build(deps): Bump the npm_and_yarn group across 4 directories with 15 updates by dependabot[bot] · Pull Request #10 · t7451/360

dependabot · 2026-06-16T00:59:39Z

Bumps the npm_and_yarn group with 12 updates in the / directory:

Package	From	To
uuid	`10.0.0`	`14.0.0`
vitest	`2.1.9`	`3.2.6`
vite	`6.4.2`	`6.4.3`
picomatch	`4.0.3`	`4.0.4`
@grpc/grpc-js	`1.14.3`	`1.14.4`
@grpc/grpc-js	`1.9.15`	`1.9.16`
fast-xml-builder	`1.1.2`	`1.2.0`
fast-xml-parser	`5.5.3`	`5.9.0`
flatted	`3.4.1`	`3.4.2`
node-forge	`1.3.3`	`1.4.0`
path-to-regexp	`0.1.12`	`0.1.13`
qs	`6.14.2`	`6.15.2`
react-router	`6.30.3`	`7.17.0`

Bumps the npm_and_yarn group with 1 update in the /forge3d-studio/client-portal directory: vite.
Bumps the npm_and_yarn group with 5 updates in the /inkvault directory:

Package	From	To
vite	`7.3.0`	`8.0.16`
picomatch	`2.3.1`	`4.0.4`
minimatch	`3.1.2`	`10.2.5`
flatted	`3.3.3`	`3.4.2`
lodash	`4.17.21`	`4.18.1`

Bumps the npm_and_yarn group with 2 updates in the /src/server directory: uuid and vitest.

Updates uuid from 10.0.0 to 14.0.0

Release notes

Sourced from uuid's releases.

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

expect crypto to be global everywhere (requires node@20+) (#935)

drop node@18 support (#934)

Features

drop node@18 support (#934) (dc4ddb8)

Bug Fixes

expect crypto to be global everywhere (requires node@20+) (#935) (f2c235f)

Use GITHUB_TOKEN for release-please and enable npm provenance (#925) (ffa3138)

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

rerelease to fix provenance. (49ccb35)

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

backport fix for GHSA-w5hq-g745-h8pq (9d27ddf)

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

make browser exports the default (#901)

Bug Fixes

make browser exports the default (#901) (bce9d72)

v12.0.1

12.0.1 (2026-04-29)

... (truncated)

Changelog

Sourced from uuid's changelog.

14.0.0 (2026-04-19)

Security

Fixes GHSA-w5hq-g745-h8pq: v3(), v5(), and v6() did not validate that writes would remain within the bounds of a caller-supplied buffer, allowing out-of-bounds writes when an invalid offset was provided. A RangeError is now thrown if offset < 0 or offset + 16 > buf.length.

⚠ BREAKING CHANGES

crypto is now expected to be globally defined (requires node@20+) (#935)

drop node@18 support (#934)

upgrade minimum supported TypeScript version to 5.4.3, in keeping with the project's policy of supporting TypeScript versions released within the last two years

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

make browser exports the default (#901)

Bug Fixes

make browser exports the default (#901) (bce9d72)

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

update to typescript@5.2 (#887)

remove CommonJS support (#886)

drop node@16 support (#883)

Features

add node@24 to ci matrix (#879) (42b6178)

drop node@16 support (#883) (0f38cf1)

remove CommonJS support (#886) (ae786e2)

update to typescript@5.2 (#887) (c7ee405)

Bug Fixes

improve v4() performance (#894) (5fd974c)

restore node: prefix (#889) (e1f42a3)

11.1.0 (2025-02-19)

... (truncated)

Commits

7c1ea08 chore(main): release 14.0.0 (#926)
3d2c5b0 Merge commit from fork
f2c235f fix!: expect crypto to be global everywhere (requires node@20+) (#935)
529ef08 chore: upgrade TypeScript and fixup types (#927)
086fd79 chore: update dependencies (#933)
dc4ddb8 feat!: drop node@18 support (#934)
0f1f9c9 chore: switch to Biome for parsing and linting (#932)
e2879e6 chore: use maintained version of npm-run-all (#930)
ffa3138 fix: Use GITHUB_TOKEN for release-please and enable npm provenance (#925)
0423d49 docs: remove obsolete v1 option notes (#915)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for uuid since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates vitest from 2.1.9 to 3.2.6

Release notes

Sourced from vitest's releases.

v3.2.6

   🐞 Bug Fixes

Pin last supported vite-node version - by @sheremet-va (16f12)

    View changes on GitHub

v3.2.5

   🚀 Features

api: Add allowWrite and allowExec options to api [backport to v3] - by @hi-ogawa and Codex in vitest-dev/vitest#10445 (af88b)

   🐞 Bug Fixes

browser: Disable client cdp API when allowWrite/allowExec: false [backport to v3] - by @hi-ogawa and Codex in vitest-dev/vitest#10456 (385a1)

    View changes on GitHub

v3.2.4

   🐞 Bug Fixes

Use correct path for optimisation of strip-literal - by @mrginglymus in vitest-dev/vitest#8139 (44940)

Print uint and buffer as a simple string - by @sheremet-va in vitest-dev/vitest#8141 (b86bf)

browser:

Show a helpful error when spying on an export - by @sheremet-va in vitest-dev/vitest#8178 (56007)

cli:

vitest run --watch should be watch-mode - by @AriPerkkio in vitest-dev/vitest#8128 (657e8)

Use absolute path environment on Windows - by @colinaaa in vitest-dev/vitest#8105 (85dc0)

Throw error when --shard x/<count> exceeds count of test files - by @AriPerkkio in vitest-dev/vitest#8112 (8a18c)

coverage:

Ignore SCSS in browser mode - by @sheremet-va in vitest-dev/vitest#8161 (0c3be)

deps:

Update all non-major dependencies - in vitest-dev/vitest#8123 (93f32)

expect:

Handle async errors in expect.soft - by @lzl0304 in vitest-dev/vitest#8145 (68699)

pool:

Auto-adjust minWorkers when only maxWorkers specified - by @AriPerkkio in vitest-dev/vitest#8110 (14dc0)

reporter:

task.meta should be available in custom reporter's errors - by @AriPerkkio in vitest-dev/vitest#8115 (27df6)

runner:

Preserve handler wrapping on extend - by @pengooseDev in vitest-dev/vitest#8153 (a9281)

ui:

Ensure ui config option works correctly - by @lzl0304 in vitest-dev/vitest#8147 (42eeb)

    View changes on GitHub

v3.2.3

   🚀 Features

browser: Use base url instead of vitest - by @sheremet-va in vitest-dev/vitest#8126 (1d8eb)

... (truncated)

Commits

b6d56f8 chore: release v3.2.6
16f120d fix: pin last supported vite-node version
2cbad0a chore: release v3.2.5
385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
af88b1f feat(api): add allowWrite and allowExec options to api [backport to v3]...
c666d14 chore: release v3.2.4
8a18c8e fix(cli): throw error when --shard x/\<count> exceeds count of test files (#...
8abd7cc chore(deps): update tinypool (#8174)
93f3200 fix(deps): update all non-major dependencies (#8123)
0c3be6f fix(coverage): ignore SCSS in browser mode (#8161)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Updates vite from 6.4.2 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576

fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

Commits

6c2c881 release: v6.4.3
96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
See full diff in compare view

Updates esbuild from 0.21.5 to 0.25.12

Release notes

Sourced from esbuild's releases.

v0.25.12
Fix a minification regression with CSS media queries (#4315)

The previous release introduced support for parsing media queries which unintentionally introduced a regression with the removal of duplicate media rules during minification. Specifically the grammar for @media <media-type> and <media-condition-without-or> { ... } was missing an equality check for the <media-condition-without-or> part, so rules with different suffix clauses in this position would incorrectly compare equal and be deduplicated. This release fixes the regression.
Update the list of known JavaScript globals (#4310)

This release updates esbuild's internal list of known JavaScript globals. These are globals that are known to not have side-effects when the property is accessed. For example, accessing the global Array property is considered to be side-effect free but accessing the global scrollY property can trigger a layout, which is a side-effect. This is used by esbuild's tree-shaking to safely remove unused code that is known to be side-effect free. This update adds the following global properties:

From ES2017:

Atomics

SharedArrayBuffer

From ES2020:

BigInt64Array

BigUint64Array

From ES2021:

FinalizationRegistry

WeakRef

From ES2025:

Float16Array

Iterator

Note that this does not indicate that constructing any of these objects is side-effect free, just that accessing the identifier is side-effect free. For example, this now allows esbuild to tree-shake classes that extend from Iterator:
// This can now be tree-shaken by esbuild:
class ExampleIterator extends Iterator {}
Add support for the new @view-transition CSS rule (#4313)

With this release, esbuild now has improved support for pretty-printing and minifying the new @view-transition rule (which esbuild was previously unaware of):
/* Original code */
@view-transition {
  navigation: auto;
  types: check;
}
/* Old output */
@view-transition { navigation: auto; types: check; }
/* New output */
@view-transition {
navigation: auto;
types: check;

... (truncated)

Changelog

Sourced from esbuild's changelog.

Changelog: 2024

This changelog documents all esbuild versions published in the year 2024 (versions 0.19.12 through 0.24.2).

0.24.2

Fix regression with --define and import.meta (#4010, #4012, #4013)

The previous change in version 0.24.1 to use a more expression-like parser for define values to allow quoted property names introduced a regression that removed the ability to use --define:import.meta=.... Even though import is normally a keyword that can't be used as an identifier, ES modules special-case the import.meta expression to behave like an identifier anyway. This change fixes the regression.

This fix was contributed by @sapphi-red.

0.24.1
Allow es2024 as a target in tsconfig.json (#4004)

TypeScript recently added es2024 as a compilation target, so esbuild now supports this in the target field of tsconfig.json files, such as in the following configuration file:
{
  "compilerOptions": {
    "target": "ES2024"
  }
}
As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.

This fix was contributed by @billyjanitsch.
Allow automatic semicolon insertion after get/set

This change fixes a grammar bug in the parser that incorrectly treated the following code as a syntax error:
class Foo {
  get
  *x() {}
  set
  *y() {}
}
The above code will be considered valid starting with this release. This change to esbuild follows a similar change to TypeScript which will allow this syntax starting with TypeScript 5.7.
Allow quoted property names in --define and --pure (#4008)

The define and pure API options now accept identifier expressions containing quoted property names. Previously all identifiers in the identifier expression had to be bare identifiers. This change now makes --define and --pure consistent with --global-name, which already supported quoted property names. For example, the following is now possible:

... (truncated)

Commits

208f539 publish 0.25.12 to npm
5f03afd update release notes
6b2ee78 minify: remove css rules containing empty :is()
f361deb add some additional known static methods
07aa646 automatically mark "RegExp.escape()" calls as pure
9039c46 simplify some call expression checks
188944d add some additional known static methods
d3c67f9 fix #4310: add Iterator and other known globals
4a51f0b fix: escape dev server breadcrumb hrefs properly (#4316)
26b29ed fix #4315: @media deduplication bug edge case
Additional commits viewable in compare view

Updates picomatch from 4.0.3 to 4.0.4

Release notes

Sourced from picomatch's releases.

4.0.4

This is a security release fixing several security relevant issues.

What's Changed

Fix for CVE-2026-33671

Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@4.0.3...4.0.4

Commits

e5474fc Publish 4.0.4
4516eb5 Merge commit from fork
5eceecd Merge commit from fork
0db7dd7 Run benchmark again against latest minimatch version (#161)
9500377 docs: clarify what brace expansion syntax is and isn't supported (#134)
2661f23 fix typo in globstars.js test name (#138)
1798b07 docs: fix makeRe example (#143)
9d76bc5 chore: undocument removed options (#146)
e4d718b Remove unused time-require (#160)
38dffeb chore(deps): pin dependencies (#158)
Additional commits viewable in compare view

Updates @grpc/grpc-js from 1.14.3 to 1.14.4

Release notes

Sourced from @grpc/grpc-js's releases.

@grpc/grpc-js 1.14.4

Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)

Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

Commits

a380735 Merge pull request #3052 from murgatroid99/grpc-js_1.14.4
5b8d37b Merge commit from fork
6a97456 Merge commit from fork
e5e0b1d grpc-js: Bump version to 1.14.4
5029a26 Make compression error a static string
2fe55fd Fix crashes when receiving malformed compressed data
234f917 Fix server crash when handling invalid requests
acef8d4 Merge pull request #3043 from murgatroid99/rbac_types_change_fix_1.14
4f3c58f grpc-js-xds: Update RBAC code to handle Node type change, pin @types/node
See full diff in compare view

Updates @grpc/grpc-js from 1.9.15 to 1.9.16

Release notes

Sourced from @grpc/grpc-js's releases.

@grpc/grpc-js 1.14.4

Fix a bug that could cause servers to crash when handling malformed requests (advisory GHSA-5375-pq7m-f5r2)

Fix a bug that could cause clients and servers to crash when handling malformed compressed messages (advisory GHSA-99f4-grh7-6pcq)

Commits

a380735 Merge pull request #3052 from murgatroid99/grpc-js_1.14.4
5b8d37b Merge commit from fork
6a97456 Merge commit from fork
e5e0b1d grpc-js: Bump version to 1.14.4
5029a26 Make compression error a static string
2fe55fd Fix crashes when receiving malformed compressed data
234f917 Fix server crash when handling invalid requests
acef8d4 Merge pull request #3043 from murgatroid99/rbac_types_change_fix_1.14
4f3c58f grpc-js-xds: Update RBAC code to handle Node type change, pin @types/node
See full diff in compare view

Updates fast-xml-builder from 1.1.2 to 1.2.0

Changelog

Sourced from fast-xml-builder's changelog.

1.2.0 (2026-05-08)

Add support for sanitizeName option

Support xml-naming for validating and sanitizing tag and attribute names

1.1.9 (2026-05-06)

fix: format output for preserve order when indent by is set to empty string

1.1.8 (2026-05-05)

fix: skip text property for PI tags

improve typings

1.1.7 (2026--05-04)

fix security issues when attribute value contains quotes

1.1.6 (2026--05-04)

fix security issues related to comment

skip comment with null value

1.1.5 (2026-04-17)

fix security issues related to comment and cdata

1.1.4 (2026-03-16)

support maxNestedTags option

1.1.3 (2026-03-13)

declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

1.1.2 (2026-03-11)

fix typings

1.1.1 (2026-03-11)

upgrade path-expression-matcher to 1.1.3

1.1.0 (2026-03-10)

Integrate path-expression-matcher

Commits

a9a905b for release
42680e8 support name sanitization
8b00185 release info
8a08f17 allow indentation to be empty string
7fc5dec update docs
c241b6a improve documentation
15d5668 update for release
9877485 fix: skip text property for PI tags
311a221 fix #5 typing import issues
e8fc5b1 update for releast
Additional commits viewable in compare view

Updates fast-xml-parser from 5.5.3 to 5.9.0

Release notes

Sourced from fast-xml-parser's releases.

update strnum, FXB. Use xml-naming for DOCTYPE

integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)

This will consider xml-version as well. '1.0' is default

update strnum to 2.3.0

You can set octal and binary parsing which is by deault off

update fast-xml-builder to 1.2.0

can sanitize tag names if found invalid

fix format output

fix minor old bugs and update builder

fix: alwaysCreateTextNode should create text node when attributes are present for self closing node

fix stop node expression when ns prefix is removed (found by iruizsalinas)

update XML Builder to 1.1.7

mark addEntity deprecated

backward compatibility for numerical external entity, fix #705, #817

allow numerical external entity for backward compatibility

fix #705: attributesGroupName working with preserveOrder

fix #817: stackoverflow when tag expression is very long

upgrade @nodable/entities and FXB

Use @nodable/entities v2.1.0

breaking changes

single entity scan. You're not allowed to use entity value to form another entity name.

you cant add numeric external entity

entity error message when expantion limit is crossed might change

typings are updated for new options related to process entity

please follow documentation of @nodable/entities for more detail.

performance

if processEntities is false, then there should not be impact on performance.

if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%

if processEntities is true, and you pass entity decoder separately

if no entity then performance should be same as before

if there are entities then performance should be increased from past versions

ignoreAttributes is not required to be set to set xml version for NCR entity value

update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

use @nodable/entities to replace entities

No API change

No change in performance for basic usage

No typing change

No config change

new dependency

breaking: error messages for entities might have been changed.

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.12...v5.6.0

performance improvment, increase entity expansion default limit

increase default entity explansion limit as many projects demand for that
</tr></table> 

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

*5.9.0 / 2026-06-15 (not released yet)

update strnum to 2.3.0

you can set hex, binary, enotation, infinity, unicode

validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)

This will consider xml-version as well. '1.0' is default

update strnum to 2.3.0

You can set octal and binary parsing which is bydeault off

update fast-xml-builder to 1.2.0

can sanitize tag names if found invalid

fix format output

5.7.3 / 2006-05-05

fix: alwaysCreateTextNode should create text node when attributes are present for self closing node

fix stop node expression when ns prefix is removed (found by iruizsalinas)

update XML Builder to 1.1.7

mark addEntity deprecated

5.7.2 / 2026-04-25

allow numerical external entity for backward compatibility

fix #705: attributesGroupName working with preserveOrder

fix #817: stackoverflow when tag expression is very long

5.7.1 / 2026-04-20

fix typo in CJS typing file

5.7.0 / 2026-04-17

Use @nodable/entities v2.1.0

breaking changes

single entity scan. You're not allowed to user entity value to form another entity name.

you cant add numeric external entity

entity error message when expantion limit is crossed might change

typings are updated for new options related to process entity

please follow documentation of @nodable/entities for more detail.

performance

if processEntities is false, then there should not be impact on performance.

if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%

if processEntities is true, and you pass entity decoder separately

if no entity then performance should be same as before

if there are entities then performance should be increased from past versions

ignoreAttributes is not required to be set to set xml version for NCR entity value

update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

... (truncated)

Commits

d429d70 update for release
a8b3564 update docs
ca273dc update strnum to support unicode, discard unsafe doctype entities
f589251 add security warning to docs
ce1001c Update Node.js CI workflow to use latest actions
be6e9d9 remove prolog from demo page (#776)
2d46cc2 fix demo XML declaration parsing option (#836)
4bcee44 for release
8a287bf release info
50b01dc Use "@byspec/xml" for testing
Additional commits viewable in compare view

Updates flatted from 3.4.1 to 3.4.2

Commits

3bf0909 3.4.2
885ddcc fix CWE-1321
0bdba70 added flatted-view to the benchmark
See full diff in compare view

Updates node-forge from 1.3.3 to 1.4.0

Changelog

Sourced from node-forge's changelog.

1.4.0 - 2026-03-24

Security

HIGH: Denial of Service in BigInteger.modInverse()

A Denial of Service (DoS) vulnerability exists due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU.

Reported by Kr0emer.

CVE ID: CVE-2026-33891

GHSA ID: GHSA-5gfm-wpxj-wjgq

HIGH: Signature forgery in RSA-PKCS due to ASN.1 extra field.

RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatures by stuffing "garbage" bytes within the ASN.1 structure in order to construct a signature that passes verification, enabling Bleichenbacher style forgery. This issue is similar to CVE-2022-24771, but adds bytes in an addition field within the ASN.1 structure, rather than outside of it.

Additionally, forge does not validate that signatures include a minimum of 8 bytes of padding as defined by the specification, providing attackers additional space to construct Bleichenbacher forgeries.

Reported as part of a U.C. Berkeley security research project by:

Austin Chu, Sohee Kim, and Corban Villa.

CVE ID: CVE-2026-33894

GHSA ID: GHSA-ppp5-5v6c-4jwp

HIGH: Signature forgery in Ed25519 due to missing S < L check.

Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (S >= L). A valid signature and its S + L variant both verify in forge, while Node.js crypto.verify (OpenSSL-backed) rejects the S + L variant, as defined by the specification. This class of signature malleability has been exploited in practice to bypass authentication and authorization logic (see CVE-2026-25793, CVE-2022-35961). Applications relying on signature uniqueness (i.e., dedup by signature bytes, replay tracking, signed-object canonicalization checks) may be bypassed.

Reported as part of a U.C. Berkeley security research project by:

Austin Chu, Sohee Kim, and Corban Villa.

CVE ID: CVE-2026-33895

GHSA ID: GHSA-q67f-28xg-22rw

HIGH: basicConstraints bypass in certificate chain verification.

pki.verifyCertificateChain() does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both the basicConstraints and keyUsage extensions. This allows any leaf certificate (without these extensions) to act as a CA and sign other certificates, which node-forge will accept as valid.

Reported by Doruk Tan Ozturk (@peaktwilight) - doruk.ch

CVE ID: CVE-2026-33896

GHSA ID: GHSA-2328-f5f3-gj25

... (truncated)

Commits

fa385f9 Release 1.4.0.
07d4e16 Update changelog.
cb90fd9 Update changelog.
963e7c5 Add unit test for "pseudonym"
f0b6f5b Add pseudonym OID
3df48a3 Fix missing CVE ID.
2e49283 Add x509 basicConstraints check.
bdecf11 Add canonical signature scaler check for S < L.
af094e6 Add RSA padding and DigestInfo length checks.
796eeb1 Improve jsbn fix.
Additional commits viewable in compare view

Updates path-to-regexp from 0.1.12 to 0.1.13

Release notes

Sourced from path-to-regexp's releases.

0.1.13

Important

Fix CVE-2026-4867 (GHSA-37ch-88jc-xwx2)

Full Changelog: pillarjs/path-to-regexp@v0.1.12...v.0.1.13

Changelog

Sourced from path-to-regexp's changelog.

0.1.13 / 2026-03-26

Fix CVE-2026-4867 (GHSA-37ch-88jc-xwx2)

0.1.7 / 2015-07-28

Fixed regression with escaped round brackets and matching groups.

0.1.6 / 2015-06-19

Replace index feature by outputting all parameters, unnamed and named.

0.1.5 / 2015-05-08

Add an index property for position in match result.

0.1.4 / 2015-03-05

Add license information

0.1.3 / 2014-07-06

Better array support

Improved support for trailing slash in non-ending mode

0.1.0 / 2014-03-06

add options.end

0.0.2 / 2013-02-10

Update to match current express

add .license property to component.json

Commits

9fd0c87 0.1.13 (#425)
7ccf02c fix: CVE-2026-4867
See full diff in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for path-to-regexp since your current version.

Updates qs from 6.14.2 to 6.15.2

Changelog

Sourced from qs's changelog.

6.15.2

[Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder

[Fix] stringify: use configured delimiter after charsetSentinel (#555)

[Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)

[Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)

[Fix] parse: handle nested bracket groups and add regression tests (#530)

[readme] fix grammar (#550)

[Dev Deps] update @ljharb/eslint-config

[Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

[Fix] parse: parameterLimit: Infin... Description has been truncated

… updates Bumps the npm_and_yarn group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [uuid](https://github.com/uuidjs/uuid) | `10.0.0` | `14.0.0` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `2.1.9` | `3.2.6` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `6.4.2` | `6.4.3` | | [picomatch](https://github.com/micromatch/picomatch) | `4.0.3` | `4.0.4` | | [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.14.3` | `1.14.4` | | [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.9.15` | `1.9.16` | | [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) | `1.1.2` | `1.2.0` | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.5.3` | `5.9.0` | | [flatted](https://github.com/WebReflection/flatted) | `3.4.1` | `3.4.2` | | [node-forge](https://github.com/digitalbazaar/forge) | `1.3.3` | `1.4.0` | | [path-to-regexp](https://github.com/pillarjs/path-to-regexp) | `0.1.12` | `0.1.13` | | [qs](https://github.com/ljharb/qs) | `6.14.2` | `6.15.2` | | [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `6.30.3` | `7.17.0` | Bumps the npm_and_yarn group with 1 update in the /forge3d-studio/client-portal directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Bumps the npm_and_yarn group with 5 updates in the /inkvault directory: | Package | From | To | | --- | --- | --- | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `7.3.0` | `8.0.16` | | [picomatch](https://github.com/micromatch/picomatch) | `2.3.1` | `4.0.4` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `10.2.5` | | [flatted](https://github.com/WebReflection/flatted) | `3.3.3` | `3.4.2` | | [lodash](https://github.com/lodash/lodash) | `4.17.21` | `4.18.1` | Bumps the npm_and_yarn group with 2 updates in the /src/server directory: [uuid](https://github.com/uuidjs/uuid) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest). Updates `uuid` from 10.0.0 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v10.0.0...v14.0.0) Updates `vitest` from 2.1.9 to 3.2.6 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.6/packages/vitest) Updates `vite` from 6.4.2 to 6.4.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `esbuild` from 0.21.5 to 0.25.12 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2024.md) - [Commits](evanw/esbuild@v0.21.5...v0.25.12) Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.4) Updates `@grpc/grpc-js` from 1.14.3 to 1.14.4 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.3...@grpc/grpc-js@1.14.4) Updates `@grpc/grpc-js` from 1.9.15 to 1.9.16 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.14.3...@grpc/grpc-js@1.14.4) Updates `fast-xml-builder` from 1.1.2 to 1.2.0 - [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-builder@v1.1.2...v1.2.0) Updates `fast-xml-parser` from 5.5.3 to 5.9.0 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.5.3...v5.9.0) Updates `flatted` from 3.4.1 to 3.4.2 - [Commits](WebReflection/flatted@v3.4.1...v3.4.2) Updates `node-forge` from 1.3.3 to 1.4.0 - [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md) - [Commits](digitalbazaar/forge@v1.3.3...v1.4.0) Updates `path-to-regexp` from 0.1.12 to 0.1.13 - [Release notes](https://github.com/pillarjs/path-to-regexp/releases) - [Changelog](https://github.com/pillarjs/path-to-regexp/blob/v.0.1.13/History.md) - [Commits](pillarjs/path-to-regexp@v0.1.12...v.0.1.13) Updates `qs` from 6.14.2 to 6.15.2 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.14.2...v6.15.2) Updates `react-router` from 6.30.3 to 7.17.0 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@7.17.0/packages/react-router) Updates `vite` from 8.0.5 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `vite` from 7.3.0 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v6.4.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v6.4.3/packages/vite) Updates `picomatch` from 2.3.1 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@4.0.3...4.0.4) Updates `minimatch` from 3.1.2 to 10.2.5 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v10.2.5) Updates `flatted` from 3.3.3 to 3.4.2 - [Commits](WebReflection/flatted@v3.4.1...v3.4.2) Updates `lodash` from 4.17.21 to 4.18.1 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.18.1) Updates `uuid` from 10.0.0 to 14.0.0 - [Release notes](https://github.com/uuidjs/uuid/releases) - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v10.0.0...v14.0.0) Updates `vitest` from 2.1.9 to 4.1.9 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v3.2.6/packages/vitest) --- updated-dependencies: - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 3.2.6 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 6.4.3 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: esbuild dependency-version: 0.25.12 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@grpc/grpc-js" dependency-version: 1.14.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@grpc/grpc-js" dependency-version: 1.9.16 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-builder dependency-version: 1.2.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-xml-parser dependency-version: 5.9.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-forge dependency-version: 1.4.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: path-to-regexp dependency-version: 0.1.13 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.15.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: react-router dependency-version: 7.17.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-version: 10.2.5 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-version: 4.18.1 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: uuid dependency-version: 14.0.0 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vitest dependency-version: 4.1.9 dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 16, 2026

Navigation Menu

Uh oh!

build(deps): Bump the npm_and_yarn group across 4 directories with 15 updates - #10

build(deps): Bump the npm_and_yarn group across 4 directories with 15 updates#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm_and_yarn-63ed32f646

dependabot Bot commented on behalf of github Jun 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 16, 2026

v14.0.0

14.0.0 (2026-04-19)

⚠ BREAKING CHANGES

Features

Bug Fixes

v13.0.2

13.0.2 (2026-05-04)

Bug Fixes

v13.0.1

13.0.1 (2026-04-27)

Bug Fixes

v13.0.0

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

Bug Fixes

v12.0.1

12.0.1 (2026-04-29)

14.0.0 (2026-04-19)

Security

⚠ BREAKING CHANGES

13.0.0 (2025-09-08)

⚠ BREAKING CHANGES

Bug Fixes

12.0.0 (2025-09-05)

⚠ BREAKING CHANGES

Features

Bug Fixes

11.1.0 (2025-02-19)

v3.2.6

🐞 Bug Fixes

View changes on GitHub

v3.2.5

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v3.2.4

🐞 Bug Fixes

View changes on GitHub

v3.2.3

🚀 Features

v6.4.3

6.4.3 (2026-06-01)

v0.25.12

Changelog: 2024

0.24.2

0.24.1

4.0.4

What's Changed

@​grpc/grpc-js 1.14.4

@​grpc/grpc-js 1.14.4

update strnum, FXB. Use xml-naming for DOCTYPE

fix minor old bugs and update builder

backward compatibility for numerical external entity, fix #705, #817

upgrade @​nodable/entities and FXB

use @​nodable/entities to replace entities

performance improvment, increase entity expansion default limit

1.4.0 - 2026-03-24

Security

0.1.13

Important

0.1.13 / 2026-03-26

0.1.7 / 2015-07-28

0.1.6 / 2015-06-19

0.1.5 / 2015-05-08

0.1.4 / 2015-03-05

0.1.3 / 2014-07-06

0.1.0 / 2014-03-06

0.0.2 / 2013-02-10

6.15.2

6.15.1

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

`@grpc/grpc-js` 1.14.4

`@grpc/grpc-js` 1.14.4

upgrade `@nodable/entities` and FXB

use `@nodable/entities` to replace entities