Bump the dependencies group across 1 directory with 5 updates

[dependabot]

Bumps the dependencies group with 5 updates in the / directory:

Package	From	To
@antora/cli	3.2.0-alpha.9	3.2.0-rc.2
@antora/site-generator-default	3.2.0-alpha.9	3.2.0-rc.2
asciidoctor-kroki	0.18.1	1.0.1
fast-xml-parser	5.2.5	5.10.1
handlebars	4.7.8	4.7.9

Updates @antora/cli from 3.2.0-alpha.9 to 3.2.0-rc.2

Changelog

Sourced from @​antora/cli's changelog.

== 3.2.0-rc.2 (2026-06-20)

=== Added

• content-classifier: Add create argument as second argument to addFile method on content catalog for backwards compatibility; default to true

=== Changed

• content-classifier: Convert contents to Buffer if contents is string for file passed to createFile method on content catalog; only used if input file is not a Vinyl object (#1226)

== 3.2.0-rc.1 (2026-06-19)

=== Added

• content-classifier: Don't compute and assign pub property when adding file to content catalog if pub property is falsy (#1220)
• content-classifier: Add publishableFamilies setting on content catalog to allow custom family to be marked as publishable (#1219)
• content-classifier: Add createFile method to content catalog to create file without adding it to content catalog (#1221)
• content-classifier: Update ContentCatalog#getFiles to accept a predicate (i.e., filter function) to filter files (#1225)

=== Changed

• content-aggregator: Automatically set READABLE_STREAM environment variable on process to force use of Node.js APIs (#1215)
• content-classifier: Move internal second argument to ContentCatalog#addFile to transient data on src property
• content-classifier: Explicitly mark underscore file as private; follow-up to #1153
• content-classifier: Move underscore file check to classifyContent instead of createFile; follow-up to #1153
• asciidoc-loader: Skip Asciidoctor extension if it has non-compliant exports (assume it self registers) (#1222)
• asciidoc-loader: Cite specific reason why include is unresolved when target is an absolute file path or URL (#1223)
• navigation-builder: Skip entries in navigation tree that have empty content
• navigation-builder: Strip xref from navigation entry if mixed with other content (#1217)
• site-generator: Add hint to site generation completion message when log failure threshold is exceeded (#1216)
• cli: Change exit code to 2 when log failure threshold is exceeded (#1216)
• Set Node.js 20 as minimum required version of Node.js

=== Fixed

• logger: Add support for destination object that's an instance of EventEmitter for logger when format is pretty
• asciidoc-loader: Decode resource reference using decodeURIComponent if it contains % (#484)

== 3.2.0-alpha.12 (2026-05-12)

=== Added

• playbook-builder: Add support for trace log level (#1210)
• playbook-builder: Preserve order of extension from playbook when enabled from CLI if order is fixed (#1192)
• content-aggregator: Support using submodule of locally-cloned repository as content source (#1208)
• navigation-builder: Add buildAlternateNavigation function for building navigation for component version from an à la carte collection of nav files (#1203)
• navigation-builder: Propagate roles on text-only entry in navigation model (#1211)

=== Changed

... (truncated)

Commits

• 4b5396b release 3.2.0-rc.2
• 6c17748 merge !1139
• 255157f resolves #1226 convert contents to Buffer if contents is string for file pass...
• e4000ba add create argument as second argument to addFile for backwards compatibility
• 3eb2bf2 add note about stability of 3.2.0 release [skip ci]
• 68f0bdd prepare branch for development [skip ci]
• deba82d release 3.2.0-rc.1
• 7db0659 upgrade to biome 2.5
• 315fc4d replace use of String#slice with String#substring
• 53d0c44 replace use of deprecated String#substr with String#substring
• Additional commits viewable in compare view

Updates @antora/site-generator-default from 3.2.0-alpha.9 to 3.2.0-rc.2

Changelog

Sourced from @​antora/site-generator-default's changelog.

== 3.2.0-rc.2 (2026-06-20)

=== Added

• content-classifier: Add create argument as second argument to addFile method on content catalog for backwards compatibility; default to true

=== Changed

• content-classifier: Convert contents to Buffer if contents is string for file passed to createFile method on content catalog; only used if input file is not a Vinyl object (#1226)

== 3.2.0-rc.1 (2026-06-19)

=== Added

• content-classifier: Don't compute and assign pub property when adding file to content catalog if pub property is falsy (#1220)
• content-classifier: Add publishableFamilies setting on content catalog to allow custom family to be marked as publishable (#1219)
• content-classifier: Add createFile method to content catalog to create file without adding it to content catalog (#1221)
• content-classifier: Update ContentCatalog#getFiles to accept a predicate (i.e., filter function) to filter files (#1225)

