build(deps): bump the npm-minor-patch group across 1 directory with 3 updates

[dependabot]

Bumps the npm-minor-patch group with 3 updates in the / directory: jszip, mammoth and vite-plugin-pwa.

Updates jszip from 3.10.1 to 3.10.2

Changelog

Sourced from jszip's changelog.

v3.10.2 2026-09-09

• Fix cross-realm binary type detection in getTypeOf. Fixes #759 (see #578)
• Add missing types for JSZip.defaults. Fixes #690 (see #927)
• Fix Blob support in Node.js 18 and up. Fixes #941 (see #955)

Commits

• 020fa33 Release preparation for 3.10.2 (#974)
• d38fda5 Fix cross-realm binary type detection in getTypeOf (#578)
• e682f9a Fix grunt build rebundling existing dist via browser field (#971)
• 5adef36 Add missing types for JSZip.defaults (#927)
• 41a1342 Fix blob support in Node.js 18 and up (#955)
• 643714a Move all continuous integration to GitHub Actions (#942)
• 418c11f Upgrade Playwright to the latest version (#940)
• 2ceb998 Create FUNDING.yml
• See full diff in compare view

Maintainer changes

This version was pushed to npm by jkoops, a new releaser for jszip since your current version.

Updates mammoth from 1.11.0 to 1.13.0

Changelog

Sourced from mammoth's changelog.

1.13.0

• Replace the use of bluebird with native promises.

  This is arguably a breaking change: however, the return value of functions such as convertToHtml() was only documented as a promise, rather than as a bluebird promise.

  The only exception is that the docs previously used .done(): therefore, when returning promises from the API to external users, a done method is added.

  Any callers that rely on bluebird promises can convert the returned promise into a bluebird promise using bluebird.Promise.resolve().

• Read the children of w:customXml elements.

• Handle paragraphs and runs that have been moved and tracked as a revision.

• Improve escaping in Markdown writer. This avoids some cases where source documents could inject arbitrary HTML into the converted document.

1.12.3

• Avoid excessive backtracking when parsing an unterminated string with many escape sequences. The previous behaviour would allow maliciously crafted documents to cause a denial of service.

  Note that it is still strongly recommended to process untrusted documents in a separate thread with a timeout to avoid potential similar issues.

• Handle complex field separator and end characters without corresponding start characters.

1.12.2

• Avoid prototype pollution when reading the styles defined in a document. This avoids an issue where a maliciously crafted document could be used to set externalFileAccess to true.

1.12.1

• Fix: on Windows, when an image's content type includes a backslash in the subpart, files may be written outside of the directory set by --output-dir.

• Detect and ignore numbering levels that use numStyleLink to refer to themselves.

1.12.0

... (truncated)

Commits

• 791a189 Bump version to 1.13.0
• 4abdfe2 Clarify implication of markdown escaping
• 8e6e755 Escape markdown image alt text and src
• 9463f5c Escape markdown link hrefs
• d302d07 Escape HTML IDs in markdown writer
• 671dbb6 Handle paragraphs and runs that have been moved and tracked as a revision
• d157374 Read the children of w:customXml elements
• 2a489fb Mark up code fragment in README
• adc5749 Update dingbat-to-unicode to 1.0.2
• c0dce8c Remove dependency on path-is-absolute
• Additional commits viewable in compare view

Updates vite-plugin-pwa from 1.1.0 to 1.3.0

Release notes

Sourced from vite-plugin-pwa's releases.

v1.3.0

   🚀 Features

• Add vite 8 peer dependency support  -  by @​Hermione-Granger-1176 and Claude Opus 4.6 (1M context) (276af)
• client: Add onNeedReload callback  -  by @​tomrehnstrom (fb308)

    View changes on GitHub

v1.2.0

No significant changes

    View changes on GitHub

Commits

• 05670fc chore: release v1.3.0
• 207f86e Merge pull request #899 from rj-au/patch-1
• 67f5000 Merge pull request #929 from vite-pwa/userquin/chore-bump-workbox-to-7.4.1
• a964691 chore: update workbox to 7.4.1
• 2432f65 Merge pull request #924 from Hermione-Granger-1176/feat/add-vite-8-peer-dep
• 3476818 Merge pull request #914 from tomrehnstrom/feat/on-need-reload
• 276af62 feat: add vite 8 peer dependency support
• 4e16215 chore: use "moduleResolution": "bundler" (#913)
• fb30890 feat(client): add onNeedReload callback
• 46f8332 chore: release v1.2.0
• Additional commits viewable in compare view