build(deps): bump jsonata from 2.1.0 to 2.2.2

[dependabot]

Bumps jsonata from 2.1.0 to 2.2.2.

Release notes

Sourced from jsonata's releases.

2.2.2 Maintenance Release

• Update TypeScript type definitions (PR #807)
• Fix $contains() when the token is undefined (PR #809)
• Regression looking up keys of an object (PR #814)
• Race condition when $$ used concurrently (PR #816)
• Correctly handle empty joins (PR #817)

2.2.1 Maintenance Release

This release predominantly contains security related fixes and enhancements, in particular to address https://nvd.nist.gov/vuln/detail/CVE-2026-12208

• Prevent object prototype pollution (PR #799)
• Wildcards should not unwrap function objects (PR #800)
• $append should enforce the sequence guardrail limit (PR #801)
• Prevent object contructor setting internal flags (PR #802)

2.2.0 Milestone Release

This release predominantly contains security related fixes and enhancements, in particular to address GHSA-86vw-mfpg-wwv9 Thanks to Doruk Tan Öztürk and Arthur Deierlein for their private disclosures.

• New API to specify resource guardrails on expressions (PR #795)
• Fix ISO8601 regex pattern (PR #793)
• Prevent $lookup from accessing object prototype members (PR #794)
• Enable OIDC publishing to NPM (PR #792)
• Publish step to be triggered by new version tag (PR #796)

2.1.1 Maintenance Release

• Fix picture string parsing for $formatNumber (PR #788)
• Fix $toMillis() with more than 3 digit fractional seconds (PR #782)
• Fix ?: operator returning wrong result when LHS has array predicate (PR #780)
• Fix ?? operator with array predicate on LHS (PR #774)
• Fix function signature for repeating arguments (PR #760)
• Fix precision fix for $string() function (PR #762)
• Fix to prevent $formatNumber() getting into an infinite loop (PR #785)

Changelog

Sourced from jsonata's changelog.

2.2.2 Maintenance Release

• Update TypeScript type definitions (PR #807)
• Fix $contains() when the token is undefined (PR #809)
• Regression looking up keys of an object (PR #814)
• Race condition when $$ used concurrently (PR #816)
• Correctly handle empty joins (PR #817)

2.2.1 Maintenance Release

• Prevent object prototype pollution (PR #799)
• Wildcards should not unwrap function objects (PR #800)
• $append should enforce the sequence guardrail limit (PR #801)
• Prevent object contructor setting internal flags (PR #802)

2.2.0 Milestone Release

• New API to specify resource guardrails on expressions (PR #795)
• Fix ISO8601 regex pattern (PR #793)
• Prevent $lookup from accessing object prototype members (PR #794)
• Enable OIDC publishing to NPM (PR #792)
• Publish step to be triggered by new version tag (PR #796)

2.1.1 Maintenance Release

• Fix picture string parsing for $formatNumber (PR #788)
• Fix $toMillis() with more than 3 digit fractional seconds (PR #782)
• Fix ?: operator returning wrong result when LHS has array predicate (PR #780)
• Fix ?? operator with array predicate on LHS (PR #774)
• Fix function signature for repeating arguments (PR #760)
• Fix precision fix for $string() function (PR #762)
• Fix to prevent $formatNumber() getting into an infinite loop (PR #785)

Commits

• 6c7e95f Prepare for v2.2.2 release (#823)
• f3e15f2 correctly handle empty joins (#817)
• df63a7c race condition when $$ used concurrently (#816)
• 82e1597 regression looking up keys of an object (#814)
• fec95de Fix $contains crash when the token is undefined (#809)
• 0457f0e Add Corvus .NET implementation link to overview (#805)
• ac3c447 update TypeScript type definitions (#807)
• 06fc08c release v2.1.1 (#803)
• f174348 Prevent object contructor setting internal flags (#802)
• 91532d4 Append limit (#801)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for jsonata since your current version.

[github-actions]

❌ Not Automerged

The PR does not match any automerge rules.

Details: No configuration rule matched this update

Dependabot Information:

• Package name(s): jsonata
• Update type: minor
• Dependency type: production
• Previous version: 2.1.0
• New version: 2.2.2

Modified Files:

• package-lock.json
• package.json

[github-actions]

❌ Not Automerged

The PR does not match any automerge rules.

Details: No configuration rule matched this update

Dependabot Information:

• Package name(s): jsonata
• Update type: minor
• Dependency type: production
• Previous version: 2.1.0
• New version: 2.2.2

Modified Files:

• package-lock.json
• package.json