Repository navigation
chore: merge develop into main - #2121
Merged
Merged
Conversation
This PR contains the following updates: | Update | Change | |---|---| | lockFileMaintenance | All locks refreshed | 🔧 This Pull Request updates lock files to use the latest dependency versions. --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - Only on Sunday and Saturday (`* * * * 0,6`) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/splunk/addonfactory-ucc-generator). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDIuMTEiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zNS40IiwidGFyZ2V0QnJhbmNoIjoiZGV2ZWxvcCIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
> ℹ️ **Note**
>
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@babel/core](https://babel.dev/docs/en/next/babel-core)
([source](https://redirect.github.com/babel/babel/tree/HEAD/packages/babel-core))
| [`^7.29.0` →
`^8.0.1`](https://renovatebot.com/diffs/npm/@babel%2fcore/7.29.7/8.0.1)
|
|
|
| [@babel/eslint-parser](https://babel.dev/)
([source](https://redirect.github.com/babel/babel/tree/HEAD/eslint/babel-eslint-parser))
| [`^7.28.6` →
`^8.0.1`](https://renovatebot.com/diffs/npm/@babel%2feslint-parser/7.29.7/8.0.1)
|
|
|
|
[@babel/helper-plugin-utils](https://babel.dev/docs/en/next/babel-helper-plugin-utils)
([source](https://redirect.github.com/babel/babel/tree/HEAD/packages/babel-helper-plugin-utils))
| [`^7.28.6` →
`^8.0.1`](https://renovatebot.com/diffs/npm/@babel%2fhelper-plugin-utils/7.29.7/8.0.1)
|
|
|
|
[@babel/plugin-transform-runtime](https://babel.dev/docs/en/next/babel-plugin-transform-runtime)
([source](https://redirect.github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-runtime))
| [`^7.29.0` →
`^8.0.1`](https://renovatebot.com/diffs/npm/@babel%2fplugin-transform-runtime/7.29.7/8.0.1)
|
|
|
| [@babel/preset-env](https://babel.dev/docs/en/next/babel-preset-env)
([source](https://redirect.github.com/babel/babel/tree/HEAD/packages/babel-preset-env))
| [`^7.29.2` →
`^8.0.2`](https://renovatebot.com/diffs/npm/@babel%2fpreset-env/7.29.7/8.0.2)
|
|
|
|
[@babel/preset-react](https://babel.dev/docs/en/next/babel-preset-react)
([source](https://redirect.github.com/babel/babel/tree/HEAD/packages/babel-preset-react))
| [`^7.28.5` →
`^8.0.1`](https://renovatebot.com/diffs/npm/@babel%2fpreset-react/7.29.7/8.0.1)
|
|
|
| @​splunk/eslint-config | [`^5.0.0` →
`^6.0.0`](https://renovatebot.com/diffs/npm/@splunk%2feslint-config/5.1.0/6.0.0)
|
|
|
| @​splunk/splunk-utils | [`^3.2.0` →
`^4.0.1`](https://renovatebot.com/diffs/npm/@splunk%2fsplunk-utils/3.4.0/4.0.1)
|
|
|
|
[@testing-library/jest-dom](https://redirect.github.com/testing-library/jest-dom)
| [`^6.9.1` →
`^7.0.1`](https://renovatebot.com/diffs/npm/@testing-library%2fjest-dom/6.10.0/7.0.1)
|
|
|
|
[@types/react-dom](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react-dom)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom))
| [`^18.3.7` →
`^19.2.5`](https://renovatebot.com/diffs/npm/@types%2freact-dom/18.3.7/19.2.5)
|
|
|
|
[@vitejs/plugin-react](https://redirect.github.com/vitejs/vite-plugin-react/tree/main/packages/plugin-react#readme)
([source](https://redirect.github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react))
| [`^4.7.0` →
`^6.1.0`](https://renovatebot.com/diffs/npm/@vitejs%2fplugin-react/4.7.0/6.1.0)
|
|
|
| [diff](https://redirect.github.com/kpdecker/jsdiff) | [`^8.0.4` →
`^9.0.0`](https://renovatebot.com/diffs/npm/diff/8.0.4/9.0.0) |
|
|
| [fast-uri](https://redirect.github.com/fastify/fast-uri) | [`^3.1.2` →
`^4.1.3`](https://renovatebot.com/diffs/npm/fast-uri/3.1.6/4.1.3) |
|
|
|
[http-proxy-middleware](https://redirect.github.com/chimurai/http-proxy-middleware)
| [`^3.0.5` →
`^4.2.0`](https://renovatebot.com/diffs/npm/http-proxy-middleware/3.0.7/4.2.0)
|
|
|
| [js-yaml](https://redirect.github.com/nodeca/js-yaml) | [`^4.1.1` →
`^5.4.0`](https://renovatebot.com/diffs/npm/js-yaml/4.3.1/5.4.0) |
|
|
| [jsdom](https://redirect.github.com/jsdom/jsdom) | [`^29.0.1` →
`^30.0.1`](https://renovatebot.com/diffs/npm/jsdom/29.1.1/30.0.1) |
|
|
|
[msw-storybook-addon](https://redirect.github.com/mswjs/msw-storybook-addon)
| [`^2.0.6` →
`^3.0.0`](https://renovatebot.com/diffs/npm/msw-storybook-addon/2.0.7/3.0.0)
|
|
|
| [nanoid](https://redirect.github.com/ai/nanoid) | [`3.3.18` →
`6.0.1`](https://renovatebot.com/diffs/npm/nanoid/3.3.18/6.0.1) |
|
|
| [typescript](https://www.typescriptlang.org/)
([source](https://redirect.github.com/microsoft/TypeScript)) | [`^5.9.3`
→ `^7.0.2`](https://renovatebot.com/diffs/npm/typescript/5.9.3/7.0.2) |
|
|
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`^7.3.1` →
`^8.2.2`](https://renovatebot.com/diffs/npm/vite/7.3.6/8.2.2) |
|
|
| [vite-plugin-dts](https://redirect.github.com/qmhc/unplugin-dts)
([source](https://redirect.github.com/qmhc/unplugin-dts/tree/HEAD/packages/vite-plugin-dts))
| [`4.5.3` →
`5.0.3`](https://renovatebot.com/diffs/npm/vite-plugin-dts/4.5.3/5.0.3)
|
|
|
---
### Release Notes
<details>
<summary>babel/babel (@​babel/core)</summary>
###
[`v8.0.1`](https://redirect.github.com/babel/babel/blob/HEAD/CHANGELOG.md#v801-2026-06-17)
[Compare
Source](https://redirect.github.com/babel/babel/compare/v8.0.0...v8.0.1)
##### :boom: Breaking Change
- `babel-core`, `babel-plugin-transform-object-rest-spread`,
`babel-plugin-transform-runtime`, `babel-preset-env`, `babel-standalone`
- [#​18079](https://redirect.github.com/babel/babel/pull/18079)
Actually remove `preset-env`'s `useBuiltIns`
([@​nicolo-ribaudo](https://redirect.github.com/nicolo-ribaudo))
###
[`v8.0.0`](https://redirect.github.com/babel/babel/blob/HEAD/CHANGELOG.md#v800-2026-06-16)
[Compare
Source](https://redirect.github.com/babel/babel/compare/v7.29.7...v8.0.0)
##### :eyeglasses: Spec Compliance
- `babel-core`
- [#​18039](https://redirect.github.com/babel/babel/pull/18039)
perf: Only extract source map comments at the end of the file
([@​liuxingbaoyu](https://redirect.github.com/liuxingbaoyu))
##### :boom: Breaking Change
- `babel-cli`, `babel-node`, `babel-plugin-proposal-decorators`,
`babel-plugin-transform-classes`,
`babel-plugin-transform-function-name`,
`babel-plugin-transform-modules-commonjs`,
`babel-plugin-transform-object-rest-spread`,
`babel-plugin-transform-parameters`,
`babel-plugin-transform-react-constant-elements`,
`babel-plugin-transform-regenerator`, `babel-preset-env`,
`babel-register`
- [#​18069](https://redirect.github.com/babel/babel/pull/18069)
Fallback to assuming ESM support with `modules: auto`
([@​nicolo-ribaudo](https://redirect.github.com/nicolo-ribaudo))
- `babel-plugin-transform-runtime`, `babel-runtime-corejs3`,
`babel-runtime`
- [#​18036](https://redirect.github.com/babel/babel/pull/18036)
Remove corejs exports for `@babe/runtime-corejs3`
([@​liuxingbaoyu](https://redirect.github.com/liuxingbaoyu))
- `babel-parser`
- [#​18034](https://redirect.github.com/babel/babel/pull/18034)
Remove `locations: "packed"`
([@​liuxingbaoyu](https://redirect.github.com/liuxingbaoyu))
##### :bug: Bug Fix
- `babel-generator`
- [#​18046](https://redirect.github.com/babel/babel/pull/18046)
fix(generator): improve new callee parens check
([@​JLHwung](https://redirect.github.com/JLHwung))
- `babel-plugin-transform-modules-systemjs`
- [#​18032](https://redirect.github.com/babel/babel/pull/18032)
fix(systemjs): support **proto** as an export name
([@​JLHwung](https://redirect.github.com/JLHwung))
##### :memo: Documentation
- [#​18070](https://redirect.github.com/babel/babel/pull/18070)
Add EOL date for Babel 7 (end of June 2027) to SECURITY.md
([@​nicolo-ribaudo](https://redirect.github.com/nicolo-ribaudo))
##### :house: Internal
- [#​18018](https://redirect.github.com/babel/babel/pull/18018)
ci: enforce yarn integrity
([@​JLHwung](https://redirect.github.com/JLHwung))
##### :running\_woman: Performance
- `babel-core`
- [#​18039](https://redirect.github.com/babel/babel/pull/18039)
perf: Only extract source map comments at the end of the file
([@​liuxingbaoyu](https://redirect.github.com/liuxingbaoyu))
</details>
<details>
<summary>testing-library/jest-dom
(@​testing-library/jest-dom)</summary>
###
[`v7.0.1`](https://redirect.github.com/testing-library/jest-dom/compare/v7.0.0...3782c78b3dc9824675afe0cb8f1722f8c96f494d)
[Compare
Source](https://redirect.github.com/testing-library/jest-dom/compare/v7.0.0...v7.0.1)
###
[`v7.0.0`](https://redirect.github.com/testing-library/jest-dom/compare/cae44df901cf8e92e3febc0af6fa667b10be6d6a...1e39089d850408a583c83495d00d8aa27078933f)
[Compare
Source](https://redirect.github.com/testing-library/jest-dom/compare/v6.10.0...v7.0.0)
</details>
<details>
<summary>vitejs/vite-plugin-react
(@​vitejs/plugin-react)</summary>
###
[`v6.1.0`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#610-2026-08-19)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/68c0cb8796ce18bd049c3d05c5210eaf0617eac0...39b31735bf79c2dd380eedaba7ed849256f92a29)
##### Add experimental native React Compiler support
([#​1419](https://redirect.github.com/vitejs/vite-plugin-react/pull/1419))
Add experimental native React Compiler support.
You can use it by installing `oxc-transform-react` and enabling it via
the `compiler` option:
```sh
npm install -D oxc-transform-react
```
```js
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})
```
###
[`v6.0.5`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#605-2026-07-30)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/f4b549822ec239799d746c030abb0b9a7d8f0a04...68c0cb8796ce18bd049c3d05c5210eaf0617eac0)
##### Fixed the react compiler preset filter to be linear
([#​1353](https://redirect.github.com/vitejs/vite-plugin-react/pull/1353))
The improved filter in v6.0.3 was non-linear and caused a performance
regression
([#​1349](https://redirect.github.com/vitejs/vite-plugin-react/issues/1349)).
The filter was changed to be linear to avoid that.
###
[`v6.0.4`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#604-2026-07-22)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/640fd358a0e82393acfce4e92e19a6ac6e1641a7...f4b549822ec239799d746c030abb0b9a7d8f0a04)
##### Fixed `$RefreshSig$ is not defined` error when running `vite dev`
with `NODE_ENV=production`
When running `vite dev` with `NODE_ENV=production`, the app errored with
`$RefreshSig$ is not defined`.
This error is now fixed.
###
[`v6.0.3`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#603-2026-06-23)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/6535b55e956b425e6650ffc2cc98fd23cca1d231...640fd358a0e82393acfce4e92e19a6ac6e1641a7)
###
[`v6.0.2`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#602-2026-05-14)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/1e94c06995c2afe2d1fee5aea2ef9720d35a7e02...6535b55e956b425e6650ffc2cc98fd23cca1d231)
##### Allow all options in reactCompilerPreset
([#​1189](https://redirect.github.com/vitejs/vite-plugin-react/pull/1189))
This is a type only change. Only `compilationMode` and `target` options
were available for `reactCompilerPreset`.
