chore(deps): bump the npm_and_yarn group across 2 directories with 16 updates

[dependabot]

Bumps the npm_and_yarn group with 13 updates in the / directory:

Package	From	To
dompurify	3.4.7	3.4.11
mongoose	8.21.0	8.22.1
vite	4.5.14	8.1.2
vite	8.0.14	8.1.2
flatted	3.3.3	3.4.2
form-data	4.0.5	4.0.6
js-cookie	2.2.1	3.0.8
path-to-regexp	0.1.12	0.1.13
ws	8.20.1	8.21.0
qs	6.14.1	6.15.3
react-router	6.30.1	7.18.1
shell-quote	1.8.3	1.8.4
undici	7.25.0	7.28.0
yaml	2.8.0	2.9.0

Bumps the npm_and_yarn group with 4 updates in the /backend directory: mongoose, esbuild, path-to-regexp and ws.

Updates dompurify from 3.4.7 to 3.4.11

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.11

• Fixed an issue with a leaky config for hooks via setConfig, thanks @​trace37labs
• Bumped vulnerable development dependencies to arrive at plain 0 with npm audit
• Updated the osv-scanner suppression list as no vulnerable dependencies are left for now
• Updated up the linting tool-chain and removed now-redundant lint directives
• Updated the documentation is several spots, README, wiki, etc.
• Bumped several dependencies where possible

DOMPurify 3.4.10

• Refactored codebase for clarity: extracted the public type declarations into types.ts
• Decomposed the three largest sanitizer functions into focused helpers
• Removed duplicated defaults and dead branches, consolidated SAFE_FOR_TEMPLATES scrubbing into single shared path
• Improved per-node performance by hoisting the mXSS probe regexes and testing textContent before innerHTML
• Added a deterministic micro-benchmark harness (npm run bench) with a --compare mode
• Reduced CI cost by running the full three-engine browser suite once per PR
• Refreshed the demos/ folder so every demo runs again, and added a SVG-via-<img> demo
• Documented the bench and test:happydom scripts in the README
• Completed the Attack Classes & Bypass History wiki page
• Bumped several dependencies where possible

DOMPurify 3.4.9

• Further improved the handling of Trusted Types config options, thanks @​offset
• Further improved the handling of IN_PLACE sanitization, thanks @​mozfreddyb
• Added more test coverage for IN_PLACE and Trusted Types related usage
• Bumped several dependencies where possible
• Updated README and wiki with more accurate documentation & attack samples

DOMPurify 3.4.8

• Cleaned up the repository root, renamed some and removed unneeded files
• Fixed an issue with handling of Trusted Types policies, thanks @​fulstadev
• Fixed the node iterator for better template scrubbing, thanks @​IamLeandrooooo
• Included formerly missing LICENSE-MPL in published npm package, thanks @​asamuzaK
• Bumped several dependencies where possible

Commits

• 0cae518 release: 3.4.11 (#1494)
• 6ee5716 release: 3.4.10 (#1478)
• 5210247 release: 3.4.9 (#1459)
• bcdd828 release: 3.4.8 (#1439)
• See full diff in compare view

Updates mongoose from 8.21.0 to 8.22.1

Release notes

Sourced from mongoose's releases.

8.22.1 / 2025-02-04

• fix: handle other top-level query operators in sanitizeFilter
• fix(document): when cloning a doc with subdocs, make sure the subdocs parent is the cloned doc #15904 #15901
• types(models): support Mongoose query casting in AnyBulkWriteOperation filter property #15910
• types: add toBSON() to documents #15927

8.22.0 / 2026-01-27

• feat(model): allow passing strict option to hydrate() #15944 #15940

8.21.1

• fix(clone): fix parent doc for map subdocuments and array subdocuments #15958 AbdelrahmanHafez
• fix(document): when cloning a doc with subdocs, make sure the subdocs parent is the cloned doc #15904 #15901
• fix: respect currentTime schema option in bulkWrite updates #15976 sderrow
• types(models): support Mongoose query casting in AnyBulkWriteOperation filter property #15910
• types: add toBSON() to documents #15927

Changelog

Sourced from mongoose's changelog.