=== Changed

• content-aggregator: Automatically set READABLE_STREAM environment variable on process to force use of Node.js APIs (#1215)
• content-classifier: Move internal second argument to ContentCatalog#addFile to transient data on src property
• content-classifier: Explicitly mark underscore file as private; follow-up to #1153
• content-classifier: Move underscore file check to classifyContent instead of createFile; follow-up to #1153
• asciidoc-loader: Skip Asciidoctor extension if it has non-compliant exports (assume it self registers) (#1222)
• asciidoc-loader: Cite specific reason why include is unresolved when target is an absolute file path or URL (#1223)
• navigation-builder: Skip entries in navigation tree that have empty content
• navigation-builder: Strip xref from navigation entry if mixed with other content (#1217)
• site-generator: Add hint to site generation completion message when log failure threshold is exceeded (#1216)
• cli: Change exit code to 2 when log failure threshold is exceeded (#1216)
• Set Node.js 20 as minimum required version of Node.js

=== Fixed

• logger: Add support for destination object that's an instance of EventEmitter for logger when format is pretty
• asciidoc-loader: Decode resource reference using decodeURIComponent if it contains % (#484)

== 3.2.0-alpha.12 (2026-05-12)

=== Added

• playbook-builder: Add support for trace log level (#1210)
• playbook-builder: Preserve order of extension from playbook when enabled from CLI if order is fixed (#1192)
• content-aggregator: Support using submodule of locally-cloned repository as content source (#1208)
• navigation-builder: Add buildAlternateNavigation function for building navigation for component version from an à la carte collection of nav files (#1203)
• navigation-builder: Propagate roles on text-only entry in navigation model (#1211)

=== Changed

... (truncated)

Commits

• 4b5396b release 3.2.0-rc.2
• 6c17748 merge !1139
• 255157f resolves #1226 convert contents to Buffer if contents is string for file pass...
• e4000ba add create argument as second argument to addFile for backwards compatibility
• 3eb2bf2 add note about stability of 3.2.0 release [skip ci]
• 68f0bdd prepare branch for development [skip ci]
• deba82d release 3.2.0-rc.1
• 7db0659 upgrade to biome 2.5
• 315fc4d replace use of String#slice with String#substring
• 53d0c44 replace use of deprecated String#substr with String#substring
• Additional commits viewable in compare view

Updates asciidoctor-kroki from 0.18.1 to 1.0.1

Release notes

Sourced from asciidoctor-kroki's releases.

v1.0.1

Added

• Publish TypeScript type declarations, generated from the JSDoc annotations (tsc --emitDeclarationOnly into build/types). The package now declares a types entry point so TypeScript consumers get typed register, KrokiContext and Vfs APIs.

v1.0.0

First stable release. It includes every change from the 1.0.0-beta.* prereleases.

This version requires Asciidoctor.js 4.0 (@asciidoctor/core >=4.0.0 <5.0.0). It is not yet compatible with Antora, which still bundles an older Asciidoctor.js; keep using the latest-0 release line (currently 0.18.1) with Antora. See the installation guide.

v1.0.0-beta.2

Changed

• The inline option (opts=inline or kroki-default-options: inline) now embeds the diagram as a data: URI image target when neither kroki-fetch-diagram nor allow-uri-read is set, instead of producing a server URL the converter cannot read (which rendered as the image's alt text). The extension still only sets the image target — the converter decides how to render it — so DocBook, PDF and other backends keep working from the same data-URI image. Inlining the result as <svg> requires @asciidoctor/core with data:-URI inline SVG support.

Fixed

• Encode diagram sources with TextEncoder/btoa instead of the Node-only Buffer global, so the JavaScript extension works in a real browser (VS Code for the Web / vscode.dev) where modern bundlers no longer polyfill Buffer. Previously every diagram failed with ReferenceError: Buffer is not defined; the new encoding produces byte-for-byte identical output.
• Attach a source location to warnings emitted when a diagram is skipped, so the message points at the offending block instead of embedding a JSON stack blob.

v1.0.0-beta.1

Added

• Ruby: support the kroki-default-options document attribute, on par with the JavaScript extension (#156).

