build(deps): bump the npm_and_yarn group across 20 directories with 11 updates

[dependabot]

Bumps the npm_and_yarn group with 8 updates in the /app directory:

Package	From	To
i18next-fs-backend	2.3.1	2.6.4
brace-expansion	1.1.12	1.1.14
@xmldom/xmldom	0.8.11	0.8.13
fast-uri	3.1.0	3.1.2
ip-address	10.1.0	10.2.0
langsmith	0.5.13	0.7.2
postcss	8.5.8	8.5.15
qs	6.15.0	6.15.2

Bumps the npm_and_yarn group with 1 update in the /eslint-config directory: brace-expansion.
Bumps the npm_and_yarn group with 5 updates in the /frontend directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
fast-uri	3.0.1	3.1.2
postcss	8.5.3	8.5.15
qs	6.14.2	6.15.2
ws	8.18.0	8.21.0

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/activity directory:

Package	From	To
brace-expansion	1.1.11	1.1.14
brace-expansion	2.0.1	2.1.0
uuid	9.0.1	removed
fast-uri	3.0.6	3.1.2
postcss	8.5.3	8.5.15
qs	6.14.2	6.15.2
ws	8.18.2	8.21.0

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/app-menus directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
fast-uri	3.1.0	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/change-logo directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
fast-uri	3.1.0	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/cluster-chooser directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
fast-uri	3.1.0	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/custom-theme directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
fast-uri	3.1.0	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/customizing-map directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
fast-uri	3.1.0	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/details-view directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
fast-uri	3.1.0	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/dynamic-clusters directory:

Package	From	To
brace-expansion	1.1.11	1.1.14
brace-expansion	2.0.1	2.1.0
brace-expansion	1.1.12	1.1.14
fast-uri	3.0.6	3.1.2
postcss	8.5.3	8.5.15
qs	6.14.2	6.15.2
ws	8.18.2	8.21.0
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/headlamp-events directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
fast-uri	3.1.0	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 5 updates in the /plugins/examples/pod-counter directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
fast-uri	3.1.0	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/projects directory:

Package	From	To
brace-expansion	1.1.11	1.1.14
brace-expansion	2.0.2	2.1.0
uuid	9.0.1	removed
fast-uri	3.0.6	3.1.2
postcss	8.5.3	8.5.15
qs	6.14.2	6.15.2
ws	8.18.2	8.21.0

Bumps the npm_and_yarn group with 5 updates in the /plugins/examples/resource-charts directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
fast-uri	3.1.0	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/sidebar directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
fast-uri	3.1.0	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/tables directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
fast-uri	3.1.0	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 6 updates in the /plugins/examples/ui-panels directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
brace-expansion	2.0.2	2.1.0
fast-uri	3.1.0	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0
serialize-javascript	6.0.2	removed

Bumps the npm_and_yarn group with 5 updates in the /plugins/headlamp-plugin directory:

Package	From	To
brace-expansion	1.1.12	1.1.14
fast-uri	3.0.6	3.1.2
postcss	8.5.6	8.5.15
qs	6.14.2	6.15.2
ws	8.18.3	8.21.0

Bumps the npm_and_yarn group with 2 updates in the /plugins/pluginctl directory: brace-expansion and fast-uri.

Updates i18next-fs-backend from 2.3.1 to 2.6.4

Changelog

Sourced from i18next-fs-backend's changelog.

2.6.4

Security release — all issues found via an internal audit. See published advisory GHSA-8847-338w-5hcj.

• security: refuse to build filesystem paths when lng or ns values contain .., path separators (/, \), control characters, prototype keys (__proto__ / constructor / prototype), or exceed 128 chars. Prevents arbitrary filesystem read / write via attacker-controlled language-code values. Any legitimate i18next language-code shape (BCP-47-like, underscores, hyphens, dots, +-joined multi-language requests) is still accepted (GHSA-8847-338w-5hcj)
• docs: new "Security considerations" README section — documents the filesystem-path sanitiser and clarifies the trust model around .js/.ts locale files (their content is eval-ed, so they must be treated as code). The eval behaviour itself is retained: dynamic expressions in .js/.ts locale files are an intentional feature, and safe replacements like import() are async-only and not viable for this sync-capable code path.
• chore: ignore .env* and *.pem/*.key files in .gitignore.

2.6.3

• use own interpolation function instead of relying on i18next's interpolator

2.6.1

• Bump js-yaml from 4.1.0 to 4.1.1 (#64)

2.6.0

• support initImmediate -> initAsync renaming of i18next v24

2.5.0

• fix for Deno 2 and removal of unnecessary .cjs file
• for esm build environments not supporting top-level await, you should import the i18next-fs-backend/cjs export or stay at v2.4.0

Commits

• 7f62307 2.6.4
• adf8a30 security: hardening for 2.6.4
• 3bd0132 update deps
• fd1616f Bump fastify from 5.3.2 to 5.8.5 in /example/fastify (#67)
• 8b6a5ba 2.6.3
• 957635d use own interpolation function
• 2771083 2.6.2
• 2cd2c20 use own interpolation function
• b1e42e4 2.6.1
• 87d032b build
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.12 to 1.1.14

Commits

• 10c05fc 1.1.14
• 1afa1b2 Add opt-in { max } mitigation to v1 legacy line (#103)
• 2fbb6a2 Revert "Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)" (#102)
• 0d7652e Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)
• 6c353ca 1.1.13
• 7fd684f Backport fix for GHSA-f886-m6hf-6m8v (#95)
• See full diff in compare view

Updates @xmldom/xmldom from 0.8.11 to 0.8.13

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.13

Commits

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -->
  • ProcessingInstruction: throws when data contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.8.12

Commits

Fixed

• preserve trailing whitespace in ProcessingInstruction data [#962](https://github.com/xmldom/xmldom/issues/962) / [#42](https://github.com/xmldom/xmldom/issues/42)
• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

xmldom/xmldom#357

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.13

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -->
  • ProcessingInstruction: throws when data contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.9.9

Added

• implement ParentNode.children getter [#960](https://github.com/xmldom/xmldom/issues/960) / [#410](https://github.com/xmldom/xmldom/issues/410)

Fixed

• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
• correctly traverse ancestor chain in Node.contains [#931](https://github.com/xmldom/xmldom/issues/931)

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

• updated dependencies

Thank you, @​stevenobiajulu, @​yoshi389111, @​thesmartshadow, for your contributions

0.8.12

Fixed

• preserve trailing whitespace in ProcessingInstruction data [#962](https://github.com/xmldom/xmldom/issues/962) / [#42](https://github.com/xmldom/xmldom/issues/42)

... (truncated)

Commits

• e5c1480 0.8.13
• 9611e20 style: drop unused import in test file
• dc4dff3 docs: add 0.8.13 changelog entry
• 842fa38 fix: prevent stack overflow in normalize (GHSA-2v35-w6hq-6mfw)
• aeff69f test: add normalize behavioral coverage to node.test.js
• cbdb0d7 fix: make walkDOM iterative to prevent stack overflow (GHSA-2v35-w6hq-6mfw)
• 0b543d3 test: assert namespace declarations are isolated between siblings in serializ...
• c007c51 refactor: migrate serializeToString to walkDOM
• 2bb3899 test: add serializeToString coverage for uncovered branches
• e69f38d refactor: migrate importNode to walkDOM
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.

Updates fast-uri from 3.1.0 to 3.1.2

Release notes

Sourced from fast-uri's releases.

v3.1.2

⚠️ Security Release

• Fix for GHSA-v39h-62p7-jpjc

What's Changed

• Handle malformed fragment decoding as a parse error by @​mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