8.22.1 / 2026-02-04

• fix: handle other top-level query operators in sanitizeFilter
• fix(document): when cloning a doc with subdocs, make sure the subdocs parent is the cloned doc #15904 #15901
• types(models): support Mongoose query casting in AnyBulkWriteOperation filter property #15910
• types: add toBSON() to documents #15927

7.8.9 / 2026-02-04

• fix: handle other top-level query operators in sanitizeFilter

8.22.0 / 2026-01-27

• feat(model): allow passing strict option to hydrate() #15944 #15940

8.21.1 / 2026-01-23

• fix(clone): fix parent doc for map subdocuments and array subdocuments #15958 AbdelrahmanHafez
• fix(document): when cloning a doc with subdocs, make sure the subdocs parent is the cloned doc #15904 #15901
• fix: respect currentTime schema option in bulkWrite updates #15976 sderrow
• types(models): support Mongoose query casting in AnyBulkWriteOperation filter property #15910
• types: add toBSON() to documents #15927

9.1.5 / 2026-01-20

• fix(map): validate map subdocument when loaded with init #15960 #15957 AbdelrahmanHafez
• fix(discriminator): prevent indexes and callQueue duplication with shared nested schemas #15974 #15966 AbdelrahmanHafez
• fix(subdocuments): do not pass parent path on init #15970 #15969 #15682 AbdelrahmanHafez
• types(inferrawdoctype): correct handling for subdocs and doc arrays #15967 #13772
• docs: improve grammar and clarity in TypeScript schema comments #15971 harshsinghpujari

9.1.4 / 2026-01-15

• fix: attach sessions to docs retrieved by cursor #15953 #15949 mjfwalsh
• fix(model): make hydrate() handle nested schema arrays #15964 #15956
• fix(clone): fix parent doc for map subdocuments and array subdocuments #15958 #15954 AbdelrahmanHafez
• fix: prevent crash when accessing nested paths on prototype #15962 #15961 som14062005

9.1.3 / 2026-01-09

• fix(model): support timestamps option to insertMany() as both boolean and QueryTimestampsConfig #15941 #15938
• fix(query): include preview of current and incoming update in error when merging normal update with pipeline #15939 #15928
• types(model): apply basic type casting to paths underneath subdocuments #15948 #15947
• types(utility): make WithLevel1NestedPaths correctly handle PopulatedDoc and other TypeScript unions with Document members #15942 #15923
• docs(schema): expose "DocumentArrayElement" #15590 hasezoey

9.1.2 / 2026-01-05

• fix(subdocs): pass options to pre-save hooks for subdocs #15921 #15920 AbdelrahmanHafez
• perf(model): select only _id when checking document existence during save() #15919 AbdelrahmanHafez

... (truncated)

Commits

• 472e7c7 chore: release 8.22.1
• 1735149 Merge branch '7.x' into 8.x
• 5227801 chore: release 7.8.9
• b804e34 fix: handle other top-level query operators in sanitizeFilter
• 8d9a81f chore: release 8.22.0
• f752854 Merge pull request #15985 from Automattic/8.22
• e7a57ed avoid hardcoding dbName
• 31adbb4 chore: release 8.21.1
• 62a5af7 test: bring test cases from #15958 into 8.x to ensure fixes are applied in 8.x
• bc8cb23 implement review suggestions
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mongoose since your current version.

