Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Edited/Blocked

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

• chore(deps): update dependency csrf-csrf to v4
• chore(deps): update vitest monorepo to v4 (major) (@vitest/browser, @vitest/coverage-istanbul, @vitest/coverage-v8, @vitest/ui, vitest)

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): update dependency electron to v39

Detected dependencies

docker-compose

docker-compose.rootless.yml

docker-compose.yml

dockerfile

apps/server/Dockerfile

• node 24.11.0-bullseye-slim
• node 24.11.0-bullseye-slim

apps/server/Dockerfile.alpine

• node 24.11.0-alpine
• node 24.11.0-alpine

apps/server/Dockerfile.alpine.rootless

• node 24.11.0-alpine
• node 24.11.0-alpine

apps/server/Dockerfile.rootless

• node 24.11.0-bullseye-slim
• node 24.11.0-bullseye-slim

github-actions

.github/actions/build-electron/action.yml

• apple-actions/import-codesign-certs v5
• apple-actions/import-codesign-certs v5

.github/actions/build-server/action.yml

• pnpm/action-setup v4
• actions/setup-node v6
• node 24

.github/actions/deploy-to-cloudflare-pages/action.yml

• cloudflare/wrangler-action v3
• cloudflare/wrangler-action v3
• actions/github-script v8

.github/actions/report-size/action.yml

• actions/checkout v5
• nejcm/bundle-size-reporter-action v1.4.1
• marocchino/sticky-pull-request-comment v2

.github/workflows/checks.yml

• eps1lon/actions-label-merge-conflict v3

.github/workflows/codeql.yml

• actions/checkout v5
• github/codeql-action v4
• github/codeql-action v4

.github/workflows/deploy-docs.yml

• actions/checkout v5
• pnpm/action-setup v4
• actions/setup-node v6
• node 24

.github/workflows/dev.yml

• actions/checkout v5
• pnpm/action-setup v4
• actions/setup-node v6
• actions/checkout v5
• pnpm/action-setup v4
• relative-ci/agent-action v3
• docker/setup-buildx-action v3
• docker/build-push-action v6
• actions/checkout v5
• pnpm/action-setup v4
• docker/setup-buildx-action v3
• docker/build-push-action v6
• stringbean/docker-healthcheck-action v3
• node 24

.github/workflows/main-docker.yml

• actions/checkout v5
• docker/setup-buildx-action v3
• pnpm/action-setup v4
• actions/setup-node v6
• docker/build-push-action v6
• stringbean/docker-healthcheck-action v3
• actions/upload-artifact v5
• actions/upload-artifact v5
• actions/checkout v5
• pnpm/action-setup v4
• actions/setup-node v6
• docker/metadata-action v5
• docker/setup-qemu-action v3
• docker/setup-buildx-action v3
• docker/login-action v3
• docker/login-action v3
• docker/build-push-action v6
• actions/upload-artifact v5
• actions/download-artifact v6
• docker/setup-buildx-action v3
• docker/metadata-action v5
• docker/login-action v3
• docker/login-action v3
• node 24
• node 24

.github/workflows/nightly.yml

• actions/checkout v5
• pnpm/action-setup v4
• actions/setup-node v6
• softprops/action-gh-release v2.4.1
• actions/upload-artifact v5
• actions/checkout v5
• softprops/action-gh-release v2.4.1
• node 24

.github/workflows/playwright.yml

• actions/checkout v5
• pnpm/action-setup v4
• actions/setup-node v6
• actions/upload-artifact v5
• node 24

.github/workflows/release-winget.yml

.github/workflows/release.yml

• actions/checkout v5
• pnpm/action-setup v4
• actions/setup-node v6
• actions/upload-artifact v5
• actions/checkout v5
• actions/upload-artifact v5
• actions/checkout v5
• actions/download-artifact v6
• softprops/action-gh-release v2.4.1
• node 24

