dependabot[bot] opened a new pull request, #45026: URL: https://github.com/apache/superset/pull/45026
Bumps the security group with 9 updates in the /superset-frontend directory: | Package | From | To | | --- | --- | --- | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.18` | `1.1.21` | | [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` | | [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.2.0` | `4.3.0` | | [joi](https://github.com/hapijs/joi) | `17.13.7` | `17.13.8` | | [joi](https://github.com/hapijs/joi) | `18.2.8` | `18.2.9` | | [nx](https://github.com/nrwl/nx/tree/HEAD/packages/nx) | `23.1.1` | `23.2.1` | | [postcss-selector-parser](https://github.com/postcss/postcss-selector-parser) | `7.1.4` | `7.1.6` | | [proxy-addr](https://github.com/jshttp/proxy-addr) | `2.0.7` | `2.0.8` | | [smol-toml](https://github.com/squirrelchat/smol-toml) | `1.7.1` | `1.9.0` | | [source-map-js](https://github.com/7rulnik/source-map-js) | `1.2.1` | `1.2.2` | Updates `brace-expansion` from 1.1.18 to 1.1.21 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/juliangruber/brace-expansion/commit/8e81e187b6e9c6c723d16c042657c00acefc2483";><code>8e81e18</code></a> 1.1.21</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e";><code>ffdfa3e</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/c6513ad31e08edb56dc414a629e39cba724b7548";><code>c6513ad</code></a> 1.1.20</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b";><code>1efee7c</code></a> Merge commit from fork</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/a34340a053abb475cc226aeb3f71887018e71bd0";><code>a34340a</code></a> 1.1.19</li> <li><a href="https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc";><code>0bcbfc0</code></a> Merge commit from fork</li> <li>See full diff in <a href="https://github.com/juliangruber/brace-expansion/compare/v1.1.18...v1.1.21";>compare view</a></li> </ul> </details> <br /> Updates `compression` from 1.8.1 to 1.8.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/expressjs/compression/releases";>compression's releases</a>.</em></p> <blockquote> <h2>v1.8.2</h2> <h2>Important</h2> <ul> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-87776";>CVE-2026-87776</a> (<a href="https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95";>GHSA-vc2v-76pw-4v95</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>chore: add funding to package.json by <a href="https://github.com/bjohansebas";><code>@bjohansebas</code></a> in <a href="https://redirect.github.com/expressjs/compression/pull/248";>expressjs/compression#248</a></li> <li>build(deps): bump github/codeql-action from 3.29.2 to 3.29.5 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/249";>expressjs/compression#249</a></li> <li>build(deps): bump actions/checkout from 4.2.2 to 5.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/253";>expressjs/compression#253</a></li> <li>build(deps): bump github/codeql-action from 3.29.7 to 3.29.11 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/252";>expressjs/compression#252</a></li> <li>build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/251";>expressjs/compression#251</a></li> <li>build(deps): bump actions/setup-node from 4.4.0 to 6.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/261";>expressjs/compression#261</a></li> <li>build(deps): bump github/codeql-action from 3.29.11 to 4.31.2 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/260";>expressjs/compression#260</a></li> <li>build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/259";>expressjs/compression#259</a></li> <li>build(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/258";>expressjs/compression#258</a></li> <li>build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/264";>expressjs/compression#264</a></li> <li>build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/263";>expressjs/compression#263</a></li> <li>build(deps): bump github/codeql-action from 4.31.2 to 4.31.5 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/262";>expressjs/compression#262</a></li> <li>chore: up node version to 25.x in CI by <a href="https://github.com/imangas";><code>@imangas</code></a> in <a href="https://redirect.github.com/expressjs/compression/pull/272";>expressjs/compression#272</a></li> <li>doc(package): remove history.md and add readme.md to published files by <a href="https://github.com/sheplu";><code>@sheplu</code></a> in <a href="https://redirect.github.com/expressjs/compression/pull/270";>expressjs/compression#270</a></li> <li>Update link to CONTRIBUTING.md by <a href="https://github.com/krzysdz";><code>@krzysdz</code></a> in <a href="https://redirect.github.com/expressjs/compression/pull/281";>expressjs/compression#281</a></li> <li>test: run CI on Windows and macOS by <a href="https://github.com/kilisamemarisaaa";><code>@kilisamemarisaaa</code></a> in <a href="https://redirect.github.com/expressjs/compression/pull/283";>expressjs/compression#283</a></li> <li>build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/257";>expressjs/compression#257</a></li> <li>build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/268";>expressjs/compression#268</a></li> <li>build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/265";>expressjs/compression#265</a></li> <li>build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/266";>expressjs/compression#266</a></li> <li>build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/expressjs/compression/pull/267";>expressjs/compression#267</a></li> <li>chore(ci): npm-publish