Updates vite from 4.5.14 to 8.1.2

Release notes

Sourced from vite's releases.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

v8.0.8

Please refer to CHANGELOG.md for details.

v8.0.7

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.1.2 (2026-06-30)

Bug Fixes

• deps: revert es-module-lexer to 2.1.0 (#22827) (0d3bd7c)
• restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (#22825) (efb98cc)
• revert, "fix: escape ids with multiple null bytes (#22687)" (cccef55)
• revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (cf97711)

8.1.1 (2026-06-30)

Features

• update dynamic import warning to link to Vite docs (#22823) (62bd7af)

Bug Fixes

• bundled-dev: avoid stack overflow on import.meta.hot.invalidate() (#22797) (709eb8e)
• bundled-dev: serve assets emitted during HMR/lazy compile (#22745) (5876b2c)
• bundledDev: skip plugin transform hooks for rolldown-lazy stub modules (#22778) (8f925e2)
• css: preserve dollar signs in external @import urls with lightningcss (#22718) (9fa7ab4)
• css: resolve tsconfig paths in CSS and Sass @​import (#22775) (ef0b891)
• deps: update all non-major dependencies (#22734) (e635f49)
• deps: update all non-major dependencies (#22804) (8837400)
• deps: update rolldown-related dependencies (#22591) (2ce6677)
• escape ids with multiple null bytes (#22687) (833fc30)
• hide console window when running 'net use' on Windows (#22698) (92b63f2)
• ignore bundled config temp dir (#22800) (043a810)
• invert esbuild.jsxSideEffects when converting to oxc.jsx.pure (#22809) (33895ba)
• optimize-deps: ignore ERR_CLOSED_SERVER in scanner (#22784) (085a0ab)
• optimizer: scanner should resolve input from root (#22769) (9722b07)
• resolve pnpm .modules.yaml from workspace root instead of cwd (#22757) (2531ac7)
• return sourcemap field from some plugins that were lacking (#22782) (7e18bf8)
• server: handle malformed URI in indexHtmlMiddleware (#22781) (84f5ccc)

Miscellaneous Chores

• improve dependency optimizer messages (#22549) (092cb3b)

Code Refactoring

• css: remove lightningcss null byte bug workaround (#22822) (2dafd3b)
• use pre-defined environments variable to avoid duplicate Object.values calls (#22790) (1113acf)

Tests

• enable "manual chunk path" test and remove "worker.format error" test (#22824) (c088511)

8.1.0 (2026-06-23)

Features

• extend server.fs.deny list with common files (#22707) (61ba8fd)

... (truncated)

Commits

• ba31193 release: v8.1.2
• 0d3bd7c fix(deps): revert es-module-lexer to 2.1.0 (#22827)
• efb98cc fix: restore, "fix: resolve pnpm .modules.yaml from workspace root instead of...
• cf97711 fix: revert, "fix: resolve pnpm .modules.yaml from workspace root instead of ...
• cccef55 fix: revert, "fix: escape ids with multiple null bytes (#22687)"
• 4ae9e14 release: v8.1.1
• 8f925e2 fix(bundledDev): skip plugin transform hooks for rolldown-lazy stub modules (...
• c088511 test: enable "manual chunk path" test and remove "worker.format error" test (...
• 62bd7af feat: update dynamic import warning to link to Vite docs (#22823)
• 2dafd3b refactor(css): remove lightningcss null byte bug workaround (#22822)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.

Updates vite from 8.0.14 to 8.1.2

Release notes

Sourced from vite's releases.

v8.1.2

Please refer to CHANGELOG.md for details.

v8.1.1

Please refer to CHANGELOG.md for details.

create-vite@8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0

Please refer to CHANGELOG.md for details.

v8.1.0

Please refer to CHANGELOG.md for details.

plugin-legacy@8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.1.0-beta.0

Please refer to CHANGELOG.md for details.

v8.0.16

Please refer to CHANGELOG.md for details.

v8.0.15

Please refer to CHANGELOG.md for details.

v8.0.14

Please refer to CHANGELOG.md for details.

v8.0.13

Please refer to CHANGELOG.md for details.

v8.0.12

Please refer to CHANGELOG.md for details.

v8.0.11

Please refer to CHANGELOG.md for details.

v8.0.10

Please refer to CHANGELOG.md for details.

v8.0.9

Please refer to CHANGELOG.md for details.

v8.0.8

Please refer to CHANGELOG.md for details.

v8.0.7

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

8.1.2 (2026-06-30)

