dependabot[bot] opened a new pull request, #20811: URL: https://github.com/apache/druid/pull/20811
Bumps the npm-security group with 1 update in the /web-console directory: [follow-redirects](https://github.com/follow-redirects/follow-redirects). Bumps the npm-security group with 9 updates in the /website directory: | Package | From | To | | --- | --- | --- | | [ajv](https://github.com/ajv-validator/ajv) | `6.12.6` | `6.15.0` | | [webpack](https://github.com/webpack/webpack) | `5.98.0` | `5.112.2` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `2.3.2` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.16.1` | `1.16.2` | | [http-proxy-middleware](https://github.com/chimurai/http-proxy-middleware) | `2.0.9` | `2.0.11` | | [immutable](https://github.com/immutable-js/immutable-js) | `5.0.3` | `5.1.9` | | [qs](https://github.com/ljharb/qs) | `6.15.4` | `6.16.2` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `0.1.12` | `0.1.13` | | [@babel/plugin-transform-modules-systemjs](https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs) | `7.25.9` | `7.29.8` | Updates `follow-redirects` from 1.16.1 to 1.16.2 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/e3b45a7a104fd84ab8e8914c78e9df4b930c1651";><code>e3b45a7</code></a> Release version 1.16.2 of the npm package.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8";><code>b0a7751</code></a> Use Array.isArray.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/d96d1fe6781172705baf6ae2d3d56a2a99a52397";><code>d96d1fe</code></a> Add funding emergency notice.</li> <li>See full diff in <a href="https://github.com/follow-redirects/follow-redirects/compare/v1.16.1...v1.16.2";>compare view</a></li> </ul> </details> <br /> Updates `ajv` from 6.12.6 to 6.15.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ajv-validator/ajv/commit/184bc32745d9d33b2322949b9f3cb5f7609bf5ec";><code>184bc32</code></a> 6.15.0</li> <li><a href="https://github.com/ajv-validator/ajv/commit/fea46afd1a76b12ff89493f6dc1bc46730c6d379";><code>fea46af</code></a> test/fix prototype pollution via $data ref with format keyword (<a href="https://redirect.github.com/ajv-validator/ajv/issues/2606";>#2606</a>)</li> <li><a href="https://github.com/ajv-validator/ajv/commit/e3af0a723b4b7ad86eff43be355c706d31e0e915";><code>e3af0a7</code></a> 6.14.0</li> <li><a href="https://github.com/ajv-validator/ajv/commit/b552ed66191eb338498df3196065c777e3bb71f2";><code>b552ed6</code></a> add regExp option to address $data exploit via a regular expression (CVE-2025...</li> <li><a href="https://github.com/ajv-validator/ajv/commit/72f228665859eed5e2be3a66f8c4a7aff6b34dcf";><code>72f2286</code></a> docs: update v7 info</li> <li><a href="https://github.com/ajv-validator/ajv/commit/231e52b3bca62559202b95e5fb5cee02145b226a";><code>231e52b</code></a> Merge pull request <a href="https://redirect.github.com/ajv-validator/ajv/issues/1320";>#1320</a> from philsturgeon/patch-1</li> <li><a href="https://github.com/ajv-validator/ajv/commit/d3475fc20416c33fe030c8aa3b09fa411f325bbd";><code>d3475fc</code></a> Add spectral, an AJV util from a sponsor</li> <li><a href="https://github.com/ajv-validator/ajv/commit/413afe01f518ea74d1740a7cb211df787c585544";><code>413afe0</code></a> docs: v7.0.0-beta.3</li> <li><a href="https://github.com/ajv-validator/ajv/commit/11e997bda2f3eecb445c1e5a07d96ef7e81c5f5d";><code>11e997b</code></a> update readme for v7</li> <li>See full diff in <a href="https://github.com/ajv-validator/ajv/compare/v6.12.6...v6.15.0";>compare view</a></li> </ul> </details> <br /> Updates `webpack` from 5.98.0 to 5.112.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack/releases";>webpack's releases</a>.</em></p> <blockquote> <h2>v5.112.2</h2> <h3>Patch Changes</h3> <ul> <li> <p>Reduce repeated scans when concatenating imported modules. (by <a href="https://github.com/xiaoxiaojx";><code>@xiaoxiaojx</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22865";>#22865</a>)</p> </li> <li> <p>Avoid allocating CSS module sets for single-group chunks. (by <a href="https://github.com/xiaoxiaojx";><code>@xiaoxiaojx</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22866";>#22866</a>)</p> </li> <li> <p>Return the value of every module type loaded with <code>importModule()</code>. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22869";>#22869</a>)</p> </li> </ul> <h2>v5.112.1</h2> <h3>Patch Changes</h3> <ul> <li> <p>Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by <a href="https://github.com/aryanraj45";><code>@aryanraj45</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22699";>#22699</a>)</p> </li> <li> <p>Rebuild under <code>cacheUnaffected</code> a module whose re-export target goes or returns. (by <a href="https://github.com/aryanraj45";><code>@aryanraj45</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22749";>#22749</a>)</p> </li> <li> <p>Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22791";>#22791</a>)</p> </li> <li> <p>Fix <code>exportType: "style"</code> CSS modules throwing outside the runtime chunk. (by <a href="https://github.com/lazerg";><code>@lazerg</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22833";>#22833</a>)</p> </li> <li> <p>Fix crash when a CSS module with <code>exportType: "style"</code> imports an ignored stylesheet. (by <a href="https://github.com/codeXsidd";><code>@codeXsidd</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22846";>#22846</a>)</p> </li> <li> <p>Keep empty process environment variables that <code>.env</code> files don't define in <code>DotenvPlugin</code>. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22794";>#22794</a>)</p> </li> <li> <p>Rehash an ESM entry chunk when a chunk it imports by file name changes. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22804";>#22804</a>)</p> </li> <li> <p>Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by <a href="https://github.com/apps/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22811";>#22811</a>)</p> </li> <li> <p>Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22733";>#22733</a>)</p> </li> <li> <p>Await asynchronous modules that <code>ProvidePlugin</code> injects into ES modules. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22728";>#22728</a>)</p> </li> <li> <p>Keep a resolve that ends after the compiler closed from throwing. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22795";>#22795</a>)</p> </li> <li> <p>Preserve string names passed to SharedWorker constructors. (by <a href="https://github.com/bjohansebas";><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22770";>#22770</a>)</p> </li> <li> <p>Preserve string contents when extracting source map comments. (by <a href="https://github.com/bjohansebas";><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22768";>#22768</a>)</p> </li> <li> <p>Scope strict-mode, async and generator block function declarations to their block. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22800";>#22800</a>)</p> </li> <li> <p>Preserve raw dotenv values when reusing cached environment files. (by <a href="https://github.com/Eshiv-Pandey";><code>@Eshiv-Pandey</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22787";>#22787</a>)</p> </li> <li> <p>Preserve assigned or patched built-ins, conversions and pattern targets. (by <a href="https://github.com/aryanraj45";><code>@aryanraj45</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22761";>#22761</a>)</p> </li> <li> <p>Keep globals a <code>globalThis</code> write replaces, and <code>slice</code> on a patched array. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22862";>#22862</a>)</p> </li> <li> <p>Skip HTML script tags for shared chunks that emit no JavaScript. (by <a href="https://github.com/bjohansebas";><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22779";>#22779</a>)</p> </li> <li> <p>Keep the digits Firefox lays out a minified CSS percentage with. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22718";>#22718</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack/blob/main/CHANGELOG.md";>webpack's changelog</a>.</em></p> <blockquote> <h2>5.112.2</h2> <h3>Patch Changes</h3> <ul> <li> <p>Reduce repeated scans when concatenating imported modules. (by <a href="https://github.com/xiaoxiaojx";><code>@xiaoxiaojx</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22865";>#22865</a>)</p> </li> <li> <p>Avoid allocating CSS module sets for single-group chunks. (by <a href="https://github.com/xiaoxiaojx";><code>@xiaoxiaojx</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22866";>#22866</a>)</p> </li> <li> <p>Return the value of every module type loaded with <code>importModule()</code>. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22869";>#22869</a>)</p> </li> </ul> <h2>5.112.1</h2> <h3>Patch Changes</h3> <ul> <li> <p>Rebuild a lazy barrel in watch when what it defers changes, and keep the imports and re-exports it still runs. (by <a href="https://github.com/aryanraj45";><code>@aryanraj45</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22699";>#22699</a>)</p> </li> <li> <p>Rebuild under <code>cacheUnaffected</code> a module whose re-export target goes or returns. (by <a href="https://github.com/aryanraj45";><code>@aryanraj45</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22749";>#22749</a>)</p> </li> <li> <p>Fix "Self-reference dependency has unused export name" for CommonJS namespace re-exports. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22791";>#22791</a>)</p> </li> <li> <p>Fix <code>exportType: "style"</code> CSS modules throwing outside the runtime chunk. (by <a href="https://github.com/lazerg";><code>@lazerg</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22833";>#22833</a>)</p> </li> <li> <p>Fix crash when a CSS module with <code>exportType: "style"</code> imports an ignored stylesheet. (by <a href="https://github.com/codeXsidd";><code>@codeXsidd</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22846";>#22846</a>)</p> </li> <li> <p>Keep empty process environment variables that <code>.env</code> files don't define in <code>DotenvPlugin</code>. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22794";>#22794</a>)</p> </li> <li> <p>Rehash an ESM entry chunk when a chunk it imports by file name changes. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22804";>#22804</a>)</p> </li> <li> <p>Handle a NUL inside an HTML CDATA section the way the parsing spec does. (by <a href="https://github.com/apps/dependabot";><code>@dependabot</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22811";>#22811</a>)</p> </li> <li> <p>Keep module exports live across chunks, runtimes, HMR and eval, sparing globals. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22733";>#22733</a>)</p> </li> <li> <p>Await asynchronous modules that <code>ProvidePlugin</code> injects into ES modules. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22728";>#22728</a>)</p> </li> <li> <p>Keep a resolve that ends after the compiler closed from throwing. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22795";>#22795</a>)</p> </li> <li> <p>Preserve string names passed to SharedWorker constructors. (by <a href="https://github.com/bjohansebas";><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22770";>#22770</a>)</p> </li> <li> <p>Preserve string contents when extracting source map comments. (by <a href="https://github.com/bjohansebas";><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22768";>#22768</a>)</p> </li> <li> <p>Scope strict-mode, async and generator block function declarations to their block. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22800";>#22800</a>)</p> </li> <li> <p>Preserve raw dotenv values when reusing cached environment files. (by <a href="https://github.com/Eshiv-Pandey";><code>@Eshiv-Pandey</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22787";>#22787</a>)</p> </li> <li> <p>Preserve assigned or patched built-ins, conversions and pattern targets. (by <a href="https://github.com/aryanraj45";><code>@aryanraj45</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22761";>#22761</a>)</p> </li> <li> <p>Keep globals a <code>globalThis</code> write replaces, and <code>slice</code> on a patched array. (by <a href="https://github.com/alexander-akait";><code>@alexander-akait</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22862";>#22862</a>)</p> </li> <li> <p>Skip HTML script tags for shared chunks that emit no JavaScript. (by <a href="https://github.com/bjohansebas";><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/webpack/webpack/pull/22779";>#22779</a>)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpack/webpack/commit/e95a7f2764281318c038e9384371797dfef0e48a";><code>e95a7f2</code></a> chore(release): new release (<a href="https://redirect.github.com/webpack/webpack/issues/22867";>#22867</a>)</li> <li><a href="https://github.com/webpack/webpack/commit/6e43fc2dc84bcea03bfe36d87eea29feb501e577";><code>6e43fc2</code></a> fix: return the value of every module type from importModule() (<a href="https://redirect.github.com/webpack/webpack/issues/22869";>#22869</a>)</li> <li><a href="https://github.com/webpack/webpack/commit/4ffac8d5f4ee6f55326580ac00056df391e73f69";><code>4ffac8d</code></a> ci: rename the parser job to spec and run CSS, HTML and XML in one leg (<a href="https://redirect.github.com/webpack/webpack/issues/22870";>#22870</a>)</li> <li><a href="https://github.com/webpack/webpack/commit/0c02242d9e0da268b85cc74f95838051e9498c18";><code>0c02242</code></a> test: split the syntax unit tests into tokenizer, parser and printer (<a href="https://redirect.github.com/webpack/webpack/issues/22825";>#22825</a>)</li> <li><a href="https://github.com/webpack/webpack/commit/660608c0d6c7578b77bb2a871c6c1e1b6deac9c3";><code>660608c</code></a> perf(css): cut CPU and allocation in the CSS minifier (<a href="https://redirect.github.com/webpack/webpack/issues/22868";>#22868</a>)</li> <li><a href="https://github.com/webpack/webpack/commit/8c3cbd3298cece30b0aa9f557cbb1c6dc1eb5cbb";><code>8c3cbd3</code></a> perf: avoid allocating unused CSS module sets (<a href="https://redirect.github.com/webpack/webpack/issues/22866";>#22866</a>)</li> <li><a href="https://github.com/webpack/webpack/commit/a1e5f6a9af0d7a360d9bea6705778e3762a351e8";><code>a1e5f6a</code></a> perf: avoid duplicate scans in module concatenation (<a href="https://redirect.github.com/webpack/webpack/issues/22865";>#22865</a>)</li> <li><a href="https://github.com/webpack/webpack/commit/759b5396ad0cb7e8e02bf9404acf8a9ad63449c8";><code>759b539</code></a> chore(release): new release (<a href="https://redirect.github.com/webpack/webpack/issues/22720";>#22720</a>)</li> <li><a href="https://github.com/webpack/webpack/commit/539f8deebc1f94a46a5161aeed0f598d7d4918bd";><code>539f8de</code></a> fix(minify): keep globals a <code>globalThis</code> write replaces, and <code>slice</code> on a pat...</li> <li><a href="https://github.com/webpack/webpack/commit/966815508a95ce5d110c46ee24af74b098d4fddc";><code>9668155</code></a> ci: run the deep-imports check in the lint job (<a href="https://redirect.github.com/webpack/webpack/issues/22859";>#22859</a>)</li> <li>Additional commits viewable in <a href="https://github.com/webpack/webpack/compare/v5.98.0...v5.112.2";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for webpack since your current version.</p> </details> <br /> Updates `picomatch` from 2.3.1 to 2.3.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/releases";>picomatch's releases</a>.</em></p> <blockquote> <h2>2.3.2</h2> <p>This is a security release fixing several security relevant issues.</p> <h2>What's Changed</h2> <ul> <li>fix: exception when glob pattern contains constructor by <a href="https://github.com/Jason3S";><code>@Jason3S</code></a> in <a href="https://redirect.github.com/micromatch/picomatch/pull/144";>micromatch/picomatch#144</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-c2c7-rcm5-vvqj";>CVE-2026-33671</a></li> <li>Fix for <a href="https://github.com/micromatch/picomatch/security/advisories/GHSA-3v7f-55p6-f55p";>CVE-2026-33672</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2";>https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md";>picomatch's changelog</a>.</em></p> <blockquote> <h2>2.3.2 (2026-03-23)</h2> <h3>Fixed</h3> <ul> <li>Avoided an exception when a glob pattern contains <code>constructor</code> (<a href="https://redirect.github.com/micromatch/picomatch/pull/144";>#144</a>, <a href="https://github.com/micromatch/picomatch/commit/3f4f10e";>3f4f10e</a>).</li> </ul> <h3>Security</h3> <ul> <li>Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric <code>maxExtglobRecursion</code> values allow limited nesting, while <code>false</code> disables the safeguard (<a href="https://github.com/advisories/GHSA-c2c7-rcm5-vvqj";>CVE-2026-33671</a>, <a href="https://github.com/micromatch/picomatch/commit/eec17ae";>eec17ae</a>).</li> <li>Prevented inherited object properties from being interpreted as POSIX character classes (<a href="https://github.com/advisories/GHSA-3v7f-55p6-f55p";>CVE-2026-33672</a>, <a href="https://github.com/micromatch/picomatch/commit/fc1f6b6";>fc1f6b6</a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/micromatch/picomatch/commit/81cba8d4b767cab3cb29d26eb4f691eed75b73b2";><code>81cba8d</code></a> Publish 2.3.2</li> <li><a href="https://github.com/micromatch/picomatch/commit/fc1f6b69006e9435caf8fb40d8aff378bc0b7bce";><code>fc1f6b6</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/eec17aee5428a7249e9ca5adbb8a0d28fa29619b";><code>eec17ae</code></a> Merge commit from fork</li> <li><a href="https://github.com/micromatch/picomatch/commit/78f8ca4362d9e66cadea97b93e292f10096452ed";><code>78f8ca4</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/picomatch/issues/156";>#156</a> from micromatch/backport-144</li> <li><a href="https://github.com/micromatch/picomatch/commit/3f4f10eaa65bf3a52e8f2999674cd27e11fa3c9b";><code>3f4f10e</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/picomatch/issues/144";>#144</a> from Jason3S/jdent-object-properties</li> <li>See full diff in <a href="https://github.com/micromatch/picomatch/compare/2.3.1...2.3.2";>compare view</a></li> </ul> </details> <br /> Updates `follow-redirects` from 1.16.1 to 1.16.2 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/e3b45a7a104fd84ab8e8914c78e9df4b930c1651";><code>e3b45a7</code></a> Release version 1.16.2 of the npm package.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8";><code>b0a7751</code></a> Use Array.isArray.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/d96d1fe6781172705baf6ae2d3d56a2a99a52397";><code>d96d1fe</code></a> Add funding emergency notice.</li> <li>See full diff in <a href="https://github.com/follow-redirects/follow-redirects/compare/v1.16.1...v1.16.2";>compare view</a></li> </ul> </details> <br /> Updates `http-proxy-middleware` from 2.0.9 to 2.0.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/chimurai/http-proxy-middleware/releases";>http-proxy-middleware's releases</a>.</em></p> <blockquote> <h2>v2.0.11</h2> <h2>What's Changed</h2> <ul> <li>fix(fixRequestBody): wait for request stream to end by <a href="https://github.com/chimurai";><code>@chimurai</code></a> in <a href="https://redirect.github.com/chimurai/http-proxy-middleware/pull/1309";>chimurai/http-proxy-middleware#1309</a></li> <li>chore(package.json): v2.0.11 by <a href="https://github.com/chimurai";><code>@chimurai</code></a> in <a href="https://redirect.github.com/chimurai/http-proxy-middleware/pull/1312";>chimurai/http-proxy-middleware#1312</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/chimurai/http-proxy-middleware/compare/v2.0.10...v2.0.11";>https://github.com/chimurai/http-proxy-middleware/compare/v2.0.10...v2.0.11</a></p> <h2>v2.0.10</h2> <h2>What's Changed</h2> <ul> <li>fix: harden proxy-table matching to prevent routing bypass by <a href="https://github.com/G-Rath";><code>@G-Rath</code></a> in <a href="https://redirect.github.com/chimurai/http-proxy-middleware/pull/1268";>chimurai/http-proxy-middleware#1268</a></li> <li>ci(github-actions): update publish.yml by <a href="https://github.com/chimurai";><code>@chimurai</code></a> in <a href="https://redirect.github.com/chimurai/http-proxy-middleware/pull/1270";>chimurai/http-proxy-middleware#1270</a></li> <li>chore(package.json): v2.0.10 by <a href="https://github.com/chimurai";><code>@chimurai</code></a> in <a href="https://redirect.github.com/chimurai/http-proxy-middleware/pull/1271";>chimurai/http-proxy-middleware#1271</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/G-Rath";><code>@G-Rath</code></a> made their first contribution in <a href="https://redirect.github.com/chimurai/http-proxy-middleware/pull/1268";>chimurai/http-proxy-middleware#1268</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/chimurai/http-proxy-middleware/compare/v2.0.9...v2.0.10";>https://github.com/chimurai/http-proxy-middleware/compare/v2.0.9...v2.0.10</a></p> <h2>v2.0.10-beta.0</h2> <h2>What's Changed</h2> <ul> <li>fix: harden proxy-table matching to prevent routing bypass by <a href="https://github.com/G-Rath";><code>@G-Rath</code></a> in <a href="https://redirect.github.com/chimurai/http-proxy-middleware/pull/1268";>chimurai/http-proxy-middleware#1268</a></li> <li>ci(github-actions): update publish.yml by <a href="https://github.com/chimurai";><code>@chimurai</code></a> in <a href="https://redirect.github.com/chimurai/http-proxy-middleware/pull/1270";>chimurai/http-proxy-middleware#1270</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/G-Rath";><code>@G-Rath</code></a> made their first contribution in <a href="https://redirect.github.com/chimurai/http-proxy-middleware/pull/1268";>chimurai/http-proxy-middleware#1268</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/chimurai/http-proxy-middleware/compare/v2.0.9...v2.0.10-beta.0";>https://github.com/chimurai/http-proxy-middleware/compare/v2.0.9...v2.0.10-beta.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/chimurai/http-proxy-middleware/blob/v2.0.11/CHANGELOG.md";>http-proxy-middleware's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.11";>v2.0.11</a></h2> <ul> <li>fix(fixRequestBody): wait for request stream to end</li> </ul> <h2><a href="https://github.com/chimurai/http-proxy-middleware/releases/tag/v2.0.10";>v2.0.10</a></h2> <ul> <li>fix(router): harden proxy-table matching (exact host for host+path keys, prefix-only path matching) to prevent routing bypass</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/chimurai/http-proxy-middleware/commit/abddcd9a60a9f8ee1c4331dce27b7df069d52f05";><code>abddcd9</code></a> chore(package.json): v2.0.11 (<a href="https://redirect.github.com/chimurai/http-proxy-middleware/issues/1312";>#1312</a>)</li> <li><a href="https://github.com/chimurai/http-proxy-middleware/commit/32b56d3f22f0c77eed6828abef84104dacf202f4";><code>32b56d3</code></a> fix(fixRequestBody): wait for request stream to end (<a href="https://redirect.github.com/chimurai/http-proxy-middleware/issues/1309";>#1309</a>)</li> <li><a href="https://github.com/chimurai/http-proxy-middleware/commit/f0be839066ba14f2598c6c1aef10ff54b020babb";><code>f0be839</code></a> chore(package.json): v2.0.10 (<a href="https://redirect.github.com/chimurai/http-proxy-middleware/issues/1271";>#1271</a>)</li> <li><a href="https://github.com/chimurai/http-proxy-middleware/commit/19c860de9854988351c4c9bf5fe79687942e1833";><code>19c860d</code></a> ci(github-actions): update publish.yml (<a href="https://redirect.github.com/chimurai/http-proxy-middleware/issues/1270";>#1270</a>)</li> <li><a href="https://github.com/chimurai/http-proxy-middleware/commit/d0f7d6368ac9cf7dac5638c466d820370a4ae98f";><code>d0f7d63</code></a> fix: harden proxy-table matching to prevent routing bypass (<a href="https://redirect.github.com/chimurai/http-proxy-middleware/issues/1268";>#1268</a>)</li> <li>See full diff in <a href="https://github.com/chimurai/http-proxy-middleware/compare/v2.0.9...v2.0.11";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for http-proxy-middleware since your current version.</p> </details> <br /> Updates `immutable` from 5.0.3 to 5.1.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/immutable-js/immutable-js/releases";>immutable's releases</a>.</em></p> <blockquote> <h2>v5.1.9</h2> <h2>What's Changed</h2> <ul> <li>fix(List): preserve undefined values when grown past 32 elements by <a href="https://github.com/spokodev";><code>@spokodev</code></a> / <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2235";>immutable-js/immutable-js#2235</a> (originated from <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2230";>immutable-js/immutable-js#2230</a> )</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/immutable-js/immutable-js/compare/v5.1.8...v5.1.9";>https://github.com/immutable-js/immutable-js/compare/v5.1.8...v5.1.9</a></p> <h2>v5.1.8</h2> <h2>What's Changed</h2> <ul> <li>fix(List): guard oversized bounds in setListBounds. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735";>https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735</a></li> <li>perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r";>https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/immutable-js/immutable-js/compare/v5.1.7...v5.1.8";>https://github.com/immutable-js/immutable-js/compare/v5.1.7...v5.1.8</a></p> <h2>v5.1.7</h2> <h2>What's Changed</h2> <ul> <li>fix(Repeat): lastIndexOf returned size instead of size - 1 by <a href="https://github.com/chatman-media";><code>@chatman-media</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2227";>immutable-js/immutable-js#2227</a></li> </ul> <h2>internal</h2> <ul> <li>Backport tests from 6.x branch by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2199";>immutable-js/immutable-js#2199</a></li> <li>fix(IndexedCollection): <code>has(index)</code> on a lazy <code>Seq</code> of unknown size now checks index existence instead of searching for a value equal to the index by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2203";>immutable-js/immutable-js#2203</a></li> <li>Better type for reduce if not ininitial value is given by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2205";>immutable-js/immutable-js#2205</a></li> <li>Backport test from <a href="https://redirect.github.com/immutable-js/immutable-js/issues/2193";>#2193</a> by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2207";>immutable-js/immutable-js#2207</a></li> <li>backport tests from 6.x by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2213";>immutable-js/immutable-js#2213</a></li> <li>Firefox link to non-French page by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2219";>immutable-js/immutable-js#2219</a></li> <li>Bump esbuild and <code>@size-limit/preset-small-lib</code> by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2217";>immutable-js/immutable-js#2217</a></li> <li>backport tests from <a href="https://redirect.github.com/immutable-js/immutable-js/issues/2210";>#2210</a> by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2214";>immutable-js/immutable-js#2214</a></li> <li>Bump shell-quote from 1.8.2 to 1.8.4 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2211";>immutable-js/immutable-js#2211</a></li> <li>Bump <code>@tootallnate/once</code> from 2.0.0 to 2.0.1 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2190";>immutable-js/immutable-js#2190</a></li> <li>Bump minimatch from 9.0.5 to 9.0.9 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2189";>immutable-js/immutable-js#2189</a></li> <li>Bump <code>@codemirror/theme-one-dark</code> from 6.1.2 to 6.1.3 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2168";>immutable-js/immutable-js#2168</a></li> <li>Bump form-data from 4.0.5 to 4.0.6 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2220";>immutable-js/immutable-js#2220</a></li> <li>Bump typescript-eslint from 8.33.0 to 8.61.1 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2222";>immutable-js/immutable-js#2222</a></li> <li>Bump <code>@rollup/plugin-commonjs</code> from 28.0.2 to 29.0.3 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2224";>immutable-js/immutable-js#2224</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/chatman-media";><code>@chatman-media</code></a> made their first contribution in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2227";>immutable-js/immutable-js#2227</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/immutable-js/immutable-js/compare/v5.1.6...v5.1.7";>https://github.com/immutable-js/immutable-js/compare/v5.1.6...v5.1.7</a></p> <h2>v5.1.6</h2> <h2>What's Changed</h2> <ul> <li>fix(reverseFactory): read reversedSequence.size in __iterator instead of this by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2196";>immutable-js/immutable-js#2196</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md";>immutable's changelog</a>.</em></p> <blockquote> <h2>5.1.9</h2> <ul> <li>fix(List): a <code>List</code> grown past 32 elements while all its values are <code>undefined</code> no longer reads those values back as <code>null</code> (affected <code>get</code>, iteration, <code>toArray</code>, <code>equals</code> and <code>hashCode</code>)</li> </ul> <h2>5.1.8</h2> <ul> <li>fix(List): guard oversized bounds in setListBounds. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735";>https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735</a></li> <li>perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r";>https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r</a></li> </ul> <h2>4.3.9</h2> <ul> <li>fix(List): guard oversized bounds in setListBounds. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735";>https://github.com/immutable-js/immutable-js/security/advisories/GHSA-v56q-mh7h-f735</a></li> <li>perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r";>https://github.com/immutable-js/immutable-js/security/advisories/GHSA-xvcm-6775-5m9r</a></li> </ul> <h2>5.1.7</h2> <ul> <li>fix(Repeat): lastIndexOf returned size instead of size - 1 by <a href="https://github.com/chatman-media";><code>@chatman-media</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2227";>immutable-js/immutable-js#2227</a>. Fixes CVE <a href="https://github.com/immutable-js/immutable-js/security/advisories/GHSA-wf6x-7x77-mvgw";>CVE-2026-29063 </a></li> <li>fix(IndexedCollection): <code>has(index)</code> on a lazy <code>Seq</code> of unknown size now checks index existence instead of searching for a value equal to the index <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2203";>#2203</a></li> <li>[TypeScript]: <code>reduce</code>/<code>reduceRight</code> without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. <code>list.reduce((a, b) => a + b)</code> infers <code>number</code>), matching <code>Array#reduce</code>. Previously an explicit type argument was required. <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2205";>#2205</a></li> </ul> <h2>5.1.6</h2> <ul> <li>fix(reverseFactory): read <code>reversedSequence.size</code> in <code>__iterator</code> instead of this <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2196";>#2196</a></li> </ul> <h2>5.1.5</h2> <ul> <li>Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable</li> </ul> <h2>5.1.4</h2> <ul> <li>Migrate some files to TS by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2125";>immutable-js/immutable-js#2125</a> <ul> <li>Iterator.ts</li> <li>PairSorting.ts</li> <li>toJS.ts</li> <li>Math.ts</li> <li>Hash.ts</li> </ul> </li> <li>Extract CollectionHelperMethods and convert to TS by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2131";>immutable-js/immutable-js#2131</a></li> <li>Use npm <a href="https://docs.npmjs.com/trusted-publishers";>trusted publishing only</a> to avoid token stealing.