###
[`v6.0.1`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#601-2026-03-13)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/dcc901236079ef7fa99139f7ba7beebac583f301...1e94c06995c2afe2d1fee5aea2ef9720d35a7e02)
##### Expand `@rolldown/plugin-babel` peer dep range
([#​1146](https://redirect.github.com/vitejs/vite-plugin-react/pull/1146))
Expanded `@rolldown/plugin-babel` peer dep range to include `^0.2.0`.
###
[`v6.0.0`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#600-2026-03-12)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/fda3a86095556b49ae3c995eb57a30d4e0b8fa8d...dcc901236079ef7fa99139f7ba7beebac583f301)
###
[`v5.2.0`](https://redirect.github.com/vitejs/vite-plugin-react/compare/f066114c3e6bf18f5209ff3d3ef6bf1ab46d3866...fda3a86095556b49ae3c995eb57a30d4e0b8fa8d)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/f066114c3e6bf18f5209ff3d3ef6bf1ab46d3866...fda3a86095556b49ae3c995eb57a30d4e0b8fa8d)
###
[`v5.1.4`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#514-2026-02-10)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/cf0cb8aa3398e312f4e91b702281806aad004cd7...f066114c3e6bf18f5209ff3d3ef6bf1ab46d3866)
##### Fix `canSkipBabel` not accounting for `babel.overrides`
([#​1098](https://redirect.github.com/vitejs/vite-plugin-react/pull/1098))
When configuring `babel.overrides` without top-level plugins or presets,
Babel was incorrectly skipped. The `canSkipBabel` function now checks
for `overrides.length` to ensure override configurations are processed.
###
[`v5.1.3`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#513-2026-02-02)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/f127a24376a90a82acf5b8aad4be750bec3045f3...cf0cb8aa3398e312f4e91b702281806aad004cd7)
###
[`v5.1.2`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#512-2025-12-08)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/23db72731b7c9c3d57a8188f0395d2ec90a6e2f6...f127a24376a90a82acf5b8aad4be750bec3045f3)
###
[`v5.1.1`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#511-2025-11-12)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/3e5a3742e94be975cbcec230fbab5e801b80dc5b...23db72731b7c9c3d57a8188f0395d2ec90a6e2f6)
##### Update code to support newer `rolldown-vite`
([#​976](https://redirect.github.com/vitejs/vite-plugin-react/pull/976))
`rolldown-vite` will remove `optimizeDeps.rollupOptions` in favor of
`optimizeDeps.rolldownOptions` soon. This plugin now uses
`optimizeDeps.rolldownOptions` to support newer `rolldown-vite`. Please
update `rolldown-vite` to the latest version if you are using an older
version.
###
[`v5.1.0`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#510-2025-10-24)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/450d7df80a52c45f3da7a9612d96a4913f565ed7...3e5a3742e94be975cbcec230fbab5e801b80dc5b)
##### Add `@vitejs/plugin-react/preamble` virtual module for SSR HMR
([#​890](https://redirect.github.com/vitejs/vite-plugin-react/pull/890))
SSR applications can now initialize HMR runtime by importing
`@vitejs/plugin-react/preamble` at the top of their client entry instead
of manually calling `transformIndexHtml`. This simplifies SSR setup for
applications that don't use the `transformIndexHtml` API.
##### Fix raw Rolldown support for Rolldown 1.0.0-beta.44+
([#​930](https://redirect.github.com/vitejs/vite-plugin-react/pull/930))
Rolldown 1.0.0-beta.44+ removed the top-level `jsx` option in favor of
`transform.jsx`. This plugin now uses the `transform.jsx` option to
support Rolldown 1.0.0-beta.44+.
###
[`v5.0.4`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#504-2025-09-27)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/8293cb38945e56729b5b045b09858da6b78ba3a3...450d7df80a52c45f3da7a9612d96a4913f565ed7)
##### Perf: use native refresh wrapper plugin in rolldown-vite
([#​881](https://redirect.github.com/vitejs/vite-plugin-react/pull/881))
###
[`v5.0.3`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#503-2025-09-17)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/1f4b4d9523c0cbdba66724e83477309ef65cac96...8293cb38945e56729b5b045b09858da6b78ba3a3)
##### HMR did not work for components imported with queries with
rolldown-vite
([#​872](https://redirect.github.com/vitejs/vite-plugin-react/pull/872))
##### Perf: simplify refresh wrapper generation
([#​835](https://redirect.github.com/vitejs/vite-plugin-react/pull/835))
###
[`v5.0.2`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#502-2025-08-28)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/efe434417542cdbfbb00503d4c35ffbba49d3efa...1f4b4d9523c0cbdba66724e83477309ef65cac96)
##### Skip transform hook completely in rolldown-vite in dev if possible
([#​783](https://redirect.github.com/vitejs/vite-plugin-react/pull/783))
###
[`v5.0.1`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#501-2025-08-19)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/9e4a94428dae6d39ccc13e0220f2abc7a76aeb5e...efe434417542cdbfbb00503d4c35ffbba49d3efa)
##### Set `optimizeDeps.rollupOptions.transform.jsx` instead of
`optimizeDeps.rollupOptions.jsx` for rolldown-vite
([#​735](https://redirect.github.com/vitejs/vite-plugin-react/pull/735))
`optimizeDeps.rollupOptions.jsx` is going to be deprecated in favor of
`optimizeDeps.rollupOptions.transform.jsx`.
##### Perf: skip `babel-plugin-react-compiler` if code has no `"use
memo"` when `{ compilationMode: "annotation" }`
([#​734](https://redirect.github.com/vitejs/vite-plugin-react/pull/734))
##### Respect tsconfig `jsxImportSource`
([#​726](https://redirect.github.com/vitejs/vite-plugin-react/pull/726))
##### Fix `reactRefreshHost` option on rolldown-vite
([#​716](https://redirect.github.com/vitejs/vite-plugin-react/pull/716))
##### Fix `RefreshRuntime` being injected twice for class components on
rolldown-vite
([#​708](https://redirect.github.com/vitejs/vite-plugin-react/pull/708))
##### Skip `babel-plugin-react-compiler` on non client environment
([689](https://redirect.github.com/vitejs/vite-plugin-react/pull/689))
###
[`v5.0.0`](https://redirect.github.com/vitejs/vite-plugin-react/blob/HEAD/packages/plugin-react/CHANGELOG.md#500-2025-08-07)
[Compare
Source](https://redirect.github.com/vitejs/vite-plugin-react/compare/80417060f7bc239d5100e1b47c819e8364c7d551...9e4a94428dae6d39ccc13e0220f2abc7a76aeb5e)
</details>
<details>
<summary>kpdecker/jsdiff (diff)</summary>
###
[`v9.0.0`](https://redirect.github.com/kpdecker/jsdiff/blob/HEAD/release-notes.md#900)
[Compare
Source](https://redirect.github.com/kpdecker/jsdiff/compare/8.0.4...v9.0.0)
(All changes part of PR
[#​672](https://redirect.github.com/kpdecker/jsdiff/pull/672).)
- **ES5 support is dropped**. `parsePatch` now uses `TextDecoder` and
`Uint8Array`, which are not available in ES5, and TypeScript is now
compiled with the "es6" `target`. From now on, I intend to freely use
any features that are deemed "Widely available" by
[Baseline](https://web.dev/baseline). Users who need ES5 support should
stick to version 8.
- **C-style quoted strings in filename headers are now properly
supported**.
When the name of either the old or new file in a patch contains "special
characters", both GNU `diff` and Git quote the filename in the patch's
headers and escape special characters using the same escape sequences
that are used in string literals in C, including octal escapes for all
non-ASCII characters. Previously, jsdiff had very little support for
this; `parsePatch` would remove the quotes, and unescape any escaped
backslashes, but would not unescape other escape sequences.
`formatPatch`, meanwhile, did not quote or escape special characters at
all.
Now, `parsePatch` parses all the possible escape sequences that GNU diff
(or Git) ever output, and `formatPatch` quotes and escapes filenames
containing special characters in the same way GNU diff does.
- **`formatPatch` now omits file headers when `oldFileName` or
`newFileName` in the provided patch object are `undefined`**, regardless
of the `headerOptions` parameter. (Previously, it would treat the
absence of `oldFileName` or `newFileName` as indicating the filename was
the word "undefined" and emit headers `--- undefined` / `+++
undefined`.)
- **`formatPatch` no longer outputs trailing tab characters at the end
of `---`/`+++` headers.**
Previously, if `formatPatch` was passed a patch object to serialize that
had empty strings for the `oldHeader` or `newHeader` property, it would
include a trailing tab character after the filename in the `---` and/or
`+++` file header. Now, this scenario is treated the same as when
`oldHeader`/`newHeader` is `undefined` - i.e. the trailing tab is
omitted.
- **`formatPatch` no longer mutates its input** when serializing a patch
containing a hunk where either the old or new content contained zero
lines. (Such a hunk occurs only when the hunk has no context lines and
represents a pure insertion or pure deletion, which for instance will
occur whenever one of the two files being diffed is completely empty.)
Previously `formatPatch` would provide the correct output but also
mutate the `oldLines` or `newLines` property on the hunk, changing the
meaning of the underlying patch.
- **Git-style patches are now supported by `parsePatch`, `formatPatch`,
and `reversePatch`**.
Patches output by `git diff` can include some features that are unlike
those output by GNU `diff`, and therefore not handled by an ordinary
unified diff format parser. An ordinary diff simply describes the
differences between the *content* of two files, but Git diffs can also
indicate, via "extended headers", the creation or deletion of
(potentially empty) files, indicate that a file was renamed, and contain
information about file mode changes. Furthermore, when these changes
appear in a diff in the absence of a content change (e.g. when an empty
file is created, or a file is renamed without content changes), the
patch will contain no associated `---`/`+++` file headers nor any hunks.
jsdiff previously did not support parsing Git's extended headers, nor
hunkless patches. Now `parsePatch` parses some of the extended headers,
parses hunkless Git patches, and can determine filenames (e.g. from the
extended headers) when parsing a patch that includes no `---` or `+++`
file headers. The additional information conveyed by the extended
headers we support is recorded on new fields on the result object
returned by `parsePatch`. See `isGit` and subsequent properties in the
docs in the README.md file.
`formatPatch` now outputs extended headers based on these new
Git-specific properties, and `reversePatch` respects them as far as
possible (with one unavoidable caveat noted in the README.md file).
- **Unpaired file headers now cause `parsePatch` to throw**.
It remains acceptable to have a patch with no file headers whatsoever
(e.g. one that begins with a `@@` hunk header on the very first line),
but a patch with *only* a `---` header or only a `+++` header is now
considered an error.
- **`parsePatch` is now more tolerant of "trailing garbage"**
That is: after a patch, or between files/indexes in a patch, it is now
acceptable to have arbitrary lines of "garbage" (so long as they
unambiguously have no syntactic meaning - e.g. trailing garbage that
leads with a `+`, `-`, or ` ` and thus is interpretable as part of a
hunk still triggers a throw).
This means we no longer reject patches output by tools that include
extra data in "garbage" lines not understood by generic unified diff
parsers. (For example, SVN patches can include "Property changes on:"
lines that generic unified diff parsers should discard as garbage;
jsdiff previously threw errors when encountering them.)
This change brings jsdiff's behaviour more in line with GNU `patch`,
which is highly permissive of "garbage".
- **The `oldFileName` and `newFileName` fields of `StructuredPatch` are
now typed as `string | undefined` instead of `string`**. This type
change reflects the (pre-existing) reality that `parsePatch` can produce
patches without filenames (e.g. when parsing a patch that simply
contains hunks with no file headers).
</details>
<details>
<summary>fastify/fast-uri (fast-uri)</summary>
###
[`v4.1.3`](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.1.3)
[Compare
Source](https://redirect.github.com/fastify/fast-uri/compare/v4.1.2...v4.1.3)
#### ⚠️ Security Warning
This release addresses the following high-severity security advisories:
-
[GHSA-5jgf-p345-68v8](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8)
— host confusion via skipped IDN canonicalization on scheme-relative
references
-
[GHSA-fph4-wmhf-6fwf](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf)
— server-side request forgery via repeated hostname percent-decoding
-
[GHSA-f65p-4m7j-42xc](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc)
— server-side request forgery via malformed IPv6 normalization
-
[GHSA-jqff-g426-hqxp](https://redirect.github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp)
— host confusion via percent-encoded scheme normalization
Users of the v4 release line should upgrade to v4.1.3.