Bug Fixes

• deps: revert es-module-lexer to 2.1.0 (#22827) (0d3bd7c)
• restore, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (#22825) (efb98cc)
• revert, "fix: escape ids with multiple null bytes (#22687)" (cccef55)
• revert, "fix: resolve pnpm .modules.yaml from workspace root instead of cwd (#22757)" (cf97711)

8.1.1 (2026-06-30)

Features

• update dynamic import warning to link to Vite docs (#22823) (62bd7af)

Bug Fixes

• bundled-dev: avoid stack overflow on import.meta.hot.invalidate() (#22797) (709eb8e)
• bundled-dev: serve assets emitted during HMR/lazy compile (#22745) (5876b2c)
• bundledDev: skip plugin transform hooks for rolldown-lazy stub modules (#22778) (8f925e2)
• css: preserve dollar signs in external @import urls with lightningcss (#22718) (9fa7ab4)
• css: resolve tsconfig paths in CSS and Sass @​import (#22775) (ef0b891)
• deps: update all non-major dependencies (#22734) (e635f49)
• deps: update all non-major dependencies (#22804) (8837400)
• deps: update rolldown-related dependencies (#22591) (2ce6677)
• escape ids with multiple null bytes (#22687) (833fc30)
• hide console window when running 'net use' on Windows (#22698) (92b63f2)
• ignore bundled config temp dir (#22800) (043a810)
• invert esbuild.jsxSideEffects when converting to oxc.jsx.pure (#22809) (33895ba)
• optimize-deps: ignore ERR_CLOSED_SERVER in scanner (#22784) (085a0ab)
• optimizer: scanner should resolve input from root (#22769) (9722b07)
• resolve pnpm .modules.yaml from workspace root instead of cwd (#22757) (2531ac7)
• return sourcemap field from some plugins that were lacking (#22782) (7e18bf8)
• server: handle malformed URI in indexHtmlMiddleware (#22781) (84f5ccc)

Miscellaneous Chores

• improve dependency optimizer messages (#22549) (092cb3b)

Code Refactoring

• css: remove lightningcss null byte bug workaround (#22822) (2dafd3b)
• use pre-defined environments variable to avoid duplicate Object.values calls (#22790) (1113acf)

Tests

• enable "manual chunk path" test and remove "worker.format error" test (#22824) (c088511)

8.1.0 (2026-06-23)

Features

• extend server.fs.deny list with common files (#22707) (61ba8fd)

... (truncated)

Commits

• ba31193 release: v8.1.2
• 0d3bd7c fix(deps): revert es-module-lexer to 2.1.0 (#22827)
• efb98cc fix: restore, "fix: resolve pnpm .modules.yaml from workspace root instead of...
• cf97711 fix: revert, "fix: resolve pnpm .modules.yaml from workspace root instead of ...
• cccef55 fix: revert, "fix: escape ids with multiple null bytes (#22687)"
• 4ae9e14 release: v8.1.1
• 8f925e2 fix(bundledDev): skip plugin transform hooks for rolldown-lazy stub modules (...
• c088511 test: enable "manual chunk path" test and remove "worker.format error" test (...
• 62bd7af feat: update dynamic import warning to link to Vite docs (#22823)
• 2dafd3b refactor(css): remove lightningcss null byte bug workaround (#22822)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vite since your current version.

Updates flatted from 3.3.3 to 3.4.2

Commits

• 3bf0909 3.4.2
• 885ddcc fix CWE-1321
• 0bdba70 added flatted-view to the benchmark
• 2a02dce 3.4.1
• fba4e8f Merge pull request #89 from WebReflection/python-fix
• 5fe8648 added "when in Rome" also a test for PHP
• 53517ad some minor improvement
• b3e2a0c Fixing recursion issue in Python too
• c4b46db Add SECURITY.md for security policy and reporting
• f86d071 Create dependabot.yml for version updates
• Additional commits viewable in compare view

Updates form-data from 4.0.5 to 4.0.6

Changelog

Sourced from form-data's changelog.

