From 54eefc720faf6e5d8c20077d50871d5087c36740 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 15 Apr 2026 12:30:47 +0000
Subject: [PATCH] Bump the runtime group across 1 directory with 3 updates

Bumps the runtime group with 3 updates in the / directory: [dotenv](https://github.com/motdotla/dotenv), [ioredis](https://github.com/luin/ioredis) and [marked](https://github.com/markedjs/marked).


Updates `dotenv` from 17.3.1 to 17.4.2
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](https://github.com/motdotla/dotenv/compare/v17.3.1...v17.4.2)

Updates `ioredis` from 5.10.0 to 5.10.1
- [Release notes](https://github.com/luin/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](https://github.com/luin/ioredis/compare/v5.10.0...v5.10.1)

Updates `marked` from 15.0.12 to 18.0.0
- [Release notes](https://github.com/markedjs/marked/releases)
- [Commits](https://github.com/markedjs/marked/compare/v15.0.12...v18.0.0)

---
updated-dependencies:
- dependency-name: dotenv
  dependency-version: 17.4.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
- dependency-name: ioredis
  dependency-version: 5.10.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: runtime
- dependency-name: marked
  dependency-version: 18.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 38 +++++++++++++++++++++++++-------------
 package.json      |  6 +++---
 2 files changed, 28 insertions(+), 16 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 955f71a7d..289427961 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -38,7 +38,7 @@
         "chokidar": "3.6.0",
         "convict": "^6.2.5",
         "date-fns": "^4.1.0",
-        "dotenv": "^17.2.3",
+        "dotenv": "^17.4.2",
         "expr-eval-fork": "^3.0.0",
         "geodesy": "^2.4.0",
         "govuk-frontend": "^5.13.0",
@@ -47,11 +47,11 @@
         "highlight.js": "^11.11.1",
         "http-status-codes": "^2.3.0",
         "humanize-duration": "^3.33.1",
-        "ioredis": "^5.8.2",
+        "ioredis": "^5.10.1",
         "joi": "^17.13.3",
         "liquidjs": "^10.24.0",
         "lodash": "^4.17.21",
-        "marked": "^15.0.12",
+        "marked": "^18.0.0",
         "nunjucks": "^3.2.4",
         "obscenity": "^0.4.5",
         "outdent": "^0.8.0",
@@ -3530,6 +3530,18 @@
         "joi": "^17.0.0"
       }
     },
+    "node_modules/@defra/forms-model/node_modules/marked": {
+      "version": "15.0.12",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-15.0.12.tgz",
+      "integrity": "sha512-8dD6FusOQSrpv9Z1rdNMdlSgQOIP880DHqnohobOmYLElGEqAL/JvxvuxZO16r4HtjTlfPRDC1hbvxC9dPN2nA==",
+      "license": "MIT",
+      "bin": {
+        "marked": "bin/marked.js"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
     "node_modules/@defra/hapi-tracing": {
       "version": "1.30.0",
       "resolved": "https://registry.npmjs.org/@defra/hapi-tracing/-/hapi-tracing-1.30.0.tgz",
@@ -17009,9 +17021,9 @@
       }
     },
     "node_modules/dotenv": {
-      "version": "17.3.1",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.3.1.tgz",
-      "integrity": "sha512-IO8C/dzEb6O3F9/twg6ZLXz164a2fhTnEWb95H23Dm4OuN+92NmEAlTrupP9VW6Jm3sO26tQlqyvyi4CsnY9GA==",
+      "version": "17.4.2",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-17.4.2.tgz",
+      "integrity": "sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=12"
@@ -20593,9 +20605,9 @@
       }
     },
     "node_modules/ioredis": {
-      "version": "5.10.0",
-      "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.10.0.tgz",
-      "integrity": "sha512-HVBe9OFuqs+Z6n64q09PQvP1/R4Bm+30PAyyD4wIEqssh3v9L21QjCVk4kRLucMBcDokJTcLjsGeVRlq/nH6DA==",
+      "version": "5.10.1",
+      "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.10.1.tgz",
+      "integrity": "sha512-HuEDBTI70aYdx1v6U97SbNx9F1+svQKBDo30o0b9fw055LMepzpOOd0Ccg9Q6tbqmBSJaMuY0fB7yw9/vjBYCA==",
       "license": "MIT",
       "dependencies": {
         "@ioredis/commands": "1.5.1",
@@ -23782,15 +23794,15 @@
       }
     },
     "node_modules/marked": {
-      "version": "15.0.12",
-      "resolved": "https://registry.npmjs.org/marked/-/marked-15.0.12.tgz",
-      "integrity": "sha512-8dD6FusOQSrpv9Z1rdNMdlSgQOIP880DHqnohobOmYLElGEqAL/JvxvuxZO16r4HtjTlfPRDC1hbvxC9dPN2nA==",
+      "version": "18.0.0",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-18.0.0.tgz",
+      "integrity": "sha512-2e7Qiv/HJSXj8rDEpgTvGKsP8yYtI9xXHKDnrftrmnrJPaFNM7VRb2YCzWaX4BP1iCJ/XPduzDJZMFoqTCcIMA==",
       "license": "MIT",
       "bin": {
         "marked": "bin/marked.js"
       },
       "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
       }
     },
     "node_modules/math-intrinsics": {
diff --git a/package.json b/package.json
index a212a5116..64f13d853 100644
--- a/package.json
+++ b/package.json
@@ -111,7 +111,7 @@
     "chokidar": "3.6.0",
     "convict": "^6.2.5",
     "date-fns": "^4.1.0",
-    "dotenv": "^17.2.3",
+    "dotenv": "^17.4.2",
     "expr-eval-fork": "^3.0.0",
     "geodesy": "^2.4.0",
     "govuk-frontend": "^5.13.0",
@@ -120,11 +120,11 @@
     "highlight.js": "^11.11.1",
     "http-status-codes": "^2.3.0",
     "humanize-duration": "^3.33.1",
-    "ioredis": "^5.8.2",
+    "ioredis": "^5.10.1",
     "joi": "^17.13.3",
     "liquidjs": "^10.24.0",
     "lodash": "^4.17.21",
-    "marked": "^15.0.12",
+    "marked": "^18.0.0",
     "nunjucks": "^3.2.4",
     "obscenity": "^0.4.5",
     "outdent": "^0.8.0",