**Full Changelog**:
<https://github.com/fastify/fast-uri/compare/v4.1.2...v4.1.3>
###
[`v4.1.2`](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.1.2)
[Compare
Source](https://redirect.github.com/fastify/fast-uri/compare/v4.1.1...v4.1.2)
#### ⚠️ Security Warning
Fix for
<https://github.com/fastify/fast-uri/security/advisories/GHSA-7p8r-x3mc-p8w7>
#### What's Changed
- ci: pin actions to commit-hash by
[@​Fdawgs](https://redirect.github.com/Fdawgs) in
[#​189](https://redirect.github.com/fastify/fast-uri/pull/189)
- chore: bump actions/setup-node from 6.4.0 to 7.0.0 by
[@​dependabot](https://redirect.github.com/dependabot)\[bot] in
[#​190](https://redirect.github.com/fastify/fast-uri/pull/190)
- docs: clarify security standards scope by
[@​mcollina](https://redirect.github.com/mcollina) in
[#​191](https://redirect.github.com/fastify/fast-uri/pull/191)
- ci: add ossf-scorecard workflow by
[@​Fdawgs](https://redirect.github.com/Fdawgs) in
[#​193](https://redirect.github.com/fastify/fast-uri/pull/193)
- ci(ossf-scorecard): add missing extension by
[@​Fdawgs](https://redirect.github.com/Fdawgs) in
[#​194](https://redirect.github.com/fastify/fast-uri/pull/194)
**Full Changelog**:
<https://github.com/fastify/fast-uri/compare/v4.1.1...v4.1.2>
###
[`v4.1.1`](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.1.1)
[Compare
Source](https://redirect.github.com/fastify/fast-uri/compare/v4.1.0...v4.1.1)
#### ⚠️ Security Release
Fix for
<https://github.com/fastify/fast-uri/security/advisories/GHSA-v2hh-gcrm-f6hx>
**Full Changelog**:
<https://github.com/fastify/fast-uri/compare/v4.1.0...v4.1.1>
###
[`v4.1.0`](https://redirect.github.com/fastify/fast-uri/compare/v4.0.1...3a877384b5848967c963e0fd2b92d50539a80af9)
[Compare
Source](https://redirect.github.com/fastify/fast-uri/compare/v4.0.1...v4.1.0)
###
[`v4.0.1`](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.0.1)
[Compare
Source](https://redirect.github.com/fastify/fast-uri/compare/v4.0.0...v4.0.1)
#### ⚠️ Security Release
- Fixes:
<https://github.com/fastify/fast-uri/security/advisories/GHSA-4c8g-83qw-93j6>
#### What's Changed
- fix: normalize scheme to lowercase (RFC 3986 §6.2.2.1) by
[@​spokodev](https://redirect.github.com/spokodev) in
[#​182](https://redirect.github.com/fastify/fast-uri/pull/182)
- chore: update depedabot setting by
[@​climba03003](https://redirect.github.com/climba03003) in
[#​179](https://redirect.github.com/fastify/fast-uri/pull/179)
- chore: replace http with https in urls by
[@​Fdawgs](https://redirect.github.com/Fdawgs) in
[#​184](https://redirect.github.com/fastify/fast-uri/pull/184)
- chore: bump actions/checkout from 6 to 7 by
[@​dependabot](https://redirect.github.com/dependabot)\[bot] in
[#​186](https://redirect.github.com/fastify/fast-uri/pull/186)
#### New Contributors
- [@​spokodev](https://redirect.github.com/spokodev) made their
first contribution in
[#​182](https://redirect.github.com/fastify/fast-uri/pull/182)
- [@​climba03003](https://redirect.github.com/climba03003) made
their first contribution in
[#​179](https://redirect.github.com/fastify/fast-uri/pull/179)
**Full Changelog**:
<https://github.com/fastify/fast-uri/compare/v4.0.0...v4.0.1>
###
[`v4.0.0`](https://redirect.github.com/fastify/fast-uri/releases/tag/v4.0.0)
[Compare
Source](https://redirect.github.com/fastify/fast-uri/compare/v3.1.6...v4.0.0)
#### What's Changed
- refactor(types): migrate from tsd to tstyche by
[@​Tony133](https://redirect.github.com/Tony133) in
[#​172](https://redirect.github.com/fastify/fast-uri/pull/172)
- ci(ci): add node 26 to test matrices by
[@​Fdawgs](https://redirect.github.com/Fdawgs) in
[#​173](https://redirect.github.com/fastify/fast-uri/pull/173)
- chore: removed types deprecated by
[@​Tony133](https://redirect.github.com/Tony133) in
[#​174](https://redirect.github.com/fastify/fast-uri/pull/174)
- fix: escape bug by [@​zekth](https://redirect.github.com/zekth)
in [#​181](https://redirect.github.com/fastify/fast-uri/pull/181)
**Full Changelog**:
<https://github.com/fastify/fast-uri/compare/v3.1.2...v4.0.0>
</details>
<details>
<summary>chimurai/http-proxy-middleware
(http-proxy-middleware)</summary>
###
[`v4.2.0`](https://redirect.github.com/chimurai/http-proxy-middleware/blob/HEAD/CHANGELOG.md#v420)
[Compare
Source](https://redirect.github.com/chimurai/http-proxy-middleware/compare/v4.1.1...v4.2.0)
- feat(types): export OnProxyEvent type
- feat(debug-proxy-errors-plugin): diagnostic message for POST +
bodyParser + ECONNRESET error
- chore(package.json): update to httpxy v0.5.4
###
[`v4.1.1`](https://redirect.github.com/chimurai/http-proxy-middleware/blob/HEAD/CHANGELOG.md#v411)
[Compare
Source](https://redirect.github.com/chimurai/http-proxy-middleware/compare/v4.1.0...v4.1.1)
- fix(fixRequestBody): harden form-data stringification
###
[`v4.1.0`](https://redirect.github.com/chimurai/http-proxy-middleware/blob/HEAD/CHANGELOG.md#v410)
[Compare
Source](https://redirect.github.com/chimurai/http-proxy-middleware/compare/v4.0.0...v4.1.0)
- feat(definePlugin): helper function to create plugins
- chore(package.json): update to httpxy\@​0.5.3
- fix(ipv6): preserve credentials when normalizing bracketed IPv6 target
string
- fix(ipv6): unspecified IPv6 target hostname (::)
- fix(response-interceptor): reduce responseInterceptor buffer churn
- fix(ws): handle multi-server upgrade subscription and safe proxy
shutdown
- feat(router): add 'res' and 'options' to router function
- feat(pathRewrite): add 'res' and 'options' to custom pathRewrite
function
- fix(responseInterceptor): prevent trailer/content-length conflict
- feat(zstd): support zstd compression in responseInterceptor and
fixRequestBody
- fix(responseInterceptor): handle bodyless responses (HEAD/1xx/204/304)
with content-encoding
- fix(router): harden proxy-table matching
###
[`v4.0.0`](https://redirect.github.com/chimurai/http-proxy-middleware/blob/HEAD/CHANGELOG.md#v400)
[Compare
Source](https://redirect.github.com/chimurai/http-proxy-middleware/compare/v3.0.7...v4.0.0)
- fix(types): fix Logger type
- fix(error-response-plugin): sanitize input
- feat: drop node v14/v16/v18 \[BREAKING CHANGE]
- refactor: replace http-proxy w/ httpxy
- chore: remove legacyCreateProxyMiddleware() \[BREAKING CHANGE]
- ci: migrate from jest to vitest
- chore(package.json): esm only \[BREAKING CHANGE]
- chore(package.json): bump to httpxy 0.5.0
([#​1183](https://redirect.github.com/chimurai/http-proxy-middleware/issues/1183))
- chore(package.json): drop node20 \[BREAKING CHANGE]
([#​1179](https://redirect.github.com/chimurai/http-proxy-middleware/issues/1179))
- refactor: remove deprecated url.parse()
([#​1176](https://redirect.github.com/chimurai/http-proxy-middleware/issues/1176))
- fix(fixRequestBody): support content-encoding on request body
([#​1142](https://redirect.github.com/chimurai/http-proxy-middleware/issues/1142))
- fix: prevent TypeError when ws enabled but server is undefined
([#​1163](https://redirect.github.com/chimurai/http-proxy-middleware/issues/1163))
- fix: applyPathRewrite logs old req.url instead of rewritten path
([#​1157](https://redirect.github.com/chimurai/http-proxy-middleware/issues/1157))
- feat(hono): support for hono with createHonoProxyMiddleware
- feat(ipv6): support literal IPv6 addresses in `target` and `forward`
options (ie. "http\://\[::1]:8000")
- chore(package.json): bump httpxy to ^0.5.1
- fix(logger-plugin): support ipv6 host and handle undefined
protocol/host
- ci(publish.yml): pin github.triggering\_actor
- chore(package.json): node ^22.15.0
([#​1218](https://redirect.github.com/chimurai/http-proxy-middleware/issues/1218))
- refactor(package): subpath 'http-proxy-middleware/hono'
([#​1220](https://redirect.github.com/chimurai/http-proxy-middleware/issues/1220))
- chore: node 26 support
</details>
<details>
<summary>nodeca/js-yaml (js-yaml)</summary>
###
[`v5.4.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#540---2026-08-25)
[Compare
Source](https://redirect.github.com/nodeca/js-yaml/compare/5.3.0...5.4.0)
##### Added
- Added the `scalarStyleRules` dumper option to customize string
formatting.
See [Scalar styling](docs/scalar_styling.md) for details.
##### Changed
- \[breaking] Flattened the low-level AST node style representation.
Scalar
and collection nodes now use `SCALAR_STYLE` and `COLLECTION_STYLE`
values;
explicit tags use the separate `tagged` property. Alias nodes now
contain
only `kind` and `anchor`. This only affects code that directly
constructs or
edits AST nodes.
- \[breaking] The `sortKeys` option was rewritten using AST mutation to
avoid
side effects.
- Reworked scalar style selection. This can change formatting without
changing
loaded values; in particular, whitespace-only strings are now
double-quoted.
##### Fixed
- Accept a byte order mark at the start of each document in a stream,
[#​791](https://redirect.github.com/nodeca/js-yaml/issues/791).
- Produce valid flow mappings with `quoteFlowKeys` and
`flowSkipColonSpace`,
including alias and property-only keys,
[#​786](https://redirect.github.com/nodeca/js-yaml/issues/786).
- Preserve empty scalar items when converting block sequences to flow
style.
- Do not apply the 1024-character simple-key limit to flow mapping keys.
- Count Unicode code points, rather than UTF-16 code units, for the
1024-character simple-key limit.
- Add an explicit document-end marker after keep-chomped block scalars
when
needed to preserve trailing newlines.
###
[`v5.3.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#530---2026-08-14)
[Compare
Source](https://redirect.github.com/nodeca/js-yaml/compare/5.2.3...5.3.0)
This release focuses on reworking the documentation and making small
architectural improvements before moving forward.
##### Added
- Added completely new documentation.
- Exported `DUMP_SCHEMA`, the default schema used by the dumper.
- Added `YAMLException.throwAt()` for throwing an error at a source
position.
##### Changed
- Changed flat constant exports to grouped exports: `EVENT_ID`,
`SCALAR_STYLE`,
`COLLECTION_STYLE`, and `CHOMPING_MODE`, along with their value types.
The old
exports are still preserved, but deprecated.
- Made `identify` mandatory for custom tag definitions. Use
`identify: () => false` for load-only tags.
##### Deprecated
- Deprecated flat constant exports. Use grouped ones instead.
##### Removed
- Removed the `MERGE_KEY` export (not used anymore after last fixes).
##### Fixed
- Validate `<<` sequence items at merge time, so aliased merge sources
are
checked too.
- Resolve `<<` outside of a mapping key as the plain string `'<<'`,
matching
v4, instead of leaking an internal symbol into the result.
###
[`v5.2.3`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#523---2026-08-01)
[Compare
Source](https://redirect.github.com/nodeca/js-yaml/compare/5.2.2...5.2.3)
##### Fixed
- Prevent prototype fallback when resolving tags and mapping entries,
[#​782](https://redirect.github.com/nodeca/js-yaml/issues/782).
- Resolve `!!timestamp` years 0000-0099 correctly,
[#​775](https://redirect.github.com/nodeca/js-yaml/issues/775).
- Preserve implicit null mapping values before document markers and
reject
unpaired mapping event streams,
[#​784](https://redirect.github.com/nodeca/js-yaml/issues/784).
- Preserve folded scalar values with tab-indented lines when
round-tripping a
parsed AST through `present()`; `dump()` and loading are unaffected,
[#​780](https://redirect.github.com/nodeca/js-yaml/issues/780).
###
[`v5.2.2`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#522---2026-07-24)
[Compare
Source](https://redirect.github.com/nodeca/js-yaml/compare/5.2.1...5.2.2)
##### Fixed
- Quote flow scalars where a colon precedes a flow indicator,
[#​773](https://redirect.github.com/nodeca/js-yaml/issues/773).
##### Security
- Avoid exponential parsing time for nested flow sequence pairs.
###
[`v5.2.1`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#521---2026-07-02)
[Compare
Source](https://redirect.github.com/nodeca/js-yaml/compare/5.2.0...5.2.1)
##### Fixed
- Add `Map` support to !!omap (should work when `realMapTag` used)
##### Security
- Remove quadratic complexity from !!omap `addItem`. Regression from v5
(usually not critical, because YAML11\_SCHEMA is not default anymore).
###
[`v5.2.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#520---2026-06-26)
[Compare
Source](https://redirect.github.com/nodeca/js-yaml/compare/5.1.0...5.2.0)
##### Added
- Added `maxTotalMergeKeys` (10000) loader option to limit the total
number of
keys processed by YAML merge (`<<`) across one `load()` / `loadAll()`
call.
- Added `maxAliases` (-1) loader option to limit the number of YAML
aliases per
document.
##### Removed
- `maxMergeSeqLength` replaced with `maxTotalMergeKeys` for limiting
YAML merge
processing.
##### Fixed
- Round-trip of integers with exponential form (>= `1e21`)
###
[`v5.1.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#510---2026-06-23)
[Compare
Source](https://redirect.github.com/nodeca/js-yaml/compare/5.0.0...5.1.0)
##### Added
- Collection tags can finalize an incrementally populated carrier into a
different result value.
##### Changed
- \[breaking] `quoteStyle` now selects the preferred quote style; use
the
restored `forceQuotes` option to force quoting non-key strings.
###
[`v5.0.0`](https://redirect.github.com/nodeca/js-yaml/blob/HEAD/CHANGELOG.md#500---2026-06-20)
[Compare
Source](https://redirect.github.com/nodeca/js-yaml/compare/4.3.1...5.0.0)
##### Added
- Added named exports for schemas, tags, parser events and AST
utilities.
- Reworked `JSON_SCHEMA` and `CORE_SCHEMA` with spec-compliant scalar
resolution
rules, and added `YAML11_SCHEMA`.
- Added `realMapTag` for lossless mappings with non-string and complex
keys.
Object-based mappings now reject complex keys instead of stringifying
them.
- Added `dump()` `transform` option for changing the generated AST
before
rendering.
- Added `dump()` options `seqInlineFirst`, `flowBracketPadding`,
`flowSkipCommaSpace`, `flowSkipColonSpace`, `quoteFlowKeys`,
`quoteStyle` and
`tagBeforeAnchor`.
- Added formal data layers (events and AST) for modular data pipelines.
- Added low-level parser (to events), presenter and visitor APIs.
- Added the [YAML Test
Suite](https://redirect.github.com/yaml/yaml-test-suite) to the
test set.
##### Changed
- See the [migration guide](docs/migrate_v4_to_v5.md) for upgrade notes.
- Rewritten in TypeScript and reorganized the public API around flat
named
exports.
- Reduced the set of exported schemas:
- YAML 1.2 schemas: `CORE_SCHEMA` (loader default), `JSON_SCHEMA`,
`FAILSAFE_SCHEMA`.
- `YAML11_SCHEMA`, a combination of all YAML 1.1 tags (YAML 1.1 does not
specify a schema, only "types").
- `load`/`dump` default behaviour is now specified exactly via schemas:
- `load` uses `CORE_SCHEMA`, without `!!merge` by default.
- `dump` uses `YAML11_SCHEMA` + `CORE_SCHEMA` for the quoting check, to
guarantee backward compatibility by default.
- `!!set` is now loaded as a JavaScript `Set`.
- Replaced the `Type` API with a tags API. Similar, but more precise and
simpler. See examples for details. Tags can be defined via
`defineScalarTag()`, `defineSequenceTag()` and `defineMappingTag()`, or
as a
spread + override of an existing tag.
- Renamed `Schema.extend()` to `Schema.withTags()`.
- Expanded YAML 1.2 conformance and improved handling of directives,
document
markers, block keys, multiline scalars, tag syntax and other things.
- `load()` now throws on empty input instead of returning `undefined`.
- Moved browser builds to the `js-yaml/browser` export.
- Deprecated the `loadAll` signature with an iterator (still works, but
is a
candidate for removal).
##### Removed
- Removed deprecated `safeLoad()`, `safeLoadAll()` and `safeDump()`
exports.
- Removed `DEFAULT_SCHEMA` and the nested `types` export.
- Removed loader options `onWarning`, `legacy` and `listener`.
- Removed dumper options `styles`, `replacer`, `noCompatMode`,
`condenseFlow`,
`quotingType` and `forceQuotes`. Renamed `noArrayIndent` to
`seqNoIndent`.
Formatting and representation are now configured through presenter
options,
schemas and tag definitions. See migration guide on how to replace.
- Removed support for importing internal files from `lib/`.
</details>
<details>
<summary>jsdom/jsdom (jsdom)</summary>
###
[`v30.0.1`](https://redirect.github.com/jsdom/jsdom/compare/v30.0.0...6584485f094d5b271553005b68804c93a455c002)
[Compare
Source](https://redirect.github.com/jsdom/jsdom/compare/v30.0.0...v30.0.1)
###
[`v30.0.0`](https://redirect.github.com/jsdom/jsdom/compare/v29.1.1...v30.0.0)
[Compare
Source](https://redirect.github.com/jsdom/jsdom/compare/v29.1.1...v30.0.0)
</details>
<details>
<summary>mswjs/msw-storybook-addon (msw-storybook-addon)</summary>
###
[`v3.0.0`](https://redirect.github.com/mswjs/msw-storybook-addon/releases/tag/v3.0.0)
[Compare
Source](https://redirect.github.com/mswjs/msw-storybook-addon/compare/v2.0.7...v3.0.0)
#### v3.0.0 (2026-07-24)
##### ⚠️ BREAKING CHANGES
- new addon architecture
([#​182](https://redirect.github.com/mswjs/msw-storybook-addon/issues/182))
([`0edc30f`](https://redirect.github.com/mswjs/msw-storybook-addon/commit/0edc30f4de3304533fd8cd750c250791927207b6))
[@​kettanaito](https://redirect.github.com/kettanaito)
[@​yannbf](https://redirect.github.com/yannbf)
Please see [MIGRATION.md](./MIGRATION.md) for the instructions and the
codemods to migrate to this version.
</details>
<details>
<summary>ai/nanoid (nanoid)</summary>
###
[`v6.0.1`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#601)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/6.0.0...6.0.1)
- Fixed docs.
###
[`v6.0.0`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#600)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.16...6.0.0)
- Made `nanoid()` and `customAlphabet()` 4 times faster (by
[@​orhanayd](https://redirect.github.com/orhanayd)).
- Removed Node.js 18 and 20 support.
###
[`v5.1.16`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5116)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.15...5.1.16)
- Fixed forever loop on negative size (by
[@​spokodev](https://redirect.github.com/spokodev)).
###
[`v5.1.15`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5115)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.14...5.1.15)
- Fixed random pool corruption on big ID sizes.
###
[`v5.1.14`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5114)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.13...5.1.14)
- Fixed npm package size regression.
###
[`v5.1.13`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5113)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.12...5.1.13)
- Fixed npm package size regression.
###
[`v5.1.12`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5112)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.11...5.1.12)
- Moved to npm Provenance and Staged Publishing.
###
[`v5.1.11`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5111)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.10...5.1.11)
- Fixed breaking Nano ID by requesting big ID.
###
[`v5.1.10`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5110)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.9...5.1.10)
- Fixed breaking Nano ID by requesting big ID (by
[@​alanzabihi](https://redirect.github.com/alanzabihi)).
###
[`v5.1.9`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#519)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.8...5.1.9)
- Fixed npm package size regression.
###
[`v5.1.8`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#518)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.7...5.1.8)
- Made `cusatomAlphabet` 75% faster (by
[@​saripovdenis](https://redirect.github.com/saripovdenis)).
###
[`v5.1.7`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#517)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.6...5.1.7)
- Added `--version` to CLI (by
[@​mahmoodhamdi](https://redirect.github.com/mahmoodhamdi)).
- Updated `nanoid.js` for CDN (by
[@​mahmoodhamdi](https://redirect.github.com/mahmoodhamdi)).
- Fixed docs (by
[@​mahmoodhamdi](https://redirect.github.com/mahmoodhamdi)).
- Fixed `customRandom` types (by
[@​oguimbal](https://redirect.github.com/oguimbal)).
###
[`v5.1.6`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#516)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.5...5.1.6)
- Fixed infinite loop on 0 size for `customAlphabet`.
###
[`v5.1.5`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#515)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.4...5.1.5)
- Fixed latest version on npm after 3.x release.
###
[`v5.1.4`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#514)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.3...5.1.4)
- Fixed latest version on npm after 3.x release.
###
[`v5.1.3`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#513)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.2...5.1.3)
- Fixed React Native support (by
[@​steida](https://redirect.github.com/steida)).
###
[`v5.1.2`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#512)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.1...5.1.2)
- Fixed module docs.
###
[`v5.1.1`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#5111)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.1.0...5.1.1)
- Fixed breaking Nano ID by requesting big ID.
###
[`v5.1.0`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#510)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.0.9...5.1.0)
- Added opaque types support (by
[@​kossnocorp](https://redirect.github.com/kossnocorp)).
###
[`v5.0.9`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#509)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.0.8...5.0.9)
- Fixed a way to break Nano ID by passing non-integer size (by
[@​myndzi](https://redirect.github.com/myndzi)).
###
[`v5.0.8`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#508)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.0.7...5.0.8)
- Reduced `customAlphabet` size (by
[@​kirillgroshkov](https://redirect.github.com/kirillgroshkov)).
###
[`v5.0.7`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#507)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.0.6...5.0.7)
- Fixed Parcel support (by
[@​WilhelmYakunin](https://redirect.github.com/WilhelmYakunin)).
###
[`v5.0.6`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#506)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.0.5...5.0.6)
- Fixed React Native support.
###
[`v5.0.5`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#505)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.0.4...5.0.5)
- Make browser’s version faster by increasing size a little (by Samuel
Elgozi).
###
[`v5.0.4`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#504)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.0.3...5.0.4)
- Fixed CLI docs (by
[@​ilyaboka](https://redirect.github.com/ilyaboka)).
###
[`v5.0.3`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#503)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.0.2...5.0.3)
- Fixed CLI docs (by Chris Schmich).
###
[`v5.0.2`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#502)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.0.1...5.0.2)
- Fixed `webcrypto` import (by Divyansh Singh).
###
[`v5.0.1`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#501)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/5.0.0...5.0.1)
- Fixed Node.js 18 support.
###
[`v5.0.0`](https://redirect.github.com/ai/nanoid/compare/4.0.2...5.0.0)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/4.0.2...5.0.0)
###
[`v4.0.2`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#402)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/4.0.1...4.0.2)
- Added [link](https://redirect.github.com/sponsors/ai) to Github
Sponsors.
###
[`v4.0.1`](https://redirect.github.com/ai/nanoid/blob/HEAD/CHANGELOG.md#401)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/4.0.0...4.0.1)
- Reduced npm package size (by
[@​HiChen404](https://redirect.github.com/HiChen404)).
###
[`v4.0.0`](https://redirect.github.com/ai/nanoid/compare/3.3.12...4.0.0)
[Compare
Source](https://redirect.github.com/ai/nanoid/compare/3.3.18...4.0.0)
</details>
<details>
<summary>microsoft/TypeScript (typescript)</summary>
###
[`v7.0.2`](https://redirect.github.com/microsoft/TypeScript/compare/v6.0.3...2bd066d87f5bafd315be9f40889d0a60b9e58e0b)
[Compare
Source](https://redirect.github.com/microsoft/TypeScript/compare/v6.0.3...v7.0.2)
###
[`v6.0.3`](https://redirect.github.com/microsoft/TypeScript/releases/tag/v6.0.3):
TypeScript 6.0.3
[Compare
Source](https://redirect.github.com/microsoft/TypeScript/compare/v6.0.2...v6.0.3)
For release notes, check out the [release announcement blog
post](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/).
- [fixed issues query for TypeScript 6.0.0
(Beta)](https://redirect.github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.0%22).
- [fixed issues query for TypeScript 6.0.1
(RC)](https://redirect.github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.1%22).
- [fixed issues query for TypeScript 6.0.2
(Stable)](https://redirect.github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.2%22).
- [fixed issues query for TypeScript 6.0.3
(Stable)](https://redirect.github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93\&q=milestone%3A%22TypeScript+6.0.3%22).
Downloads are available on:
- [npm](https://www.npmjs.com/package/typescript)
###
[`v6.0.2`](https://redirect.github.com/microsoft/TypeScript/releases/tag/v6.0.2):
TypeScript 6.0
[Compare
Source](https://redirect.github.com/microsoft/TypeScript/compare/v5.9.3...v6.0.2)
For release notes, check out the [release announcement blog
post](https://devblogs.microsoft.com/typescript/announcing-typescript-6-0/).
- [fixed issues query for TypeScript 6.0.0
(Beta)](https://redirect.githu
> ✂ **Note**
>
> PR body was truncated to here.
