[dependabot]

Bumps the frontend-prod-patch group with 5 updates in the /frontend directory:

Package	From	To
@tabler/core	1.6.0	1.6.1
cytoscape	3.34.3	3.34.4
vue	3.5.43	3.5.44
vue-i18n	11.4.12	11.4.14
vue3-apexcharts	1.11.1	1.11.3

Updates @tabler/core from 1.6.0 to 1.6.1

Release notes

Sourced from @​tabler/core's releases.

Tabler v1.6.1

Core changes

• e3da90e: Fixed Autosize adding a phantom line after shrinking past max-height and wrong heights on content-box textareas.
• e3da90e: Fixed Clipboard reading data-bs-text as a number or JSON, copying hidden text, and added reset() for a delay of 0.
• 7748029: Fixed CountUp firing complete.bs.countup twice when update() ran before it scrolled into view.
• 0a9edcb: Fixed CountUp printing -0 when a value crosses or rounds to zero.
• e3da90e: Fixed CountUp reset() blocking a later viewport start and data-countup or data-sortable JSON that is not an object.
• e3da90e: Fixed Datepicker dispose() swapping the input for a stale clone, a hide timer after dispose and Date values for dateMin.
• 6199b80: Fixed published types requiring the optional vanilla-calendar-pro peer dependency to be installed.
• 4f471dd: Fixed Datepicker failing with data-bs-display-months-count on Vanilla Calendar Pro 3.4 by registering its extensions.
• e3da90e: Fixed Datepicker keeping a deselected date in the field, setSelectedDates() not writing it and not opening on the value's month.
• 0f6e843: Fixed tab, tooltip, popover, dropdown and toast init running before DOMContentLoaded, dropping early listeners.
• e3da90e: Fixed an open dropdown with a disabled toggle being closed by outside clicks, matching Bootstrap.
• c89bf8d: Fixed autosize not resizing a position: fixed textarea.
• 70b8372: Fixed .card-progress to keep a 2px bar fallback when it isn't a direct child of .card.
• ee3843e: Fixed Confetti firing end after dispose(), stalling without a 2D context and sizing its canvas with the scrollbar width.
• d104e78: Fixed Confetti ignoring the trigger's data-bs-* options when data-bs-target points elsewhere.
• 29818fc: Fixed Manipulator.setDataAttribute() writing data-tblr-* attributes instead of data-bs-*.
• 9fc77b9: Fixed Datepicker popup snapping back to the input on resize and an initial value not being formatted.
• e2da442: Fixed the OTP input ignoring groups for its length when neither length nor maxlength is set.
• 01857d2: Fixed Sparkline wiping author content when empty or disposed, keeping stale tween attributes and skipping single-value lines.
• e3da90e: Fixed InputMask dropping options other than mask and lazy, rejecting non-string masks and a bare data-mask-visible.
• e3da90e: Fixed Bootstrap components rejecting a jQuery collection passed as the element, container, parent or target.
• e3da90e: Fixed tooltip, popover, dropdown, toast and tab auto-init stopping the bundle on one bad element and ignoring data-tblr-toggle.
• e3da90e: Fixed OTP input firing complete on every edit of a full value, events on no-op keys, invalid length and type="email" fields.
• 3d10e24: Fixed the Delete key in .otp jumping to the last slot; it now removes the character under the caret and keeps it in place.
• dee65f2: Fixed OtpInput reusing a stale tap position, overwriting only one slot of a selection and breaking IME composition.
• 4b02b6a: Fixed new Tooltip(), new Popover() and new Dropdown() on auto-initialised elements ignoring options and doubling listeners.
• e3da90e: Fixed Clipboard target, Strength input and Datepicker positionElement selectors failing on ids like #user:1.
• e3da90e: Fixed sidebar toggles not syncing when tabler.js loads after DOMContentLoaded and errors on synthetic clicks.
• e3da90e: Fixed a partial messages or weights config on the Strength meter dropping the default entries.
• f7c3956: Fixed the strength meter rating a confirm-password field after it instead of the password field before it.
• e3da90e: Fixed SwitchIcon throwing and staying in the loading state when a wait() promise settles after dispose().
• e3da90e: Fixed the theme switcher and sidebar toggle failing when localStorage is blocked, and ignored unsafe ?theme= URL values.
• e3da90e: Fixed data-bs-delay on tooltips and popovers being overridden by the default delay.

Demo changes

• 6c1d546: Removed JS string evaluation from Chart axis formatters in charts.json and the extraJs prop from Signature.

Docs changes

• 3ab97bc: Updated the hero image on the docs homepage with a new dashboard graphic for light and dark mode.
• 3ab97bc: Updated the table of contents rail on docs pages to a fixed 13rem width.
• 0fdf1b7: Updated the 1.6 upgrade guide with the swapped $table-sort-asc-bg-image and $table-sort-desc-bg-image variables.

