chore(deps): update dependency @nextcloud/vue to v9.8.1#71
Conversation
|
Claude finished @renovate-bot-cbcoutinho[bot]'s task in 1m 11s —— View job Code Review:
|
| Package | Old | New | Notes |
|---|---|---|---|
dompurify |
3.3.3 | 3.4.7 | Security-relevant XSS sanitiser — welcome upgrade |
vue-router |
5.0.4 | 5.1.0 | Minor version bump (was 5.0.3 constraint, now 5.0.7) |
focus-trap |
8.0.1 | 8.2.1 | Minor bump |
@vueuse/core / @vueuse/components |
14.2.1 | 14.3.0 | Minor bump |
p-queue |
9.1.0 | 9.3.0 | Minor bump |
linkifyjs |
4.3.2 | 4.3.3 | Patch bump |
vue-select@4.0.0-beta.6 |
(removed) | — | Beta dependency eliminated |
@nextcloud/vue-select |
(new) | 4.1.0 | Stable Nextcloud fork replaces above |
remark-stringify |
11.0.0 | (removed) | Replaced by mdast-util-to-string |
unist-util-visit |
— | (removed) | Replaced by unist-util-visit-parents |
Assessment
Positives:
- Security improvement:
dompurify3.3.3 → 3.4.7 is a meaningful step forward for the XSS sanitisation layer used heavily inNcRichText. - Beta removed:
vue-select@4.0.0-beta.6is fully replaced by the stable@nextcloud/vue-select@4.1.0— this eliminates a pre-release package from the production dependency tree. - Bug fixes from 9.7.0 (previously reviewed) and beyond, including:
NcModalfocus trap race condition fix,NcAvatarguest redirect,NcAppNavigationmobile close,NcPasswordFieldvalidation state reset.
Points to be aware of:
-
NcRichTextbreaking change from 9.7.0 (still applies): Relative markdown links like[text](#anchor),[text](?param=1), and[text](internal_route)no longer render as clickable links whenuseMarkdown = trueoruseExtendedMarkdown = true. This was flagged in the previous review — if the app usesNcRichTextwith such links, they will silently become plain text. -
vue-router5.0.4 → 5.1.0: This is a minor version bump (not just a patch).vue-router 5.xis tied to Vue Router for Vue 3. A minor bump here shouldn't break anything, but it's worth noting since routing is a foundational concern. -
@babel/generator@8.0.0-rc.6in the transitive tree:vue-router 5.1.0pulls in@babel/generator@8.0.0-rc.6as a new transitive dependency — a release candidate. This is a dev/build-time tool used only for code transformation (not runtime), so it carries minimal runtime risk, but it is a pre-release in the tree. -
Lock file root
versionfield: The lock file's rootversionwas already updated from0.15.0→0.16.6in the previous commit, and this PR reflects0.16.6correctly.
Verdict
Safe to merge. This is a routine minor-version upgrade. The dompurify bump is a net security positive. The only outstanding item worth a manual sanity check is whether any NcRichText usage in the app relies on relative/anchor markdown links (per the 9.7.0 breaking change noted above).
1f006a3 to
c899697
Compare
Code Review:
|
| Package | Old | New | Notes |
|---|---|---|---|
@nextcloud/auth |
2.5.3 | 2.6.0 | Minor bump |
@nextcloud/axios |
2.5.2 | 2.6.0 | Minor bump |
axios |
1.13.2 | 1.16.0 | Minor bump |
dompurify |
3.3.3 | 3.4.2 | Security-relevant library |
follow-redirects |
1.15.11 | 1.16.0 | Security-sensitive (redirect handling) |
focus-trap |
8.0.1 | 8.1.0 | Minor bump |
vue-router |
5.0.4 | 5.0.6 | Minor bump |
proxy-from-env |
1.1.0 | 2.1.0 | Major version bump (transitive) |
vue-select@beta |
4.0.0-beta.6 | removed | Replaced by @nextcloud/vue-select |
@nextcloud/vue-select |
(new) | 4.1.0 | Stable Nextcloud fork |
remark-stringify |
11.0.0 | removed | Replaced by mdast-util-to-string |
unist-util-visit |
— | removed | Replaced by unist-util-visit-parents |
Also note: the lock file's root version field changed from 0.13.2 → 0.13.11, now matching the current package.json — this means the lock file was previously stale on that field, not that the project version changed.
Assessment
Positives:
- Security improvements:
dompurify3.3.3 → 3.4.2 andfollow-redirects1.15.11 → 1.16.0 are welcome security-related updates. - Beta dependency removed:
vue-select@4.0.0-beta.6is replaced by the stable@nextcloud/vue-select@4.1.0— this eliminates a beta package from the dependency tree. - Bug fixes included: The upstream release addresses
NcCheckboxRadioSwitchreactive state,NcModalfocus trap race condition,NcAvatarguest redirect, andNcAppNavigationmobile close behavior.
Points to be aware of:
-
NcRichTextbreaking change: The 9.7.0 release notes include this note:NcRichTextwithuseMarkdown = trueoruseExtendedMarkdown = trueno longer renders relative links that cannot be resolved by Vue Router (e.g.[link](#anchor),[link](?param=1),[link](internal_route)).If this project uses
NcRichTextwith markdown and any relative/anchor links, they will silently stop rendering as clickable links. Worth a quick check in the source. -
proxy-from-envmajor bump (1.x → 2.x): This is a major version jump in a transitive dependency (used byaxios). It's an internal implementation detail for proxy resolution and shouldn't affect application behavior, but it's worth being aware of in case of any unusual proxy configurations. -
@nextcloud/vue-selectnode engine constraint: The new package requiresnode: "^22 || ^24", which is satisfied by the project's"node": "^24.0.0"requirement — no conflict.
Verdict
Safe to merge. This is a routine minor-version upgrade with good upstream release notes. The dompurify and follow-redirects updates are security-positive. The only thing worth a quick sanity check is whether any NcRichText usage with useMarkdown relies on relative/anchor links, given the noted behavioral change in 9.7.0.
c821e80 to
b27587c
Compare
b27587c to
9698a87
Compare
5bd6495 to
6769796
Compare
0c0d9bc to
0848284
Compare
baa9f90 to
7eff338
Compare
7eff338 to
95978cf
Compare
|
This PR contains the following updates:
9.6.0→9.8.1Release Notes
nextcloud-libraries/nextcloud-vue (@nextcloud/vue)
v9.8.1Compare Source
Full Changelog
v9.8.0Compare Source
Full Changelog
v9.7.0Compare Source
Full Changelog
📝 Notes
NcRichTextcomponent used withuseMarkdown = trueoruseExtendedMarkdown = trueno longer renders relative links that can not be resolved by Vue Router.They are might interfere with routing logic and considered not belonging to the application. Examples that are not rendered as a clickable link:
[unknown protocols](unknown:protocol)[unresolved relative link](internal_route)[relative parameters](?parameters=1)[relative anchor](#anchor)🚀 Enhancements
menuContaineras string #8417 (Antreesy)🐛 Fixed bugs
Other Changes
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.