</li> </ul> <h3>Documentation</h3> <ul> <li>Fix/a11y issues by <a href="https://github.com/lyannel";><code>@lyannel</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2136";>immutable-js/immutable-js#2136</a></li> <li>Doc add Map.get signature update by <a href="https://github.com/borracciaBlu";><code>@borracciaBlu</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2138";>immutable-js/immutable-js#2138</a></li> <li>fix(doc):minor-issues#2132 by <a href="https://github.com/JayMeDotDot";><code>@JayMeDotDot</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2133";>immutable-js/immutable-js#2133</a></li> <li>Fix algolia search by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2135";>immutable-js/immutable-js#2135</a></li> <li>Typo in OrderedMap by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2144";>immutable-js/immutable-js#2144</a></li> </ul> <h3>Internal</h3> <ul> <li>chore: Sort all imports and activate eslint import rule by <a href="https://github.com/jdeniau";><code>@jdeniau</code></a> in <a href="https://redirect.github.com/immutable-js/immutable-js/pull/2119";>immutable-js/immutable-js#2119</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/immutable-js/immutable-js/commit/329f7a680efa262c310b938a343295880eefe4fc";><code>329f7a6</code></a> 5.1.9</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/21fabd92bc6cd6771918fc966004034fc10a06e0";><code>21fabd9</code></a> changelog</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/009164facb3c69870c6ad4c6472b1baeb02fcdf7";><code>009164f</code></a> Merge pull request <a href="https://redirect.github.com/immutable-js/immutable-js/issues/2235";>#2235</a> from immutable-js/fix/avoid-null-when-setsize33</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/5b65bfbd583472eaa9686137a61db2a29d63cd36";><code>5b65bfb</code></a> fix(List): preserve undefined values when grown past 32 elements</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/50bf39e94105f83f1132cce02b9ee6c45cc7d9ca";><code>50bf39e</code></a> Update CHANGELOG.md for versions 5.1.8 and 4.3.9</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/6496539bd1e9dfa75ce11b053e7d70d79e9ac6f7";><code>6496539</code></a> 5.1.8</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/808a83a071c9e22b8199ac256dc7e6e764198aac";><code>808a83a</code></a> Merge commit from fork</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/e51d49fc612ded5ec4dfb94ff294d22074269b0f";><code>e51d49f</code></a> perf(Map): index large hash-collision buckets for faster lookups</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/25c58b094f112dc32e9b0bca79c84f448d0d2a38";><code>25c58b0</code></a> fix typescript in tests</li> <li><a href="https://github.com/immutable-js/immutable-js/commit/a1a1ee412dcaa380ab325196283d06594ffe4b84";><code>a1a1ee4</code></a> Merge commit from fork</li> <li>Additional commits viewable in <a href="https://github.com/immutable-js/immutable-js/compare/v5.0.3...v5.1.9";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for immutable since your current version.</p> </details> <br /> Updates `qs` from 6.15.4 to 6.16.2 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ljharb/qs/blob/main/CHANGELOG.md";>qs's changelog</a>.</em></p> <blockquote> <h2><strong>6.16.2</strong></h2> <ul> <li>[Fix] <code>stringify</code>: encode keys when <code>allowEmptyArrays</code> is set (<a href="https://redirect.github.com/ljharb/qs/issues/561";>#561</a>)</li> <li>[meta] use double quotes for better OS support</li> <li>[Dev Deps] update <code>evalmd</code>, <code>npmignore</code></li> <li>[Tests] <code>stringify</code>: pin <code>allowEmptyArrays</code> output for keys that need no encoding</li> </ul> <h2><strong>6.16.1</strong></h2> <ul> <li>[Fix] <code>parse</code>: do not mutate an object input</li> <li>[Fix] <code>stringify</code>: stop re-encoding structural separator dots when <code>encodeDotInKeys</code> is set (<a href="https://redirect.github.com/ljharb/qs/issues/564";>#564</a>)</li> <li>[Fix] <code>stringify</code>: <code>arrayFormat: 'comma'</code>: pass the full encoder arguments with <code>encodeValuesOnly</code></li> <li>[Fix] <code>utils</code>: encode <code>+</code> as <code>%2B</code> in iso-8859-1 mode so values round-trip (<a href="https://redirect.github.com/ljharb/qs/issues/565";>#565</a>)</li> <li>[Fix] parse: only convert top-level dots to brackets when allowDots is on (<a href="https://redirect.github.com/ljharb/qs/issues/621";>#621</a>)</li> <li>[Fix] <code>stringify</code>: ignore inherited array format names (<a href="https://redirect.github.com/ljharb/qs/issues/622";>#622</a>)</li> <li>[Fix] <code>stringify</code>: <code>arrayFormat: 'comma'</code>: do not throw on elements with no callable <code>toString</code></li> <li>[Fix] <code>utils</code>: <code>merge</code>: seed an overflow container's index from its own keys, not just the source</li> <li>[Fix] <code>utils</code>: <code>merge</code>: keep a <code>strictMerge</code> conflict container's index and <code>arrayLimit</code> correct</li> <li>[Fix] <code>parse</code>: only treat <code>[]</code> as array syntax when it ends the key</li> <li>[Perf] <code>decode</code>: skip decoders when there is no percent sign (<a href="https://redirect.github.com/ljharb/qs/issues/583";>#583</a>)</li> <li>[Robustness] <code>utils</code>: <code>merge</code>: apply <code>arrayLimit</code> to the two-element array built for colliding values</li> <li>[Robustness] <code>parse</code>: bound the nesting added by repeated <code>strictMerge</code> conflicts (credit <a