• Fix for GHSA-q3j6-qgpj-74h6

What's Changed

• build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @​dependabot[bot] in fastify/fast-uri#148
• build(deps): bump actions/checkout from 4 to 5 by @​dependabot[bot] in fastify/fast-uri#149
• chore(.npmrc): ignore scripts by @​Fdawgs in fastify/fast-uri#150
• build(deps-dev): remove @​fastify/pre-commit by @​Fdawgs in fastify/fast-uri#151
• build(deps): bump actions/setup-node from 4 to 5 by @​dependabot[bot] in fastify/fast-uri#152
• ci(ci): add concurrency config by @​Fdawgs in fastify/fast-uri#153
• build(deps): bump actions/setup-node from 5 to 6 by @​dependabot[bot] in fastify/fast-uri#154
• build(deps): bump actions/checkout from 5 to 6 by @​dependabot[bot] in fastify/fast-uri#156
• chore(license): standardise license notice by @​Fdawgs in fastify/fast-uri#159
• style: remove trailing whitespace by @​Fdawgs in fastify/fast-uri#161
• ci: remove unused github files by @​Tony133 in fastify/fast-uri#162
• chore: update readme by @​Tony133 in fastify/fast-uri#164
• build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-manager.yml from 5 to 6 by @​dependabot[bot] in fastify/fast-uri#165
• build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml from 5 to 6 by @​dependabot[bot] in fastify/fast-uri#166
• build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 by @​dependabot[bot] in fastify/fast-uri#167
• ci: add lock-threads workflow by @​Fdawgs in fastify/fast-uri#169

New Contributors

• @​Tony133 made their first contribution in fastify/fast-uri#162

Full Changelog: fastify/fast-uri@v3.1.0...v3.1.1

Commits

• 919dd8e Bumped v3.1.2
• c65ba57 fixup: linting
• 6c86c17 Merge commit from fork
• a95158a Handle malformed fragment decoding without throwing (#171)
• cea547c Bumped v3.1.1
• 876ce79 Merge commit from fork
• dcdf690 ci: add lock-threads workflow (#169)
• c860e65 build(deps-dev): bump neostandard from 0.12.2 to 0.13.0 (#167)
• 9b4c6dc build(deps): bump fastify/workflows/.github/workflows/plugins-ci.yml (#166)
• 85d09a9 build(deps): bump fastify/workflows/.github/workflows/plugins-ci-package-mana...
• Additional commits viewable in compare view

Updates ip-address from 10.1.0 to 10.2.0

Commits

• 80fccaa 10.2.0
• abaeb4d Type Address4.addressMinusSuffix as non-nilable (closes #143)
• 2878c29 Preserve subnet prefix through Address6.to4() (closes #123) (#203)
• 586666e Reject trailing junk in Address6.fromURL (closes #158) (#202)
• 80bc76e Validate static factories instead of silently overflowing (#201)
• 98927be Clarify isValid() accepts CIDRs with host bits set (#81)
• a0eb073 Fix getScope() and broaden getType() classification (closes #122) (#200)
• ec52105 Add networkForm() for CIDR network-address strings (#199)
• a9443a7 Add isMapped4() predicate for IPv4-mapped IPv6 addresses (closes #62) (#198)
• f01d742 Add address-property predicates (private, ULA, loopback, link-local, etc.) (#...
• Additional commits viewable in compare view

Updates langsmith from 0.5.13 to 0.7.2

Release notes

Sourced from langsmith's releases.

v0.7.2

What's Changed

• release(js): 0.5.1 by @​jacoblee93 in langchain-ai/langsmith-sdk#2389
• fix(js): Remove @​internal by @​jacoblee93 in langchain-ai/langsmith-sdk#2391
• release(js): 0.5.2 by @​jacoblee93 in langchain-ai/langsmith-sdk#2392
• chore(deps-dev): bump openai from 5.8.2 to 6.18.0 in /js by @​dependabot[bot] in langchain-ai/langsmith-sdk#2378
• chore(deps-dev): bump cross-env from 7.0.3 to 10.1.0 in /js by @​dependabot[bot] in langchain-ai/langsmith-sdk#2379
• chore(deps-dev): bump the js-minor-and-patch group in /js with 4 updates by @​dependabot[bot] in langchain-ai/langsmith-sdk#2376
• chore(deps-dev): bump node-fetch from 2.7.0 to 3.3.2 in /js by @​dependabot[bot] in langchain-ai/langsmith-sdk#2380
• Google ADK LangSmith tracing enhancements by @​j-broekhuizen in langchain-ai/langsmith-sdk#2394
• chore: update dependabot.yml to comply with posture checks by @​jkennedyvz in langchain-ai/langsmith-sdk#2393
• chore(deps): bump cryptography from 46.0.3 to 46.0.5 in /python in the uv group across 1 directory by @​dependabot[bot] in langchain-ai/langsmith-sdk#2397
• chore(deps-dev): bump the js-minor-and-patch group in /js with 6 updates by @​dependabot[bot] in langchain-ai/langsmith-sdk#2398
• chore(deps-dev): bump eslint-config-prettier from 8.10.0 to 10.1.8 in /js by @​dependabot[bot] in langchain-ai/langsmith-sdk#2399
• chore(deps): bump packaging from 25.0 to 26.0 in /python by @​dependabot[bot] in langchain-ai/langsmith-sdk#2403
• chore(deps-dev): bump pytest from 8.4.2 to 9.0.2 in /python by @​dependabot[bot] in langchain-ai/langsmith-sdk#2405
• chore(deps): bump the py-minor-and-patch group across 1 directory with 20 updates by @​dependabot[bot] in langchain-ai/langsmith-sdk#2406
• fix(js): Log Vitest/Jest outputs even if test throws an error by @​jacoblee93 in langchain-ai/langsmith-sdk#2408
• fix(js): Remove async by @​jacoblee93 in langchain-ai/langsmith-sdk#2409
• release(js): 0.5.3 by @​jacoblee93 in langchain-ai/langsmith-sdk#2410
• fix: ignoring p-queue dep by @​jkennedyvz in langchain-ai/langsmith-sdk#2414
• feat(js): add feedback config CRUD and annotation queue rubric items (closes LSPE-67) by @​bentanny in langchain-ai/langsmith-sdk#2420
• fix(js): Add on_start handler for traceable, use in evaluate by @​jacoblee93 in langchain-ai/langsmith-sdk#2421
• release(js): 0.5.4 by @​jacoblee93 in langchain-ai/langsmith-sdk#2422
• feat(python): add feedback config CRUD and annotation queue rubric items (closes LSPE-67) by @​bentanny in langchain-ai/langsmith-sdk#2419
• feat(python): add exceptions_to_handle to @​traceable by @​QuentinBrosse in langchain-ai/langsmith-sdk#2423
• release(py): 0.7.2 by @​jacoblee93 in langchain-ai/langsmith-sdk#2426

New Contributors

• @​j-broekhuizen made their first contribution in langchain-ai/langsmith-sdk#2394
• @​bentanny made their first contribution in langchain-ai/langsmith-sdk#2420

Full Changelog: langchain-ai/langsmith-sdk@v0.7.1...v0.7.2

v0.7.1

What's Changed

• release(js): 0.5.0 by @​jacoblee93 in langchain-ai/langsmith-sdk#2381
• fix(ci): Convert JS release workflow to use OIDC by @​jacoblee93 in langchain-ai/langsmith-sdk#2383
• feat(js): run evaluations as examples complete by @​bees in langchain-ai/langsmith-sdk#2349
• fix(js): Restore default concurrency behavior for JS eval runner by @​jacoblee93 in langchain-ai/langsmith-sdk#2385
• fix(js,py): Adds backcompat for old prompt cache API by @​jacoblee93 in langchain-ai/langsmith-sdk#2386
• fix(js): Add system message visibility to Anthropic wrapper traces by @​veeceey in langchain-ai/langsmith-sdk#2375
• release(py): 0.7.1 by @​jacoblee93 in langchain-ai/langsmith-sdk#2388

New Contributors

• @​veeceey made their first contribution in langchain-ai/langsmith-sdk#2375

Full Changelog: langchain-ai/langsmith-sdk@v0.7.0...v0.7.1

v0.7.0

... (truncated)

Commits

• See full diff in compare view

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.

Updates postcss from 8.5.8 to 8.5.15

Release notes

Sourced from postcss's releases.

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

Changelog

Sourced from postcss's changelog.

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

8.5.9

• Speed up source map encoding paring in case of the error.

Commits

• eae46db Release 8.5.15 version
• 79508ff Update CI actions
• b128e21 Speed up declaration parsing by avoiding creating new array on each token
• 9825dca Fix code format
• 55789c8 Update dependencies
• 84fbbe9 Install older pnpm action for old Node.js
• 9f860bd Revert pnpm action for old Node.js
• 0877198 Update CI actions
• b2d1a33 Fix linter warnings
• 0700dac Merge pull request #2088 from rootvector2/add-oss-fuzz-harness
• Additional commits viewable in compare view

Updates qs from 6.15.0 to 6.15.2

Changelog

Sourced from qs's changelog.

6.15.2

• [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
• [Fix] stringify: use configured delimiter after charsetSentinel (#555)
• [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
• [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
• [Fix] parse: handle nested bracket groups and add regression tests (#530)
• [readme] fix grammar (#550)
• [Dev Deps] update @ljharb/eslint-config
• [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

• [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
• [Deps] update @ljharb/eslint-config
• [Dev Deps] update @ljharb/eslint-config, iconv-lite
• [Tests] increase coverage

Commits

• 9aca407 v6.15.2
• 5e33d33 [Dev Deps] update @ljharb/eslint-config
• 21f80b3 [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + `e...
• a0a81ea [Fix] stringify: use configured delimiter after charsetSentinel
• e3062f7 [Fix] stringify: apply formatter to encoded key under strictNullHandling
• 0c180a4 [Fix] stringify: skip null/undefined filter-array entries instead of crashi...
• 3a8b94a [Tests] add regression tests for keys containing percent-encoded bracket text
• 96755ab [readme] fix grammar
• a419ce5 [Fix] parse: handle nested bracket groups and add regression tests
• 3f5e1c5 v6.15.1
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.12 to 1.1.14

Commits

• 10c05fc 1.1.14
• 1afa1b2 Add opt-in { max } mitigation to v1 legacy line (#103)
• 2fbb6a2 Revert "Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)" (#102)
• 0d7652e Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)
• 6c353ca 1.1.13
• 7fd684f Backport fix for GHSA-f886-m6hf-6m8v (#95)
• See full diff in compare view

Updates brace-expansion from 1.1.12 to 1.1.14

Commits

• 10c05fc 1.1.14
• 1afa1b2 Add opt-in { max } mitigation to v1 legacy line (#103)
• 2fbb6a2 Revert "Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)" (#102)
• 0d7652e Backport fix for GHSA-7h2j-956f-4vf2 to v1 (#101)
• 6c353ca 1.1.13
• 7fd684f Backport fix for GHSA-f886-m6hf-6m8v (#95)
• See full diff in compare view

Updates fast-uri from 3.0.1 to 3.1.2

Release notes

Sourced from fast-uri's releases.

v3.1.2

⚠️ Security Release

• Fix for GHSA-v39h-62p7-jpjc

What's Changed

• Handle malformed fragment decoding as a parse error by @​mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

• Fix for GHSA-q3j6-qgpj-74h6

What's Changed

• build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @​dependabot[bot] in fastify/fast-uri#148
• build(deps): bump actions/checkout from 4 to 5 by @​dependabot[bot] in fastify/fast-uri#149
• chore(.npmrc): ignore scripts by @​Fdawgs in fastify/fast-uri#150
• build(deps-dev): remove @​fastify/pre-commit by @​Fdawgs in fastify/fast-uri#151
• build(deps): bump actions/setup-node from 4 to 5 by @​dependabot[bot] in fastify/fast-uri#152
• ci(ci): add concurrency config by @​Fdawgs in fastify/fast-uri#153
• build(deps): bump actions/setup-node from 5 to 6 by @​dependabot[bot] in fastify/fast-uri#154
• build(deps): bump actions/checkout from 5 to 6 by @​dependabot[bot] in fastify/fast-uri#156
• chore(license): standardise license notice by @​Fdawgs in fastify/fast-uri#159
• style: remove trailing whitespace by @​Fdawg...

  Description has been truncated