Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• chore(deps): update dependency vite to v7.2.7
• fix(deps): update dependency i18next to v25.7.2

Edited/Blocked

The following updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox below.

• chore(deps): update dependency csrf-csrf to v4

Detected dependencies

docker-compose

docker-compose.rootless.yml

docker-compose.yml

dockerfile

apps/server/Dockerfile

• node 24.11.1-bullseye-slim
• node 24.11.1-bullseye-slim

apps/server/Dockerfile.alpine

• node 24.11.1-alpine
• node 24.11.1-alpine

apps/server/Dockerfile.alpine.rootless

• node 24.11.1-alpine
• node 24.11.1-alpine

apps/server/Dockerfile.rootless

• node 24.11.1-bullseye-slim
• node 24.11.1-bullseye-slim

github-actions

.github/actions/build-electron/action.yml

• apple-actions/import-codesign-certs v6
• apple-actions/import-codesign-certs v6

.github/actions/build-server/action.yml

• pnpm/action-setup v4
• actions/setup-node v6
• node 24

.github/actions/deploy-to-cloudflare-pages/action.yml

• cloudflare/wrangler-action v3
• cloudflare/wrangler-action v3
• actions/github-script v8

.github/actions/report-size/action.yml

• actions/checkout v6
• nejcm/bundle-size-reporter-action v1.4.1
• marocchino/sticky-pull-request-comment v2

.github/workflows/checks.yml

• eps1lon/actions-label-merge-conflict v3

.github/workflows/codeql.yml

• actions/checkout v6
• github/codeql-action v4
• github/codeql-action v4

.github/workflows/deploy-docs.yml

• actions/checkout v6
• pnpm/action-setup v4
• actions/setup-node v6
• node 24

.github/workflows/dev.yml

• actions/checkout v6
• pnpm/action-setup v4
• actions/setup-node v6
• actions/checkout v6
• pnpm/action-setup v4
• relative-ci/agent-action v3
• docker/setup-buildx-action v3
• docker/build-push-action v6
• actions/checkout v6
• pnpm/action-setup v4
• docker/setup-buildx-action v3
• docker/build-push-action v6
• stringbean/docker-healthcheck-action v3
• node 24

.github/workflows/main-docker.yml

• actions/checkout v6
• docker/setup-buildx-action v3
• pnpm/action-setup v4
• actions/setup-node v6
• docker/build-push-action v6
• stringbean/docker-healthcheck-action v3
• actions/upload-artifact v5
• actions/upload-artifact v5
• actions/checkout v6
• pnpm/action-setup v4
• actions/setup-node v6
• docker/metadata-action v5
• docker/setup-qemu-action v3
• docker/setup-buildx-action v3
• docker/login-action v3
• docker/login-action v3
• docker/build-push-action v6
• actions/upload-artifact v5
• actions/download-artifact v6
• docker/setup-buildx-action v3
• docker/metadata-action v5
• docker/login-action v3
• docker/login-action v3
• node 24
• node 24

.github/workflows/nightly.yml

• actions/checkout v6
• pnpm/action-setup v4
• actions/setup-node v6
• softprops/action-gh-release v2.5.0
• actions/upload-artifact v5
• actions/checkout v6
• softprops/action-gh-release v2.5.0
• node 24

.github/workflows/playwright.yml

• actions/checkout v6
• pnpm/action-setup v4
• actions/setup-node v6
• actions/upload-artifact v5
• node 24

.github/workflows/release-winget.yml

.github/workflows/release.yml

• actions/checkout v6
• pnpm/action-setup v4
• actions/setup-node v6
• actions/upload-artifact v5
• actions/checkout v6
• actions/upload-artifact v5
• actions/checkout v6
• actions/download-artifact v6
• softprops/action-gh-release v2.5.0
• node 24

