build(deps-dev): bump the npm-dependencies group with 2 updates

[dependabot]

Bumps the npm-dependencies group with 2 updates: sitemap and vitepress.

Updates sitemap from 9.0.0 to 9.0.1

Release notes

Sourced from sitemap's releases.

9.0.1 — Security Patch

Security Fixes

• BB-01: Fix XML injection via unescaped xslUrl in stylesheet processing instruction
• BB-02: Enforce 50,000 URL hard limit in XMLToSitemapItemStream parser
• BB-03: Cap parser error array at 100 entries to prevent memory DoS
• BB-04: Reject absolute destinationDir paths in simpleSitemapAndIndex to prevent arbitrary file writes
• BB-05: parseSitemapIndex now destroys source and parser streams immediately when maxEntries limit is exceeded
• Many thanks to @​maru1009 For the report

Changelog

Sourced from sitemap's changelog.

9.0.1 — Security Patch

• BB-01: Fix XML injection via unescaped xslUrl in stylesheet processing instruction — special characters (&, ", <, >) in the XSL URL are now escaped before being interpolated into the <?xml-stylesheet?> processing instruction
• BB-02: Enforce 50,000 URL hard limit in XMLToSitemapItemStream — the parser now stops emitting items and emits an error when the limit is exceeded, rather than merely logging a warning
• BB-03: Cap parser error array at 100 entries to prevent memory DoS — XMLToSitemapItemStream now tracks a separate errorCount and stops appending to the errors array beyond LIMITS.MAX_PARSER_ERRORS
• BB-04: Reject absolute destinationDir paths in simpleSitemapAndIndex to prevent arbitrary file writes — passing an absolute path (e.g. /tmp/sitemaps) now throws immediately with a descriptive error
• BB-05: parseSitemapIndex now destroys source and parser streams immediately when the maxEntries limit is exceeded, preventing unbounded memory consumption from large sitemap index files

Commits

• 244f256 Merge pull request #477 from ekalinin/sec-fixes
• 71718f3 chore: bump version to 9.0.1 and add changelog entry
• d19d4c9 fix: destroy streams immediately on maxEntries breach in parseSitemapIndex (B...
• 7ed774e fix: reject absolute destinationDir paths to prevent arbitrary write (BB-04)
• dde5c5e fix: cap parser error collection to prevent memory DoS (BB-03)
• 81df466 fix: enforce 50k URL limit in XMLToSitemapItemStream parser (BB-02)
• 8a8e0b8 fix: prevent XML injection via unvalidated xslUrl in SitemapIndexStream
• 723d8e7 Merge pull request #472 from ekalinin/dependabot/npm_and_yarn/express-5.2.0
• b5138f1 Merge pull request #470 from ekalinin/dependabot/npm_and_yarn/glob-10.5.0
• 52d9477 build(deps-dev): bump express from 5.1.0 to 5.2.0
• Additional commits viewable in compare view

Updates vitepress from 2.0.0-alpha.16 to 2.0.0-alpha.18

Release notes

Sourced from vitepress's releases.

v2.0.0-alpha.18

Please refer to CHANGELOG.md for details.

v2.0.0-alpha.17

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vitepress's changelog.

2.0.0-alpha.18 (2026-07-06)

Bug Fixes

• build: apply base to links with download attribute (#5186) (01987c4)
• build: normalize rewrite drive letters (#5245) (5c50b99)
• build: show dead link line numbers (#5230) (c37bde6)
• compose markdown config when extending configs (#5236) (04f4fba)
• delete undefined values while merging sidepanel props (cc30b10)
• disable pluginTimings and invalidAnnotation for now (9315fc1)
• don't invalidate framework chunk when a new asset is added (c0e2e18)
• escape description in head (d96bf1d)
• index rewritten local search pages by locale (#5241) (80cf265)
• keep translation links in the current tab (#5158) (202ee70)
• normalize /index to / (856858d), closes #5165
• preserve Agent Studio DocSearch options (#5254) (f29ffdb)
• preserve external sidebar links with base (#5243) (ddf178a)
• prevent DocSearch SVG clipping in WebKit (#5240) (a357e5e)
• strip frontmatter before heading includes (#5246) (e68fade)
• theme: avatars misaligned in team member cards (6730fb8), closes #5160
• theme: correct mixed LTR/RTL text rendering in code blocks (73f7b0b)
• theme: keep external link icon inline (#5232) (756a88c)
• theme: prevent sub and sup elements from affecting line height (19357f9), closes #5173
• use resolveDynamicComponent instead of resolveComponent (9da1e3e)

Features

• add macOS local search navigation shortcuts (#5237) (e635e9e)
• add support for format option in Carbon options (#5188) (6ee01bf)
• allow custom i18n routing (#5239) (eef5742)
• allow VPContent to use custom components (#5176) (c0b38d5)
• markdown: expose Shiki color replacements in markdown options (#5153) (fccc617)
• migrate to vite 8 (228eef1)
• show local search loading state (#5252) (7e2273a)
• support scroll-margin / scroll-padding (6cce766)
• support social link target option (#5242) (d0159c8)

BREAKING CHANGES

• VitePress now uses Vite 8. If you are using Vite plugins in your config, please check the Vite 8 migration guide for any breaking changes that may affect you.
• Node 20 support is dropped. v22 or higher is needed.
• scrollOffset from config is removed. Users wanting to customize scroll offset should customize scroll-margin-top via CSS instead. smoothScroll support from router.go is also removed as it didn't work as expected for most users. Users wanting smooth scrolling should set scroll-behavior: smooth in CSS, ideally inside a @media (prefers-reduced-motion: no-preference) block.

2.0.0-alpha.17 (2026-03-19)

Bug Fixes

• build: processIncludes no longer swallows errors (fb21fdf)
• build: deterministic local search indexing and non-blocking initial scan (closes #4081) (fc0f203)
• client: await clipboard.writeText so that fallback works in non-secure contexts (#5119) (b544df8)

... (truncated)

Commits

• ca57890 release: v2.0.0-alpha.18
• 9315fc1 fix: disable pluginTimings and invalidAnnotation for now
• 470c4e0 refactor: clean up types
• c0e2e18 fix: don't invalidate framework chunk when a new asset is added
• 1ade7bd refactor: migrate scripts to typescript and organize imports
• e6e90ed refactor: drop fs-extra and organize imports
• 228eef1 feat!: migrate to vite 8
• 7e2273a feat: show local search loading state (#5252)
• 0100d4d docs: clarify Ask AI suggested questions (#5248)
• cc30b10 fix: delete undefined values while merging sidepanel props
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions