Dependency Dashboard

[renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
View this repository on the Mend.io Web Portal.

Repository Problems

These problems occurred while renovating this repository. View logs.

• ⚠️ WARN: Package lookup failures

Deprecations / Replacements

Warning

The following dependencies are either deprecated or have replacements available.

Datasource	Package	Replacement PR?
npm	@ckeditor/ckeditor5-vue2

Rate-Limited

The following updates are currently rate-limited. To force their creation now, click on a checkbox below.

• chore(deps): bump css-loader from ^7.1.4 to ^7.1.5 (main)
• chore(deps): bump rector/rector from ^2.6.3 to ^2.6.4 (main)
• chore(deps): bump webpack-cli from ^7.2.2 to ^7.2.3 (main)
• fix(deps): bump @nextcloud/calendar-js from ^8.1.6 to ^8.1.7 (main)
• fix(deps): bump rubix/ml from 2.5.5 to v2.5.9 (main)
• chore(deps): bump @playwright/test from ^1.62.1 to ^1.63.0-alpha-2026-08-29 (main)
• chore(deps): bump stalwartlabs/stalwart docker tag to v0.16.19 (main)
• chore(deps): bump webpack from ^5.109.2 to ^5.110.1 (main)
• fix(deps): bump @nextcloud/cdav-library from ^2.7.0 to ^2.8.0 (main)
• fix(deps): bump nextcloud/openapi-extractor from ^1.8.7 to ^1.9.0 (main)
• fix(deps): bump sebastiankrupinski/jmap-client-php from ^2.0.0 to ^2.1.0 (main)
• fix(deps): bump youthweb/urllinker from ^2.1.0 to ^2.2.1 (main)
• chore(deps): bump actions/setup-node action from v6.5.0 to v7 (main)
• chore(deps): bump christophwurst/nextcloud_testing from ^2.0.0 to v3 (main)
• chore(deps): bump typescript from ^5.9.3 to v7 (main)
• chore(deps): bump vitest from ^4.1.11 to v5 (main)
• fix(deps): bump @nextcloud/vue from ^8.41.0 to v9 (main)
• fix(deps): bump @pinia/testing from ^0.1.7 to v2 (main)
• fix(deps): bump pinia from ^2.3.1 to v4 (main)
• 🔐 Create all rate-limited PRs at once 🔐

Pending Status Checks

The following updates await pending status checks. To force their creation now, click on a checkbox below.

• chore(deps): bump ghcr.io/christophwurst/docker-imap-devel:latest docker digest to 1baf0e6 (main)
• chore(deps): bump ghcr.io/nextcloud/continuous-integration-redis:latest docker digest to 022165f (main)
• chore(deps): bump autoprefixer from ^10.5.4 to ^10.5.5 (main)
• chore(deps): bump icewind1991/nextcloud-version-matrix action from v1.3.2 to v1.3.3 (main)
• chore(deps): bump postcss from ^8.5.26 to ^8.5.28 (main)
• chore(deps): bump sass-loader from ^17.0.0 to ^17.0.1 (main)
• fix(deps): bump p-limit from ^7.3.1 to ^7.3.2 (main)
• fix(deps): bump stylelint from ^17.14.1 to ^17.15.0 (main)
• chore(deps): bump ubuntu from 24.04 to v26 (main)

---

Warning

Renovate failed to look up the following dependencies: Failed to look up packagist package arthurhoaro/favicon: no-result, Failed to look up packagist package bytestream/horde-exception: no-result, Failed to look up packagist package bytestream/horde-imap-client: no-result, Failed to look up packagist package bytestream/horde-mail: no-result, Failed to look up packagist package coenjacobs/mozart: no-result, Failed to look up packagist package fig/log-test: no-result.

Files affected: composer.json, vendor-bin/mozart/composer.json, vendor-bin/phpunit/composer.json

---

Open

The following updates have all been created. To force a retry/rebase of any, click on a checkbox below.

• chore(deps): bump @nextcloud/eslint-config from ^9.0.0-rc.8 to ^9.0.1 (main)
• chore(deps): bump php-cs-fixer/shim from ^3.95.19 to ^3.95.23 (main)
• fix(deps): bump dompurify from ^3.4.13 to ^3.4.14 (main)
• fix(deps): bump html-to-text from ^10.0.0 to ^10.0.1 (main)
• chore(deps): bump sass from ^1.102.0 to ^1.103.1 (main)
• chore(deps): bump node-polyfill-webpack-plugin from ^3.0.0 to v4 (main)
• chore(deps): bump psalm/phar from ^5.26.1 to v7 (main)
• chore(deps): bump tripss/conventional-changelog-action action from v3 to v6 (main)
• fix(deps): bump @nextcloud/dialogs from ^6.4.2 to v7 (main)
• fix(deps): bump @nextcloud/files from ^3.12.2 to v4 (main)
• fix(deps): bump vue from ^2.7.16 to v3 (stable5.12)
• Click on this checkbox to rebase all open PRs at once

PR Closed (Blocked)

The following updates are blocked by an existing closed PR. To recreate the PR, click on a checkbox below.

• fix(deps): bump vue from ^2.7.16 to v3 (main)
• fix(deps): bump ckeditor5 from ^47.6.2-alpha.0 to ^47.7.3 (main)
• fix(deps): bump ckeditor5 from ^47.6.2-alpha.0 to v48 (main)
• fix(deps): bump vue from ^2.7.16 to v3 (stable5.11)

Detected Dependencies

Branch main

composer (7)

composer.json (30)

• arthurhoaro/favicon ^2.0.1
• bamarni/composer-bin-plugin ^1.9.1
• bytestream/horde-exception ^2.2.0
• bytestream/horde-imap-client ^2.34.1
• bytestream/horde-mail ^2.7.2
• bytestream/horde-mime ^2.14.1
• bytestream/horde-stream ^1.7.2
• bytestream/horde-stringprep ^1.2.1
• bytestream/horde-support ^2.4.0
• bytestream/horde-text-filter ^2.5.0
• bytestream/horde-text-flowed ^2.1
• bytestream/horde-util ^2.8.1
• cerdic/css-tidy v2.2.1
• cweagans/composer-patches ~2.0
• ezyang/htmlpurifier 4.19.0
• glenscott/url-normalizer ^1.4
• hamza221/html2text ^1.0
• jeremykendall/php-domain-parser ^6.4.0
• nextcloud/horde-managesieve ^1.0.1
• nextcloud/horde-smtp ^1.0.3
• nextcloud/kitinerary ^1.0
• nextcloud/kitinerary-bin ^1.0.4
• nextcloud/kitinerary-flatpak ^1.0
• nextcloud/kitinerary-sys ^2.0.0
• phpmailer/dkimvalidator ^0.3.1
• rubix/ml 2.5.5 → [Updates: 2.5.9]
• sabberworm/php-css-parser ^9.4.0
• sebastiankrupinski/jmap-client-php ^2.0.0 → [Updates: ^2.1.0]
• youthweb/urllinker ^2.1.0 → [Updates: ^2.2.1]
• psalm/phar ^5.26.1 → [Updates: ^7.0.0-beta19]

vendor-bin/cs-fixer/composer.json (2)

• nextcloud/coding-standard ^1.5.0
• php-cs-fixer/shim ^3.95.19 → [Updates: ^3.95.23]

vendor-bin/mozart/composer.json (1)

• coenjacobs/mozart ^0.7.1

vendor-bin/openapi/composer.json (1)

• nextcloud/openapi-extractor ^1.8.7 → [Updates: ^1.9.0]

vendor-bin/phpunit/composer.json (2)

• christophwurst/nextcloud_testing ^2.0.0 → [Updates: ^3.0.0]
• fig/log-test ^1.2.1

vendor-bin/psalm-stubs/composer.json (1)

• psr/log ^3.0.2

vendor-bin/rector/composer.json (2)

• rector/rector ^2.6.3 → [Updates: ^2.6.4]
• nextcloud/rector ^0.5.2

github-actions (6)

.github/workflows/appstore-conventional-build-publish.yml (4)

• skjnldsv/check-actor-permission v3.0@69e92a3c4711150929bca9fcf34448c5bf5526e7
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• TriPSs/conventional-changelog-action v3@b7f32a8347e86c26ea2f4823cc7c160b9014c6a0 → [Updates: v6]
• actions/create-release v1@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e