v4.0.6 - 2026-06-12

Commits

• [Fix] escape CR, LF, and " in field names and filenames 8dff42c
• [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape f31d21e
• [Deps] update hasown, mime-types 92ae0eb
• [Dev Deps] update js-randomness-predictor 67b0f65

Commits

• 64190db v4.0.6
• 92ae0eb [Deps] update hasown, mime-types
• f31d21e [Dev Deps] update @ljharb/eslint-config, auto-changelog, tape
• 8dff42c [Fix] escape CR, LF, and " in field names and filenames
• 67b0f65 [Dev Deps] update js-randomness-predictor
• See full diff in compare view

Updates js-cookie from 2.2.1 to 3.0.8

Release notes

Sourced from js-cookie's releases.

v3.0.8

• Restore ES5 compatibility, inadvertently broken in 3.0.7 - #959
• Lift Node version restriction, inadvertently restricted to >= 20 in 3.0.7 - #956

v3.0.7

• Prevent cookie attribute injection: CVE-2026-46625 (eb3c40e)
• Add Partitioned attribute to readme (b994768)
• Publish to npm registry via trusted publisher exclusively (4dc71be)
• Ensure consistent behaviour for get('name') + get() (1953d30)

v3.0.5

• Remove npm version restriction in package.json - #818

v3.0.4

• Publish to npmjs.com with package provenance

v3.0.1

• Make package.json accessible in export - #727

v3.0.0

• Removed defaults in favor of a builder: now to supply an api instance with particular predefined (cookie) attributes there's Cookies.withAttributes(), e.g.:

const api = Cookies.withAttributes({
  path: '/',
  secure: true
})
api.set('key', 'value') // writes cookie with path: '/' and secure: true...

• The attributes that an api instance is configured with are exposed as attributes property; it's an immutable object and unlike defaults cannot be changed to configure the api.
• The mechanism to fall back to the standard, internal converter by returning a falsy value in a custom read converter has been removed. Instead the default converters are now exposed as Cookies.converter, which allows for implementing self-contained custom converters providing the same behavior:

const customReadConverter = (value, name) => {
  if (name === 'special') {
    return unescape(value)
  }
  return Cookies.converter.read(value)
}

• withConverter() no longer accepts a function as argument to be turned into a read converter. It is now required to always pass an object with the explicit type(s) of converter(s):

const api = Cookies.withConverter({
  read: (value, name) => unescape(value)
})

• The converter(s) that an api instance is configured with are exposed as converter property; it's an immutable object and cannot be changed to configure the api.
• Started providing library as ES module, in addition to UMD module. The module field in package.json points to an ES module variant of the library.
• Started using browser field instead of main in package.json (for the UMD variant of the library).
• Dropped support for IE < 10.
• Removed built-in JSON support, i.e. getJSON() and automatic stringifying in set(): use Cookies.set('foo', JSON.stringify({ ... })) and JSON.parse(Cookies.get('foo')) instead.
• Removed support for Bower.

... (truncated)

Commits

• d7a1096 Craft v3.0.8 release
• 248e685 Use existing Chrome with puppeteer
• fc04269 Remove QUnit related workaround in Grunt config
• 265a685 Tidy up package lock file
• 478e591 Disable Node deprecation DEP0044 for release workflow
• 331d524 Fix node version config for E2E test job
• 11d773d Ensure ECMAScript compatibility
• d788646 Remove engines property from package
• e7d9a4d Fix typo in test assertion message
• b5fca24 Make credentials use explicit in release workflow
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for js-cookie since your current version.

Updates path-to-regexp from 0.1.12 to 0.1.13

Release notes

Sourced from path-to-regexp's releases.

0.1.13

Important

• Fix CVE-2026-4867 (GHSA-37ch-88jc-xwx2)

Full Changelog: pillarjs/path-to-regexp@v0.1.12...v.0.1.13

Changelog

Sourced from path-to-regexp's changelog.

0.1.13 / 2026-03-26

• Fix CVE-2026-4867 (GHSA-37ch-88jc-xwx2)

0.1.7 / 2015-07-28

• Fixed regression with escaped round brackets and matching groups.