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "every 2 weeks on Sunday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/splunk/addonfactory-ucc-generator).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjQ2LjAiLCJ0YXJnZXRCcmFuY2giOiJkZXZlbG9wIiwibGFiZWxzIjpbXX0=-->
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: kkedziak-splunk <kkedziak@splunk.com>
Co-authored-by: srv-rr-github-token <94607705+srv-rr-github-token@users.noreply.github.com>
> ℹ️ **Note**
>
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [@babel/core](https://babel.dev/docs/en/next/babel-core)
([source](https://redirect.github.com/babel/babel/tree/HEAD/packages/babel-core))
| [`^7.29.0` →
`^7.29.7`](https://renovatebot.com/diffs/npm/@babel%2fcore/7.29.7/7.29.7)
|
|
|
| [@babel/eslint-parser](https://babel.dev/)
([source](https://redirect.github.com/babel/babel/tree/HEAD/eslint/babel-eslint-parser))
| [`^7.28.6` →
`^7.29.7`](https://renovatebot.com/diffs/npm/@babel%2feslint-parser/7.29.7/7.29.7)
|
|
|
|
[@babel/helper-plugin-utils](https://babel.dev/docs/en/next/babel-helper-plugin-utils)
([source](https://redirect.github.com/babel/babel/tree/HEAD/packages/babel-helper-plugin-utils))
| [`^7.28.6` →
`^7.29.7`](https://renovatebot.com/diffs/npm/@babel%2fhelper-plugin-utils/7.29.7/7.29.7)
|
|
|
|
[@babel/plugin-transform-runtime](https://babel.dev/docs/en/next/babel-plugin-transform-runtime)
([source](https://redirect.github.com/babel/babel/tree/HEAD/packages/babel-plugin-transform-runtime))
| [`^7.29.0` →
`^7.29.7`](https://renovatebot.com/diffs/npm/@babel%2fplugin-transform-runtime/7.29.7/7.29.7)
|
|
|
| [@babel/preset-env](https://babel.dev/docs/en/next/babel-preset-env)
([source](https://redirect.github.com/babel/babel/tree/HEAD/packages/babel-preset-env))
| [`^7.29.2` →
`^7.29.7`](https://renovatebot.com/diffs/npm/@babel%2fpreset-env/7.29.7/7.29.7)
|
|
|
|
[@babel/preset-react](https://babel.dev/docs/en/next/babel-preset-react)
([source](https://redirect.github.com/babel/babel/tree/HEAD/packages/babel-preset-react))
| [`^7.28.5` →
`^7.29.7`](https://renovatebot.com/diffs/npm/@babel%2fpreset-react/7.29.7/7.29.7)
|
|
|
|
[@rollup/plugin-commonjs](https://redirect.github.com/rollup/plugins/tree/master/packages/commonjs/#readme)
([source](https://redirect.github.com/rollup/plugins/tree/HEAD/packages/commonjs))
| [`^29.0.2` →
`^29.0.3`](https://renovatebot.com/diffs/npm/@rollup%2fplugin-commonjs/29.0.3/29.0.3)
|
|
|
| @​splunk/dashboard-action-buttons | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-action-buttons/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-context | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-context/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-core | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-core/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-definition | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-definition/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-event-handlers | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-event-handlers/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-icons | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-icons/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-inputs | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-inputs/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-layouts | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-layouts/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-presets | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-presets/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-search | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-search/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-state | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-state/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-telemetry | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-telemetry/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-types | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-types/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-ui | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-ui/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-utils | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-utils/29.4.0/29.8.0)
|
|
|
| @​splunk/dashboard-validation | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdashboard-validation/29.4.0/29.8.0)
|
|
|
| @​splunk/datasource-utils | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdatasource-utils/29.4.0/29.8.0)
|
|
|
| @​splunk/datasources | [`29.4.0` →
`29.8.0`](https://renovatebot.com/diffs/npm/@splunk%2fdatasources/29.4.0/29.8.0)
|
|
|
| @​splunk/eslint-config | [`^5.0.0` →
`^5.1.0`](https://renovatebot.com/diffs/npm/@splunk%2feslint-config/5.1.0/5.1.0)
|
|
|
| @​splunk/react-events-viewer | [`^28.0.0` →
`^28.9.0`](https://renovatebot.com/diffs/npm/@splunk%2freact-events-viewer/28.8.0/28.9.0)
|
|
|
| @​splunk/react-icons | [`^5.2.0` →
`^5.14.1`](https://renovatebot.com/diffs/npm/@splunk%2freact-icons/5.14.1/5.14.1)
|
|
|
| @​splunk/react-page | [`^8.0.0` →
`^8.3.2`](https://renovatebot.com/diffs/npm/@splunk%2freact-page/8.3.2/8.3.2)
|
|
|
| @​splunk/react-toast-notifications | [`^0.12.0` →
`^0.13.0`](https://renovatebot.com/diffs/npm/@splunk%2freact-toast-notifications/0.12.0/0.13.0)
|
|
|
| @​splunk/react-ui | [`5.2.0` →
`5.15.0`](https://renovatebot.com/diffs/npm/@splunk%2freact-ui/5.2.0/5.15.0)
|
|
|
| @​splunk/splunk-utils | [`^3.2.0` →
`^3.4.0`](https://renovatebot.com/diffs/npm/@splunk%2fsplunk-utils/3.4.0/3.4.0)
|
|
|
| @​splunk/themes | [`^1.2.0` →
`^1.11.0`](https://renovatebot.com/diffs/npm/@splunk%2fthemes/1.11.0/1.11.0)
|
|
|
| @​splunk/ui-utils | [`^1.10.0` →
`^1.14.1`](https://renovatebot.com/diffs/npm/@splunk%2fui-utils/1.14.1/1.14.1)
|
|
|
| @​splunk/visualization-context | [`^28.4.0` →
`^28.9.0`](https://renovatebot.com/diffs/npm/@splunk%2fvisualization-context/28.8.0/28.9.0)
|
|
|
| @​splunk/visualization-schemas | [`28.4.0` →
`28.9.0`](https://renovatebot.com/diffs/npm/@splunk%2fvisualization-schemas/28.4.0/28.9.0)
|
|
|
|
[@storybook/addon-a11y](https://redirect.github.com/storybookjs/storybook/tree/next/code/addons/a11y)
([source](https://redirect.github.com/storybookjs/storybook/tree/HEAD/code/addons/a11y))
| [`^10.3.3` →
`^10.5.10`](https://renovatebot.com/diffs/npm/@storybook%2faddon-a11y/10.5.10/10.5.10)
|
|
|
|
[@storybook/addon-links](https://redirect.github.com/storybookjs/storybook/tree/next/code/addons/links)
([source](https://redirect.github.com/storybookjs/storybook/tree/HEAD/code/addons/links))
| [`^10.3.3` →
`^10.5.10`](https://renovatebot.com/diffs/npm/@storybook%2faddon-links/10.5.10/10.5.10)
|
|
|
|
[@storybook/builder-vite](https://redirect.github.com/storybookjs/storybook/tree/next/code/builders/builder-vite/#readme)
([source](https://redirect.github.com/storybookjs/storybook/tree/HEAD/code/builders/builder-vite))
| [`^10.3.3` →
`^10.5.10`](https://renovatebot.com/diffs/npm/@storybook%2fbuilder-vite/10.5.10/10.5.10)
|
|
|
|
[@storybook/react](https://redirect.github.com/storybookjs/storybook/tree/next/code/renderers/react)
([source](https://redirect.github.com/storybookjs/storybook/tree/HEAD/code/renderers/react))
| [`^10.3.3` →
`^10.5.10`](https://renovatebot.com/diffs/npm/@storybook%2freact/10.5.10/10.5.10)
|
|
|
|
[@storybook/react-vite](https://redirect.github.com/storybookjs/storybook/tree/next/code/frameworks/react-vite)
([source](https://redirect.github.com/storybookjs/storybook/tree/HEAD/code/frameworks/react-vite))
| [`^10.3.3` →
`^10.5.10`](https://renovatebot.com/diffs/npm/@storybook%2freact-vite/10.5.10/10.5.10)
|
|
|
|
[@storybook/test-runner](https://redirect.github.com/storybookjs/test-runner)
| [`^0.24.3` →
`^0.24.4`](https://renovatebot.com/diffs/npm/@storybook%2ftest-runner/0.24.4/0.24.4)
|
|
|
|
[@testing-library/user-event](https://redirect.github.com/testing-library/user-event)
| [`^14.6.1` →
`^14.6.6`](https://renovatebot.com/diffs/npm/@testing-library%2fuser-event/14.6.6/14.6.6)
|
|
|
|
[@types/lodash](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/lodash)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash))
| [`^4.17.24` →
`^4.17.25`](https://renovatebot.com/diffs/npm/@types%2flodash/4.17.25/4.17.25)
|
|
|
|
[@types/react](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/react)
([source](https://redirect.github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react))
| [`^18.3.28` →
`^18.3.31`](https://renovatebot.com/diffs/npm/@types%2freact/18.3.31/18.3.31)
|
|
|
| [@vitest/coverage-istanbul](https://vitest.dev/guide/coverage)
([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul))
| [`^4.1.2` →
`^4.1.11`](https://renovatebot.com/diffs/npm/@vitest%2fcoverage-istanbul/4.1.11/4.1.11)
|
|
|
| [@xmldom/xmldom](https://redirect.github.com/xmldom/xmldom) |
[`^0.8.13` →
`^0.9.12`](https://renovatebot.com/diffs/npm/@xmldom%2fxmldom/0.8.15/0.9.12)
|
|
|
| [ajv](https://ajv.js.org)
([source](https://redirect.github.com/ajv-validator/ajv)) | [`^8.18.0` →
`^8.20.0`](https://renovatebot.com/diffs/npm/ajv/8.20.0/8.20.0) |
|
|
| [axios](https://axios-http.com)
([source](https://redirect.github.com/axios/axios)) | [`^1.14.0` →
`^1.20.0`](https://renovatebot.com/diffs/npm/axios/1.19.0/1.20.0) |
|
|
| [babel-jest](https://redirect.github.com/jestjs/jest)
([source](https://redirect.github.com/jestjs/jest/tree/HEAD/packages/babel-jest))
| [`^30.3.0` →
`^30.4.1`](https://renovatebot.com/diffs/npm/babel-jest/30.4.1/30.4.1) |
|
|
| [esbuild](https://redirect.github.com/evanw/esbuild) | [`^0.28.0` →
`^0.28.2`](https://renovatebot.com/diffs/npm/esbuild/0.28.2/0.28.2) |
|
|
|
[esbuild-loader](https://redirect.github.com/privatenumber/esbuild-loader)
| [`^4.4.2` →
`^4.5.0`](https://renovatebot.com/diffs/npm/esbuild-loader/4.5.0/4.5.0)
|
|
|
|
[eslint-import-resolver-typescript](https://redirect.github.com/import-js/eslint-import-resolver-typescript)
| [`^4.4.4` →
`^4.4.5`](https://renovatebot.com/diffs/npm/eslint-import-resolver-typescript/4.4.5/4.4.5)
|
|
|
|
[eslint-plugin-jest](https://redirect.github.com/jest-community/eslint-plugin-jest)
| [`^29.15.1` →
`^29.16.2`](https://renovatebot.com/diffs/npm/eslint-plugin-jest/29.16.1/29.16.2)
|
|
|
|
[eslint-plugin-storybook](https://redirect.github.com/storybookjs/storybook/tree/next/code/lib/eslint-plugin#readme)
([source](https://redirect.github.com/storybookjs/storybook/tree/HEAD/code/lib/eslint-plugin))
| [`^10.3.3` →
`^10.5.10`](https://renovatebot.com/diffs/npm/eslint-plugin-storybook/10.5.10/10.5.10)
|
|
|
| [fast-uri](https://redirect.github.com/fastify/fast-uri) | [`^3.1.2` →
`^3.1.6`](https://renovatebot.com/diffs/npm/fast-uri/3.1.6/3.1.6) |
|
|
|
[http-proxy-middleware](https://redirect.github.com/chimurai/http-proxy-middleware)
| [`^3.0.5` →
`^3.0.7`](https://renovatebot.com/diffs/npm/http-proxy-middleware/3.0.7/3.0.7)
|
|
|
| [jest](https://jestjs.io/)
([source](https://redirect.github.com/jestjs/jest/tree/HEAD/packages/jest))
| [`^30.3.0` →
`^30.4.2`](https://renovatebot.com/diffs/npm/jest/30.4.2/30.4.2) |
|
|
| [jest-environment-jsdom](https://redirect.github.com/jestjs/jest)
([source](https://redirect.github.com/jestjs/jest/tree/HEAD/packages/jest-environment-jsdom))
| [`^30.3.0` →
`^30.4.1`](https://renovatebot.com/diffs/npm/jest-environment-jsdom/30.4.1/30.4.1)
|
|
|
| [js-yaml](https://redirect.github.com/nodeca/js-yaml) | [`^4.1.1` →
`^4.3.2`](https://renovatebot.com/diffs/npm/js-yaml/4.3.1/4.3.2) |
|
|
| [lodash](https://lodash.com/)
([source](https://redirect.github.com/lodash/lodash)) | [`^4.17.23` →
`^4.18.1`](https://renovatebot.com/diffs/npm/lodash/4.18.1/4.18.1) |
|
|
| [msw](https://mswjs.io)
([source](https://redirect.github.com/mswjs/msw)) | [`^2.12.14` →
`^2.15.0`](https://renovatebot.com/diffs/npm/msw/2.15.0/2.15.0) |
|
|
|
[msw-storybook-addon](https://redirect.github.com/mswjs/msw-storybook-addon)