.github/workflows/package.yml (3)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• skjnldsv/read-package-engines-version-actions v3@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

.github/workflows/release-relay.yml (2)

• skjnldsv/check-actor-permission v3.0@69e92a3c4711150929bca9fcf34448c5bf5526e7
• peter-evans/repository-dispatch v4.0.1@28959ce8df70de7be546dd1250a005dd32156697

.github/workflows/stale.yml (1)

• actions/stale v11.0.0@4391f3da665fdf50b6810c1a66712fb9ba21aa93

.github/workflows/test.yml (21)

• dorny/paths-filter v4.0.3@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• codecov/codecov-action v7.0.0@fb8b3582c8e4def4969c97caa2f19720cb33a72f
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• codecov/codecov-action v7.0.0@fb8b3582c8e4def4969c97caa2f19720cb33a72f
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• skjnldsv/read-package-engines-version-actions v3@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4
• actions/setup-node v6.5.0@249970729cb0ef3589644e2896645e5dc5ba9c38 → [Updates: v7.0.0]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• icewind1991/nextcloud-version-matrix v1.3.2@8a7bac6300b2f0f3100088b297995a229558ddba → [Updates: v1.3.3]
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/setup-node v6.5.0@249970729cb0ef3589644e2896645e5dc5ba9c38 → [Updates: v7.0.0]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• codecov/codecov-action v7.0.0@fb8b3582c8e4def4969c97caa2f19720cb33a72f
• ghcr.io/christophwurst/docker-imap-devel latest@sha256:b76a062268d7342ccec549f5323a0b6dc1b6ac55b03367f474934927653f5cb5 → [Updates: latest]
• stalwartlabs/stalwart v0.15.5 → [Updates: v0.16.19]
• ghcr.io/nextcloud/continuous-integration-mariadb-11.8 latest@sha256:9232089007ddc49b42e5a7e4cc158ac373efebed6885ea0f76e3d4e5f8532bac
• ghcr.io/nextcloud/continuous-integration-postgres-15 latest@sha256:1939108b31fd841cf01906c431c1802cd984fcfb0e57fb0d714b9e6895c340b0
• ghcr.io/nextcloud/continuous-integration-redis latest@sha256:4ae220629fc544cd1396b35723137628a4cf7e5355b1d86649073f30249d7cbe → [Updates: latest]
• ubuntu 24.04 → [Updates: 26.04]

.github/workflows/update-public-suffix-list.yml (2)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• peter-evans/create-pull-request v8.1.1@5f6978faf089d4d20b00c7766989d076bb2fc7f1

npm (1)

package.json (86)

• @ckeditor/ckeditor5-vue2 ^3.0.1
• @iframe-resizer/child ^5.5.9
• @iframe-resizer/parent ^5.5.9
• @mdi/svg ^7.4.47
• @nextcloud/auth ^2.6.0
• @nextcloud/axios ^2.6.0
• @nextcloud/calendar-js ^8.1.6 → [Updates: ^8.1.7]
• @nextcloud/cdav-library ^2.7.0 → [Updates: ^2.8.0]
• @nextcloud/dialogs ^6.4.2 → [Updates: ^7.5.0]
• @nextcloud/files ^3.12.2 → [Updates: ^4.0.0]
• @nextcloud/initial-state ^3.0.0
• @nextcloud/l10n ^3.4.1
• @nextcloud/logger ^3.0.3
• @nextcloud/moment ^1.3.5
• @nextcloud/router ^3.1.0
• @nextcloud/sharing ^0.4.0
• @nextcloud/timezones ^1.0.2
• @nextcloud/vue ^8.41.0 → [Updates: ^9.11.0]
• @pinia/testing ^0.1.7 → [Updates: ^2.0.1]
• @riophae/vue-treeselect ^0.4.0
• address-rfc2822 ^2.2.4
• ckeditor5 ^47.6.2-alpha.0 → [Updates: ^47.7.3, ^48.5.0-alpha.3]
• cldr-core ^48.2.0
• color-convert ^3.1.3
• core-js ^3.50.0
• debounce-promise ^3.1.2
• dompurify ^3.4.13 → [Updates: ^3.4.14]
• escape-html ^1.0.3
• franc ^6.2.0
• html-to-text ^10.0.0 → [Updates: ^10.0.1]
• ical.js ^2.2.1
• js-base64 ^3.9.3
• jstz ^2.1.1
• lodash ^4.18.1
• md5 ^2.3.0
• mitt ^3.0.1
• nextcloud_issuetemplate_builder ^0.1.0
• node-forge ^1.4.0
• p-limit ^7.3.1 → [Updates: ^7.3.2]
• pinia ^2.3.1 → [Updates: ^4.0.3]
• process ^0.11.10
• ramda ^0.32.0
• raw-loader ^4.0.2
• stylelint ^17.14.1 → [Updates: ^17.15.0]
• uuid ^14.0.2
• v-tooltip ^2.1.3
• vue ^2.7.16 → [Updates: ^3.0.0-alpha]
• vue-autosize ^1.0.2
• vue-dndrop ^1.3.4
• vue-frag ^1.4.3
• vue-material-design-icons ^5.3.1
• vue-router ^3.6.5
• vue-shortkey ^3.1.7
• vue-tabs-component ^1.5.0
• webdav 5.10.0
• @nextcloud/babel-config ^1.3.0
• @nextcloud/browserslist-config ^3.1.2
• @nextcloud/eslint-config ^9.0.0-rc.8 → [Updates: ^9.0.1]
• @nextcloud/stylelint-config ^3.2.2
• @playwright/test ^1.62.1 → [Updates: ^1.63.0-alpha-2026-08-29]
• @vitejs/plugin-vue2 ^2.3.4
• @vue/test-utils ^1.3.6
• autoprefixer ^10.5.4 → [Updates: ^10.5.5]
• babel-loader ^10.1.1
• babel-loader-exclude-node-modules-except ^1.2.4
• css-loader ^7.1.4 → [Updates: ^7.1.5]
• eslint-plugin-import ^2.32.0
• eslint-plugin-vitest-globals ^1.6.1
• file-loader ^6.2.0
• jsdom ^30.0.1
• node-polyfill-webpack-plugin ^3.0.0 → [Updates: ^4.1.0]
• patch-package ^8.0.1
• postcss ^8.5.26 → [Updates: ^8.5.28]
• sass ^1.102.0 → [Updates: ^1.103.1]
• sass-loader ^17.0.0 → [Updates: ^17.0.1]
• style-loader ^4.0.0
• svg-inline-loader ^0.8.2
• ts-loader ^9.6.2
• typescript ^5.9.3 → [Updates: ^7.0.2]
• url-loader ^4.1.1
• vitest ^4.1.11 → [Updates: ^5.0.0-rc.3]
• vue-loader ^15.11.1
• vue-template-compiler ^2.7.16
• webpack ^5.109.2 → [Updates: ^5.110.1]
• webpack-cli ^7.2.2 → [Updates: ^7.2.3]
• webpack-merge ^6.0.1

Branch stable5.11

composer (7)

composer.json

vendor-bin/cs-fixer/composer.json

vendor-bin/mozart/composer.json

vendor-bin/openapi/composer.json

vendor-bin/phpunit/composer.json

vendor-bin/psalm-stubs/composer.json

vendor-bin/rector/composer.json

github-actions (6)

.github/workflows/appstore-conventional-build-publish.yml

.github/workflows/package.yml

.github/workflows/release-relay.yml

.github/workflows/stale.yml

.github/workflows/test.yml

.github/workflows/update-public-suffix-list.yml

npm (1)

package.json (1)

• vue ^2.7.16 → [Updates: ^3.0.0-alpha]

Branch stable5.12

composer (7)

composer.json

vendor-bin/cs-fixer/composer.json

vendor-bin/mozart/composer.json

vendor-bin/openapi/composer.json

vendor-bin/phpunit/composer.json

vendor-bin/psalm-stubs/composer.json

vendor-bin/rector/composer.json

github-actions (6)

.github/workflows/appstore-conventional-build-publish.yml

.github/workflows/package.yml

.github/workflows/release-relay.yml

.github/workflows/stale.yml

.github/workflows/test.yml

.github/workflows/update-public-suffix-list.yml

npm (1)

package.json (1)

• vue ^2.7.16 → [Updates: ^3.0.0-alpha]

---

• Check this box to trigger a request for Renovate to run again on this repository