Changed

• Breaking: require Asciidoctor.js 4.0 (@asciidoctor/core >=4.0.0 <5.0.0). Antora is not yet supported because it ships an older Asciidoctor.js; use the latest-0 release line with Antora until it upgrades.
• Use a stable file name for fetched diagrams that are given an explicit name: [ditaa,foo] now generates foo.svg instead of foo-<checksum>.svg, so links to generated images stay stable across content changes. Anonymous diagrams keep a content-addressed name (diag-<sha256>.svg); reusing the same name for diagrams with different content overwrites the file and logs a warning. The JavaScript checksum is also switched from SHA-1 to SHA-256 to match the Ruby gem (#451).
• Lower the minimum supported Node.js version to 22 (nothing in the code requires Node.js 24).
• Document the feature parity between the JavaScript/Node.js extension and the Ruby gem. Preprocessing (resolving PlantUML/Structurizr !include and Vega-Lite data.url) and kroki-plantuml-include-paths are available in the JavaScript/Node.js extension only; the Ruby gem relies on the Kroki server to resolve includes.

Fixed

• Resolve relative !include directives nested inside a remote PlantUML/Structurizr file against the remote URL of the including file, instead of looking them up on the local file system and silently skipping them (#398).
• Fix the broken documentation link in the README.

Changelog

Sourced from asciidoctor-kroki's changelog.

[1.0.1] - 2026-07-15

Added

• Publish TypeScript type declarations, generated from the JSDoc annotations (tsc --emitDeclarationOnly into build/types). The package now declares a types entry point so TypeScript consumers get typed register, KrokiContext and Vfs APIs.

[1.0.0] - 2026-07-14

First stable release. It includes every change from the 1.0.0-beta.* prereleases.

This version requires Asciidoctor.js 4.0 (@asciidoctor/core >=4.0.0 <5.0.0). It is not yet compatible with Antora, which still bundles an older Asciidoctor.js; keep using the latest-0 release line (currently 0.18.1) with Antora. See the installation guide.

[1.0.0-beta.2] - 2026-07-06

Changed

• The inline option (opts=inline or kroki-default-options: inline) now embeds the diagram as a data: URI image target when neither kroki-fetch-diagram nor allow-uri-read is set, instead of producing a server URL the converter cannot read (which rendered as the image's alt text). The extension still only sets the image target — the converter decides how to render it — so DocBook, PDF and other backends keep working from the same data-URI image. Inlining the result as <svg> requires @asciidoctor/core with data:-URI inline SVG support.

Fixed

• Encode diagram sources with TextEncoder/btoa instead of the Node-only Buffer global, so the JavaScript extension works in a real browser (VS Code for the Web / vscode.dev) where modern bundlers no longer polyfill Buffer. Previously every diagram failed with ReferenceError: Buffer is not defined; the new encoding produces byte-for-byte identical output.
• Attach a source location to warnings emitted when a diagram is skipped, so the message points at the offending block instead of embedding a JSON stack blob.

[1.0.0-beta.1] - 2026-06-23

Added

• Ruby: support the kroki-default-options document attribute, on par with the JavaScript extension (#156).

Changed

• Breaking: require Asciidoctor.js 4.0 (@asciidoctor/core >=4.0.0 <5.0.0). Antora is not yet supported because it ships an older Asciidoctor.js; use the latest-0 release line with Antora until it upgrades.
• Use a stable file name for fetched diagrams that are given an explicit name: [ditaa,foo] now generates foo.svg instead of foo-<checksum>.svg, so links to generated images stay stable across content changes. Anonymous diagrams keep a content-addressed name (diag-<sha256>.svg); reusing the same name for diagrams with different content overwrites the file and logs a warning. The JavaScript checksum is also switched from SHA-1 to SHA-256 to match the Ruby gem (#451).
• Lower the minimum supported Node.js version to 22 (nothing in the code requires Node.js 24).
• Document the feature parity between the JavaScript/Node.js extension and the Ruby gem. Preprocessing (resolving PlantUML/Structurizr !include and Vega-Lite data.url) and kroki-plantuml-include-paths are available in the JavaScript/Node.js extension only; the Ruby gem relies on the Kroki server to resolve includes.

Fixed

• Resolve relative !include directives nested inside a remote PlantUML/Structurizr file against the remote URL of the including file, instead of looking them up on the local file system and silently skipping them (#398).
• Fix the broken documentation link in the README.

Commits

• 7af83e4 chore: release v1.0.1
• 92954d0 feat: publish TypeScript declarations generated from JSDoc
• d492e0e docs: consistent tone and document missing features and behaviors
• af15391 docs: register the extension with the Asciidoctor.js CLI using --extension
• 4310e1f chore: release v1.0.0
• a8ce127 docs: quote Antora component version to keep it a string
• f4566f3 docs: use xref for Asciidoctor document attributes link
• 9fe8d60 docs: add missing changelog entries for 1.0.0-beta.2
• 655168e chore: release v1.0.0-beta.2
• d03ba69 ci: name release workflow run with the version
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for asciidoctor-kroki since your current version.

