Bump the npm_and_yarn group across 32 directories with 6 updates

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: undici.
Bumps the npm_and_yarn group with 1 update in the /compiler directory: undici.
Bumps the npm_and_yarn group with 2 updates in the /compiler/apps/playground directory: postcss and next.
Bumps the npm_and_yarn group with 1 update in the /compiler/packages/react-forgive/client directory: brace-expansion.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/art directory: brace-expansion and tar.
Bumps the npm_and_yarn group with 1 update in the /fixtures/attribute-behavior directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /fixtures/concurrent/time-slicing directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /fixtures/dom directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /fixtures/eslint-v6 directory: brace-expansion.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/eslint-v7 directory: brace-expansion and fast-uri.
Bumps the npm_and_yarn group with 1 update in the /fixtures/eslint-v8 directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /fixtures/eslint-v9 directory: brace-expansion.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/expiration directory: brace-expansion and tar.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/fiber-debugger directory: brace-expansion and tar.
Bumps the npm_and_yarn group with 1 update in the /fixtures/fizz directory: brace-expansion.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/flight directory: undici and postcss.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/flight-esm directory: undici and brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /fixtures/flight-ssr-bench directory: fast-uri.
Bumps the npm_and_yarn group with 1 update in the /fixtures/legacy-jsx-runtimes directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /fixtures/legacy-jsx-runtimes/react-14 directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /fixtures/owner-stacks directory: fast-uri.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/browserify/dev directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/systemjs-builder/prod directory: brace-expansion.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/packaging/webpack-alias/dev directory: brace-expansion and tar.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/packaging/webpack-alias/prod directory: brace-expansion and tar.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/packaging/webpack/dev directory: brace-expansion and tar.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/packaging/webpack/prod directory: brace-expansion and tar.
Bumps the npm_and_yarn group with 1 update in the /fixtures/ssr directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /fixtures/ssr2 directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /fixtures/view-transition directory: fast-uri.
Bumps the npm_and_yarn group with 1 update in the /scripts/bench directory: brace-expansion.
Bumps the npm_and_yarn group with 1 update in the /scripts/release directory: brace-expansion.

Updates undici from 5.28.4 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	6.27.0	b7f252e7
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	6.27.0	25efa447
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	6.27.0	25efa447
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	6.27.0	f4c31d60

---

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did

... (truncated)

Commits

• 01a912e Bumped v6.28.0 (#5591)
• 481ecfc Use Node 22 and npm 11 to release
• 740a0b7 fix: validate blob body content type
• 2698e49 fix: validate coerced header values for CRLF (#5579)
• 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
• cba3a52 fix(retry): reject partial content length mismatch
• af74840 fix: harden cookie domain, path, and unparsed attribute validation
• 551138c Bumped v6.27.0 (#5431)
• b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
• 25efa44 fix(cookies): preserve values and parse SameSite strictly
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates undici from 6.23.0 to 6.28.0

Release notes

Sourced from undici's releases.

v6.28.0

⚠️ Security fixes

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

The v6 line is not affected by the SOCKS5 advisories (GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj), the shared-cache disclosure (GHSA-pr7r-676h-xcf6), or the 8.x-only WebSocket regression (GHSA-38rv-x7px-6hhq).

Summary

Advisory	CVE	Severity (CVSS)	Fixed in	Fix commit
GHSA-vxpw-j846-p89q	CVE-2026-12151	High (7.5)	6.27.0	b7f252e7
GHSA-p88m-4jfj-68fv	CVE-2026-9679	Moderate (5.9)	6.27.0	25efa447
GHSA-g8m3-5g58-fq7m	CVE-2026-11525	Low (3.7)	6.27.0	25efa447
GHSA-35p6-xmwp-9g52	CVE-2026-6733	Low (3.7)	6.27.0	f4c31d60

---

High severity

WebSocket DoS via fragment count bypass — CVE-2026-12151

GHSA-vxpw-j846-p89q · CWE-400, CWE-770 Fix: b7f252e7 Backport WebSocket maxPayloadSize fixes (#5423, backported to v6 in #5428)

A malicious WebSocket server can stream a large number of small or empty continuation frames. Undici enforced a limit on cumulative payload size but did

... (truncated)

Commits

• 01a912e Bumped v6.28.0 (#5591)
• 481ecfc Use Node 22 and npm 11 to release
• 740a0b7 fix: validate blob body content type
• 2698e49 fix: validate coerced header values for CRLF (#5579)
• 4fd5a0c test(retry): correct broken content-range fixtures in retry-handler.js
• cba3a52 fix(retry): reject partial content length mismatch
• af74840 fix: harden cookie domain, path, and unparsed attribute validation
• 551138c Bumped v6.27.0 (#5431)
• b7f252e Backport WebSocket maxPayloadSize fixes to v7.x (#5423) (#5428)
• 25efa44 fix(cookies): preserve values and parse SameSite strictly
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates postcss from 8.4.47 to 8.5.23

Release notes

Sourced from postcss's releases.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

• Fixed postcss-scss commend regression.

