chore(deps): bump the npm-patch group across 1 directory with 5 updates

[dependabot]

Bumps the npm-patch group with 5 updates in the / directory:

Package	From	To
@rails/actiontext	8.1.300	8.1.301
@rails/activestorage	8.1.300	8.1.301
dompurify	3.4.13	3.4.14
postcss	8.5.25	8.5.26
webpack-cli	7.2.2	7.2.3

Updates @rails/actiontext from 8.1.300 to 8.1.301

Commits

• See full diff in compare view

Updates @rails/activestorage from 8.1.300 to 8.1.301

Commits

• See full diff in compare view

Updates dompurify from 3.4.13 to 3.4.14

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

Commits

• 4e6fe24 release: 3.4.14 (#1587)
• See full diff in compare view

Updates postcss from 8.5.25 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

Commits

• 07b2577 Release 8.5.26 version
• 47de6b9 Update CI
• 1493a83 Fix Rule#selectors losing the empty selector (#2129)
• 180db16 Typo
• 29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
• 3ba8f84 Update dependencies
• 87e72f6 Update lock file
• caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
• 3609b6f Explain how to type plugin options
• fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
• See full diff in compare view

Updates webpack-cli from 7.2.2 to 7.2.3

Release notes

Sourced from webpack-cli's releases.

webpack-cli@7.2.3

Patch Changes

• fix: resolve the webpack-dev-server type from its default export, so the types work with both v5 and v6 (by @​bjohansebas in #4834)

• feat: allow toml@5 as a peer dependency for TOML configuration files (by @​alexander-akait in #4837)

Changelog

Sourced from webpack-cli's changelog.

7.2.3

Patch Changes

• fix: resolve the webpack-dev-server type from its default export, so the types work with both v5 and v6 (by @​bjohansebas in #4834)

• feat: allow toml@5 as a peer dependency for TOML configuration files (by @​alexander-akait in #4837)

Commits

• 7d40e4e chore(release): new release (#4839)
• 1f6593a ci: use the input names changesets/action v2 expects (#4838)
• 99cfc4f build(deps): update dependencies (#4837)
• 11be634 feat(create-webpack-app): stop asking about HTML and CSS (#4836)
• a2418aa feat(create-webpack-app): use webpack's native CSS and HTML support in init t...
• 3664b9d chore: update webpack-dev-server to v6 and test against v5 and v6 (#4834)
• ce1a219 ci: node 26 (#4763)
• 0cfc077 chore(deps): bump changesets/action in the dependencies group (#4831)
• ef262eb chore(deps): bump changesets/action in the dependencies group (#4830)
• d90f5ab chore: add gitignore to ignore autogenerated build & fix codecov option (#4828)
• Additional commits viewable in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@rails/actiontext	8.1.301	🟢 6.8	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 7 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 2 badge detected: InProgress Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2
npm/@rails/activestorage	8.1.301	🟢 6.8	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 10 all changesets reviewed Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions 🟢 7 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 2 badge detected: InProgress Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2
npm/dompurify	3.4.14	🟢 9.8	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Dependency-Update-Tool 🟢 10 update tool detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices 🟢 7 badge detected: Silver Vulnerabilities 🟢 10 0 existing vulnerabilities detected SAST 🟢 10 SAST tool is run on all commits Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Signed-Releases 🟢 10 5 out of the last 5 releases have a total of 10 signed artifacts. Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 42 contributing companies or organizations
npm/postcss	8.5.26	🟢 7.4	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 3 Found 11/30 approved changesets -- score normalized to 3 Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 10 all dependencies are pinned License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/webpack-cli	7.2.3	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 5 Found 4/8 approved changesets -- score normalized to 5 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Security-Policy 🟢 10 security policy file detected Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• yarn.lock