| [`^2.0.6` →
`^2.0.7`](https://renovatebot.com/diffs/npm/msw-storybook-addon/2.0.7/2.0.7)
|
|
|
| [postcss](https://postcss.org/)
([source](https://redirect.github.com/postcss/postcss)) | [`^8.5.10` →
`^8.5.26`](https://renovatebot.com/diffs/npm/postcss/8.5.26/8.5.26) |
|
|
| [react-is](https://react.dev/)
([source](https://redirect.github.com/react/react/tree/HEAD/packages/react-is))
| [`^19.2.4` →
`^19.2.8`](https://renovatebot.com/diffs/npm/react-is/19.2.4/19.2.8) |
|
|
| [react-router-dom](https://redirect.github.com/remix-run/react-router)
([source](https://redirect.github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom))
| [`7.18.0` →
`7.18.2`](https://renovatebot.com/diffs/npm/react-router-dom/7.18.0/7.18.2)
|
|
|
|
[rollup-plugin-license](https://redirect.github.com/mjeanroy/rollup-plugin-license)
| [`^3.7.0` →
`^3.7.1`](https://renovatebot.com/diffs/npm/rollup-plugin-license/3.7.1/3.7.1)
|
|
|
| [semver](https://redirect.github.com/npm/node-semver) | [`^7.7.4` →
`^7.8.5`](https://renovatebot.com/diffs/npm/semver/7.8.5/7.8.5) |
|
|
| [storybook](https://storybook.js.org)
([source](https://redirect.github.com/storybookjs/storybook/tree/HEAD/code/core))
| [`^10.3.3` →
`^10.5.10`](https://renovatebot.com/diffs/npm/storybook/10.5.10/10.5.10)
|
|
|
| [uuid](https://redirect.github.com/uuidjs/uuid) | [`^14.0.0` →
`^14.0.2`](https://renovatebot.com/diffs/npm/uuid/14.0.2/14.0.2) |
|
|
| [vite](https://vite.dev)
([source](https://redirect.github.com/vitejs/vite/tree/HEAD/packages/vite))
| [`^7.3.1` →
`^7.3.6`](https://renovatebot.com/diffs/npm/vite/7.3.6/7.3.6) |
|
|
|
[vite-plugin-checker](https://redirect.github.com/fi3ework/vite-plugin-checker)
| [`^0.12.0` →
`^0.14.5`](https://renovatebot.com/diffs/npm/vite-plugin-checker/0.12.0/0.14.5)
|
|
|
|
[vite-plugin-node-polyfills](https://redirect.github.com/davidmyersdev/vite-plugin-node-polyfills)
| [`^0.26.0` →
`^0.28.0`](https://renovatebot.com/diffs/npm/vite-plugin-node-polyfills/0.26.0/0.28.0)
|
|
|
| [vitest](https://vitest.dev)
([source](https://redirect.github.com/vitest-dev/vitest/tree/HEAD/packages/vitest))
| [`^4.1.2` →
`^4.1.11`](https://renovatebot.com/diffs/npm/vitest/4.1.11/4.1.11) |
|
|
| [zod](https://zod.dev)
([source](https://redirect.github.com/colinhacks/zod)) | [`^4.3.6` →
`^4.4.3`](https://renovatebot.com/diffs/npm/zod/4.4.3/4.4.3) |
|
|
---
### Release Notes
<details>
<summary>xmldom/xmldom (@​xmldom/xmldom)</summary>
###
[`v0.9.12`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#0912)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.9.11...0.9.12)
##### Fixed
- Security: parsing a deeply or repeatedly namespaced document no longer
consumes quadratic memory; the in-scope namespace map is inherited
through the prototype chain instead of being copied for every
prefix-declaring element (O(N) instead of O(N²)), preventing a
denial-of-service reachable from `DOMParser.parseFromString` with
default options. Serialized output is byte-identical.
[`GHSA-965w-775f-mr7g`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g)
- Security: attribute de-duplication during parsing is now O(M) instead
of O(M²); the `NamedNodeMap` parse-time dedup path uses a null-prototype
membership index, so a well-formed document with a hostile number of
duplicate attributes can no longer wedge the parse. Attribute order and
duplicate resolution (last value wins, first position kept) are
byte-identical, preserving the XML [no-duplicate-attributes
well-formedness constraint](https://www.w3.org/TR/xml/#uniqattspec).
[`GHSA-8344-3jmq-59r6`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6)
- Security: HTML raw-text parsing no longer amplifies output on a
missing or case-mismatched closing tag; the closing tag is matched
case-insensitively per the WHATWG HTML [RAWTEXT end-tag
rule](https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-name-state)
and a missing closing tag is handled explicitly, preventing a
denial-of-service. Output for well-formed input is unchanged.
[`GHSA-6mj3-qw4j-hgrw`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw)
- Security: malformed-input recovery is now linear instead of quadratic
— the malformed tag-name scan terminates at an embedded `<`, and
`Node.prototype.normalize()` merges adjacent text nodes in O(K) instead
of O(K²) (also reachable programmatically), per
[`normalize()`](https://dom.spec.whatwg.org/#dom-node-normalize) in the
WHATWG DOM spec. DOM output is unchanged; only the reported error text
differs.
[`GHSA-93r5-fhx6-vmg9`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9)
- Security: `XMLSerializer.serializeToString()` under `{
requireWellFormed: true }` now rejects a DocType `name` that is not a
valid XML [`Name`](https://www.w3.org/TR/xml/#NT-Name), throwing
`InvalidStateError` — matching the sibling
`publicId`/`systemId`/`internalSubset` checks and preventing XML
injection via `DocumentType.name`.
[`GHSA-27p8-2357-5qqv`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv)
- Security: `XMLSerializer.serializeToString()` under `{
requireWellFormed: true }` now validates a processing-instruction target
as an XML [`NCName`](https://www.w3.org/TR/xml-names/#NT-NCName) and
rejects a case-insensitive `xml`, throwing `InvalidStateError` —
preventing PI-target injection via `>`, `?`, or whitespace.
[`GHSA-c7q8-3ch8-vqpv`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv)
- Security: `Document.createEntityReference()` now rejects an invalid
XML [`Name`](https://www.w3.org/TR/xml/#NT-Name) at creation, and
`XMLSerializer.serializeToString()` under `{ requireWellFormed: true }`
validates an `EntityReference` `nodeName` as an XML `Name`, throwing
`InvalidStateError` — preventing XML injection via an entity-reference
name.
[`GHSA-6gmq-8vp8-gcm6`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6)
- Security: the `requireWellFormed` serializer's element- and
attribute-name validators no longer treat an interior line terminator as
satisfying the name anchors, so a name containing a line terminator is
rejected with `InvalidStateError` — closing a bypass of the XML
[`QName`](https://www.w3.org/TR/xml-names/#NT-QName) check.
[`GHSA-jxjr-3g7g-3944`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-jxjr-3g7g-3944)
- Security: the `requireWellFormed` serializer's DocType
`publicId`/`systemId` validators no longer treat an interior line
terminator as satisfying the anchor, so an identifier containing an
ECMAScript line terminator is rejected with `InvalidStateError` —
closing a bypass of the XML
[`PubidLiteral`](https://www.w3.org/TR/xml/#NT-PubidLiteral)/`SystemLiteral`
check.
[`GHSA-vr34-hp96-76pp`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-vr34-hp96-76pp)
- Security: `createElementNS()`, `createAttributeNS()`,
`createDocumentType()`, and `createAttribute()` now reject a name
containing a line terminator with `InvalidCharacterError`, because name
validation applies to the whole string — closing a creation-time bypass
of the XML [`Name`/`QName`](https://www.w3.org/TR/xml-names/#NT-QName)
production on the default serialization path.
[`GHSA-3px3-54cx-rmw9`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-3px3-54cx-rmw9)
- Security: the parser now reports a not-well-formed end tag whose valid
name is followed by trailing content (a recoverable `error` in XML, a
`warning` in HTML) instead of accepting it silently, per the XML
[`ETag`](https://www.w3.org/TR/xml/#NT-ETag) production; parsing
recovers to the byte-identical DOM. Consumers that want strict rejection
can escalate the reported `error` to fatal via the parser's `onError`
handler.
[`GHSA-6h8r-xr42-gp59`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59)
- `DOMException`s raised during parsing are now reported as a
`fatalError`, and the originating error is preserved as the `cause` on
the resulting `ParseError`.
##### Chore
- updated dependencies
Thank you,
[@​ericchiang](https://redirect.github.com/ericchiang),
[@​KarimTantawey](https://redirect.github.com/KarimTantawey),
[@​bhaswanthc](https://redirect.github.com/bhaswanthc),
[@​arpitjain099](https://redirect.github.com/arpitjain099),
[@​Paranoidgrinch](https://redirect.github.com/Paranoidgrinch),
for your contributions
###
[`v0.9.11`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#0911)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.9.10...0.9.11)
##### Fixed
- Security: `XMLSerializer.serializeToString()` now also rejects invalid
element and attribute names when `{ requireWellFormed: true }` is
passed, throwing `InvalidStateError` for a name that is not a valid XML
[`QName`](https://www.w3.org/TR/xml-names/#NT-QName) (this covers the
namespace prefix, which surfaces in the element qualified name or in a
synthesized `xmlns:` declaration). This prevents XML injection via
`createElement()` / `setAttribute()`, extending the existing
`requireWellFormed` checks to the serialized name set.
[`GHSA-w2rr-34g9-rvrj`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj)
[`GHSA-4w3w-2rp5-g8jm`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm)
- Security: the processing-instruction grammar regex no longer
backtracks quadratically on an unterminated processing instruction
(`<?…` with no closing `?>`), preventing a denial-of-service (ReDoS)
reachable from `DOMParser.parseFromString` with default options.
[`GHSA-g53g-w8rj-fmg7`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-g53g-w8rj-fmg7)
- `CharacterData` `nodeValue` and `data` are now kept in sync
[`#990`](https://redirect.github.com/xmldom/xmldom/pull/990)
##### Chore
- updated dependencies
Thank you,
[@​bhaswanthc](https://redirect.github.com/bhaswanthc),
[@​jmestwa-coder](https://redirect.github.com/jmestwa-coder),
[@​stevenobiajulu](https://redirect.github.com/stevenobiajulu),
for your contributions
###
[`v0.9.10`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#0910)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.9.9...0.9.10)
##### Fixed
- Security: `XMLSerializer.serializeToString()` (and `Node.toString()`,
`NodeList.toString()`) now accept a `requireWellFormed` option. When `{
requireWellFormed: true }` is passed, the serializer throws
`InvalidStateError` for injection-prone node content, preventing XML
injection via attacker-controlled node data.
[`GHSA-j759-j44w-7fr8`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8)
[`GHSA-x6wf-f3px-wcqx`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx)
[`GHSA-f6ww-3ggp-fr8h`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h)
- Comment: throws when `data` contains `--` anywhere, ends with `-`, or
contains characters outside the XML `Char` production
- ProcessingInstruction: throws when target contains `:` or matches
`xml` (case-insensitive), or `data` contains characters outside the XML
`Char` production or contains `?>`
- DocumentType: throws when `publicId` fails `PubidLiteral`, `systemId`
fails `SystemLiteral`, or `internalSubset` contains `]>`
- Security: DOM traversal operations
(`XMLSerializer.serializeToString()`, `Node.prototype.normalize()`,
`Node.prototype.cloneNode(true)`, `Document.prototype.importNode(node,
true)`, `node.textContent` getter, `getElementsByTagName()` /
`getElementsByTagNameNS()` / `getElementsByClassName()` /
`getElementById()`, `Node.prototype.isEqualNode()`) are now iterative.
Previously, deeply nested DOM trees would exhaust the JavaScript call
stack and throw an unrecoverable `RangeError`.
[`GHSA-2v35-w6hq-6mfw`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw)
- `isEqualNode` now correctly returns `false` for CDATASection nodes
with different `data`
##### Deprecated
- The `splitCDATASections` serializer option is deprecated and will be
removed in the next breaking release. The automatic splitting of `"]]>"`
in `CDATASection` data was introduced as a workaround; use
`requireWellFormed: true` or ensure `CDATASection` data does not contain
`"]]>"` before serialization.