via reusable workflows by <a href="https://github.com/sheplu";><code>@sheplu</code></a> in <a href="https://redirect.github.com/expressjs/compression/pull/269";>expressjs/compression#269</a></li> <li>docs: update outdated Brotli note and fix npm install docs URL by <a href="https://github.com/Vansh1811";><code>@Vansh1811</code></a> in <a href="https://redirect.github.com/expressjs/compression/pull/276";>expressjs/compression#276</a></li> <li>fix: match Cache-Control no-transform directive case-insensitively by <a href="https://github.com/vaibhavmashal";><code>@vaibhavmashal</code></a> in <a href="https://redirect.github.com/expressjs/compression/pull/286";>expressjs/compression#286</a></li> <li>1.8.2 by <a href="https://github.com/UlisesGascon";><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/expressjs/compression/pull/287";>expressjs/compression#287</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/imangas";><code>@imangas</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/compression/pull/272";>expressjs/compression#272</a></li> <li><a href="https://github.com/sheplu";><code>@sheplu</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/compression/pull/270";>expressjs/compression#270</a></li> <li><a href="https://github.com/krzysdz";><code>@krzysdz</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/compression/pull/281";>expressjs/compression#281</a></li> <li><a href="https://github.com/kilisamemarisaaa";><code>@kilisamemarisaaa</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/compression/pull/283";>expressjs/compression#283</a></li> <li><a href="https://github.com/Vansh1811";><code>@Vansh1811</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/compression/pull/276";>expressjs/compression#276</a></li> <li><a href="https://github.com/vaibhavmashal";><code>@vaibhavmashal</code></a> made their first contribution in <a href="https://redirect.github.com/expressjs/compression/pull/286";>expressjs/compression#286</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/expressjs/compression/compare/v1.8.1...v1.8.2";>https://github.com/expressjs/compression/compare/v1.8.1...v1.8.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/expressjs/compression/blob/master/HISTORY.md";>compression's changelog</a>.</em></p> <blockquote> <h1>1.8.2</h1> <ul> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-87776";>CVE-2026-87776</a> (<a href="https://github.com/expressjs/compression/security/advisories/GHSA-vc2v-76pw-4v95";>GHSA-vc2v-76pw-4v95</a>)</li> <li>deps: add [email protected]</li> <li>Match <code>Cache-Control: no-transform</code> directive case-insensitively</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/expressjs/compression/commit/0f9707417bd53d41a319fce8bdb80dfa08b435c8";><code>0f97074</code></a> 1.8.2 (<a href="https://redirect.github.com/expressjs/compression/issues/287";>#287</a>)</li> <li><a href="https://github.com/expressjs/compression/commit/151f63e91e1b64f8fb0b064e19321a4f28db6bff";><code>151f63e</code></a> fix: destroy compression stream on response close</li> <li><a href="https://github.com/expressjs/compression/commit/0a764956691bede2b62c711598ee65ea643d3b1e";><code>0a76495</code></a> fix: match Cache-Control no-transform directive case-insensitively (<a href="https://redirect.github.com/expressjs/compression/issues/286";>#286</a>)</li> <li><a href="https://github.com/expressjs/compression/commit/c17b6e58ac914c84d9e3a64130dcc428e0e26887";><code>c17b6e5</code></a> docs: update outdated Brotli note and fix npm install docs URL (<a href="https://redirect.github.com/expressjs/compression/issues/276";>#276</a>)</li> <li><a href="https://github.com/expressjs/compression/commit/112911abc46e0d8fa6c9793ef5005ca1d53ccb7c";><code>112911a</code></a> chore(ci): npm-publish via reusable workflows (<a href="https://redirect.github.com/expressjs/compression/issues/269";>#269</a>)</li> <li><a href="https://github.com/expressjs/compression/commit/1bf5eb0b5eaf5001af9782ade18c6cca690ccaad";><code>1bf5eb0</code></a> build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (<a href="https://redirect.github.com/expressjs/compression/issues/267";>#267</a>)</li> <li><a href="https://github.com/expressjs/compression/commit/d8fe64d50081d4a13a8ea5c25a852ca27fde0b7b";><code>d8fe64d</code></a> build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (<a href="https://redirect.github.com/expressjs/compression/issues/266";>#266</a>)</li> <li><a href="https://github.com/expressjs/compression/commit/b218ff54eb8e211100d8a6697d13cdc73fdb13b3";><code>b218ff5</code></a> build(deps): bump github/codeql-action from 4.31.5 to 4.31.9 (<a href="https://redirect.github.com/expressjs/compression/issues/265";>#265</a>)</li> <li><a href="https://github.com/expressjs/compression/commit/8a1cf8ecf948c28ffd3d29f942c9a310bc36e5c1";><code>8a1cf8e</code></a> build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (<a href="https://redirect.github.com/expressjs/compression/issues/268";>#268</a>)</li> <li><a href="https://github.com/expressjs/compression/commit/4a19855442b7ebfcea4f95caf491968108dc15b8";><code>4a19855</code></a> build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (<a href="https://redirect.github.com/expressjs/compression/issues/257";>#257</a>)</li> <li>Additional commits viewable in <a href="https://github.com/expressjs/compression/compare/v1.8.1...v1.8.2";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for compression since your current version.