.github/workflows/website.yml

• actions/checkout v5
• pnpm/action-setup v4
• actions/setup-node v6
• node 24

npm

_regroup/package.json

• @playwright/test 1.56.1
• @stylistic/eslint-plugin 5.5.0
• @types/express 5.0.5
• @types/node 24.9.2
• @types/yargs 17.0.34
• @vitest/coverage-v8 3.2.4
• eslint 9.39.0
• eslint-plugin-simple-import-sort 12.1.1
• esm 3.2.25
• jsdoc 4.0.5
• lorem-ipsum 2.0.8
• rcedit 4.0.1
• rimraf 6.1.0
• tslib 2.8.1
• typedoc 0.28.14
• typedoc-plugin-missing-exports 4.1.2
• appdmg 0.6.6

apps/client/package.json

• @eslint/js 9.39.0
• @excalidraw/excalidraw 0.18.0
• @fullcalendar/core 6.1.19
• @fullcalendar/daygrid 6.1.19
• @fullcalendar/interaction 6.1.19
• @fullcalendar/list 6.1.19
• @fullcalendar/multimonth 6.1.19
• @fullcalendar/timegrid 6.1.19
• @maplibre/maplibre-gl-leaflet 0.1.3
• @mermaid-js/layout-elk 0.2.0
• @mind-elixir/node-menu 5.0.0
• @popperjs/core 2.11.8
• autocomplete.js 0.38.1
• bootstrap 5.3.8
• boxicons 2.1.4
• color 5.0.2
• dayjs 1.11.19
• dayjs-plugin-utc 0.1.2
• debounce 2.2.0
• draggabilly 3.0.0
• force-graph 1.51.0
• globals 16.5.0
• i18next 25.6.0
• i18next-http-backend 3.0.2
• jquery 3.7.1
• jquery.fancytree 2.38.5
• jsplumb 2.15.6
• katex 0.16.25
• knockout 3.5.1
• leaflet 1.9.4
• leaflet-gpx 2.2.0
• mark.js 8.11.1
• marked 16.4.1
• mermaid 11.12.1
• mind-elixir 5.3.4
• normalize.css 8.0.1
• panzoom 9.4.3
• preact 10.27.2
• react-i18next 16.2.3
• reveal.js 5.2.1
• svg-pan-zoom 3.6.2
• tabulator-tables 6.3.1
• vanilla-js-wheel-zoom 9.0.4
• @ckeditor/ckeditor5-inspector 5.0.0
• @preact/preset-vite 2.10.2
• @types/bootstrap 5.2.10
• @types/jquery 3.5.33
• @types/leaflet 1.9.21
• @types/leaflet-gpx 1.3.8
• @types/mark.js 8.11.12
• @types/reveal.js 5.2.1
• @types/tabulator-tables 6.3.0
• copy-webpack-plugin 13.0.1
• happy-dom 20.0.10
• script-loader 0.7.2
• vite-plugin-static-copy 3.1.4

apps/db-compare/package.json

• colors 1.4.0
• diff 8.0.2
• sqlite 5.1.1
• sqlite3 5.1.7

apps/desktop/package.json

• @electron/remote 2.1.3
• better-sqlite3 12.4.1
• electron-debug 4.1.0
• electron-dl 4.0.0
• electron-squirrel-startup 1.0.1
• jquery.fancytree 2.38.5
• jquery-hotkeys 0.2.2
• @types/electron-squirrel-startup 1.0.2
• copy-webpack-plugin 13.0.1
• electron 38.5.0
• @electron-forge/cli 7.10.2
• @electron-forge/maker-deb 7.10.2
• @electron-forge/maker-dmg 7.10.2
• @electron-forge/maker-flatpak 7.10.2
• @electron-forge/maker-rpm 7.10.2
• @electron-forge/maker-squirrel 7.10.2
• @electron-forge/maker-zip 7.10.2
• @electron-forge/plugin-auto-unpack-natives 7.10.2
• prebuild-install 7.1.3

apps/dump-db/package.json

• better-sqlite3 12.4.1
• mime-types 3.0.1
• sanitize-filename 1.6.3
• tsx 4.20.6
• yargs 18.0.0
• @types/better-sqlite3 7.6.13
• @types/mime-types 3.0.1
• @types/yargs 17.0.34

apps/edit-docs/package.json

• archiver 7.0.1
• better-sqlite3 12.4.1
• @types/fs-extra 11.0.4
• copy-webpack-plugin 13.0.1
• electron 38.5.0
• fs-extra 11.3.2

apps/server-e2e/package.json

• dotenv 17.2.3

apps/server/docker/package.json

• better-sqlite3 12.4.1

apps/server/package.json

• better-sqlite3 12.4.1
• html-to-text 9.0.5
• node-html-parser 7.0.1
• @anthropic-ai/sdk 0.68.0
• @braintree/sanitize-url 7.1.1
• @electron/remote 2.1.3
• @preact/preset-vite 2.10.2
• @types/archiver 7.0.0
• @types/better-sqlite3 7.6.13
• @types/cls-hooked 4.3.9
• @types/compression 1.8.1
• @types/cookie-parser 1.4.10
• @types/debounce 1.2.4
• @types/ejs 3.1.5
• @types/escape-html 1.0.4
• @types/express-http-proxy 1.6.7
• @types/express-session 1.18.2
• @types/fs-extra 11.0.4
• @types/html 1.0.4
• @types/ini 4.1.1
• @types/js-yaml 4.0.9
• @types/mime-types 3.0.1
• @types/multer 2.0.0
• @types/safe-compare 1.1.2
• @types/sanitize-html 2.16.0
• @types/sax 1.2.7
• @types/serve-favicon 2.5.7
• @types/serve-static 2.2.0
• @types/stream-throttle 0.1.4
• @types/supertest 6.0.3
• @types/swagger-ui-express 4.1.8
• @types/tmp 0.2.6
• @types/turndown 5.0.6
• @types/ws 8.18.1
• @types/xml2js 0.4.14
• archiver 7.0.1
• async-mutex 0.5.0
• axios 1.13.1
• bindings 1.5.0
• bootstrap 5.3.8
• chardet 2.1.1
• cheerio 1.1.2
• chokidar 4.0.3
• cls-hooked 4.2.2
• compression 1.8.1
• cookie-parser 1.4.7
• csrf-csrf 3.2.2
• dayjs 1.11.19
• debounce 2.2.0
• debug 4.4.3
• ejs 3.1.10
• electron 38.5.0
• electron-debug 4.1.0
• electron-window-state 5.0.3
• escape-html 1.0.3
• express 5.1.0
• express-http-proxy 2.1.2
• express-openid-connect 2.19.2
• express-rate-limit 8.2.1
• express-session 1.18.2
• file-uri-to-path 2.0.0
• fs-extra 11.3.2
• helmet 8.1.0
• html 1.0.0
• html2plaintext 2.1.4
• http-proxy-agent 7.0.2
• https-proxy-agent 7.0.6
• i18next 25.6.0
• i18next-fs-backend 2.6.0
• image-type 6.0.0
• ini 6.0.0
• is-animated 2.0.2
• is-svg 6.1.0
• jimp 1.6.0
• js-yaml 4.1.0
• marked 16.4.1
• mime-types 3.0.1
• multer 2.0.2
• normalize-strings 1.1.1
• ollama 0.6.2
• openai 6.7.0
• rand-token 1.0.1
• safe-compare 1.1.4
• sanitize-filename 1.6.3
• sanitize-html 2.17.0
• sax 1.4.1
• serve-favicon 2.5.1
• stream-throttle 0.1.3
• strip-bom 5.0.0
• striptags 3.2.0
• supertest 7.1.4
• swagger-jsdoc 6.2.8
• swagger-ui-express 5.0.1
• time2fa 1.4.2
• tmp 0.2.5
• turndown 7.2.2
• unescape 1.0.1
• vite 7.1.12
• ws 8.18.3
• xml2js 0.6.2
• yauzl 3.2.0

apps/website/package.json

• i18next 25.6.0
• i18next-http-backend 3.0.2
• preact 10.27.2
• preact-iso 2.11.0
• preact-render-to-string 6.6.3
• react-i18next 16.2.3
• @preact/preset-vite 2.10.2
• eslint 9.39.0
• eslint-config-preact 2.0.0
• typescript 5.9.3
• user-agent-data-types 0.4.2
• vite 7.1.12

package.json

• @electron/rebuild 4.0.1
• @fast-csv/parse 5.0.5
• @playwright/test 1.56.1
• @types/express 5.0.5
• @types/node 24.9.2
• @vitest/coverage-v8 3.2.4
• @vitest/ui 3.2.4
• chalk 5.6.2
• cross-env 10.1.0
• dpdm 3.14.0
• esbuild 0.25.12
• eslint 9.39.0
• eslint-config-prettier 10.1.8
• eslint-plugin-playwright 2.3.0
• eslint-plugin-react-hooks 7.0.1
• happy-dom ~20.0.0
• jiti 2.6.1
• jsonc-eslint-parser 2.4.1
• react-refresh 0.18.0
• rollup-plugin-webpack-stats 2.1.6
• tslib 2.8.1
• tsx 4.20.6
• typescript ~5.9.0
• typescript-eslint 8.46.2
• upath 2.0.1
• vite 7.1.12
• vite-plugin-dts ~4.5.0
• vitest 3.2.4
• pnpm 10.20.0
• mermaid 11.12.1
• preact 10.27.2
• roughjs 4.6.6
• @types/express-serve-static-core 5.1.0
• flat@<5.0.1 >=5.0.1
• debug@>=3.2.0 <3.2.7 >=3.2.7
• nanoid@<3.3.8 >=3.3.8
• nanoid@>=4.0.0 <5.0.9 >=5.0.9
• dompurify@<3.2.4 >=3.2.4
• esbuild@<=0.24.2 >=0.25.0
• cookie@<0.7.0 >=0.7.0
• tar-fs@>=2.0.0 <2.1.3 >=2.1.3
• on-headers@<1.1.0 >=1.1.0
• form-data@>=4.0.0 <4.0.4 >=4.0.4
• form-data@>=3.0.0 <3.0.4 >=3.0.4
• node-abi 4.17.0

packages/ckeditor5-admonition/package.json

• @ckeditor/ckeditor5-dev-build-tools 43.1.0
• @ckeditor/ckeditor5-inspector >=4.1.0
• @ckeditor/ckeditor5-package-tools 4.1.1
• @typescript-eslint/eslint-plugin ~8.46.0
• @typescript-eslint/parser 8.46.2
• @vitest/browser 3.2.4
• @vitest/coverage-istanbul 3.2.4
• ckeditor5 47.1.0
• eslint 9.39.0
• eslint-config-ckeditor5 >=9.1.0
• http-server 14.1.1
• lint-staged 16.2.6
• stylelint 16.25.0
• stylelint-config-ckeditor5 >=9.1.0
• ts-node 10.9.2
• typescript 5.9.3
• vite-plugin-svgo ~2.0.0
• vitest 3.2.4
• webdriverio 9.20.0
• ckeditor5 47.1.0
• node >=18.0.0
• npm >=5.7.1

packages/ckeditor5-footnotes/package.json

• @ckeditor/ckeditor5-dev-build-tools 43.1.0
• @ckeditor/ckeditor5-inspector >=4.1.0
• @ckeditor/ckeditor5-package-tools 4.1.1
• @typescript-eslint/eslint-plugin ~8.46.0
• @typescript-eslint/parser 8.46.2
• @vitest/browser 3.2.4
• @vitest/coverage-istanbul 3.2.4
• ckeditor5 47.1.0
• eslint 9.39.0
• eslint-config-ckeditor5 >=9.1.0
• http-server 14.1.1
• lint-staged 16.2.6
• stylelint 16.25.0
• stylelint-config-ckeditor5 >=9.1.0
• ts-node 10.9.2
• typescript 5.9.3
• vite-plugin-svgo ~2.0.0
• vitest 3.2.4
• webdriverio 9.20.0
• ckeditor5 47.1.0
• node >=18.0.0
• npm >=5.7.1