8.5.12

• Fixed reading any file via user-generated CSS.
• Added opts.unsafeMap to disable checks.

8.5.11

• Fixed nested brackets parsing performance (by @​offset).

8.5.10

• Fixed XSS via unescaped </style> in non-bundler cases (by @​TharVid).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

... (truncated)

Commits

• eb9e1fe Release 8.5.23 version
• 9d19c78 Update dependencies
• 7beca13 Does no load source map file without opts.from
• decea51 Typo
• c18e30d Update EM banner
• 98a39ad Update EM banner
• a3e48c4 Release 8.5.22 version
• f49d691 Fix custom property losing its semicolon before a comment (#2117)
• 28e0daf Release 8.5.21 version
• 3d2b4e4 Update dependencies
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates next from 15.5.9 to 15.5.21

Release notes

Sourced from next's releases.

v15.5.21

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v15.5.20

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 15.5.15.

15.5.19

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [15.5.x] Don't drop FormData entries (#94244)

Other

• [15.5.x] Fix CI (#94281)

Credits

Huge thanks to @​eps1lon for helping!

Commits

• e26f6ff v15.5.21
• 7f5deeb [15.x] Improve performance of checking valid MPA form submissions
• 57c31f7 [15.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• e3e5666 [15.x] Set correct origin for internal redirects in custom server
• 35f5013 [15.x] Ensure exotic rewrite param values are properly encoded
• 062f667 [15.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• 577c9dc [15.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
• 530d4fa [15.x] fix(next/image): improve performance of detectContentType()
• 8fabaf3 [15.x] Performance improvements when decoding React Server function payloads
• ff12a61 [15.x] Validate server reference IDs during manifest lookup
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates brace-expansion from 2.0.1 to 2.1.4

Release notes

Sourced from brace-expansion's releases.

v2.1.1

• Backport v5.0.6 change to v2 (#109) c3a817c

---

juliangruber/brace-expansion@v2.1.0...v2.1.1

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

---

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

• b25213d 2.1.4
• 1e30c93 Merge commit from fork
• 878df39 2.1.3
• c8bd93c npm ignore .claude
• d13ff45 fix: backport GHSA-mh99-v99m-4gvg (#130)
• 9e67a3b 2.1.2
• 835d6be fix: v2 backport for CVE-2026-13149 (#123)
• 64b71d3 2.1.1
• c3a817c Backport v5.0.6 change to v2 (#109)
• 1ee4a90 2.1.0
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.6 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v2.1.1

• Backport v5.0.6 change to v2 (#109) c3a817c

---

juliangruber/brace-expansion@v2.1.0...v2.1.1

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

---

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

• b25213d 2.1.4
• 1e30c93 Merge commit from fork
• 878df39 2.1.3
• c8bd93c npm ignore .claude
• d13ff45 fix: backport GHSA-mh99-v99m-4gvg (#130)
• 9e67a3b 2.1.2
• 835d6be fix: v2 backport for CVE-2026-13149 (#123)
• 64b71d3 2.1.1
• c3a817c Backport v5.0.6 change to v2 (#109)
• 1ee4a90 2.1.0
• Additional commits viewable in compare view

Updates tar from 2.2.1 to 2.2.2

Commits

• 523c5c7 2.2.2
• 7ecef07 Bump fstream to fix hardlink overwriting vulnerability
• 9fc84b9 Use {} for hardlink tracking instead of []
• 15e59f1 Only track previously seen hardlinks
• 4f85851 Ignore potentially unsafe files
• See full diff in compare view

Updates brace-expansion from 1.1.8 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v2.1.1

• Backport v5.0.6 change to v2 (#109) c3a817c

---

juliangruber/brace-expansion@v2.1.0...v2.1.1

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

---

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

• b25213d 2.1.4
• 1e30c93 Merge commit from fork
• 878df39 2.1.3
• c8bd93c npm ignore .claude
• d13ff45 fix: backport GHSA-mh99-v99m-4gvg (#130)
• 9e67a3b 2.1.2
• 835d6be fix: v2 backport for CVE-2026-13149 (#123)
• 64b71d3 2.1.1
• c3a817c Backport v5.0.6 change to v2 (#109)
• 1ee4a90 2.1.0
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v2.1.1

• Backport v5.0.6 change to v2 (#109) c3a817c

---

juliangruber/brace-expansion@v2.1.0...v2.1.1

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

---

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

• b25213d 2.1.4
• 1e30c93 Merge commit from fork
• 878df39 2.1.3
• c8bd93c npm ignore .claude
• d13ff45 fix: backport GHSA-mh99-v99m-4gvg (#130)
• 9e67a3b 2.1.2
• 835d6be fix: v2 backport for CVE-2026-13149 (#123)
• 64b71d3 2.1.1
• c3a817c Backport v5.0.6 change to v2 (#109)
• 1ee4a90 2.1.0
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v2.1.1

