.3.1

Release notes

Sourced from vite's releases.

v8.3.1

Bug Fixes

• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23537) (e8990c4)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)
• optimizer: resolve pending discovered dep processing on close before init (#23567) (5f89433)
• server: avoid reinitializing watcher when adding file after server close (#23572) (6f831f9)
• sourcemap: skip URL source roots when injecting sources content (#23519) (04fc30a)

Miscellaneous Chores

• merge prereleases in changelog (#23466) (99bd9d1)
• optimizer: add debug log when waiting for dep before init (#23566) (63567c7)
• update optimizeDeps.include comment (#23489) (6a84c72)

Code Refactoring

• assets regexp use non-capture (#23491) (f4b4431)
• remove duplicate configurations (#23532) (9abd99b)
• replace find with some (#23554) (af7cdf6)

Changelog

Sourced from vite's changelog.

8.3.1 (2026-09-24)

Bug Fixes

• deps: update all non-major dependencies (#23482) (3c752c8)
• deps: update all non-major dependencies (#23537) (e8990c4)
• deps: update rolldown-related dependencies (#23483) (9aecbbf)
• handle server.ws: false in mergeConfig (#23511) (f68c0d5)
• merge build.rolldownOptions.output.comments correctly (#23514) (4aba8d8)
• optimizer: don't skip imports whose binding starts with type (#23540) (39330f4)
• optimizer: resolve pending discovered dep processing on close before init (#23567) (5f89433)
• server: avoid reinitializing watcher when adding file after server close (#23572) (6f831f9)
• sourcemap: skip URL source roots when injecting sources content (#23519) (04fc30a)

Miscellaneous Chores

• merge prereleases in changelog (#23466) (99bd9d1)
• optimizer: add debug log when waiting for dep before init (#23566) (63567c7)
• update optimizeDeps.include comment (#23489) (6a84c72)

Code Refactoring

• assets regexp use non-capture (#23491) (f4b4431)
• remove duplicate configurations (#23532) (9abd99b)
• replace find with some (#23554) (af7cdf6)

Commits

• 39ddf7c release: v8.3.1 (#23573)
• f68c0d5 fix: handle server.ws: false in mergeConfig (#23511)
• 6f831f9 fix(server): avoid reinitializing watcher when adding file after server close...
• 04fc30a fix(sourcemap): skip URL source roots when injecting sources content (#23519)
• 5f89433 fix(optimizer): resolve pending discovered dep processing on close before ini...
• 63567c7 chore(optimizer): add debug log when waiting for dep before init (#23566)
• e8990c4 fix(deps): update all non-major dependencies (#23537)
• af7cdf6 refactor: replace find with some (#23554)
• 39330f4 fix(optimizer): don't skip imports whose binding starts with type (#23540)
• 9abd99b refactor: remove duplicate configurations (#23532)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Client V3 Test Results

209 tests   209 ✅  0s ⏱️
 14 suites    0 💤
  1 files      0 ❌

Results for commit cc97359.

[github-actions]

Client Test Results

95 tests   95 ✅  0s ⏱️
 6 suites   0 💤
 1 files     0 ❌

Results for commit cc97359.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Python Test Results

  1 files    1 suites   47s ⏱️
934 tests 934 ✅ 0 💤 0 ❌
939 runs  939 ✅ 0 💤 0 ❌

Results for commit cc97359.

[github-actions]

Playwright E2E Results (firefox)

222 tests   222 ✅  2m 13s ⏱️
 14 suites    0 💤
  1 files      0 ❌

Results for commit cc97359.

[github-actions]

Playwright E2E Results (chromium)

222 tests   222 ✅  2m 15s ⏱️
 14 suites    0 💤
  1 files      0 ❌

Results for commit cc97359.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.