Changelog

Sourced from @​tabler/core's changelog.

1.6.1

Patch Changes

• 4f471dd: Fixed Datepicker failing with data-bs-display-months-count on Vanilla Calendar Pro 3.4 by registering its extensions.
• 3ab97bc: Updated the hero image on the docs homepage with a new dashboard graphic for light and dark mode.
• 3ab97bc: Updated the table of contents rail on docs pages to a fixed 13rem width.
• d104e78: Fixed Confetti ignoring the trigger's data-bs-* options when data-bs-target points elsewhere.
• 01857d2: Fixed Sparkline wiping author content when empty or disposed, keeping stale tween attributes and skipping single-value lines.
• 6c1d546: Removed JS string evaluation from Chart axis formatters in charts.json and the extraJs prop from Signature.
• 4b02b6a: Fixed new Tooltip(), new Popover() and new Dropdown() on auto-initialised elements ignoring options and doubling listeners.
• 0fdf1b7: Updated the 1.6 upgrade guide with the swapped $table-sort-asc-bg-image and $table-sort-desc-bg-image variables.

Commits

• ec33733 chore: update versions (#3194)
• 150e2d2 Merge branch 'main' of https://github.com/tabler/tabler into dev
• f2c00c7 Reset compat baseline after the 1.6.0 release (#3235)
• af0448d Skip PR checks for changeset and markdown-only changes (#3236)
• 0ff708b Fix wording and length of two 1.6.1 changesets (#3234)
• 9fc77b9 Fix Datepicker popup snapping back on resize and an unformatted initial val...
• 4f471dd Fix Datepicker throwing on Vanilla Calendar Pro 3.4 by registering its exte...
• 8896c89 Restore PostHog analytics on docs and preview (#3233)
• dee65f2 Fix OtpInput stale tap position, multi-slot selection overwrite and IME com...
• ee3843e Fix Confetti end event after dispose, stalled frame without a 2D context an...
• Additional commits viewable in compare view

Updates cytoscape from 3.34.3 to 3.34.4

Release notes

Sourced from cytoscape's releases.

v3.34.4

Release version v3.34.4

Commits

• e394aa8 3.34.4
• 68cbcf4 Build 3.34.4
• 89e2e47 Docs: Add 3.34.4 to versions.json
• 1a1a30d Merge pull request #3530 from sergioperezcheco/fix/hierholzer-collection-subg...
• 62122e8 Merge pull request #3520 from belomaxorka/fix/opaque-export-background
• d0378eb Revert "Fix semitransparent border around png and jpg exports"
• ca08466 Merge pull request #3532 from zensharma0512-a11y/fix/png-bg-edges
• f610fb7 Fix semitransparent border around png and jpg exports
• 57dc32d Fix Hierholzer traversal of collection subgraphs
• 4c2e810 Fill the image export background with fillRect()
• Additional commits viewable in compare view

Updates vue from 3.5.43 to 3.5.44

Release notes

Sourced from vue's releases.

v3.5.44

For stable releases, please refer to CHANGELOG.md for details. For pre-releases, please refer to CHANGELOG.md of the minor branch.

Changelog

Sourced from vue's changelog.

3.5.44 (2026-10-13)

Bug Fixes

• compat: expose _setupProxy for Vue 2.7 compiled script setup (fix #11164) (#15618) (f08059d)
• compiler-core: parenthesise v-for key in v-memo cache guard (#15724) (d084b90), closes #15723
• compiler-dom: correctly stringify 0 and false in v-html (#15571) (9f3b437)
• compiler-dom: inject transition persisted for v-show in production (#15783) (89cb272)
• compiler-sfc: error when defineModel prop options reference a destructured prop (#15604) (38012a5), closes #15602
• custom-element: skip mounting an async custom element removed while its component loads (#15777) (0f8e7b4), closes #15775
• hydration: observe children of a display: contents root in hydrateOnVisible (#15773) (7f688e8)
• KeepAlive: unmount pruned current component when its vnode was cloned on mount (#15711) (92798ac), closes #15710
• reactivity: avoid mutating native array iterators (#15703) (7f9d45d), closes #15643
• reactivity: do not track deps in watcher callbacks run inside another effect (#15782) (db00fe9), closes #5009
• reactivity: once watcher should stop when its callback throws (#15755) (ae4bd94)
• reactivity: preserve shallow collection semantics (#15793) (b600466), closes #15792
• runtime-core: detect new prop keys when comparing full props (#15634) (702fa61), closes #15632
• runtime-core: keep async placeholder for block patching and pending component updates (#15554) (05ec25f), closes #15551
• runtime-core: only flush jobs queued by the root render itself (#15757) (0bea14b), closes #6728
• runtime-core: render nothing for an invalid v-for range in production (#15742) (ad19e7d)
• runtime-dom: preserve v-show display for unchanged style strings (#15794) (c0a6d3f)
• runtime-dom: treat playsinline as a boolean attribute (#15627) (a084e44)
• server-renderer: propagate async setup errors (#15857) (6930374), closes #15716
• ssr: honor falsy vnode content overrides (#15769) (c11c5c8)
• suspense: mount resolved async component with its own namespace (#15640) (2a086a2), closes #15639
• suspense: skip rendering async components unmounted while pending (4ab865a)
• teleport: move targetStart and keep children before targetAnchor (#15818) (d3c6e02), closes #15817
• transition-group: measure nested groups against their moving outer item (#15848) (1936c87), closes #5385 #1531
• transition: handle comment-wrapped component roots (#15853) (ff35014), closes #6080 #5500