</p> </details> <br /> Updates `http-cache-semantics` from 4.2.0 to 4.3.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/kornelski/http-cache-semantics/commits";>compare view</a></li> </ul> </details> <br /> Updates `joi` from 17.13.7 to 17.13.8 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hapijs/joi/commit/4ae6af96f7990fdb336aa8ad7dee5e9f847d084a";><code>4ae6af9</code></a> 17.13.8</li> <li><a href="https://github.com/hapijs/joi/commit/b3ed6fbdf123f4d77755e6a5df2d6a7af27cd9e8";><code>b3ed6fb</code></a> Merge pull request <a href="https://redirect.github.com/hapijs/joi/issues/3153";>#3153</a> from hapijs/fix/messages-proto-flat-v17</li> <li><a href="https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2";><code>1d2001c</code></a> chore: backport <a href="https://redirect.github.com/hapijs/joi/issues/3151";>#3151</a></li> <li>See full diff in <a href="https://github.com/hapijs/joi/compare/v17.13.7...v17.13.8";>compare view</a></li> </ul> </details> <br /> Updates `joi` from 18.2.8 to 18.2.9 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/hapijs/joi/commit/4ae6af96f7990fdb336aa8ad7dee5e9f847d084a";><code>4ae6af9</code></a> 17.13.8</li> <li><a href="https://github.com/hapijs/joi/commit/b3ed6fbdf123f4d77755e6a5df2d6a7af27cd9e8";><code>b3ed6fb</code></a> Merge pull request <a href="https://redirect.github.com/hapijs/joi/issues/3153";>#3153</a> from hapijs/fix/messages-proto-flat-v17</li> <li><a href="https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2";><code>1d2001c</code></a> chore: backport <a href="https://redirect.github.com/hapijs/joi/issues/3151";>#3151</a></li> <li>See full diff in <a href="https://github.com/hapijs/joi/compare/v17.13.7...v17.13.8";>compare view</a></li> </ul> </details> <br /> Updates `nx` from 23.1.1 to 23.2.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/nrwl/nx/releases";>nx's releases</a>.</em></p> <blockquote> <h2>23.2.1 (2026-09-09)</h2> <h3>🚀 Features</h3> <ul> <li><strong>core:</strong> report the cache location alongside usage (<a href="https://redirect.github.com/nrwl/nx/pull/36959";>#36959</a>)</li> <li><strong>repo:</strong> add a .NET example for <code>@nx/dotnet</code> (<a href="https://redirect.github.com/nrwl/nx/pull/36701";>#36701</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li><strong>angular:</strong> correct declaration maps and exports of buildable libraries (<a href="https://redirect.github.com/nrwl/nx/pull/36373";>#36373</a>, <a href="https://redirect.github.com/nrwl/nx/issues/36357";>#36357</a>)</li> <li><strong>core:</strong> separate daemon runtime env from graph identity (<a href="https://redirect.github.com/nrwl/nx/pull/36565";>#36565</a>, <a href="https://redirect.github.com/nrwl/nx/issues/36564";>#36564</a>)</li> <li><strong>core:</strong> validate the migrations path before extracting package migrations (<a href="https://redirect.github.com/nrwl/nx/pull/36887";>#36887</a>)</li> <li><strong>core:</strong> release per-run process listeners and task history results (<a href="https://redirect.github.com/nrwl/nx/pull/36866";>#36866</a>)</li> <li><strong>core:</strong> read the pnpm 12 min-release-age policy instead of deferring to an install (<a href="https://redirect.github.com/nrwl/nx/pull/36915";>#36915</a>, <a href="https://redirect.github.com/nrwl/nx/issues/36914";>#36914</a>)</li> <li><strong>core:</strong> carry minimumReleaseAge into pruned pnpm deploy output (<a href="https://redirect.github.com/nrwl/nx/pull/36900";>#36900</a>, <a href="https://redirect.github.com/nrwl/nx/issues/36899";>#36899</a>)</li> <li><strong>core:</strong> report how a plugin worker was lost instead of always calling it an exit (<a href="https://redirect.github.com/nrwl/nx/pull/36894";>#36894</a>)</li> <li><strong>core:</strong> keep the cache in the workspace on CI (<a href="https://redirect.github.com/nrwl/nx/pull/36922";>#36922</a>)</li> <li><strong>core:</strong> restore the wasm walker imports dropped by a stray cfg attribute (<a href="https://redirect.github.com/nrwl/nx/pull/36924";>#36924</a>)</li> <li><strong>core:</strong> avoid mutating target options when resolving configurations (<a href="https://redirect.github.com/nrwl/nx/pull/36934";>#36934</a>)</li> <li><strong>js:</strong> resolve tsconfig to absolute path so ${configDir} paths type-check without baseUrl (<a href="https://redirect.github.com/nrwl/nx/pull/36445";>#36445</a>)</li> <li><strong>misc:</strong> scan package projects for env vars (<a href="https://redirect.github.com/nrwl/nx/pull/36847";>#36847</a>)</li> <li><strong>release:</strong> exclude AI coding agents from the changelog Thank You section (<a href="https://redirect.github.com/nrwl/nx/pull/36892";>#36892</a>)</li> <li><strong>release:</strong> use the release group name when resolving the previous tag for fixed groups (<a href="https://redirect.github.com/nrwl/nx/pull/36554";>#36554</a>)</li> <li><strong>repo:</strong> provision JDK 17 for Gradle builds with mise (<a href="https://redirect.github.com/nrwl/nx/pull/36965";>#36965</a>)</li> <li><strong>repo:</strong> guard JAVA17_HOME against an uninstalled JDK (<a href="https://redirect.github.com/nrwl/nx/pull/36969";>#36969</a>)</li> <li><strong>rspack:</strong> write the normalized cache option in NxAppRspackPlugin (<a href="https://redirect.github.com/nrwl/nx/pull/36905";>#36905</a>, <a href="https://redirect.github.com/nrwl/nx/issues/36878";>#36878</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>AgentEnder <a href="https://github.com/AgentEnder";><code>@AgentEnder</code></a></li> <li>Caleb Ukle</li> <li>Claude</li> <li>Craigory Coppola <a href="https://github.com/AgentEnder";><code>@AgentEnder</code></a></li> <li>Denis Frenademetz <a href="https://github.com/skrtheboss";><code>@skrtheboss</code></a></li> <li>Eduardo Speroni <a href="https://github.com/edusperoni";><code>@edusperoni</code></a></li> <li>Federico Bartoli</li> <li>FrozenPandaz <a href="https://github.com/FrozenPandaz";><code>@FrozenPandaz</code></a></li> <li>Jack Stevenson</li> <li>Jason Jean <a href="https://github.com/FrozenPandaz";><code>@FrozenPandaz</code></a></li> <li>Jupiter Jayna <a href="https://github.com/sdjayna";><code>@sdjayna</code></a></li> <li>Juri Strumpflohner <a href="https://github.com/juristr";><code>@juristr</code></a></li> <li>Leosvel Pérez Espinosa <a href="https://github.com/leosvelperez";><code>@leosvelperez</code></a></li> <li>Nicolas Beaussart <a href="https://github.com/beaussan";><code>@beaussan</code></a></li> <li>ShwethaSundar</li> <li>Stephen Jayna</li> </ul> <h2>23.2.0 (2026-09-02)</h2> <h3>🚀 Features</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/nrwl/nx/commit/4008ffd1a523bc86413480f53a7fcfec974d9e46";><code>4008ffd</code></a> chore(repo): check the wasm target on PRs that touch rust (<a href="https://github.com/nrwl/nx/tree/HEAD/packages/nx/issues/36925";>#36925</a>)</li> <li><a href="https://github.com/nrwl/nx/commit/6e7f8278ca47c10d0470f444a8c4004967a85b64";><code>6e7f827</code></a> feat(core): report the cache location alongside usage (<a href="https://github.com/nrwl/nx/tree/HEAD/packages/nx/issues/36959";>#36959</a>)</li> <li><a href="https://github.com/nrwl/nx/commit/0a267e4e461bf53763c7716be0849b426cb780ff";><code>0a267e4</code></a> fix(core): avoid mutating target options when resolving configurations (<a href="https://github.com/nrwl/nx/tree/HEAD/packages/nx/issues/36934";>#36934</a>)</li> <li><a href="https://github.com/nrwl/nx/commit/f9ba81b5b2f2d78993b025132d6546cce9a81039";><code>f9ba81b</code></a> fix(core): restore the wasm walker imports dropped by a stray cfg attribute (...</li> <li><a href="https://github.com/nrwl/nx/commit/9469e56d032b6a3c419fd427e53c6016456f910a";><code>9469e56</code></a> fix(core): keep the cache in the workspace on CI (<a href="https://github.com/nrwl/nx/tree/HEAD/packages/nx/issues/36922";>#36922</a>)</li> <li><a href="https://github.com/nrwl/nx/commit/c0b2f2d8419c735f7dadb46f1e26f514d4b91445";><code>c0b2f2d</code></a> fix(core): report how a plugin worker was lost instead of always calling it a...</li> <li><a href="https://github.com/nrwl/nx/commit/90aab1728d8b662bf4abe482093ce449e72aaf84";><code>90aab17</code></a> fix(core): carry minimumReleaseAge into pruned pnpm deploy output (<a href="https://github.com/nrwl/nx/tree/HEAD/packages/nx/issues/36900";>#36900</a>)</li> <li><a href="https://github.com/nrwl/nx/commit/4871a959b9fe421616a271f41b71db782d9b0279";><code>4871a95</code></a> fix(core): read the pnpm 12 min-release-age policy instead of deferring to an...</li> <li><a href="https://github.com/nrwl/nx/commit/0ae906996ec7d299706a1e18851e89634e04b51e";><code>0ae9069</code></a> fix(core): release per-run process listeners and task history results (<a href="https://github.com/nrwl/nx/tree/HEAD/packages/nx/issues/36866";>#36866</a>)</li> <li><a href="https://github.com/nrwl/nx/commit/de37c5ebd1852fac700d70726326236ac398af3f";><code>de37c5e</code></a> fix(core): validate the migrations path before extracting package migrations ...</li> <li>Additional commits viewable in <a href="https://github.com/nrwl/nx/commits/23.2.1/packages/nx";>compare view</a></li> </ul> </details> <br /> Updates `postcss-selector-parser` from 7.1.4 to 7.1.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss-selector-parser/releases";>postcss-selector-parser's releases</a>.</em></p> <blockquote> <h2>7.1.6</h2> <ul> <li>fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (<a href="https://github.com/advisories/GHSA-rj75-hqrm-r3gf";>GHSA-rj75-hqrm-r3gf</a>, reported by Wayde Shi)</li> </ul> <h2>7.1.5</h2> <ul> <li>fix: don't treat a non-prefix token before <code>|</code> as a namespace (<a href="https://redirect.github.com/postcss/postcss-selector-parser/pull/324";>#324</a> by <a href="https://github.com/spokodev";><code>@spokodev</code></a>)</li> <li>fix: preserve whitespace before a <code>*</code> namespace in attribute selectors (<a href="https://redirect.github.com/postcss/postcss-selector-parser/pull/325";>#325</a> by <a href="https://github.com/spokodev";><code>@spokodev</code></a>)</li> <li>fix: TypeError on unclosed <code>[</code>, <code>(</code> and trailing <code>|</code> (<a href="https://redirect.github.com/postcss/postcss-selector-parser/pull/330";>#330</a> by <a href="https://github.com/theRizwan";><code>@theRizwan</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss-selector-parser/blob/main/CHANGELOG.md";>postcss-selector-parser's changelog</a>.