href="https://github.com/Yeaseen";><code>@Yeaseen</code></a>)</li> <li>[Docs] document that <code>qs</code> and flat parsers disagree about parameter names</li> <li>[Docs] clarify that <code>throwOnLimitExceeded</code> limits each array, not the total number of values</li> <li>[Docs] clarify 6.14.1/6.15.2 parse bracket behavior change (<a href="https://redirect.github.com/ljharb/qs/issues/567";>#567</a>, <a href="https://redirect.github.com/ljharb/qs/issues/568";>#568</a>)</li> <li>[meta] fix changelog indents</li> <li>[actions] set least-privilege <code>cache-mode</code></li> <li>[Tests] <code>utils</code>: <code>decode</code>: add missing cases</li> <li>[Tests] <code>parse</code>: characterize the <code>]=</code> split when an <code>=</code> precedes any bracket group (<a href="https://redirect.github.com/ljharb/qs/issues/620";>#620</a>)</li> <li>[Tests] <code>parse</code>: <code>allowDots</code>: cover stray close brackets before a dot</li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code>, <code>eslint</code>, <code>tape</code></li> </ul> <h2><strong>6.16.0</strong></h2> <ul> <li>[New] <code>stringify</code>: add a <code>depth</code> option to bound recursion depth (default <code>Infinity</code>)</li> <li>[Fix] stringify: serialize Date values when a filter is provided</li> <li>[Fix] <code>parse</code>: enforce <code>arrayLimit</code> on comma groups under <code>[]=</code> when <code>throwOnLimitExceeded</code> is set</li> <li>[Fix] <code>parse</code>: flatten a collection appended to an overflowed array (<a href="https://redirect.github.com/ljharb/qs/issues/571";>#571</a>)</li> <li>[Fix] <code>utils</code>: <code>isBuffer</code>: do not invoke a non-callable <code>constructor.isBuffer</code></li> <li>[Fix] <code>stringify</code>: do not let <code>allowEmptyArrays</code> skip cycle detection (or drop own keys) on an empty array with own properties</li> <li>[Fix] <code>stringify</code>: encode dots in a top-level key with a primitive value when encodeDotInKeys is set (<a href="https://redirect.github.com/ljharb/qs/issues/562";>#562</a>)</li> <li>[Docs] threat model: clarify <code>stringify</code> deep-nesting DoS is caller-bounded</li> <li>[Docs] clarify <code>arrayLimit</code> is a representation threshold, not an element-count cap</li> <li>[Tests] <code>parse</code>: remove a test that pinned <code>[]=</code> comma groups escaping <code>arrayLimit</code></li> <li>[Tests] <code>stringify</code>: pin current <code>encodeDotInKeys</code> separator-dot behavior</li> <li>[Dev Deps] update <code>@ljharb/eslint-config</code>, <code>eslint</code></li> <li>[Dev Deps] update <code>eslint</code>, <code>evalmd</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/ljharb/qs/commit/136912a619c2d81c090ca196ea02b6c193580d1d";><code>136912a</code></a> v6.16.2</li> <li><a href="https://github.com/ljharb/qs/commit/6ed1c73b103440d51a0b573d6f629a457ea625ce";><code>6ed1c73</code></a> [Dev Deps] update <code>evalmd</code>, <code>npmignore</code></li> <li><a href="https://github.com/ljharb/qs/commit/a09bc29e5718f661ea66d39feb8f5b1fb1c4fa18";><code>a09bc29</code></a> [meta] use double quotes for better OS support</li> <li><a href="https://github.com/ljharb/qs/commit/5d3b1b9ec6afd0cfc760c8e12862873789a32fc8";><code>5d3b1b9</code></a> [Fix] <code>stringify</code>: encode keys when <code>allowEmptyArrays</code> is set</li> <li><a href="https://github.com/ljharb/qs/commit/f13ec6c2eb9d4fb59508dfa29e73952c4ffc68a3";><code>f13ec6c</code></a> [Tests] <code>stringify</code>: pin <code>allowEmptyArrays</code> output for keys that need no enco...</li> <li><a href="https://github.com/ljharb/qs/commit/2471b66ae696a8a10915c01453ae2c0f139a5adc";><code>2471b66</code></a> v6.16.1</li> <li><a href="https://github.com/ljharb/qs/commit/51f736e94b079b8479fa8f668acba84c1e177596";><code>51f736e</code></a> [Docs] document that <code>qs</code> and flat parsers disagree about parameter names</li> <li><a href="https://github.com/ljharb/qs/commit/40239f7564e99ab92eb9125defaaf4779a26b03a";><code>40239f7</code></a> [Dev Deps] update <code>tape</code></li> <li><a href="https://github.com/ljharb/qs/commit/d219359f5bedc42815190b2448160fae06b7817c";><code>d219359</code></a> [Fix] <code>parse</code>: do not mutate an object input</li> <li><a href="https://github.com/ljharb/qs/commit/98157dc1b770240ed4fb91da0faa3fb404b80474";><code>98157dc</code></a> [Fix] <code>stringify</code>: stop re-encoding structural separator dots when `encodeDot...</li> <li>Additional commits viewable in <a href="https://github.com/ljharb/qs/compare/v6.15.4...v6.16.2";>compare view</a></li> </ul> </details> <br /> Updates `path-to-regexp` from 0.1.12 to 0.1.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pillarjs/path-to-regexp/releases";>path-to-regexp's releases</a>.</em></p> <blockquote> <h2>0.1.13</h2> <h2>Important</h2> <ul> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-4867";>CVE-2026-4867</a> (<a href="https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2";>GHSA-37ch-88jc-xwx2</a>)</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13";>https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md";>path-to-regexp's changelog</a>.</em></p> <blockquote> <h1>0.1.13 / 2026-03-26</h1> <ul> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-4867";>CVE-2026-4867</a> (<a href="https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-37ch-88jc-xwx2";>GHSA-37ch-88jc-xwx2</a>)</li> </ul> <h1>0.1.7 / 2015-07-28</h1> <ul> <li>Fixed regression with escaped round brackets and matching groups.</li> </ul> <h1>0.1.6 / 2015-06-19</h1> <ul> <li>Replace <code>index</code> feature by outputting all parameters, unnamed and named.</li> </ul> <h1>0.1.5 / 2015-05-08</h1> <ul> <li>Add an index property for position in match result.</li> </ul> <h1>0.1.4 / 2015-03-05</h1> <ul> <li>Add license information</li> </ul> <h1>0.1.3 / 2014-07-06</h1> <ul> <li>Better array support</li> <li>Improved support for trailing slash in non-ending mode</li> </ul> <h1>0.1.0 / 2014-03-06</h1> <ul> <li>add options.end</li> </ul> <h1>0.0.2 / 2013-02-10</h1> <ul> <li>Update to match current express</li> <li>add .license property to component.json</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/9fd0c879f232c2464591f56dd7c7edad7f45b4e0";><code>9fd0c87</code></a> 0.1.13 (<a href="https://redirect.github.com/pillarjs/path-to-regexp/issues/425";>#425</a>)</li> <li><a href="https://github.com/pillarjs/path-to-regexp/commit/7ccf02cee33402f06ed2125085992ee9cd3a7c45";><code>7ccf02c</code></a> fix: CVE-2026-4867</li> <li>See full diff in <a href="https://github.com/pillarjs/path-to-regexp/compare/v0.1.12...v.0.1.13";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~ulisesgascon";>ulisesgascon</a>, a new releaser for path-to-regexp since your current version.</p> </details> <br /> Updates `@babel/plugin-transform-modules-systemjs` from 7.25.9 to 7.29.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/babel/babel/releases";>@babel/plugin-transform-modules-systemjs's releases</a>.</em></p> <blockquote> <h2>v7.29.8 (2026-07-31)</h2> <h4>:eyeglasses: Spec Compliance</h4> <ul> <li><code>babel-generator</code>, <code>babel-parser</code>, <code>babel-plugin-transform-spread</code>, <code>babel-traverse</code>, <code>babel-types</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17871";>#17871</a> Disallow super call after new (<a href="https://github.com/JLHwung";><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>:bug: Bug Fix</h4> <ul> <li><code>babel-generator</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/18046";>#18046</a> fix(generator): improve new callee parens check (<a href="https://github.com/JLHwung";><code>@JLHwung</code></a>)</li> </ul> </li> <li><code>babel-node</code>, <code>babel-plugin-transform-modules-systemjs</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/18044";>#18044</a> fix(systemjs): support <code>__proto__</code> as an export name (<a href="https://github.com/JLHwung";><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>Committers: 2</h4> <ul> <li>Huáng Jùnliàng (<a href="https://github.com/JLHwung";><code>@JLHwung</code></a>)</li> <li>Nicolò Ribaudo (<a href="https://github.com/nicolo-ribaudo";><code>@nicolo-ribaudo</code></a>)</li> </ul> <h2>v7.29.7 (2026-05-25)</h2> <p>Re-release all packages with npm provenance attestations</p> <h2>v7.29.6 (2026-05-25)</h2> <h4>:bug: Bug Fix</h4> <ul> <li><code>babel-generator</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/18014";>#18014</a> Catchup source map position in preserveFormat (<a href="https://github.com/nicolo-ribaudo";><code>@nicolo-ribaudo</code></a>)</li> </ul> </li> <li><code>babel-core</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/18001";>#18001</a> [7.x packport]Improve input source map handling (<a href="https://github.com/JLHwung";><code>@JLHwung</code></a>)</li> </ul> </li> <li><code>babel-core</code>, <code>babel-generator</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17998";>#17998</a> Preserve original identifier names from input sourcemaps (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17992";>#17992</a>) (<a href="https://github.com/Andarist";><code>@Andarist</code></a>)</li> </ul> </li> </ul> <h4>Committers: 3</h4> <ul> <li>Huáng Jùnliàng (<a href="https://github.com/JLHwung";><code>@JLHwung</code></a>)</li> <li>Mateusz Burzyński (<a href="https://github.com/Andarist";><code>@Andarist</code></a>)</li> <li>Nicolò Ribaudo (<a href="https://github.com/nicolo-ribaudo";><code>@nicolo-ribaudo</code></a>)</li> </ul> <h2>v7.29.5 (2026-05-05)</h2> <h4>:house: Internal</h4> <ul> <li><code>babel-preset-env</code> <ul> <li>Update <code>@babel/*</code> dependencies</li> </ul> </li> </ul> <h2>v7.29.4 (2026-05-05)</h2> <h4>:bug: Bug Fix</h4> <ul> <li><code>babel-plugin-transform-modules-systemjs</code> <ul> <li><a href="https://redirect.github.com/babel/babel/pull/17974";>#17974</a> [7.x backport]fix(systemjs): improve module string name support (<a href="https://github.com/JLHwung";><code>@JLHwung</code></a>)</li> </ul> </li> </ul> <h4>Committers: 1</h4> <ul> <li>Huáng Jùnliàng (<a href="https://github.com/JLHwung";><code>@JLHwung</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/babel/babel/commit/5de11ca9234379b78ef95df72aebbec93f28bf45";><code>5de11ca</code></a> v7.29.8</li> <li><a href="https://github.com/babel/babel/commit/f08d4342e1f189a56e7cee46e60a1817af96219e";><code>f08d434</code></a> fix(systemjs): support <strong>proto</strong> as an export name (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/18044";>#18044</a>)</li> <li><a href="https://github.com/babel/babel/commit/4fba7541180bf5f58256d8e358b544e3831ad090";><code>4fba754</code></a> v7.29.7</li> <li><a href="https://github.com/babel/babel/commit/a458f66074b97d54773db8159af673d23b26079b";><code>a458f66</code></a> v7.29.4</li> <li><a href="https://github.com/babel/babel/commit/32ebd5aaf2526ddd176fd6a3d1e3dc594abdc8d9";><code>32ebd5a</code></a> [7.x backport]fix(systemjs): improve module string name support (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17974";>#17974</a>)</li> <li><a href="https://github.com/babel/babel/commit/aa8394e454337d118ac3d40bfa3ee1a3cb3f3ed2";><code>aa8394e</code></a> v7.29.0</li> <li><a href="https://github.com/babel/babel/commit/0053db620c05acf0036f593b5aaf4e372daa79d0";><code>0053db6</code></a> Update polyfill packages (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17727";>#17727</a>)</li> <li><a href="https://github.com/babel/babel/commit/61647ae2397c82c3c71f077b5ab109106a5cac0f";><code>61647ae</code></a> v7.28.5</li> <li><a href="https://github.com/babel/babel/commit/a177d551adba99773f4ff00ea9bf46550def6132";><code>a177d55</code></a> [Babel 8] Use <code>t.traverseFast</code> to replace some <code>path.traverse</code> (<a href="https://github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-modules-systemjs/issues/17518";>#17518</a>)</li> <li><a href="https://github.com/babel/babel/commit/eebd3a06021c13d335b5b0bd79734df3abbea678";><code>eebd3a0</code></a> v7.27.1</li> <li>Additional commits viewable in <a href="https://github.com/babel/babel/commits/v7.29.8/packages/babel-plugin-transform-modules-systemjs";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for <code>@babel/plugin-transform-modules-systemjs</code> since your current version.</p> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/druid/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