Commits

• bf5f0dd release: v3.5.44
• 6930374 fix(server-renderer): propagate async setup errors (#15857)
• 8e8c547 chore(deps): update all non-major dependencies (#15585)
• 4cb0ca8 chore(deps): update playground (#15685)
• e38478f chore(deps): update dawidd6/action-download-artifact action to v27 (#15768)
• 1caed5a chore(deps): update compiler (#15586)
• a49f451 chore(deps): update lint (#15680)
• 219b858 chore(deps): update build (#15679)
• ff35014 fix(transition): handle comment-wrapped component roots (#15853)
• d084b90 fix(compiler-core): parenthesise v-for key in v-memo cache guard (#15724)
• Additional commits viewable in compare view

Updates vue-i18n from 11.4.12 to 11.4.14

Release notes

Sourced from vue-i18n's releases.

v11.4.14

What's Changed

🔒 Security Fixes

• fix(shared): neutralize srcdoc attribute in sanitizeTranslatedHtml by @​kazupon in intlify/vue-i18n#2679
• fix(core-base): escape both list and named values with escapeParameter by @​kazupon in intlify/vue-i18n#2680
• fix: ignore locales named after Object.prototype properties by @​kazupon in intlify/vue-i18n#2681

👕 Refactoring

• refactor(core-base): extract the resolved message format check by @​kazupon in intlify/vue-i18n#2674
• refactor(vue-i18n-core): remove dead branches in getCoreContext() by @​kazupon in intlify/vue-i18n#2675
• refactor(vue-i18n-core): share the fallbackContext handling in the composer by @​kazupon in intlify/vue-i18n#2676
• refactor(vue-i18n-core): simplify flat JSON handling in setLocaleMessage / mergeLocaleMessage by @​kazupon in intlify/vue-i18n#2677
• refactor(core-base): give the compile cache a proper type by @​kazupon in intlify/vue-i18n#2678

Full Changelog: intlify/vue-i18n@v11.4.13...v11.4.14

v11.4.13

What's Changed

⚡ Improvement Features

• fix(core-base): map locale unions without the UnionToTuple round-trip by @​kazupon in intlify/vue-i18n#2651

Full Changelog: intlify/vue-i18n@v11.4.12...v11.4.13

Changelog

Sourced from vue-i18n's changelog.

v11.4.14 (2026-10-10T11:06:13.502Z)

This changelog is generated by GitHub Releases

What's Changed

🔒 Security Fixes

• fix(shared): neutralize srcdoc attribute in sanitizeTranslatedHtml by @​kazupon in intlify/vue-i18n#2679
• fix(core-base): escape both list and named values with escapeParameter by @​kazupon in intlify/vue-i18n#2680
• fix: ignore locales named after Object.prototype properties by @​kazupon in intlify/vue-i18n#2681

👕 Refactoring

• refactor(core-base): extract the resolved message format check by @​kazupon in intlify/vue-i18n#2674
• refactor(vue-i18n-core): remove dead branches in getCoreContext() by @​kazupon in intlify/vue-i18n#2675
• refactor(vue-i18n-core): share the fallbackContext handling in the composer by @​kazupon in intlify/vue-i18n#2676
• refactor(vue-i18n-core): simplify flat JSON handling in setLocaleMessage / mergeLocaleMessage by @​kazupon in intlify/vue-i18n#2677
• refactor(core-base): give the compile cache a proper type by @​kazupon in intlify/vue-i18n#2678

Full Changelog: intlify/vue-i18n@v11.4.13...v11.4.14

v11.4.13 (2026-10-02T11:01:59.781Z)

This changelog is generated by GitHub Releases

What's Changed

⚡ Improvement Features

• fix(core-base): map locale unions without the UnionToTuple round-trip by @​kazupon in intlify/vue-i18n#2651

Full Changelog: intlify/vue-i18n@v11.4.12...v11.4.13

Commits

• 6bb9ebd release: v11.4.14
• f6b3e75 release: v11.4.13
• See full diff in compare view

Updates vue3-apexcharts from 1.11.1 to 1.11.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vue3-apexcharts since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.