</em></p> <blockquote> <h2>7.1.6 - 2026-09-03</h2> <ul> <li>fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability (<a href="https://github.com/advisories/GHSA-rj75-hqrm-r3gf";>GHSA-rj75-hqrm-r3gf</a>, reported by Wayde Shi)</li> </ul> <h2>7.1.5 - 2026-08-07</h2> <ul> <li>fix: don't treat a non-prefix token before <code>|</code> as a namespace (<a href="https://redirect.github.com/postcss/postcss-selector-parser/pull/324";>#324</a> by <a href="https://github.com/spokodev";><code>@spokodev</code></a>)</li> <li>fix: preserve whitespace before a <code>*</code> namespace in attribute selectors (<a href="https://redirect.github.com/postcss/postcss-selector-parser/pull/325";>#325</a> by <a href="https://github.com/spokodev";><code>@spokodev</code></a>)</li> <li>fix: TypeError on unclosed <code>[</code>, <code>(</code> and trailing <code>|</code> (<a href="https://redirect.github.com/postcss/postcss-selector-parser/pull/330";>#330</a> by <a href="https://github.com/theRizwan";><code>@theRizwan</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss-selector-parser/commit/4eb3468e754f9f94d2092d103767bae98aa41438";><code>4eb3468</code></a> 7.1.6</li> <li><a href="https://github.com/postcss/postcss-selector-parser/commit/62b191792df0a0bc56062e5a875bc74aae2a51cd";><code>62b1917</code></a> fix: parse flat selectors in linear time, closing a CPU exhaustion vulnerability</li> <li><a href="https://github.com/postcss/postcss-selector-parser/commit/e33e9bca3e9afd7ba07ffaad4fe0868d421dfb34";><code>e33e9bc</code></a> 7.1.5</li> <li><a href="https://github.com/postcss/postcss-selector-parser/commit/6f4e6c1def46c2591f6874d2cd39a1aec767d5bb";><code>6f4e6c1</code></a> fix: TypeError on unclosed <code>[</code>, <code>(</code> and trailing <code>|</code> (<a href="https://redirect.github.com/postcss/postcss-selector-parser/issues/330";>#330</a>)</li> <li><a href="https://github.com/postcss/postcss-selector-parser/commit/4d8437ffc4a510606b78f0bc762620fcff2b1d7c";><code>4d8437f</code></a> fix: preserve whitespace before a <code>*</code> namespace in attribute selectors (<a href="https://redirect.github.com/postcss/postcss-selector-parser/issues/325";>#325</a>)</li> <li><a href="https://github.com/postcss/postcss-selector-parser/commit/e2f902954c83f6580eaacdf174232882e293cd5a";><code>e2f9029</code></a> fix: don't treat a non-prefix token before <code>|</code> as a namespace (<a href="https://redirect.github.com/postcss/postcss-selector-parser/issues/324";>#324</a>)</li> <li><a href="https://github.com/postcss/postcss-selector-parser/commit/dd50ee11ad57e3ac1b901864f0d55a702eef0780";><code>dd50ee1</code></a> chore(deps-dev): bump postcss from 8.5.18 to 8.5.23 (<a href="https://redirect.github.com/postcss/postcss-selector-parser/issues/331";>#331</a>)</li> <li><a href="https://github.com/postcss/postcss-selector-parser/commit/7e3abb2c7250bb8ef1e7a8d196d0ea0ca47b8430";><code>7e3abb2</code></a> chore(deps-dev): bump postcss from 8.5.15 to 8.5.18 (<a href="https://redirect.github.com/postcss/postcss-selector-parser/issues/328";>#328</a>)</li> <li>See full diff in <a href="https://github.com/postcss/postcss-selector-parser/compare/7.1.4...7.1.6";>compare view</a></li> </ul> </details> <br /> Updates `proxy-addr` from 2.0.7 to 2.0.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jshttp/proxy-addr/releases";>proxy-addr's releases</a>.</em></p> <blockquote> <h2>2.0.8</h2> <h2>Important</h2> <ul> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-90711";>CVE-2026-90711</a> (<a href="https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h";>GHSA-jqcg-44mw-7w3h</a>)</li> </ul> <h2>What's Changed</h2> <ul> <li>Add OSSF scorecard action by <a href="https://github.com/carpasse";><code>@carpasse</code></a> in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/27";>jshttp/proxy-addr#27</a></li> <li>Fix ci pipeline and add missing Node.JS versions by <a href="https://github.com/carpasse";><code>@carpasse</code></a> in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/26";>jshttp/proxy-addr#26</a></li> <li>[StepSecurity] Apply security best practices by <a href="https://github.com/step-security-bot";><code>@step-security-bot</code></a> in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/29";>jshttp/proxy-addr#29</a></li> <li>build(deps): bump coverallsapp/github-action from 1.2.5 to 2.3.6 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/30";>jshttp/proxy-addr#30</a></li> <li>build(deps): bump github/codeql-action from 2.23.2 to 3.28.18 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/31";>jshttp/proxy-addr#31</a></li> <li>build(deps-dev): bump eslint-plugin-import from 2.23.4 to 2.31.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/32";>jshttp/proxy-addr#32</a></li> <li>build(deps): bump ossf/scorecard-action from 2.0.6 to 2.4.2 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/33";>jshttp/proxy-addr#33</a></li> <li>build(deps): bump actions/upload-artifact from 3.1.3 to 4.6.2 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/35";>jshttp/proxy-addr#35</a></li> <li>build(deps-dev): bump deep-equal from 1.0.1 to 1.1.2 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/34";>jshttp/proxy-addr#34</a></li> <li>build(deps-dev): bump eslint-plugin-markdown from 2.2.0 to 2.2.1 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/36";>jshttp/proxy-addr#36</a></li> <li>chore: add funding to package.json by <a href="https://github.com/Phillip9587";><code>@Phillip9587</code></a> in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/40";>jshttp/proxy-addr#40</a></li> <li>build(deps): bump github/codeql-action from 3.28.18 to 3.29.5 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/41";>jshttp/proxy-addr#41</a></li> <li>build(deps): bump github/codeql-action from 3.29.7 to 3.29.11 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/43";>jshttp/proxy-addr#43</a></li> <li>build(deps): bump actions/checkout from 3.6.0 to 5.