.github/workflows/website.yml

• actions/checkout v6
• pnpm/action-setup v4
• actions/setup-node v6
• node 24

npm

apps/build-docs/package.json

• @redocly/cli 2.12.3
• archiver 7.0.1
• fs-extra 11.3.2
• react 19.2.1
• react-dom 19.2.1
• typedoc 0.28.15
• typedoc-plugin-missing-exports 4.1.2
• pnpm 10.24.0

apps/client/package.json

• @excalidraw/excalidraw 0.18.0
• @fullcalendar/core 6.1.19
• @fullcalendar/daygrid 6.1.19
• @fullcalendar/interaction 6.1.19
• @fullcalendar/list 6.1.19
• @fullcalendar/multimonth 6.1.19
• @fullcalendar/timegrid 6.1.19
• @maplibre/maplibre-gl-leaflet 0.1.3
• @mermaid-js/layout-elk 0.2.0
• @mind-elixir/node-menu 5.0.1
• @popperjs/core 2.11.8
• @preact/signals 2.5.1
• @zumer/snapdom 2.0.1
• autocomplete.js 0.38.1
• bootstrap 5.3.8
• boxicons 2.1.4
• clsx 2.1.1
• color 5.0.3
• debounce 3.0.0
• draggabilly 3.0.0
• force-graph 1.51.0
• globals 16.5.0
• i18next 25.7.1
• i18next-http-backend 3.0.2
• jquery 3.7.1
• jquery.fancytree 2.38.5
• jsplumb 2.15.6
• katex 0.16.27
• knockout 3.5.1
• leaflet 1.9.4
• leaflet-gpx 2.2.0
• mark.js 8.11.1
• marked 17.0.1
• mermaid 11.12.2
• mind-elixir 5.3.7
• normalize.css 8.0.1
• panzoom 9.4.3
• preact 10.28.0
• react-i18next 16.4.0
• reveal.js 5.2.1
• svg-pan-zoom 3.6.2
• tabulator-tables 6.3.1
• vanilla-js-wheel-zoom 9.0.4
• @ckeditor/ckeditor5-inspector 5.0.0
• @preact/preset-vite 2.10.2
• @types/bootstrap 5.2.10
• @types/jquery 3.5.33
• @types/leaflet 1.9.21
• @types/leaflet-gpx 1.3.8
• @types/mark.js 8.11.12
• @types/reveal.js 5.2.2
• @types/tabulator-tables 6.3.0
• copy-webpack-plugin 13.0.1
• happy-dom 20.0.11
• script-loader 0.7.2
• vite-plugin-static-copy 3.1.4

apps/db-compare/package.json

• colors 1.4.0
• diff 8.0.2
• sqlite 5.1.1
• sqlite3 5.1.7

apps/desktop/package.json

• @electron/remote 2.1.3
• better-sqlite3 12.5.0
• electron-debug 4.1.0
• electron-dl 4.0.0
• electron-squirrel-startup 1.0.1
• jquery.fancytree 2.38.5
• jquery-hotkeys 0.2.2
• @types/electron-squirrel-startup 1.0.2
• copy-webpack-plugin 13.0.1
• electron 39.2.6
• @electron-forge/cli 7.10.2
• @electron-forge/maker-deb 7.10.2
• @electron-forge/maker-dmg 7.10.2
• @electron-forge/maker-flatpak 7.10.2
• @electron-forge/maker-rpm 7.10.2
• @electron-forge/maker-squirrel 7.10.2
• @electron-forge/maker-zip 7.10.2
• @electron-forge/plugin-auto-unpack-natives 7.10.2
• prebuild-install 7.1.3

apps/dump-db/package.json

• better-sqlite3 12.5.0
• mime-types 3.0.2
• sanitize-filename 1.6.3
• tsx 4.21.0
• yargs 18.0.0
• @types/better-sqlite3 7.6.13
• @types/mime-types 3.0.1
• @types/yargs 17.0.35

apps/edit-docs/package.json

• archiver 7.0.1
• better-sqlite3 12.5.0
• @types/fs-extra 11.0.4
• copy-webpack-plugin 13.0.1
• electron 39.2.6
• fs-extra 11.3.2

apps/server-e2e/package.json

• dotenv 17.2.3

apps/server/docker/package.json

• better-sqlite3 12.5.0

apps/server/package.json

• better-sqlite3 12.5.0
• html-to-text 9.0.5
• node-html-parser 7.0.1
• @anthropic-ai/sdk 0.71.2
• @braintree/sanitize-url 7.1.1
• @electron/remote 2.1.3
• @preact/preset-vite 2.10.2
• @types/archiver 7.0.0
• @types/better-sqlite3 7.6.13
• @types/cls-hooked 4.3.9
• @types/compression 1.8.1
• @types/cookie-parser 1.4.10
• @types/debounce 1.2.4
• @types/ejs 3.1.5
• @types/escape-html 1.0.4
• @types/express-http-proxy 1.6.7
• @types/express-session 1.18.2
• @types/fs-extra 11.0.4
• @types/html 1.0.4
• @types/ini 4.1.1
• @types/mime-types 3.0.1
• @types/multer 2.0.0
• @types/safe-compare 1.1.2
• @types/sanitize-html 2.16.0
• @types/sax 1.2.7
• @types/serve-favicon 2.5.7
• @types/serve-static 2.2.0
• @types/stream-throttle 0.1.4
• @types/supertest 6.0.3
• @types/tmp 0.2.6
• @types/turndown 5.0.6
• @types/ws 8.18.1
• @types/xml2js 0.4.14
• archiver 7.0.1
• async-mutex 0.5.0
• axios 1.13.2
• bindings 1.5.0
• bootstrap 5.3.8
• chardet 2.1.1
• cheerio 1.1.2
• chokidar 5.0.0
• cls-hooked 4.2.2
• compression 1.8.1
• cookie-parser 1.4.7
• csrf-csrf 3.2.2
• debounce 3.0.0
• debug 4.4.3
• ejs 3.1.10
• electron 39.2.6
• electron-debug 4.1.0
• electron-window-state 5.0.3
• escape-html 1.0.3
• express 5.2.1
• express-http-proxy 2.1.2
• express-openid-connect 2.19.3
• express-rate-limit 8.2.1
• express-session 1.18.2
• file-uri-to-path 2.0.0
• fs-extra 11.3.2
• helmet 8.1.0
• html 1.0.0
• html2plaintext 2.1.4
• http-proxy-agent 7.0.2
• https-proxy-agent 7.0.6
• i18next 25.7.1
• i18next-fs-backend 2.6.1
• image-type 6.0.0
• ini 6.0.0
• is-animated 2.0.2
• is-svg 6.1.0
• jimp 1.6.0
• lorem-ipsum 2.0.8
• marked 17.0.1
• mime-types 3.0.2
• multer 2.0.2
• normalize-strings 1.1.1
• ollama 0.6.3
• openai 6.10.0
• rand-token 1.0.1
• safe-compare 1.1.4
• sanitize-filename 1.6.3
• sanitize-html 2.17.0
• sax 1.4.3
• serve-favicon 2.5.1
• stream-throttle 0.1.3
• strip-bom 5.0.0
• striptags 3.2.0
• supertest 7.1.4
• swagger-jsdoc 6.2.8
• time2fa 1.4.2
• tmp 0.2.5
• turndown 7.2.2
• unescape 1.0.1
• vite 7.2.6
• ws 8.18.3
• xml2js 0.6.2
• yauzl 3.2.0

apps/website/package.json

• i18next 25.7.1
• i18next-http-backend 3.0.2
• preact 10.28.0
• preact-iso 2.11.0
• preact-render-to-string 6.6.3
• react-i18next 16.4.0
• @preact/preset-vite 2.10.2
• eslint 9.39.1
• eslint-config-preact 2.0.0
• typescript 5.9.3
• user-agent-data-types 0.4.2
• vite 7.2.6
• vitest 4.0.15

package.json

• @electron/rebuild 4.0.1
• @fast-csv/parse 5.0.5
• @playwright/test 1.57.0
• @types/express 5.0.6
• @types/node 24.10.1
• @vitest/browser-webdriverio 4.0.15
• @vitest/coverage-v8 4.0.15
• @vitest/ui 4.0.15
• chalk 5.6.2
• cross-env 10.1.0
• dpdm 3.14.0
• esbuild 0.27.1
• eslint 9.39.1
• eslint-config-preact 2.0.0
• eslint-config-prettier 10.1.8
• eslint-plugin-playwright 2.4.0
• eslint-plugin-simple-import-sort 12.1.1
• happy-dom ~20.0.0
• http-server 14.1.1
• jiti 2.6.1
• jsonc-eslint-parser 2.4.2
• react-refresh 0.18.0
• rollup-plugin-webpack-stats 2.1.8
• tslib 2.8.1
• tsx 4.21.0
• typescript ~5.9.0
• typescript-eslint 8.48.1
• upath 2.0.1
• vite 7.2.6
• vite-plugin-dts ~4.5.0
• vitest 4.0.15
• pnpm 10.24.0
• mermaid 11.12.2
• preact 10.28.0
• roughjs 4.6.6
• @types/express-serve-static-core 5.1.0
• flat@<5.0.1 >=5.0.1
• debug@>=3.2.0 <3.2.7 >=3.2.7
• nanoid@<3.3.8 >=3.3.8
• nanoid@>=4.0.0 <5.0.9 >=5.0.9
• dompurify@<3.2.4 >=3.2.4
• esbuild@<=0.24.2 >=0.25.0
• cookie@<0.7.0 >=0.7.0
• tar-fs@>=2.0.0 <2.1.3 >=2.1.3
• on-headers@<1.1.0 >=1.1.0
• form-data@>=4.0.0 <4.0.4 >=4.0.4
• form-data@>=3.0.0 <3.0.4 >=3.0.4
• node-abi 4.24.0

packages/ckeditor5-admonition/package.json

• @ckeditor/ckeditor5-dev-build-tools 43.1.0
• @ckeditor/ckeditor5-inspector >=4.1.0
• @ckeditor/ckeditor5-package-tools 5.0.1
• @typescript-eslint/eslint-plugin ~8.48.0
• @typescript-eslint/parser 8.48.1
• @vitest/browser 4.0.15
• @vitest/coverage-istanbul 4.0.15
• ckeditor5 47.3.0
• eslint 9.39.1
• eslint-config-ckeditor5 >=9.1.0
• http-server 14.1.1
• lint-staged 16.2.7
• stylelint 16.26.1
• stylelint-config-ckeditor5 >=9.1.0
• ts-node 10.9.2
• typescript 5.9.3
• vite-plugin-svgo ~2.0.0
• vitest 4.0.15
• webdriverio 9.21.0
• ckeditor5 47.3.0
• node >=18.0.0
• npm >=5.7.1

packages/ckeditor5-footnotes/package.json

• @ckeditor/ckeditor5-dev-build-tools 43.1.0
• @ckeditor/ckeditor5-inspector >=4.1.0
• @ckeditor/ckeditor5-package-tools 5.0.1
• @typescript-eslint/eslint-plugin ~8.48.0
• @typescript-eslint/parser 8.48.1
• @vitest/browser 4.0.15
• @vitest/coverage-istanbul 4.0.15
• ckeditor5 47.3.0
• eslint 9.39.1
• eslint-config-ckeditor5 >=9.1.0
• http-server 14.1.1
• lint-staged 16.2.7
• stylelint 16.26.1
• stylelint-config-ckeditor5 >=9.1.0
• ts-node 10.9.2
• typescript 5.9.3
• vite-plugin-svgo ~2.0.0
• vitest 4.0.15
• webdriverio 9.21.0
• ckeditor5 47.3.0
• node >=18.0.0
• npm >=5.7.1