packages/ckeditor5-keyboard-marker/package.json

• @ckeditor/ckeditor5-dev-build-tools 43.1.0
• @ckeditor/ckeditor5-inspector >=4.1.0
• @ckeditor/ckeditor5-package-tools 4.1.1
• @typescript-eslint/eslint-plugin ~8.46.0
• @typescript-eslint/parser 8.46.2
• @vitest/browser 3.2.4
• @vitest/coverage-istanbul 3.2.4
• ckeditor5 47.1.0
• eslint 9.39.0
• eslint-config-ckeditor5 >=9.1.0
• http-server 14.1.1
• lint-staged 16.2.6
• stylelint 16.25.0
• stylelint-config-ckeditor5 >=9.1.0
• ts-node 10.9.2
• typescript 5.9.3
• vite-plugin-svgo ~2.0.0
• vitest 3.2.4
• webdriverio 9.20.0
• ckeditor5 47.1.0
• node >=18.0.0
• npm >=5.7.1

packages/ckeditor5-math/package.json

• @ckeditor/ckeditor5-icons 47.1.0
• @ckeditor/ckeditor5-dev-build-tools 43.1.0
• @ckeditor/ckeditor5-dev-utils 43.1.0
• @ckeditor/ckeditor5-inspector >=4.1.0
• @ckeditor/ckeditor5-package-tools 4.1.1
• @typescript-eslint/eslint-plugin ~8.46.0
• @typescript-eslint/parser 8.46.2
• @vitest/browser 3.2.4
• @vitest/coverage-istanbul 3.2.4
• ckeditor5 47.1.0
• eslint 9.39.0
• eslint-config-ckeditor5 >=9.1.0
• http-server 14.1.1
• lint-staged 16.2.6
• stylelint 16.25.0
• stylelint-config-ckeditor5 >=9.1.0
• ts-node 10.9.2
• typescript 5.9.3
• vite-plugin-svgo ~2.0.0
• vitest 3.2.4
• webdriverio 9.20.0
• ckeditor5 47.1.0
• node >=18.0.0
• npm >=5.7.1

packages/ckeditor5-mermaid/package.json

• @types/lodash-es 4.17.12
• lodash-es 4.17.21
• @ckeditor/ckeditor5-dev-build-tools 43.1.0
• @ckeditor/ckeditor5-inspector >=4.1.0
• @ckeditor/ckeditor5-package-tools 4.1.1
• @typescript-eslint/eslint-plugin ~8.46.0
• @typescript-eslint/parser 8.46.2
• @vitest/browser 3.2.4
• @vitest/coverage-istanbul 3.2.4
• ckeditor5 47.1.0
• eslint 9.39.0
• eslint-config-ckeditor5 >=9.1.0
• http-server 14.1.1
• lint-staged 16.2.6
• stylelint 16.25.0
• stylelint-config-ckeditor5 >=9.1.0
• ts-node 10.9.2
• typescript 5.9.3
• vite-plugin-svgo ~2.0.0
• vitest 3.2.4
• webdriverio 9.20.0
• ckeditor5 47.1.0
• node >=18.0.0
• npm >=5.7.1

packages/ckeditor5/package.json

• ckeditor5 47.1.0
• ckeditor5-premium-features 47.1.0
• @smithy/middleware-retry 4.4.6
• @types/jquery 3.5.33

packages/codemirror/package.json

• @codemirror/commands 6.10.0
• @codemirror/lang-css 6.3.1
• @codemirror/lang-html 6.4.11
• @codemirror/lang-javascript 6.2.4
• @codemirror/lang-json 6.0.2
• @codemirror/lang-markdown 6.5.0
• @codemirror/lang-php 6.0.2
• @codemirror/lang-vue 0.1.3
• @codemirror/lang-xml 6.1.0
• @codemirror/legacy-modes 6.5.2
• @codemirror/search 6.5.11
• @codemirror/view 6.38.6
• @fsegurai/codemirror-theme-abcdef 6.2.2
• @fsegurai/codemirror-theme-abyss 6.2.2
• @fsegurai/codemirror-theme-android-studio 6.2.2
• @fsegurai/codemirror-theme-andromeda 6.2.2
• @fsegurai/codemirror-theme-basic-dark 6.2.2
• @fsegurai/codemirror-theme-basic-light 6.2.2
• @fsegurai/codemirror-theme-cobalt2 6.0.2
• @fsegurai/codemirror-theme-forest 6.2.2
• @fsegurai/codemirror-theme-github-dark 6.2.2
• @fsegurai/codemirror-theme-github-light 6.2.2
• @fsegurai/codemirror-theme-gruvbox-dark 6.2.2
• @fsegurai/codemirror-theme-gruvbox-light 6.2.2
• @fsegurai/codemirror-theme-material-dark 6.2.2
• @fsegurai/codemirror-theme-material-light 6.2.2
• @fsegurai/codemirror-theme-monokai 6.2.2
• @fsegurai/codemirror-theme-nord 6.2.2
• @fsegurai/codemirror-theme-palenight 6.2.2
• @fsegurai/codemirror-theme-solarized-dark 6.2.2
• @fsegurai/codemirror-theme-solarized-light 6.2.2
• @fsegurai/codemirror-theme-tokyo-night-day 6.2.2
• @fsegurai/codemirror-theme-tokyo-night-storm 6.2.2
• @fsegurai/codemirror-theme-volcano 6.2.2
• @fsegurai/codemirror-theme-vscode-dark 6.2.2
• @fsegurai/codemirror-theme-vscode-light 6.2.2
• @replit/codemirror-indentation-markers 6.5.3
• @replit/codemirror-lang-nix 6.0.1
• @replit/codemirror-vim 6.3.0
• @ssddanbrown/codemirror-lang-smarty 1.0.0
• @ssddanbrown/codemirror-lang-twig 1.0.0
• codemirror-lang-elixir 4.0.0
• codemirror-lang-hcl 0.1.0
• codemirror-lang-mermaid 0.5.0
• eslint-linter-browserify 9.39.0

packages/commons/package.json

packages/express-partial-content/package.json

• tslib 2.8.1

packages/highlightjs/package.json

• @exercism/highlightjs-gdscript 0.0.1
• highlight.js 11.11.1
• highlightjs-cobol 0.3.3
• highlightjs-cypher 1.2.0

packages/share-theme/package.json

• boxicons 2.1.4
• fuse.js 7.1.0
• katex 0.16.25
• mermaid 11.12.0
• @digitak/esrun 3.2.26
• @types/swagger-ui 5.21.1
• @typescript-eslint/eslint-plugin 8.46.2
• @typescript-eslint/parser 8.46.2
• dotenv 17.2.3
• esbuild 0.25.12
• eslint 9.39.0
• highlight.js 11.11.1
• typescript 5.9.3

packages/splitjs/package.json

• @rollup/plugin-buble 1.0.3
• karma 6.4.4
• karma-chrome-launcher 3.2.0
• karma-firefox-launcher 2.1.3
• karma-jasmine 5.1.0

packages/turndown-plugin-gfm/package.json

• turndown 7.2.2
• turndown-attendant 0.0.3

pnpm-workspace.yaml

nvm

.nvmrc

• node 24.11.0

---

• Check this box to trigger a request for Renovate to run again on this repository

[pano9000]

csurf replacement is being worked on here: TriliumNext/Notes#864

[pano9000]

electron-packager and electron-rebuild are updated here: TriliumNext/Notes#935

[eliandoran]

Closing for now as we have the web UI of Renovate if we need it.
Apparently it is needed.