Updates fast-xml-parser from 5.2.5 to 5.10.1

Release notes

Sourced from fast-xml-parser's releases.

v5.10.1

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

v5.10.0

What's Changed

• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#849
• Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#848

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

v5.9.3

What's Changed

• Harden GitHub Actions workflows by @​martincostello in NaturalIntelligence/fast-xml-parser#841
• GitHub Actions workflow fixes by @​martincostello in NaturalIntelligence/fast-xml-parser#844

New Contributors

• @​martincostello made their first contribution in NaturalIntelligence/fast-xml-parser#841

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.2...v5.9.3

v5.9.2

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.1...v5.9.2

v5.9.1

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.0...v5.9.1

update strnum, use is-unsafe

• update strnum to 2.3.0
  • you can set hex, binary, enotation, infinity, unicode
• validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

update strnum, FXB. Use xml-naming for DOCTYPE

• integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)
  • This will consider xml-version as well. '1.0' is default
• update strnum to 2.3.0
  • You can set octal and binary parsing which is by deault off
• update fast-xml-builder to 1.2.0
  • can sanitize tag names if found invalid
  • fix format output

fix minor old bugs and update builder

• fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
• fix stop node expression when ns prefix is removed (found by iruizsalinas)
• update XML Builder to 1.1.7
• mark addEntity deprecated

backward compatibility for numerical external entity, fix #705, #817

• allow numerical external entity for backward compatibility
• fix #705: attributesGroupName working with preserveOrder

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.10.1 / 2026-07-17

• fix: multiple DOCTYPE declarations.
• deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

• upgrade:
  • xml-naming v0.3.0: cache support
  • PEM v1.6.2: sibling bug fix
  • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

• update strnum

*5.9.2 / 2026-06-17

• dummy release to test changes in github action

*5.9.1 / 2026-06-17

• dummy release to test release from github action

*5.9.0 / 2026-06-15

• update strnum to 2.3.0
  • you can set hex, binary, enotation, infinity, unicode
• validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

• integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
  • This will consider xml-version as well. '1.0' is default
• update strnum to 2.3.0
  • You can set octal and binary parsing which is bydeault off
• update fast-xml-builder to 1.2.0
  • can sanitize tag names if found invalid
  • fix format output

5.7.3 / 2006-05-05

• fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
• fix stop node expression when ns prefix is removed (found by iruizsalinas)
• update XML Builder to 1.1.7
• mark addEntity deprecated

5.7.2 / 2026-04-25

• allow numerical external entity for backward compatibility

... (truncated)

Commits

• 2ce7191 5.10.1
• 4e1bb01 update for release
• ffd1269 deps: @​nodable/entities for treeshaking
• 4e546e0 fix: multiple DOCTYPE are not allowed
• 296b332 5.10.0
• 75f7565 update package guide
• 2d8d1d0 update details
• e58e4dd upgrade: xml-naming v0.3.0, PEM v1.6.2, is-unsafe v2.0.0
• 545e491 Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (#848)
• 5ea8aa1 Bump actions/checkout from 6.0.3 to 7.0.0 (#849)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-xml-parser since your current version.

Updates handlebars from 4.7.8 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

• fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
• fix type "RuntimeOptions" also accepting string partials - eab1d14
• feat(types): set hash to be a Record<string, any> - de4414d
• fix non-contiguous program indices - 4512766
• refactor: rename i to startPartIndex - e497a35
• security: fix security issues - 68d8df5
  • GHSA-2w6w-674q-4c4q
  • GHSA-3mfm-83xf-c92r
  • GHSA-xhpv-hc6g-r9c6
  • GHSA-xjpj-3mr7-gcpf
  • GHSA-9cx6-37pm-9jff
  • GHSA-2qvq-rjwj-gvw9
  • GHSA-7rx3-28cr-v5wh
  • GHSA-442j-39wm-28r2

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

• fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
• fix type "RuntimeOptions" also accepting string partials - eab1d14
• feat(types): set hash to be a Record<string, any> - de4414d
• fix non-contiguous program indices - 4512766
• refactor: rename i to startPartIndex - e497a35
• security: fix security issues - 68d8df5

Commits

Commits

• dce542c v4.7.9
• 8a41389 Update release notes
• 68d8df5 Fix security issues
• b2a0831 Fix browser tests
• 9f98c16 Fix release script
• 45443b4 Revert "Improve partial indenting performance"
• 8841a5f Fix CI errors with linting
• e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
• e914d60 Improve rendering performance
• 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions