[dependabot]

Bumps the security group with 15 updates in the / directory:

Package	From	To
js-yaml	3.14.1	3.15.2
brace-expansion	1.1.11	1.1.21
ws	7.5.10	7.5.13
@tootallnate/once	2.0.0	2.0.1
@xmldom/xmldom	0.8.10	0.8.15
picomatch	2.3.1	2.3.2
decode-uri-component	0.2.2	removed
flatted	3.3.3	3.4.4
form-data	4.0.2	4.0.6
lodash	4.17.21	4.18.1
shell-quote	1.8.3	1.12.0
source-map-js	1.2.1	1.2.2
uuid	7.0.3	removed
yaml	2.8.1	2.9.1
zod	3.25.76	4.6.7

Updates js-yaml from 3.14.1 to 3.15.2

Changelog

Sourced from js-yaml's changelog.

3.15.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

3.15.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

3.15.0 - 2026-06-27

Added

• Added maxTotalMergeKeys (10000) loader option to limit the total number of keys processed by YAML merge (<<) across one safeLoad() / safeLoadAll() call.

[3.14.2] - 2025-11-15

Security

• Fix prototype pollution in merge (<<).

Commits

• 5c45bd6 3.15.2 released
• 5a708f9 dist rebuild
• 3485bc0 Backport merge limits from v5.4.1
• f34812f Update .gitignore
• ab85ae2 3.15.1 released
• 30a5e76 dist rebuild
• 22a8071 Backport quadratic complexity fix for !!omap
• c34b6c4 3.15.0 released
• 21e13d3 dist rebuild
• 4165c62 Add v3-legacy tag for publish
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.21

Release notes

Sourced from brace-expansion's releases.

v1.1.15

• Backport v5.0.6 change to v1 (#111) 0b09384

---

juliangruber/brace-expansion@v1.1.14...v1.1.15

v1.1.12

• pkg: publish on tag 1.x c460dbd
• fmt ccb8ac6
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) c3c73c8

---

juliangruber/brace-expansion@v1.1.11...v1.1.12

Commits

• 8e81e18 1.1.21
• ffdfa3e Merge commit from fork
• c6513ad 1.1.20
• 1efee7c Merge commit from fork
• a34340a 1.1.19
• 0bcbfc0 Merge commit from fork
• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• Additional commits viewable in compare view

Updates ws from 7.5.10 to 7.5.13

Release notes

Sourced from ws's releases.

7.5.13

Bug fixes

• Fixed a bug introduced in version 7.5.12 that prevented the fragment counter from resetting (18bcb11a).

7.5.12

Bug fixes

• Backported a2f4e7c0 and f197ac65 to the v7.x release line (fb8a1935, deec2114).

7.5.11

Bug fixes

• Backported 2b2abd45 to the 7.x release line (e14c4586).

Commits

• 1680801 [dist] 7.5.13
• 18bcb11 [fix] Reset the fragment counter when the message is complete
• 98fce81 [dist] 7.5.12
• deec211 [fix] Lower default values of maxBufferedChunks and maxFragments
• fb8a193 [fix] Count empty fragments toward the limit (#2329)
• fd36cd8 [dist] 7.5.11
• e14c458 [security] Limit retained message parts
• See full diff in compare view

Updates @tootallnate/once from 2.0.0 to 2.0.1

Release notes

Sourced from @​tootallnate/once's releases.

v2.0.1

Patch Changes

• a1e5e2d: Fix promise hang when AbortSignal is aborted

Changelog

Sourced from @​tootallnate/once's changelog.

2.0.1

Patch Changes

• a1e5e2d: Fix promise hang when AbortSignal is aborted

Commits

• bcbb21d ci: fix OIDC publishing — Node 24, npm latest, provenance
• dc24387 Version Packages (2.x) (#12)
• b8a6f80 CI: test all Node versions on Linux only
• dabcc0f ci: drop EOL Node.js 14.x/16.x, add 22.x
• b464efc Update CI: modern Node versions, fix macOS ARM64 compat
• a1e5e2d Fix promise hang when AbortSignal is aborted
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​tootallnate/once since your current version.

Updates @xmldom/xmldom from 0.8.10 to 0.8.15

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.15

Commits

Fixed

• Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
• Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
• Security: trimming trailing whitespace from an XML end tag (ETag) is now anchored so it runs in linear time instead of backtracking quadratically on a long whitespace run, preventing a ReDoS reachable from DOMParser.parseFromString. Trimmed output is byte-identical. GHSA-x4fp-j954-r2f4
• Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — a check 0.8.x did not previously perform, preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
• Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
• Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content as a recoverable error instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's errorHandler. GHSA-6h8r-xr42-gp59

Thank you, @​ericchiang, @​bhaswanthc, @​arpitjain099, @​Paranoidgrinch, for your contributions

0.8.14

Commits

Fixed

• Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm

Thank you, @​bhaswanthc, @​jmestwa-coder, for your contributions

0.8.13

Commits

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -->
  • ProcessingInstruction: throws when data contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei,

... (truncated)

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.15

Fixed

• Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from DOMParser.parseFromString with default options. Serialized output is byte-identical. GHSA-965w-775f-mr7g
• Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the NamedNodeMap parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML no-duplicate-attributes well-formedness constraint. GHSA-8344-3jmq-59r6
• Security: trimming trailing whitespace from an XML end tag (ETag) is now anchored so it runs in linear time instead of backtracking quadratically on a long whitespace run, preventing a ReDoS reachable from DOMParser.parseFromString. Trimmed output is byte-identical. GHSA-x4fp-j954-r2f4
• Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <, and Node.prototype.normalize() merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per normalize() in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. GHSA-93r5-fhx6-vmg9
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now rejects a DocType name that is not a valid XML Name, throwing InvalidStateError — matching the sibling publicId/systemId/internalSubset checks and preventing XML injection via DocumentType.name. GHSA-27p8-2357-5qqv
• Security: XMLSerializer.serializeToString() under { requireWellFormed: true } now validates a processing-instruction target as an XML NCName and rejects a case-insensitive xml, throwing InvalidStateError — a check 0.8.x did not previously perform, preventing PI-target injection via >, ?, or whitespace. GHSA-c7q8-3ch8-vqpv
• Security: Document.createEntityReference() now rejects an invalid XML Name at creation, and XMLSerializer.serializeToString() under { requireWellFormed: true } validates an EntityReference nodeName as an XML Name, throwing InvalidStateError — preventing XML injection via an entity-reference name. GHSA-6gmq-8vp8-gcm6
• Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content as a recoverable error instead of accepting it silently, per the XML ETag production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported error to fatal via the parser's errorHandler. GHSA-6h8r-xr42-gp59

Thank you, @​ericchiang, @​bhaswanthc, @​arpitjain099, @​Paranoidgrinch, for your contributions

0.9.11

Fixed

• Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm
• Security: the processing-instruction grammar regex no longer backtracks quadratically on an unterminated processing instruction (<?… with no closing ?>), preventing a denial-of-service (ReDoS) reachable from DOMParser.parseFromString with default options. GHSA-g53g-w8rj-fmg7
• CharacterData nodeValue and data are now kept in sync [#990](https://github.com/xmldom/xmldom/issues/990)

Chore

• updated dependencies

Thank you, @​bhaswanthc, @​jmestwa-coder, @​stevenobiajulu, for your contributions

0.8.14

Fixed

• Security: XMLSerializer.serializeToString() now also rejects invalid element and attribute names when { requireWellFormed: true } is passed, throwing InvalidStateError for a name that is not a valid XML QName (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized xmlns: declaration). This prevents XML injection via createElement() / setAttribute(), extending the existing requireWellFormed checks to the serialized name set. GHSA-w2rr-34g9-rvrj GHSA-4w3w-2rp5-g8jm

Thank you, @​bhaswanthc, @​jmestwa-coder, for your contributions

0.9.10

... (truncated)

Commits

• b5b8fb5 0.8.15
• 327508e docs: add 0.8.15 CHANGELOG entry
• f40ccb8 fix: prevent quadratic malformed-tag recovery and normalize() adjacent-text m...
• 3abb093 fix: prevent end-tag whitespace-trim ReDoS via anchored trim (GHSA-x4fp-j954-...
• 2c548f2 fix: prevent quadratic attribute de-duplication via null-prototype membership...
• 08a74b4 test: characterize NamedNodeMap attribute de-duplication before the index ref...
• 954370f fix: prevent quadratic namespace-map memory consumption via prototype-chain i...
• 4430189 fix: report not-well-formed end-tag trailing content (GHSA-6h8r-xr42-gp59)
• 6c3fb5f fix: prevent XML injection via unsafe EntityReference name (GHSA-6gmq-8vp8-gcm6)
• 3b69487 fix: prevent XML injection via unsafe processing instruction target serializa...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.

Updates picomatch from 2.3.1 to 2.3.2

Release notes

Sourced from picomatch's releases.

2.3.2

This is a security release fixing several security relevant issues.

What's Changed

• fix: exception when glob pattern contains constructor by @​Jason3S in micromatch/picomatch#144
• Fix for CVE-2026-33671
• Fix for CVE-2026-33672

Full Changelog: micromatch/picomatch@2.3.1...2.3.2

Changelog

Sourced from picomatch's changelog.

2.3.2 (2026-03-23)

Fixed

• Avoided an exception when a glob pattern contains constructor (#144, 3f4f10e).

Security

• Backported the extglob-quantifier ReDoS fix from 4.0.4. Risky repeated extglobs are now safely rewritten or treated as literals by default; positive numeric maxExtglobRecursion values allow limited nesting, while false disables the safeguard (CVE-2026-33671, eec17ae).
• Prevented inherited object properties from being interpreted as POSIX character classes (CVE-2026-33672, fc1f6b6).

Commits

• 81cba8d Publish 2.3.2
• fc1f6b6 Merge commit from fork
• eec17ae Merge commit from fork
• 78f8ca4 Merge pull request #156 from micromatch/backport-144
• 3f4f10e Merge pull request #144 from Jason3S/jdent-object-properties
• See full diff in compare view

Removes decode-uri-component

Updates flatted from 3.3.3 to 3.4.4

Commits

• e6f5ca7 3.4.4
• 47f14fa removed E_STRICT from PHP
• 4050568 fixced go-lang issues in CI
• 4303f4d Merge pull request #101 from mfinelli/gocriticfixes
• 106735b updated package-lock.json
• 670a1bd 3.4.3
• 50a61a9 Fix #104 - allow null as replacer value
• 8aa64f4 solved crytical errors over dependencies
• b85577f Fix go-critic errors
• bb8c63c Merge pull request #100 from WebReflection/WebReflection-patch-1
• Additional commits viewable in compare view

Updates form-data from 4.0.2 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

• [Fix] escape CR, LF, and " in field names and filenames 8dff42c
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e
• [Deps] update hasown, mime-types 92ae0eb
• [Dev Deps] update js-randomness-predictor 67b0f65

v4.0.5 - 2025-11-17

Commits

• [Tests] Switch to newer v8 prediction library; enable node 24 testing 16e0076
• [Dev Deps] update @ljharb/eslint-config, eslint 5822467
• [Fix] set Symbol.toStringTag in the proper place 76d0dee

v4.0.4 - 2025-07-16

Commits

• [meta] add auto-changelog 811f682
• [Tests] handle predict-v8-randomness failures in node < 17 and node > 23 1d11a76
• [Fix] Switch to using crypto random for boundary values 3d17230
• [Tests] fix linting errors 5e34080
• [meta] actually ensure the readme backup isn’t published 316c82b
• [Dev Deps] update @ljharb/eslint-config 58c25d7
• [meta] fix readme capitalization 2300ca1

v4.0.3 - 2025-06-05

Fixed

• [Fix] append: avoid a crash on nullish values [#577](https://github.com/form-data/form-data/issues/577)

Commits

• [eslint] use a shared config 426ba9a
• [eslint] fix some spacing issues 2094191
• [Refactor] use hasown 81ab41b
• [Fix] validate boundary type in setBoundary() method 8d8e469
• [Tests] add tests to check the behavior of getBoundary with non-strings 837b8a1
• [Dev Deps] remove unused deps 870e4e6
• [meta] remove local commit hooks e6e83cc
• [Dev Deps] update eslint 4066fd6
• [meta] fix scripts to use prepublishOnly c4bbb13

Commits

• 64190db v4.0.6
• 92ae0eb [Deps] update hasown, mime-types
• f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
• 8dff42c [Fix] escape CR, LF, and " in field names and filenames
• 67b0f65 [Dev Deps] update js-randomness-predictor
• 68ff7dd v4.0.5
• 5822467 [Dev Deps] update @ljharb/eslint-config, eslint
• 76d0dee [Fix] set Symbol.toStringTag in the proper place
• 16e0076 [Tests] Switch to newer v8 prediction library; enable node 24 testing
• 41996f5 v4.0.4
• Additional commits viewable in compare view

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.

Updates lodash from 4.17.21 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

4.18.0

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#6099)
• Document lower > upper behavior in _.random (#6115)
• Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

Commits

• cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
• 75535f5 chore: prune stale advisory refs (#6170)
• 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
• 59be2de release(minor): bump to 4.18.0 (#6161)
• af63457 fix: broken tests for _.template 879aaa9
• 1073a76 fix: linting issues
• 879aaa9 fix: validate imports keys in _.template
• fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
• 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
• b819080 ci: add dist sync validation workflow (#6137)
• Additional commits viewable in compare view

Updates shell-quote from 1.8.3 to 1.12.0

Changelog

Sourced from shell-quote's changelog.

v1.12.0 - 2026-10-02

Fixed

• [New] parse: support here-documents (<<) [#31](https://github.com/ljharb/shell-quote/issues/31)

Commits

• [New] parse: support tab-stripping here-documents (<<-) dbfac37
• [New] parse: support output process substitution (>() 2053315
• [New] parse: support the case test-next terminator (;;&) 7d688b9
• [New] parse: support the case fall-through terminator (;&) f27010e
• [New] parse: support redirecting output despite noclobber (>|) b78d19c
• [New] parse: support opening a file for reading and writing (<>) 21cc333
• [New] parse: support redirecting stdout and stderr (&>) 6ad6cd2
• [New] parse: support appending stdout and stderr (&>>) 90cde9c
• [Dev Deps] update @ljharb/eslint-config 3a7b4ae

v1.11.0 - 2026-09-29

Fixed

• [Refactor] quote: drop a replace that can never match in the single-quote branch [#15](https://github.com/ljharb/shell-quote/issues/15)
• [New] parse: support bash ANSI-C quoting ($'...') [#32](https://github.com/ljharb/shell-quote/issues/32)

Commits

• [Fix] quote: reject line terminators in tokens after a comment 6002b2e
• [Fix] parse: preserve text after special shell parameters 81b08a5
• [Fix] parse: an escaped backslash does not escape the character after it d708019
• [Fix] quote: preserve ! in arguments that also contain ' ad39927
• [Fix] parse: treat $_name as a variable name, not $_ followed by text 28f88cd
• [Fix] quote: preserve empty glob patterns 35c9b97
• [Fix] quote: escape ~ in glob patterns to prevent shell tilde-expansion 239d49c
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, eslint, evalmd b1e406e
• [meta] npmignore some files ebfc308
• [actions] add permissions 3429b0d
• [actions] set least-privilege cache-mode 36f2394
• [Dev Deps] update eslint 6de9a41

v1.10.0 - 2026-07-10

Merged

• [New] parse: add opt-in splitUnquoted option for shell field-splitting of unquoted expansions [#1](https://github.com/ljharb/shell-quote/issues/1)

Commits

• [Fix] parse: match nested ${...} braces so nested parameter expansion is consumed as one substitution c0842c8
• [Tests] parse: pin single-quote literalness and unmatched-quote handling a0d03e3

... (truncated)

Commits

• 6ecb8aa v1.12.0
• 3a7b4ae [Dev Deps] update @ljharb/eslint-config
• 7d688b9 [New] parse: support the case test-next terminator (;;&)
• f27010e [New] parse: support the case fall-through terminator (;&)
• 90cde9c [New] parse: support appending stdout and stderr (&>>)
• 6ad6cd2 [New] parse: support redirecting stdout and stderr (&>)
• 2053315 [New] parse: support output process substitution (>()
• b78d19c [New] parse: support redirecting output despite noclobber (>|)
• 21cc333 [New] parse: support opening a file for reading and writing (\<>)
• dbfac37 [New] parse: support tab-stripping here-documents (<<-)
• Additional commits viewable in compare view

Updates source-map-js from 1.2.1 to 1.2.2

Release notes

Sourced from source-map-js's releases.

v1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Changelog

Sourced from source-map-js's changelog.

1.2.2

• Fix crash when executing in browser with CSP script-src that don't permit unsafe-eval (#29) @​xfournet

• Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)

  Reported by @​waydeshi in #76. A fix was also proposed by @​aniebiet in #78.

Commits

• 0a1d334 1.2.2
• 4c6fa26 Update changelog
• cf76580 Fix denial of service from malicious indexed source maps (CVE-2026-93749) (#79)
• 7899a86 Fix crash when executing browser with CSP script-src that don't permit unsafe...
• See full diff in compare view

Removes uuid

Updates yaml from 2.8.1 to 2.9.1

Release notes

Sourced from yaml's releases.

v2.9.1

• Limit recursive merge aliases (#685, #713)
• Simplify line unfolding during quoted string parsing (#714)

v2.9.0

The changes here are really only patches, but I'm releasing this as a minor version to note a small change to the documentation of parseDocument() and parseAllDocuments(): I've removed the claim that they'll "never throw".

It remains the case that practically all non-malicious inputs will be handled without emitting an error, but there is a decent chance that code paths remain where e.g. a RangeError due to call stack exhaustion can be triggered by malicious inputs. Up to now, I've considered these as security vulnerabilities, and in fact it's the only category of error for which yaml CVEs have been issued so far.

Starting from this release, I'll be considering such errors as bugs, but not vulnerabilities. I do welcome people and/or LLMs looking for them, but please report them as normal issues rather than suspected security vulnerabilities. This also applies to previously undiscovered bugs in earlier releases.

• fix: Avoid calling Array.prototype.push.apply() with large source array
• fix(lexer): Avoid recursive calls that may exhaust the call stack

v2.8.4

• Disable alias resolution with maxAliasCount:0Description has been truncated

[dependabot]

Looks like these dependencies are no longer updatable, so this is no longer needed.