0.1.6 / 2015-06-19

• Replace index feature by outputting all parameters, unnamed and named.

0.1.5 / 2015-05-08

• Add an index property for position in match result.

0.1.4 / 2015-03-05

• Add license information

0.1.3 / 2014-07-06

• Better array support
• Improved support for trailing slash in non-ending mode

0.1.0 / 2014-03-06

• add options.end

0.0.2 / 2013-02-10

• Update to match current express
• add .license property to component.json

Commits

• 9fd0c87 0.1.13 (#425)
• 7ccf02c fix: CVE-2026-4867
• See full diff in compare view

Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for path-to-regexp since your current version.

Updates ws from 8.20.1 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• See full diff in compare view

Updates qs from 6.14.1 to 6.15.3

Changelog

Sourced from qs's changelog.

6.15.3

• [Fix] parse: enforce throwOnLimitExceeded for cumulative array growth via combine/merge
• [Fix] utils: respect encoding of surrogate pairs across chunks (#559)
• [Robustness] parse: throw the arrayLimit error before splitting oversized comma values
• [Robustness] utils.merge / utils.assign: avoid invoking __proto__ setter when copying own properties
• [Robustness] utils: enforce arrayLimit consistently across merge's array paths
• [Perf] utils: make compact O(n) via a side-channel visited-set instead of Array.indexOf
• [Deps] update side-channel
• [Dev Deps] update eslint, mock-property, tape
• [Tests] parse: characterize current lenient handling of unbalanced bracket keys (#558)

6.15.2

• [Fix] stringify: skip null/undefined entries in arrayFormat: 'comma' + encodeValuesOnly instead of crashing in encoder
• [Fix] stringify: use configured delimiter after charsetSentinel (#555)
• [Fix] stringify: apply formatter to encoded key under strictNullHandling (#554)
• [Fix] stringify: skip null/undefined filter-array entries instead of crashing in encoder (#551)
• [Fix] parse: handle nested bracket groups and add regression tests (#530)
• [readme] fix grammar (#550)
• [Dev Deps] update @ljharb/eslint-config
• [Tests] add regression tests for keys containing percent-encoded bracket text

6.15.1

• [Fix] parse: parameterLimit: Infinity with throwOnLimitExceeded: true silently drops all parameters
• [Deps] update @ljharb/eslint-config
• [Dev Deps] update @ljharb/eslint-config, iconv-lite
• [Tests] increase coverage

6.15.0

• [New] parse: add strictMerge option to wrap object/primitive conflicts in an array (#425, #122)
• [Fix] duplicates option should not apply to bracket notation keys (#514)

6.14.2

• [Fix] parse: mark overflow objects for indexed notation exceeding arrayLimit (#546)
• [Fix] arrayLimit means max count, not max index, in combine/merge/parseArrayValue
• [Fix] parse: throw on arrayLimit exceeded with indexed notation when throwOnLimitExceeded is true (#529)
• [Fix] parse: enforce arrayLimit on comma-parsed values
• [Fix] parse: fix error message to reflect arrayLimit as max index; remove extraneous comments (#545)
• [Robustness] avoid .push, use void
• [readme] document that addQueryPrefix does not add ? to empty output (#418)
• [readme] clarify parseArrays and arrayLimit documentation (#543)
• [readme] replace runkit CI badge with shields.io check-runs badge
• [meta] fix changelog typo (arrayLength → arrayLimit)
• [actions] fix rebase workflow permissions

Commits

• 18d085e v6.15.3
• c38af42 [Deps] update side-channel
• adce539 [Dev Deps] update eslint, mock-property, tape
• 74a0f6a [Robustness] utils: enforce arrayLimit consistently across merge's arra...
• f4938f5 [Tests] parse: characterize current lenient handling of unbalanced bracket ...
• 5d5f723 [Perf] utils: make compact O(n) via a side-channel visited-set instead of...
• 52afe00 [Robustness] parse: throw the arrayLimit error before splitting oversized...

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cineflix	Error		Jul 1, 2026 5:27am

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.