chore(deps): update dependency sitemap to v7.1.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
sitemap	7.1.1 → 7.1.3

---

Release Notes

ekalinin/sitemap.js (sitemap)

v7.1.3: — Security Patch

Compare Source

7.1.3 — Security Patch

• BB-01: Fix XML injection via unescaped xslUrl in stylesheet processing instruction (stylesheetInclude now escapes &, ", <, >)
• BB-02: Enforce 50,000 URL hard limit in XMLToSitemapItemStream — parser stops emitting items instead of only logging a warning
• BB-04: Reject absolute destinationDir paths in simpleSitemapAndIndex to prevent arbitrary file writes
• BB-05: parseSitemapIndex now accepts a maxEntries limit (default 50,000) and destroys source/parser streams immediately on breach
• Many thanks to @​maru1009 For the report

v7.1.2

Compare Source

• fix #​425 via #​426 thanks to @​huntharo update streamToPromise to bubble up errors + jsDoc
• fix #​415 thanks to @​mohd-akram Fix circular dependency breaking Node.js 20.6
• non-breaking updates of dependent packages

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontends	Ready	Preview, Comment	Jul 12, 2026 10:57am