build(deps): bump the tester-minor-patch group across 1 directory with 6 updates

[dependabot]

Bumps the tester-minor-patch group with 6 updates in the /web/tester directory:

Package	From	To
dompurify	3.4.12	3.4.13
marked	18.0.7	18.0.9
protobufjs	8.7.1	8.7.2
@types/luxon	3.7.2	3.7.4
postcss	8.5.23	8.5.26
vite	8.1.5	8.2.1

Updates dompurify from 3.4.12 to 3.4.13

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

Commits

• 3067f77 release: 3.4.13 (#1562)
• See full diff in compare view

Updates marked from 18.0.7 to 18.0.9

Release notes

Sourced from marked's releases.

v18.0.9

18.0.9 (2026-08-04)

Bug Fixes

• an unmatched strong run before emphasis stays literal (#4008) (e8544e6)
• Fix spurious deeper nesting in a blockquote continuation (#4030) (452f1ed)
• pedantic foo: and "word" emphasis parsing (#3999) (823093f)

v18.0.8

18.0.8 (2026-08-04)

Bug Fixes

• fall back to default checkbox renderer when extension returns false (#4023) (e1b6139)

Commits

• 8e858a4 chore(release): 18.0.9 [skip ci]
• 641e5df docs: explain partial extensions in use (#4033)
• 452f1ed fix: Fix spurious deeper nesting in a blockquote continuation (#4030)
• e8544e6 fix: an unmatched strong run before emphasis stays literal (#4008)
• 823093f fix: pedantic foo: and "word" emphasis parsing (#3999)
• 12a84a8 chore(release): 18.0.8 [skip ci]
• 3a1a706 chore(deps-dev): bump undici from 6.24.0 to 6.27.0 (#4042)
• 58ed4af chore(deps-dev): bump eslint from 10.7.0 to 10.8.0 (#4032)
• 01539fb chore(deps-dev): bump @​semantic-release/git from 10.0.1 to 11.0.1 (#4031)
• e1b6139 fix: fall back to default checkbox renderer when extension returns false (#4023)
• Additional commits viewable in compare view

Updates protobufjs from 8.7.1 to 8.7.2

Release notes

Sourced from protobufjs's releases.

protobufjs: v8.7.2

8.7.2 (2026-08-08)

Bug Fixes

• Also use TextDecoder for loose UTF-8 decoding (#2408) (5851a3b)
• Parse numeric defaults according to field type (#2402) (bb2d836)
• Parse numeric descriptor defaults by field type (#2406) (09f24ec)
• preserve first enum alias from JSON descriptors (#2389) (8304739)
• Preserve negative zero in codegen formatters (#2403) (92ddc9b)
• Preserve non-finite defaults in toObject (#2393) (a38b925)

Performance Improvements

• Optimize writer allocs and packed varint reads (#2405) (64cc8f1)

Changelog

Sourced from protobufjs's changelog.

8.7.2 (2026-08-08)

Bug Fixes

• Also use TextDecoder for loose UTF-8 decoding (#2408) (5851a3b)
• Parse numeric defaults according to field type (#2402) (bb2d836)
• Parse numeric descriptor defaults by field type (#2406) (09f24ec)
• preserve first enum alias from JSON descriptors (#2389) (8304739)
• Preserve negative zero in codegen formatters (#2403) (92ddc9b)
• Preserve non-finite defaults in toObject (#2393) (a38b925)

Performance Improvements

• Optimize writer allocs and packed varint reads (#2405) (64cc8f1)

Commits

• 91cdef0 chore: release master (#2391)
• c362fe3 chore(deps-dev): Bump shell-quote from 1.8.4 to 1.10.0 (#2399)
• 7999776 chore(deps-dev): Bump browserify-sign from 4.2.1 to 4.2.6 (#2398)
• 549aa7a chore(deps): Bump linkify-it from 5.0.1 to 5.0.2 in /cli (#2397)
• 5851a3b fix: Also use TextDecoder for loose UTF-8 decoding (#2408)
• aca5b83 docs: Clarify README
• adce445 chore(deps): update dev dependencies (#2395)
• a38b925 fix: Preserve non-finite defaults in toObject (#2393)
• 09f24ec fix: Parse numeric descriptor defaults by field type (#2406)
• 64cc8f1 perf: Optimize writer allocs and packed varint reads (#2405)
• Additional commits viewable in compare view

Updates @types/luxon from 3.7.2 to 3.7.4

Commits

• See full diff in compare view

Updates postcss from 8.5.23 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

Commits

• 07b2577 Release 8.5.26 version
• 47de6b9 Update CI
• 1493a83 Fix Rule#selectors losing the empty selector (#2129)
• 180db16 Typo
• 29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
• 3ba8f84 Update dependencies
• 87e72f6 Update lock file
• caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
• 3609b6f Explain how to type plugin options
• fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
• Additional commits viewable in compare view

Updates vite from 8.1.5 to 8.2.1

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

create-vite@8.2.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0

Please refer to CHANGELOG.md for details.

v8.2.0-beta.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.1 (2026-08-06)

Bug Fixes

• build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
• bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)
• css: don't re-run lightningcss visitor during minify (fix #23146) (#23147) (de041a7)
• deps: update all non-major dependencies (#23136) (14454fd)
• deps: update rolldown-related dependencies (#23070) (7ac6f7f)
• don't mutate the user config when resolving the lib entry from the top-level input (#23135) (b4bf596)
• handle shebang ending with uncommon line terminators (#23038) (17f7b2f)
• server: use a random port when port is 0 (#23158) (fddf4ea)

Performance Improvements

• css: look up pure CSS chunks through a Set (#23114) (1331b0b)

Documentation

• build: fix incomplete @default for build.minify (#23177) (ef02435)

Miscellaneous Chores

• deps: update dependency rolldown-plugin-dts to ^0.28.0 (#23137) (4adc1e7)
• deps: update dependency strip-literal to v4 (#23140) (9db65ce)

Code Refactoring

• bundled-dev: avoid injecting server values in the bundle (#22967) (23b8a08)
• bundled-dev: remove rolldown lazy stub module workaround (#23129) (e72036e)

Tests

• bundled-dev: enable sourcemap playgrounds (#23080) (c2155fe)
• reduce logs (#23138) (7673c02)

8.2.0 (2026-07-30)

Features

• add input to server.fs.allow (#23035) (95a3cda)
• bundled-dev: reload once after rebuild instead of via the fallback page (#23106) (b24381d)
• bundled-dev: support worker file update accepted by HMR (#23068) (0d04351)
• config: include column in config incompatibility location (#23064) (8a24572)
• dev: resolve interface name for explicit host in network URLs (#22965) (3ac77d9)

Bug Fixes

• bundledDev: print build errors to the terminal when an HMR update fails (#23024) (41c4658)
• deps: update all non-major dependencies (#23069) (4c07b74)
• hmr: preserve environment snapshot during server restart (#22992) (b1186c3)
• importAnalysis: interop imports injected into optimized dep files by plugins (#23029) (8c2a87d)

... (truncated)

Commits

• 4216158 release: v8.2.1
• fddf4ea fix(server): use a random port when port is 0 (#23158)
• de041a7 fix(css): don't re-run lightningcss visitor during minify (fix #23146) (#23147)
• 15f0307 fix(build): make client chunkImportMap work with sharedPlugins: true (#23184)
• c2155fe test(bundled-dev): enable sourcemap playgrounds (#23080)
• ef02435 docs(build): fix incomplete @default for build.minify (#23177)
• eac0cc8 fix(bundled-dev): inject client script tag before chunk scripts (#23161)
• 23b8a08 refactor(bundled-dev): avoid injecting server values in the bundle (#22967)
• e72036e refactor(bundled-dev): remove rolldown lazy stub module workaround (#23129)
• 14454fd fix(deps): update all non-major dependencies (#23136)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions