Deps: bump the patch-updates group with 4 updates

[dependabot]

Bumps the patch-updates group with 4 updates: d3-cloud, dayjs, dompurify and @vitest/eslint-plugin.

Updates d3-cloud from 1.2.8 to 1.2.9

Commits

• See full diff in compare view

Updates dayjs from 1.11.19 to 1.11.20

Release notes

Sourced from dayjs's releases.

v1.11.20

1.11.20 (2026-03-12)

Bug Fixes

• Update locale km.js to support meridiem (#3017) (9d2b6a1)
• update updateLocale plugin to merge nested object properties instead of replacing (#3012) (99691c5), closes #1118

Changelog

Sourced from dayjs's changelog.

1.11.20 (2026-03-12)

Bug Fixes

• Update locale km.js to support meridiem (#3017) (9d2b6a1)
• update updateLocale plugin to merge nested object properties instead of replacing (#3012) (99691c5), closes #1118

Commits

• af6e1f8 chore(release): 1.11.20 [skip ci]
• 82babd6 D2M (#3018)
• bbe4ab1 chore: fix lint error
• 99691c5 fix: update updateLocale plugin to merge nested object properties instead of ...
• 9d2b6a1 fix: Update locale km.js to support meridiem (#3017)
• acf21cd chore: update doc
• 55a64e1 chore: update doc
• 807face chore: update doc
• 54f4470 chore: update doc
• 9ea23c7 chore: update doc
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for dayjs since your current version.

Updates dompurify from 3.3.2 to 3.3.3

Release notes

Sourced from dompurify's releases.

DOMPurify 3.3.3

• Fixed an engine requirement for Node 20 which caused hiccups, thanks @​Rotzbua

Commits

• 8bcbf73 chore: Preparing 3.3.3 release
• 5faddd6 fix: engine requirement (#1210)
• 0f91e3a Update README.md
• d5ff1a8 Merge branch 'main' of github.com:cure53/DOMPurify
• c3efd48 fix: moved back from jsdom 28 to jsdom 20
• 988b888 fix: moved back from jsdom 28 to jsdom 20
• 2726c74 chore: Preparing 3.3.2 release
• 6202c7e build(deps): bump @​tootallnate/once and jsdom (#1204)
• 302b51d fix: Expanded the regex ever so slightly to also cover script
• cd85175 Merge branch 'main' of github.com:cure53/DOMPurify
• Additional commits viewable in compare view

Updates @vitest/eslint-plugin from 1.6.9 to 1.6.12

Release notes

Sourced from @​vitest/eslint-plugin's releases.

v1.6.12

    View changes on GitHub

What's Changed

• fix: detect class/function type more reliably by @​FloEdelmann in vitest-dev/eslint-plugin-vitest#882
• fix(no-alias-methods): reverse toThrow/toThrowError alias direction by @​FloEdelmann in vitest-dev/eslint-plugin-vitest#881

Full Changelog: vitest-dev/eslint-plugin-vitest@v1.6.11...v1.6.12

v1.6.11

   🐞 Bug Fixes

• no-focused-tests: Not all chainable APIs are reported  -  by @​StyleShit in vitest-dev/eslint-plugin-vitest#878 (703b0)

    View changes on GitHub

v1.6.10

   🚀 Features

• prefer-import-in-mock: Support doMock  -  by @​andreww2012 in vitest-dev/eslint-plugin-vitest#875 (ef227)

    View changes on GitHub

Commits

• a5cfe4f chore: release v1.6.12
• 6629da5 fix(no-alias-methods): reverse toThrow/toThrowError alias direction (#881)
• c3e4754 fix: detect class/function type more reliably (#882)
• ba77927 chore: release v1.6.11
• 703b006 fix(no-focused-tests): not all chainable APIs are reported (#878)
• 99cd227 chore: release v1.6.10
• ef2274a feat(prefer-import-in-mock): support doMock (#875)
• e3aab3c refactor: Enforce schema option descriptions and align rule docs with auto-ge...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 4630549.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@vitest/eslint-plugin	1.6.12	Unknown	Unknown
npm/d3-cloud	1.2.9	🟢 3.6	Details Check Score Reason Pinned-Dependencies ⚠️ -1 no dependencies found Token-Permissions ⚠️ -1 No tokens found Code-Review ⚠️ 1 Found 3/29 approved changesets -- score normalized to 1 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow ⚠️ -1 no workflows found Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 6 commit(s) and 28 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/dayjs	1.11.20	🟢 4.9	Details Check Score Reason Code-Review 🟢 3 Found 6/20 approved changesets -- score normalized to 3 Maintained 🟢 6 8 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices 🟢 10 badge detected: Gold Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Packaging 🟢 10 packaging workflow detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/dompurify	3.3.3	🟢 6.2	Details Check Score Reason Security-Policy 🟢 10 security policy file detected Code-Review 🟢 5 Found 7/12 approved changesets -- score normalized to 5 Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 29 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool is run on all commits

Scanned Files

• package-lock.json

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.39%. Comparing base (7aece73) to head (4630549).
⚠️ Report is 17 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5173   +/-   ##
=======================================
  Coverage   77.39%   77.39%           
=======================================
  Files        1179     1179           
  Lines       30864    30864           
  Branches     9232     9232           
=======================================
  Hits        23886    23886           
  Misses       6244     6244           
  Partials      734      734           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.