packages/ckeditor5-keyboard-marker/package.json

• @ckeditor/ckeditor5-dev-build-tools 43.1.0
• @ckeditor/ckeditor5-inspector >=4.1.0
• @ckeditor/ckeditor5-package-tools 5.0.1
• @typescript-eslint/eslint-plugin ~8.48.0
• @typescript-eslint/parser 8.48.1
• @vitest/browser 4.0.15
• @vitest/coverage-istanbul 4.0.15
• ckeditor5 47.3.0
• eslint 9.39.1
• eslint-config-ckeditor5 >=9.1.0
• http-server 14.1.1
• lint-staged 16.2.7
• stylelint 16.26.1
• stylelint-config-ckeditor5 >=9.1.0
• ts-node 10.9.2
• typescript 5.9.3
• vite-plugin-svgo ~2.0.0
• vitest 4.0.15
• webdriverio 9.21.0
• ckeditor5 47.3.0
• node >=18.0.0
• npm >=5.7.1

packages/ckeditor5-math/package.json

• @ckeditor/ckeditor5-icons 47.3.0
• @ckeditor/ckeditor5-dev-build-tools 43.1.0
• @ckeditor/ckeditor5-inspector >=4.1.0
• @ckeditor/ckeditor5-package-tools 5.0.1
• @typescript-eslint/eslint-plugin ~8.48.0
• @typescript-eslint/parser 8.48.1
• @vitest/browser 4.0.15
• @vitest/coverage-istanbul 4.0.15
• ckeditor5 47.3.0
• eslint 9.39.1
• eslint-config-ckeditor5 >=9.1.0
• http-server 14.1.1
• lint-staged 16.2.7
• stylelint 16.26.1
• stylelint-config-ckeditor5 >=9.1.0
• ts-node 10.9.2
• typescript 5.9.3
• vite-plugin-svgo ~2.0.0
• vitest 4.0.15
• webdriverio 9.21.0
• ckeditor5 47.3.0
• node >=18.0.0
• npm >=5.7.1

packages/ckeditor5-mermaid/package.json

• @types/lodash-es 4.17.12
• lodash-es 4.17.21
• @ckeditor/ckeditor5-dev-build-tools 43.1.0
• @ckeditor/ckeditor5-inspector >=4.1.0
• @ckeditor/ckeditor5-package-tools 5.0.1
• @typescript-eslint/eslint-plugin ~8.48.0
• @typescript-eslint/parser 8.48.1
• @vitest/browser 4.0.15
• @vitest/coverage-istanbul 4.0.15
• ckeditor5 47.3.0
• eslint 9.39.1
• eslint-config-ckeditor5 >=9.1.0
• http-server 14.1.1
• lint-staged 16.2.7
• stylelint 16.26.1
• stylelint-config-ckeditor5 >=9.1.0
• ts-node 10.9.2
• typescript 5.9.3
• vite-plugin-svgo ~2.0.0
• vitest 4.0.15
• webdriverio 9.21.0
• ckeditor5 47.3.0
• node >=18.0.0
• npm >=5.7.1

packages/ckeditor5/package.json

• ckeditor5 47.3.0
• ckeditor5-premium-features 47.3.0
• @smithy/middleware-retry 4.4.14
• @types/jquery 3.5.33

packages/codemirror/package.json

• @codemirror/commands 6.10.0
• @codemirror/lang-css 6.3.1
• @codemirror/lang-html 6.4.11
• @codemirror/lang-javascript 6.2.4
• @codemirror/lang-json 6.0.2
• @codemirror/lang-markdown 6.5.0
• @codemirror/lang-php 6.0.2
• @codemirror/lang-vue 0.1.3
• @codemirror/lang-xml 6.1.0
• @codemirror/legacy-modes 6.5.2
• @codemirror/search 6.5.11
• @codemirror/view 6.38.8
• @fsegurai/codemirror-theme-abcdef 6.2.3
• @fsegurai/codemirror-theme-abyss 6.2.3
• @fsegurai/codemirror-theme-android-studio 6.2.3
• @fsegurai/codemirror-theme-andromeda 6.2.3
• @fsegurai/codemirror-theme-basic-dark 6.2.3
• @fsegurai/codemirror-theme-basic-light 6.2.3
• @fsegurai/codemirror-theme-cobalt2 6.0.3
• @fsegurai/codemirror-theme-forest 6.2.3
• @fsegurai/codemirror-theme-github-dark 6.2.3
• @fsegurai/codemirror-theme-github-light 6.2.3
• @fsegurai/codemirror-theme-gruvbox-dark 6.2.3
• @fsegurai/codemirror-theme-gruvbox-light 6.2.3
• @fsegurai/codemirror-theme-material-dark 6.2.3
• @fsegurai/codemirror-theme-material-light 6.2.3
• @fsegurai/codemirror-theme-monokai 6.2.3
• @fsegurai/codemirror-theme-nord 6.2.3
• @fsegurai/codemirror-theme-palenight 6.2.3
• @fsegurai/codemirror-theme-solarized-dark 6.2.3
• @fsegurai/codemirror-theme-solarized-light 6.2.3
• @fsegurai/codemirror-theme-tokyo-night-day 6.2.3
• @fsegurai/codemirror-theme-tokyo-night-storm 6.2.3
• @fsegurai/codemirror-theme-volcano 6.2.3
• @fsegurai/codemirror-theme-vscode-dark 6.2.3
• @fsegurai/codemirror-theme-vscode-light 6.2.3
• @replit/codemirror-indentation-markers 6.5.3
• @replit/codemirror-lang-nix 6.0.1
• @replit/codemirror-vim 6.3.0
• @ssddanbrown/codemirror-lang-smarty 1.0.0
• @ssddanbrown/codemirror-lang-twig 1.0.0
• codemirror-lang-elixir 4.0.0
• codemirror-lang-hcl 0.1.0
• codemirror-lang-mermaid 0.5.0
• eslint-linter-browserify 9.39.1

packages/commons/package.json

• dayjs 1.11.19
• dayjs-plugin-utc 0.1.2

packages/express-partial-content/package.json

• tslib 2.8.1

packages/highlightjs/package.json

• @exercism/highlightjs-gdscript 0.0.1
• highlight.js 11.11.1
• highlightjs-cobol 0.3.3
• highlightjs-cypher 1.2.0

packages/share-theme/package.json

• boxicons 2.1.4
• fuse.js 7.1.0
• katex 0.16.27
• mermaid 11.12.2
• @digitak/esrun 3.2.26
• @typescript-eslint/eslint-plugin 8.48.1
• @typescript-eslint/parser 8.48.1
• dotenv 17.2.3
• esbuild 0.27.1
• eslint 9.39.1
• highlight.js 11.11.1
• typescript 5.9.3

packages/splitjs/package.json

• @rollup/plugin-buble 1.0.3
• karma 6.4.4
• karma-chrome-launcher 3.2.0
• karma-firefox-launcher 2.1.3
• karma-jasmine 5.1.0

packages/turndown-plugin-gfm/package.json

• turndown 7.2.2
• turndown-attendant 0.0.3

pnpm-workspace.yaml

nvm

.nvmrc

• node 24.11.1

---

• Check this box to trigger a request for Renovate to run again on this repository

[pano9000]

csurf replacement is being worked on here: TriliumNext/Notes#864

[pano9000]

electron-packager and electron-rebuild are updated here: TriliumNext/Notes#935

[eliandoran]

Closing for now as we have the web UI of Renovate if we need it.
Apparently it is needed.