• Backport v5.0.6 change to v2 (#109) c3a817c

---

juliangruber/brace-expansion@v2.1.0...v2.1.1

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

---

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

• b25213d 2.1.4
• 1e30c93 Merge commit from fork
• 878df39 2.1.3
• c8bd93c npm ignore .claude
• d13ff45 fix: backport GHSA-mh99-v99m-4gvg (#130)
• 9e67a3b 2.1.2
• 835d6be fix: v2 backport for CVE-2026-13149 (#123)
• 64b71d3 2.1.1
• c3a817c Backport v5.0.6 change to v2 (#109)
• 1ee4a90 2.1.0
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v2.1.1

• Backport v5.0.6 change to v2 (#109) c3a817c

---

juliangruber/brace-expansion@v2.1.0...v2.1.1

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

---

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

• b25213d 2.1.4
• 1e30c93 Merge commit from fork
• 878df39 2.1.3
• c8bd93c npm ignore .claude
• d13ff45 fix: backport GHSA-mh99-v99m-4gvg (#130)
• 9e67a3b 2.1.2
• 835d6be fix: v2 backport for CVE-2026-13149 (#123)
• 64b71d3 2.1.1
• c3a817c Backport v5.0.6 change to v2 (#109)
• 1ee4a90 2.1.0
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v2.1.1

• Backport v5.0.6 change to v2 (#109) c3a817c

---

juliangruber/brace-expansion@v2.1.0...v2.1.1

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

---

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

• b25213d 2.1.4
• 1e30c93 Merge commit from fork
• 878df39 2.1.3
• c8bd93c npm ignore .claude
• d13ff45 fix: backport GHSA-mh99-v99m-4gvg (#130)
• 9e67a3b 2.1.2
• 835d6be fix: v2 backport for CVE-2026-13149 (#123)
• 64b71d3 2.1.1
• c3a817c Backport v5.0.6 change to v2 (#109)
• 1ee4a90 2.1.0
• Additional commits viewable in compare view

Updates fast-uri from 3.0.6 to 3.1.5

Release notes

Sourced from fast-uri's releases.

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

• Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

v3.1.2

⚠️ Security Release

• Fix for GHSA-v39h-62p7-jpjc

What's Changed

• Handle malformed fragment decoding as a parse error by @​mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

• Fix for GHSA-q3j6-qgpj-74h6

What's Changed

• build(deps-dev): bump tsd from 0.32.0 to 0.33.0 by @​dependabot[bot] in fastify/fast-uri#148
• build(deps): bump actions/checkout from 4 to 5 by @​dependabot[bot] in fastify/fast-uri#149
• chore(.npmrc): ignore scripts by @​Fdawgs in fastify/fast-uri#150
• build(deps-dev): remove @​fastify/pre-commit by @​Fdawgs in fastify/fast-uri#151
• build(deps): bump actions/setup-node from 4 to 5 by @​dependabot[bot] in fastify/fast-uri#152
• ci(ci): add concurrency config by @​Fdawgs in fastify/fast-uri#153
• build(deps): bump actions/setup-node from 5 to 6 by @​dependabot[bot] in fastify/fast-uri#154
• build(deps): bump actions/checkout from 5 to 6 by @​dependabot[bot] in fastify/fast-uri#156
• chore(license): standardise license notice by @​Fdawgs in fastify/fast-uri#159
• style: remove trailing whitespace by @​Fdawgs in fastify/fast-uri#161
• ci: remove unused github files by @​Tony133 in fastify/fast-uri#162
• chore: update readme by @​Tony133 in fastify/fast-uri#164

... (truncated)

Commits

• 5e179cb Bumped v3.1.5
• 2cad02d Merge commit from fork
• 6aeece6 Bumped v3.1.4
• 2d50fba fix: reject literal backslash in URI authority
• 0549fe3 Bumped v3.1.3
• 2a6d357 Merge commit from fork
• 919dd8e Bumped v3.1.2
• c65ba57 fixup: linting
• 6c86c17 Merge commit from fork
• a95158a Handle malformed fragment decoding without throwing (#171)
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.11 to 1.1.18

Release notes

Sourced from brace-expansion's releases.

v2.1.1

• Backport v5.0.6 change to v2 (#109) c3a817c

---

juliangruber/brace-expansion@v2.1.0...v2.1.1

v2.0.2

• pkg: publish on tag 2.x 14f1d91
• fmt ed7780a
• Fix potential ReDoS Vulnerability or Inefficient Regular Expression (#65) 36603d5

---

juliangruber/brace-expansion@v2.0.1...v2.0.2

Commits

• b25213d 2.1.4
• 1e30c93 Merge commit from fork
• 878df39 2.1.3
• c8bd93c npm ignore .claude
• Description has been truncated