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/42";>jshttp/proxy-addr#42</a></li> <li>build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/47";>jshttp/proxy-addr#47</a></li> <li>build(deps): bump github/codeql-action from 3.29.11 to 4.31.2 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/46";>jshttp/proxy-addr#46</a></li> <li>build(deps): bump coverallsapp/github-action from 2.3.6 to 2.3.7 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/50";>jshttp/proxy-addr#50</a></li> <li>build(deps): bump github/codeql-action from 4.31.2 to 4.31.5 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/49";>jshttp/proxy-addr#49</a></li> <li>build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/48";>jshttp/proxy-addr#48</a></li> <li>build(deps): bump actions/checkout from 6.0.0 to 6.0.2 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/56";>jshttp/proxy-addr#56</a></li> <li>build(deps): bump github/codeql-action from 4.31.5 to 4.32.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/55";>jshttp/proxy-addr#55</a></li> <li>build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/57";>jshttp/proxy-addr#57</a></li> <li>build(deps): bump actions/upload-artifact from 5.0.0 to 7.0.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/58";>jshttp/proxy-addr#58</a></li> <li>Fix "arugment" typo in README by <a href="https://github.com/schiwekM";><code>@schiwekM</code></a> in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/61";>jshttp/proxy-addr#61</a></li> <li>build(deps): bump github/codeql-action from 4.32.4 to 4.36.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/64";>jshttp/proxy-addr#64</a></li> <li>build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/63";>jshttp/proxy-addr#63</a></li> <li>build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/45";>jshttp/proxy-addr#45</a></li> <li>build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 by <a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/39";>jshttp/proxy-addr#39</a></li> <li>chore(ci): npm-publish via reusable workflows by <a href="https://github.com/sheplu";><code>@sheplu</code></a> in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/54";>jshttp/proxy-addr#54</a></li> <li>refresh CI by <a href="https://github.com/UlisesGascon";><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/69";>jshttp/proxy-addr#69</a></li> <li>fix: typo by <a href="https://github.com/UlisesGascon";><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/71";>jshttp/proxy-addr#71</a></li> <li>Release: 2.0.8 by <a href="https://github.com/UlisesGascon";><code>@UlisesGascon</code></a> in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/70";>jshttp/proxy-addr#70</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/carpasse";><code>@carpasse</code></a> made their first contribution in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/27";>jshttp/proxy-addr#27</a></li> <li><a href="https://github.com/step-security-bot";><code>@step-security-bot</code></a> made their first contribution in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/29";>jshttp/proxy-addr#29</a></li> <li><a href="https://github.com/dependabot";><code>@dependabot</code></a>[bot] made their first contribution in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/30";>jshttp/proxy-addr#30</a></li> <li><a href="https://github.com/Phillip9587";><code>@Phillip9587</code></a> made their first contribution in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/40";>jshttp/proxy-addr#40</a></li> <li><a href="https://github.com/schiwekM";><code>@schiwekM</code></a> made their first contribution in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/61";>jshttp/proxy-addr#61</a></li> <li><a href="https://github.com/sheplu";><code>@sheplu</code></a> made their first contribution in <a href="https://redirect.github.com/jshttp/proxy-addr/pull/54";>jshttp/proxy-addr#54</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jshttp/proxy-addr/compare/v2.0.7...v2.0.8";>https://github.com/jshttp/proxy-addr/compare/v2.0.7...v2.0.8</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/jshttp/proxy-addr/blob/master/HISTORY.md";>proxy-addr's changelog</a>.</em></p> <blockquote> <h1>2.0.8</h1> <ul> <li>Fix <a href="https://www.cve.org/CVERecord?id=CVE-2026-90711";>CVE-2026-90711</a> (<a href="https://github.com/jshttp/proxy-addr/security/advisories/GHSA-jqcg-44mw-7w3h";>GHSA-jqcg-44mw-7w3h</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jshttp/proxy-addr/commit/a11ad82545698af5c33e59f3ed0b52eab79bf610";><code>a11ad82</code></a> 2.0.8 (<a href="https://redirect.github.com/jshttp/proxy-addr/issues/70";>#70</a>)</li> <li><a href="https://github.com/jshttp/proxy-addr/commit/780911d84d18e2c5fa008ed0c0d387631ec11965";><code>780911d</code></a> fix: reject IPv4 trust via mapped IPv6 subnets with a short prefix</li> <li><a href="https://github.com/jshttp/proxy-addr/commit/92e103e3f3ab0467c8846cacea71f27dfc81091d";><code>92e103e</code></a> fix(ci): use publised as release trigger event (<a href="https://redirect.github.com/jshttp/proxy-addr/issues/71";>#71</a>)</li> <li><a href="https://github.com/jshttp/proxy-addr/commit/3e5ac75d275d82606d33d6ac47c0ff43c2eccee9";><code>3e5ac75</code></a> ci: merge coverage via artifacts, disable fail-fast, add Node.js 23-26 (<a href="https://redirect.github.com/jshttp/proxy-addr/issues/69";>#69</a>)</li> <li><a href="https://github.com/jshttp/proxy-addr/commit/4b9db8190923840eb732b752a70f3e5ff713768c";><code>4b9db81</code></a> chore(ci): npm-publish via workflows (<a href="https://redirect.github.com/jshttp/proxy-addr/issues/54";>#54</a>)</li> <li><a href="https://github.com/jshttp/proxy-addr/commit/655e8950435ac457c586e8287da4d5993b7d0db5";><code>655e895</code></a> build(deps-dev): bump eslint-plugin-import from 2.31.0 to 2.32.0 (<a href="https://redirect.github.com/jshttp/proxy-addr/issues/39";>#39</a>)</li> <li><a href="https://github.com/jshttp/proxy-addr/commit/50ce4d09132a4c34f5485b52740ce879a9223b1f";><code>50ce4d0</code></a> build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 (<a href="https://redirect.github.com/jshttp/proxy-addr/issues/45";>#45</a>)</li> <li><a href="https://github.com/jshttp/proxy-addr/commit/0fd347f5b342e7502da58a512dc998d4a59cea24";><code>0fd347f</code></a> build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/jshttp/proxy-addr/issues/63";>#63</a>)</li> <li><a href="https://github.com/jshttp/proxy-addr/commit/6a517fa25c741cc107a90019df458b34f580ce55";><code>6a517fa</code></a> build(deps): bump github/codeql-action from 4.32.4 to 4.36.0 (<a href="https://redirect.github.com/jshttp/proxy-addr/issues/64";>#64</a>)</li> <li><a href="https://github.com/jshttp/proxy-addr/commit/0d45e2a88e82a2faf1148956b6457e3a6c99ebcd";><code>0d45e2a</code></a> Fix "arugment" typo in README (<a href="https://redirect.github.com/jshttp/proxy-addr/issues/61";>#61</a>)</li> <li>Additional commits viewable in <a href="https://github.com/jshttp/proxy-addr/compare/v2.0.7...v2.0.8";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions";>GitHub Actions</a>, a new releaser for proxy-addr since your current version.</p> </details> <br /> Updates `smol-toml` from 1.7.1 to 1.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/squirrelchat/smol-toml/releases";>smol-toml's releases</a>.</em></p> <blockquote> <h2>v1.9.0</h2> <p><strong>Huge update</strong>!!! This is most likely the largest update the library received since its release, with lots of new features and improvements.</p> <h3>Performance improvements</h3> <p>Significant parts of the internal parse logic have been rewritten, improving performance by <strong>1.5x-2x</strong>. The library was already comfortably ahead of the others, but it is now faster than ever, sitting at <strong>4x faster parse performance</strong> than the closest maintained implementation.</p> <p>Problematic code paths have also been replaced by safer implementations, solving potential DoS vectors. See GHSA-r4xh-jqrq-34v2.</p> <p>Note: the objects returned by the library now have a <em>null prototype</em>. This is a transparent change for 99.9% of users, and is one of the most significant contributors to the major performance gains in this version.</p> <h3>Full Temporal support</h3> <p>Version 1.8.0 brought support for Temporal in <code>stringify</code>; now the library is also able to emit Temporal objects instead of its own ad-hoc <code>TomlDate</code> object. It is not enabled by default, but it will become the default in v2. Enable by setting <code>useLegacyDate: false</code> in the parser's options.</p> <h4>Better Temporal support in stringify</h4> <p>Temporal support has been improved since it released: Temporal objects that cannot be represented (such as <code>Temporal.PlainMonthDay</code>) now throw an error (instead of silently emitting a bogus object).</p> <p>A new option has been added to <code>stringify</code> to disallow Temporal objects that cannot be fully represented in TOML. This includes <code>ZonedDateTime</code> objects with a IANA timezone attached instead of a plain offset, and dates with a specific calendar value set. Enable by setting <code>strictTemporal: true</code> in the options.</p> <h3>Handling of unsafe keys</h3> <p>Since its release the library has been protected against prototype pollution attacks, setting properties like <code>__proto__</code> using safe mechanisms that do not trigger prototype pollution. However, while the returned objects are safe on their own, they may become problematic if used carelessly.</p> <p>Inspired by <code>secure-json-parse</code>, the library now offers a way to either drop unsafe properties from the returned object, or to throw an error and reject documents altogether. By default, these potentially unsafe keys are preserved and returned.</p> <h3>Miscellaneous updates</h3> <ul> <li>Unicode BOM is now gracefully accepted and ignored.</li> <li>Table array headers are now properly checked again. Reported in <a href="https://redirect.github.com/squirrelchat/smol-toml/issues/65";>#65</a>.</li> <li>Closed certain gaps where invalid whitespace would be accepted. Reported in <a href="https://redirect.github.com/squirrelchat/smol-toml/issues/61";>#61</a>.</li> <li>Bogus local date and local time values with a UTC offset are no longer accepted.</li> <li>Certain error messages are more accurate and handle errors at line boundaries better.</li> <li>The default export of the lib is now formally deprecated; use a <code>import *</code> instead. Proposed in <a href="https://redirect.github.com/squirrelchat/smol-toml/issues/50";>#50</a>.</li> <li>On Node 20+, strings that contain lone surrogates are now normalised to well-formed strings.</li> <li>On Node 20+, keys that contain lone surrogates are now rejected.</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/squirrelchat/smol-toml/compare/v1.8.0...v1.9.0";>https://github.com/squirrelchat/smol-toml/compare/v1.8.0...v1.9.0</a></p> <h2>v1.8.0</h2> <h2>What's Changed</h2> <ul> <li>feat: stringify temporal objects by <a href="https://github.com/Gouvernathor";><code>@Gouvernathor</code></a> and <a href="https://github.com/cyyynthia";><code>@cyyynthia</code></a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/squirrelchat/smol-toml/compare/v1.7.2...v1.8.0";>https://github.com/squirrelchat/smol-toml/compare/v1.7.2...v1.8.0</a></p> <h2>v1.7.2</h2> <h2>What's Changed</h2> <ul> <li>refactor: improve performance of the parser by <a href="https://github.com/cyyynthia";><code>@cyyynthia</code></a></li> <li>chore: revert sourcemap publishing by <a href="https://github.com/cyyynthia";><code>@cyyynthia</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/squirrelchat/smol-toml/commit/6f9739a5ab481f57c3112024bc4947534b580b58";><code>6f9739a</code></a> fix: gate <code>[is|to]WellFormed</code> (Node 18 compat)</li> <li><a href="https://github.com/squirrelchat/smol-toml/commit/a73ca32c7c9237f744c880d900ad15307a0cef56";><code>a73ca32</code></a> fix: no Temporal with toml-test when Node < 26</li> <li><a href="https://github.com/squirrelchat/smol-toml/commit/7727890604580bd3fc2d7d2f79ad6e67b745ebe7";><code>7727890</code></a> chore: version bump</li> <li><a href="https://github.com/squirrelchat/smol-toml/commit/641903d60d47900080602b6a83e919d2a526547f";><code>641903d</code></a> chore: rewrite README.md</li> <li><a href="https://github.com/squirrelchat/smol-toml/commit/2df14c57945fec5a3737bc0cdce06a436bf9a77e";><code>2df14c5</code></a> fix(types): make it work if Temporal doesn't exist</li> <li><a href="https://github.com/squirrelchat/smol-toml/commit/3eaa44ef54b859990969935664b12023b26d0eae";><code>3eaa44e</code></a> chore: update benchmark harness</li> <li><a href="https://github.com/squirrelchat/smol-toml/commit/cd3ba6021a59bff0ac57dc059ca2e194365caedd";><code>cd3ba60</code></a> feat: safety option for dangerous properties</li> <li><a href="https://github.com/squirrelchat/smol-toml/commit/6746a7f3ec066109ef8ba69126489fd84b6d3b73";><code>6746a7f</code></a> perf: refactor TomlDate to avoid regex path</li> <li><a href="https://github.com/squirrelchat/smol-toml/commit/16fa64fc5efad895e8657d70e5a1855a16f58ace";><code>16fa64f</code></a> chore: move benchmarks and test harness under 0BSD</li> <li><a href="https://github.com/squirrelchat/smol-toml/commit/bbd14b154b603068ad25ad54b4a3e7f53adeedc0";><code>bbd14b1</code></a> fix: correct sign for single-char numbers</li> <li>Additional commits viewable in <a href="https://github.com/squirrelchat/smol-toml/compare/v1.7.1...v1.9.0";>compare view</a></li> </ul> </details> <br /> Updates `source-map-js` from 1.2.1 to 1.2.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/7rulnik/source-map-js/releases";>source-map-js's releases</a>.</em></p> <blockquote> <h2>v1.2.2</h2> <ul> <li> <p>Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (<a href="https://redirect.github.com/7rulnik/source-map-js/pull/29";>#29</a>) <a href="https://github.com/xfournet";><code>@xfournet</code></a></p> </li> <li> <p>Fix denial of service from malicious indexed source maps (CVE-2026-93749) (<a href="https://redirect.github.com/7rulnik/source-map-js/pull/79";>#79</a>)</p> <p>Reported by <a href="https://github.com/waydeshi";><code>@waydeshi</code></a> in <a href="https://redirect.github.com/7rulnik/source-map-js/issues/76";>#76</a>. A fix was also proposed by <a href="https://github.com/aniebiet";><code>@aniebiet</code></a> in <a href="https://redirect.github.com/7rulnik/source-map-js/pull/78";>#78</a>.</p> </li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md";>source-map-js's changelog</a>.</em></p> <blockquote> <h2>1.2.2</h2> <ul> <li> <p>Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (<a href="https://redirect.github.com/7rulnik/source-map-js/pull/29";>#29</a>) <a href="https://github.com/xfournet";><code>@xfournet</code></a></p> </li> <li> <p>Fix denial of service from malicious indexed source maps (CVE-2026-93749) (<a href="https://redirect.github.com/7rulnik/source-map-js/pull/79";>#79</a>)</p> <p>Reported by <a href="https://github.com/waydeshi";><code>@waydeshi</code></a> in <a href="https://redirect.github.com/7rulnik/source-map-js/issues/76";>#76</a>. A fix was also proposed by <a href="https://github.com/aniebiet";><code>@aniebiet</code></a> in <a href="https://redirect.github.com/7rulnik/source-map-js/pull/78";>#78</a>.</p> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/7rulnik/source-map-js/commit/0a1d334fd1e55a47df97fcd60a7915d46df3b08a";><code>0a1d334</code></a> 1.2.2</li> <li><a href="https://github.com/7rulnik/source-map-js/commit/4c6fa26d77419bd8e48ec92844866cce7d9ae739";><code>4c6fa26</code></a> Update changelog</li> <li><a href="https://github.com/7rulnik/source-map-js/commit/cf7658058ceeaa8619d5ae0ec90be6905209d016";><code>cf76580</code></a> Fix denial of service from malicious indexed source maps (CVE-2026-93749) (<a href="https://redirect.github.com/7rulnik/source-map-js/issues/79";>#79</a>)</li> <li><a href="https://github.com/7rulnik/source-map-js/commit/7899a86615c630f4fc220273ff9fe2e8e49a56df";><code>7899a86</code></a> Fix crash when executing browser with CSP script-src that don't permit unsafe...</li> <li>See full diff in <a href="https://github.com/7rulnik/source-map-js/compare/v1.2.1...v1.2.2";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/superset/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