##### Chore
- updated dependencies
Thank you,
[@​Jvr2022](https://redirect.github.com/Jvr2022),
[@​praveen-kv](https://redirect.github.com/praveen-kv),
[@​TharVid](https://redirect.github.com/TharVid),
[@​decsecre583](https://redirect.github.com/decsecre583),
[@​tlsbollei](https://redirect.github.com/tlsbollei),
[@​KarimTantawey](https://redirect.github.com/KarimTantawey),
for your contributions
###
[`v0.9.9`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#099)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.9.8...0.9.9)
##### Added
- implement `ParentNode.children` getter
[`#960`](https://redirect.github.com/xmldom/xmldom/pull/960) /
[`#410`](https://redirect.github.com/xmldom/xmldom/issues/410)
##### Fixed
- Security: `createCDATASection` now throws `InvalidCharacterError` when
`data` contains `"]]>"`, as required by the [WHATWG DOM
spec](https://dom.spec.whatwg.org/#dom-document-createcdatasection).
[`GHSA-wh4c-j3r5-mjhp`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
- Security: `XMLSerializer` now splits CDATASection nodes whose data
contains `"]]>"` into adjacent CDATA sections at serialization time,
preventing XML injection via mutation methods (`appendData`,
`replaceData`, `.data =`, `.textContent =`).
[`GHSA-wh4c-j3r5-mjhp`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp)
- correctly traverse ancestor chain in `Node.contains`
[`#931`](https://redirect.github.com/xmldom/xmldom/pull/931)
Code that passes a string containing `"]]>"` to `createCDATASection` and
relied on the previously unsafe behavior will now receive
`InvalidCharacterError`. Use a mutation method such as `appendData` if
you intentionally need `"]]>"` in a CDATASection node's data.
##### Chore
- updated dependencies
Thank you,
[@​stevenobiajulu](https://redirect.github.com/stevenobiajulu),
[@​yoshi389111](https://redirect.github.com/yoshi389111),
[@​thesmartshadow](https://redirect.github.com/thesmartshadow),
for your contributions
###
[`v0.9.8`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#098)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.9.7...0.9.8)
##### Fixed
- fix: replace \u2029 as part of normalizeLineEndings
[`#839`](https://redirect.github.com/xmldom/xmldom/pull/839) /
[`#838`](https://redirect.github.com/xmldom/xmldom/issues/838)
- perf: speed up line detection
[`#847`](https://redirect.github.com/xmldom/xmldom/pull/847) /
[`#838`](https://redirect.github.com/xmldom/xmldom/issues/838)
##### Chore
- updated dependencies
- drop jazzer and rxjs devDependencies
[`#845`](https://redirect.github.com/xmldom/xmldom/pull/845)
Thank you,
[@​kboshold](https://redirect.github.com/kboshold),
[@​Ponynjaa](https://redirect.github.com/Ponynjaa),
for your contributions.
###
[`v0.9.7`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#097)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.9.6...0.9.7)
##### Added
- Implementation of `hasAttributes`
[`#804`](https://redirect.github.com/xmldom/xmldom/pull/804)
##### Fixed
- locator is now true even when other options are being used for the
DOMParser [`#802`](https://redirect.github.com/xmldom/xmldom/issues/802)
/ [`#803`](https://redirect.github.com/xmldom/xmldom/pull/803)
- allow case-insensitive DOCTYPE in HTML
[`#817`](https://redirect.github.com/xmldom/xmldom/issues/817) /
[`#819`](https://redirect.github.com/xmldom/xmldom/pull/819)
##### Performance
- simplify `DOM.compareDocumentPosition`
[`#805`](https://redirect.github.com/xmldom/xmldom/pull/805)
##### Chore
- updated devDependencies
Thank you,
[@​zorkow](https://redirect.github.com/zorkow),
[@​Ponynjaa](https://redirect.github.com/Ponynjaa),
[@​WesselKroos](https://redirect.github.com/WesselKroos),
for your contributions.
###
[`v0.9.6`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#096)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.9.5...0.9.6)
##### Fixed
- lower error level for unicode replacement character
[`#790`](https://redirect.github.com/xmldom/xmldom/issues/790) /
[`#794`](https://redirect.github.com/xmldom/xmldom/pull/794) /
[`#797`](https://redirect.github.com/xmldom/xmldom/pull/797)
##### Chore
- updated devDependencies
- migrate renovate config
[`#792`](https://redirect.github.com/xmldom/xmldom/pull/792)
Thank you, [@​eglitise](https://redirect.github.com/eglitise), for
your contributions.
###
[`v0.9.5`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#095)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.9.4...0.9.5)
##### Fixed
- fix: re-index childNodes on insertBefore
[`#763`](https://redirect.github.com/xmldom/xmldom/issues/763) /
[`#766`](https://redirect.github.com/xmldom/xmldom/pull/766)
Thank you,
[@​mureinik](https://redirect.github.com/mureinik),
for your contributions.
###
[`v0.9.4`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#094)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.9.3...0.9.4)
##### Fixed
- restore performance for large amount of child nodes
[`#748`](https://redirect.github.com/xmldom/xmldom/issues/748) /
[`#760`](https://redirect.github.com/xmldom/xmldom/pull/760)
- types: correct error handler level to `warning`
([#​759](https://redirect.github.com/xmldom/xmldom/issues/759))
[`#754`](https://redirect.github.com/xmldom/xmldom/issues/754) /
[`#759`](https://redirect.github.com/xmldom/xmldom/pull/759)
##### Docs
- test: verify BOM handling
[`#758`](https://redirect.github.com/xmldom/xmldom/pull/758)
Thank you,
[@​luffynando](https://redirect.github.com/luffynando),
[@​mattiasw](https://redirect.github.com/mattiasw),
[@​JoinerDev](https://redirect.github.com/JoinerDev),
for your contributions.
###
[`v0.9.3`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#093)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.9.2...0.9.3)
##### Fixed
- restore more `Node` and `ProcessingInstruction` types
[`#725`](https://redirect.github.com/xmldom/xmldom/issues/725) /
[`#726`](https://redirect.github.com/xmldom/xmldom/pull/726)
- `getElements*` methods return `LiveNodeList<Element>`
[`#731`](https://redirect.github.com/xmldom/xmldom/issues/731) /
[`#734`](https://redirect.github.com/xmldom/xmldom/pull/734)
- Add more missing `Node` props
[`#728`](https://redirect.github.com/xmldom/xmldom/pull/728), triggered
by unclosed [`#724`](https://redirect.github.com/xmldom/xmldom/pull/724)
##### Docs
- Update supported runtimes in readme (NodeJS >= 14.6 and other [ES5
compatible runtimes](https://compat-table.github.io/compat-table/es5/))
##### Chore
- updates devDependencies
Thank you,
[@​Ponynjaa](https://redirect.github.com/Ponynjaa),
[@​ayZagen](https://redirect.github.com/ayZagen),
[@​sserdyuk](https://redirect.github.com/sserdyuk),
[@​wydengyre](https://redirect.github.com/wydengyre),
[@​mykola-mokhnach](https://redirect.github.com/mykola-mokhnach),
[@​benkroeger](https://redirect.github.com/benkroeger),
for your contributions.
###
[`v0.9.2`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#092)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.9.1...0.9.2)
##### Feature
- add `Element.getElementsByClassName`
[`#722`](https://redirect.github.com/xmldom/xmldom/pull/722)
##### Fixed
- add missing types for `Document.documentElement` and `Element.tagName`
[`#721`](https://redirect.github.com/xmldom/xmldom/pull/721)
[`#720`](https://redirect.github.com/xmldom/xmldom/issues/720)
Thank you, [@​censujiang](https://redirect.github.com/censujiang),
[@​Mathias-S](https://redirect.github.com/Mathias-S), for your
contributions
###
[`v0.9.1`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#0910)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.9.0...0.9.1)
##### Fixed
- Security: `XMLSerializer.serializeToString()` (and `Node.toString()`,
`NodeList.toString()`) now accept a `requireWellFormed` option. When `{
requireWellFormed: true }` is passed, the serializer throws
`InvalidStateError` for injection-prone node content, preventing XML
injection via attacker-controlled node data.
[`GHSA-j759-j44w-7fr8`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8)
[`GHSA-x6wf-f3px-wcqx`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx)
[`GHSA-f6ww-3ggp-fr8h`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h)
- Comment: throws when `data` contains `--` anywhere, ends with `-`, or
contains characters outside the XML `Char` production
- ProcessingInstruction: throws when target contains `:` or matches
`xml` (case-insensitive), or `data` contains characters outside the XML
`Char` production or contains `?>`
- DocumentType: throws when `publicId` fails `PubidLiteral`, `systemId`
fails `SystemLiteral`, or `internalSubset` contains `]>`
- Security: DOM traversal operations
(`XMLSerializer.serializeToString()`, `Node.prototype.normalize()`,
`Node.prototype.cloneNode(true)`, `Document.prototype.importNode(node,
true)`, `node.textContent` getter, `getElementsByTagName()` /
`getElementsByTagNameNS()` / `getElementsByClassName()` /
`getElementById()`, `Node.prototype.isEqualNode()`) are now iterative.
Previously, deeply nested DOM trees would exhaust the JavaScript call
stack and throw an unrecoverable `RangeError`.
[`GHSA-2v35-w6hq-6mfw`](https://redirect.github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw)
- `isEqualNode` now correctly returns `false` for CDATASection nodes
with different `data`
##### Deprecated
- The `splitCDATASections` serializer option is deprecated and will be
removed in the next breaking release. The automatic splitting of `"]]>"`
in `CDATASection` data was introduced as a workaround; use
`requireWellFormed: true` or ensure `CDATASection` data does not contain
`"]]>"` before serialization.
##### Chore
- updated dependencies
Thank you,
[@​Jvr2022](https://redirect.github.com/Jvr2022),
[@​praveen-kv](https://redirect.github.com/praveen-kv),
[@​TharVid](https://redirect.github.com/TharVid),
[@​decsecre583](https://redirect.github.com/decsecre583),
[@​tlsbollei](https://redirect.github.com/tlsbollei),
[@​KarimTantawey](https://redirect.github.com/KarimTantawey),
for your contributions
###
[`v0.9.0`](https://redirect.github.com/xmldom/xmldom/blob/HEAD/CHANGELOG.md#090)
[Compare
Source](https://redirect.github.com/xmldom/xmldom/compare/0.8.15...0.9.0)
-
[Discussion](https://redirect.github.com/xmldom/xmldom/discussions/435)
- [Summary on
dev.to](https://dev.to/karfau/release-090-of-xmldomxmldom-4106)
##### Features
- feat: expose all DOM level 2 element prototypes
[`#637`](https://redirect.github.com/xmldom/xmldom/pull/637) /
[`#40`](https://redirect.github.com/xmldom/xmldom/issues/40)
- feat: add iterator function to NodeList and NamedNodeMap
[`#634`](https://redirect.github.com/xmldom/xmldom/pull/634) /
[`#633`](https://redirect.github.com/xmldom/xmldom/issues/633)
##### Fixed
- parse empty/whitspace only doctype internal subset
[`#692`](https://redirect.github.com/xmldom/xmldom/pull/692)
- avoid prototype clash in namespace prefix
[`#554`](https://redirect.github.com/xmldom/xmldom/pull/554)
- report fatalError when doctype is inside elements
[`#550`](https://redirect.github.com/xmldom/xmldom/pull/550)
##### Other
- test: add fuzz target and regression tests
[`#556`](https://redirect.github.com/xmldom/xmldom/pull/556)
- chore: improve .gitignore and provide .envrc.template
[`#697`](https://redirect.github.com/xmldom/xmldom/pull/697)
- chore: Apply security best practices
[`#546`](https://redirect.github.com/xmldom/xmldom/pull/546)
- ci: check test coverage in PRs
[`#524`](https://redirect.github.com/xmldom/xmldom/pull/524)
- docs: add missing commas to readme
[`#566`](https://redirect.github.com/xmldom/xmldom/pull/566)
- docs: click to copy install command in readme
[`#644`](https://redirect.github.com/xmldom/xmldom/pull/644)
- docs: enhance jsdoc comments
[`#511`](https://redirect.github.com/xmldom/xmldom/pull/511)
Thank you, [@​kboshold](https://redirect.github.com/kboshold),
[@​edi9999](https://redirect.github.com/edi9999),
[@​apupier](https://redirect.github.com/apupier),
[@​shunkica](https://redirect.github.com/shunkica),
[@​homer0](https://redirect.github.com/homer0),
[@​jhauga](https://redirect.github.com/jhauga),
[@​UdayKharatmol](https://redirect.github.com/UdayKharatmol), for
your contributions
</details>
<details>
<summary>axios/axios (axios)</summary>
###
[`v1.20.0`](https://redirect.github.com/axios/axios/releases/tag/v1.20.0)
[Compare
Source](https://redirect.github.com/axios/axios/compare/v1.19.0...v1.20.0)
#### v1.20.0 — August 19, 2026
This release hardens runtime option handling, adds RFC 9110 status-code
aliases, fixes Node.js and XHR reliability issues, and refreshes project
tooling and documentation.
#### ⚠️ Breaking Changes & Deprecations
- HTTP Status Naming: Added ContentTooLarge (413) and
UnprocessableContent (422), while retaining PayloadTooLarge and
UnprocessableEntity as backward-compatible deprecated aliases.
([#​11082](https://redirect.github.com/axios/axios/issues/11082))
#### 🔒 Security Fixes
- Runtime Option Handling: Hardened behavioral configuration reads
against shared and foreign prototype pollution and normalized unsafe
interceptor replacement objects. This also clarifies Fetch redirect and
custom implementation behavior, HTTP/2 DNS and proxy handling,
CIDR-based NO\_PROXY matching, and malformed data URI rejection; see the
PR for documented compatibility effects.
([#​11141](https://redirect.github.com/axios/axios/issues/11141))
#### 🐛 Bug Fixes
- Interceptor Lifecycle: Prevented unbounded handler-array growth by
trimming trailing ejected interceptors without changing iteration
semantics, and kept interceptor operations safe when the public handlers
field is nullish.
([#​11087](https://redirect.github.com/axios/axios/issues/11087),
[#​11118](https://redirect.github.com/axios/axios/issues/11118))
- Request Error Preservation: Prevented custom Error.prepareStackTrace
implementations that return non-string values from replacing the
original request failure with an unrelated TypeError.
([#​11109](https://redirect.github.com/axios/axios/issues/11109))
- XHR Reliability: Navigation-canceled requests now reject with
ECONNABORTED instead of resolving with status 0, while successful
downloads flush their final progress callback during the live loadend
dispatch.
([#​11094](https://redirect.github.com/axios/axios/issues/11094),
[#​11121](https://redirect.github.com/axios/axios/issues/11121))
- Node.js Socket Memory: Removed request-context retention from
per-socket error listeners, preventing completed response data from
being pinned for the lifetime of pooled keep-alive sockets.
([#​11091](https://redirect.github.com/axios/axios/issues/11091))
- Core Methods and HTTP Errors: Prevented structural method-header
buckets from leaking into outgoing headers, standardized invalid DNS
lookup and httpVersion failures as AxiosError.ERR\_BAD\_OPTION\_VALUE,
and corrected the timeoutErrorMessage merge strategy.
([#​11096](https://redirect.github.com/axios/axios/issues/11096))
#### 🔧 Maintenance & Chores
- Dependencies: Updated fast-uri, postcss, js-yaml, mocha,
development-tooling groups, and GitHub Actions dependencies.
([#​11092](https://redirect.github.com/axios/axios/issues/11092),
[#​11098](https://redirect.github.com/axios/axios/issues/11098),
[#​11099](https://redirect.github.com/axios/axios/issues/11099),
[#​11106](https://redirect.github.com/axios/axios/issues/11106),
[#​11107](https://redirect.github.com/axios/axios/issues/11107),
[#​11122](https://redirect.github.com/axios/axios/issues/11122),
[#​11123](https://redirect.github.com/axios/axios/issues/11123),
[#​11126](https://redirect.github.com/axios/axios/issues/11126),
[#​11127](https://redirect.github.com/axios/axios/issues/11127),
[#​11133](https://redirect.github.com/axios/axios/issues/11133),
[#​11140](https://redirect.github.com/axios/axios/issues/11140),
[#​11143](https://redirect.github.com/axios/axios/issues/11143),
[#​11144]
> ✂ **Note**
>
> PR body was truncated to here.
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "every 2 weeks on Sunday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/splunk/addonfactory-ucc-generator).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMTAuMiIsInVwZGF0ZWRJblZlciI6IjQ0LjQ2LjAiLCJ0YXJnZXRCcmFuY2giOiJkZXZlbG9wIiwibGFiZWxzIjpbXX0=-->
…2105) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [mkdocs-material](https://redirect.github.com/squidfunk/mkdocs-material) ([changelog](https://squidfunk.github.io/mkdocs-material/changelog/)) | `==9.6.16` → `==9.7.7` |  |  | --- ### Material for MkDocs: DOM XSS in search suggestions via query parameter [CVE-2026-73295](https://nvd.nist.gov/vuln/detail/CVE-2026-73295) / [GHSA-xvg9-69gf-fjrf](https://redirect.github.com/advisories/GHSA-xvg9-69gf-fjrf) <details> <summary>More information</summary> #### Details ##### Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional `search.suggest` feature. A crafted `q` URL parameter could execute JavaScript in the documentation site's origin after user interaction. ##### Patches The issue is fixed in Material for MkDocs 9.7.7. Users should upgrade to 9.7.7 or later. ##### Workarounds Sites unable to upgrade should disable the `search.suggest` feature. #### Severity - CVSS Score: 5.4 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N` #### References - [https://github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf](https://redirect.github.com/squidfunk/mkdocs-material/security/advisories/GHSA-xvg9-69gf-fjrf) - [https://nvd.nist.gov/vuln/detail/CVE-2026-73295](https://nvd.nist.gov/vuln/detail/CVE-2026-73295) - [https://github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25](https://redirect.github.com/squidfunk/mkdocs-material/commit/52fb6be8aafe326419f34dc94d3211e7bbfbfb25) - [https://github.com/squidfunk/mkdocs-material/releases/tag/9.7.7](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.7.7) - [https://github.com/advisories/GHSA-xvg9-69gf-fjrf](https://redirect.github.com/advisories/GHSA-xvg9-69gf-fjrf) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-xvg9-69gf-fjrf) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>squidfunk/mkdocs-material (mkdocs-material)</summary> ### [`v9.7.7`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.7.7): mkdocs-material-9.7.7 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.7.6...9.7.7) > \[!WARNING] > > **Material for MkDocs is approaching end of life** > > Material for MkDocs is scheduled to reach end of life on November 5, 2026. Until then, maintenance is limited to critical bug fixes and security updates. > > The path forward is [Zensical], our next-generation static site generator built from first principles. If you’re planning a new documentation project or thinking about your long-term setup, we encourage you to start exploring Zensical. > > Organizations requiring support beyond this date can [get in touch](mailto:hello@zensical.org) to discuss options. > > [Read the full announcement on our blog] [Zensical]: https://zensical.org [Read the full announcement on our blog]: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/ #### Changes - Fixed a DOM-based XSS vulnerability in search suggestions > Thanks to [@​p-](https://redirect.github.com/p-) for responsibly reporting this issue. ### [`v9.7.6`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.7.6): mkdocs-material-9.7.6 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.7.5...9.7.6) > \[!WARNING] > > **Material for MkDocs is in maintenance mode** > > Going forward, the Material for MkDocs team focuses on [Zensical], a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026. > > [Read the full announcement on our blog] [Zensical]: https://zensical.org [Read the full announcement on our blog]: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/ #### Changes - Automatically disable MkDocs 2.0 warning for forks of MkDocs ### [`v9.7.5`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.7.5): mkdocs-material-9.7.5 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.7.4...9.7.5) > \[!WARNING] > > **Material for MkDocs is in maintenance mode** > > Going forward, the Material for MkDocs team focuses on [Zensical], a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026. > > [Read the full announcement on our blog] [Zensical]: https://zensical.org [Read the full announcement on our blog]: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/ #### Changes - Limited version range of mkdocs to <2 - Updated MkDocs 2.0 incompatibility warning (clarify relation with MkDocs) ### [`v9.7.4`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.7.4): mkdocs-material-9.7.4 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.7.3...9.7.4) > \[!WARNING] > > **Material for MkDocs is in maintenance mode** > > Going forward, the Material for MkDocs team focuses on [Zensical], a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026. > > [Read the full announcement on our blog] [Zensical]: https://zensical.org [Read the full announcement on our blog]: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/ #### Changes - Hardened social cards plugin by switching to sandboxed environment (recommended by [@​caveeroo](https://redirect.github.com/caveeroo)) - Updated MkDocs 2.0 incompatibility warning ### [`v9.7.3`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.7.3): mkdocs-material-9.7.3 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.7.2...9.7.3) > \[!WARNING] > > **Material for MkDocs is in maintenance mode** > > Going forward, the Material for MkDocs team focuses on [Zensical], a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026. > > [Read the full announcement on our blog] [Zensical]: https://zensical.org [Read the full announcement on our blog]: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/ #### Changes - Fixed [#​8567](https://redirect.github.com/squidfunk/mkdocs-material/issues/8567): Print MkDocs 2.0 incompatibility warning to stderr ### [`v9.7.2`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.7.2): mkdocs-material-9.7.2 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.7.1...9.7.2) > \[!WARNING] > > **Material for MkDocs is in maintenance mode** > > Going forward, the Material for MkDocs team focuses on [Zensical], a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs until November 2026. > > [Read the full announcement on our blog] [Zensical]: https://zensical.org [Read the full announcement on our blog]: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/ #### Changes - Opened up version ranges of optional dependencies for forward-compatibility - Added warning to `mkdocs build` about impending MkDocs 2.0 incompatibility (doesn't affect strict mode) ### [`v9.7.1`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.7.1): mkdocs-material-9.7.1 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.7.0...9.7.1) - Updated requests to 2.30+ to mitigate CVE in urllib - Fixed privacy plugin not picking up protocol-relative URLs - Fixed [#​8542](https://redirect.github.com/squidfunk/mkdocs-material/issues/8542): false positives and negatives captured in privacy plugin ### [`v9.7.0`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.7.0): mkdocs-material-9.7.0 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.6.23...9.7.0) > \[!WARNING] > > **Material for MkDocs is now in maintenance mode** > > This is the last release of Material for MkDocs that will receive new features. Going forward, the Material for MkDocs team focuses on [Zensical], a next-gen static site generator built from first principles. We will provide critical bug fixes and security updates for Material for MkDocs for 12 months at least. → [Read the full announcement on our blog] This release includes all features that were previously exclusive to the Insiders edition. These features are now freely available to everyone. **Note on deprecated plugins**: The [projects] and [typeset] plugins are included in this release, but must be considered deprecated. Both plugins proved unsustainable to maintain and represent architectural dead ends. They are provided as-is without ongoing support. **Changes**: - Added support for projects plugin (for compat, now deprecated) - Added support for typeset plugin (for compat, now deprecated) - Added support for pinned blog posts and author profiles - Added support for customizing pagination for blog index pages - Added support for customizing blog category sort order - Added support for staying on page when switching languages - Added support for disabling tags in table of contents - Added support for nested tags and shadow tags - Added support for footnote tooltips - Added support for instant previews - Added support for instant prefetching - Added support for custom social card layouts - Added support for custom social card background images - Added support for selectable rangs in code blocks - Added support for custom selectors for code annotations - Added support for configurable log level in privacy plugin - Added support for processing of external links in privacy plugin - Added support for automatic image optimization via optimize plugin - Added support for navigation paths (breadcrumbs) - Fixed [#​8519](https://redirect.github.com/squidfunk/mkdocs-material/issues/8519): Vector accents do not render when using KaTeX [Zensical]: https://zensical.org [Read the full announcement on our blog]: https://squidfunk.github.io/mkdocs-material/blog/2025/11/05/zensical/ [projects]: https://squidfunk.github.io/mkdocs-material/plugins/projects/ [typeset]: https://squidfunk.github.io/mkdocs-material/plugins/typeset/ ### [`v9.6.23`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.6.23): mkdocs-material-9.6.23 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.6.22...9.6.23) - Updated Burmese translation ### [`v9.6.22`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.6.22): mkdocs-material-9.6.22 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.6.21...9.6.22) - Updated Georgian translation ### [`v9.6.21`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.6.21): mkdocs-material-9.6.21 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.6.20...9.6.21) - Updated Serbian translations - Fixed [#​8458](https://redirect.github.com/squidfunk/mkdocs-material/issues/8458): Temporary pin of click dependency ### [`v9.6.20`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.6.20): mkdocs-material-9.6.20 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.6.19...9.6.20) - Fixed [#​8446](https://redirect.github.com/squidfunk/mkdocs-material/issues/8446): Deprecation warning as of Python 3.14 in Emoji extension - Fixed [#​8440](https://redirect.github.com/squidfunk/mkdocs-material/issues/8440): `&` character not escaped in search highlighting - Fixed [#​8439](https://redirect.github.com/squidfunk/mkdocs-material/issues/8439): FontAwesome icons color not set in social cards (regression) ### [`v9.6.19`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.6.19): mkdocs-material-9.6.19 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.6.18...9.6.19) - Added support for Python 3.14 - Updated Bahasa Malaysia translations ### [`v9.6.18`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.6.18): mkdocs-material-9.6.18 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.6.17...9.6.18) - Updated Azerbaijani translations - Fixed last compat issues with [minijinja], now 100% compatible [minijinja]: https://redirect.github.com/mitsuhiko/minijinja ### [`v9.6.17`](https://redirect.github.com/squidfunk/mkdocs-material/releases/tag/9.6.17): mkdocs-material-9.6.17 [Compare Source](https://redirect.github.com/squidfunk/mkdocs-material/compare/9.6.16...9.6.17) - Fixed [#​8396](https://redirect.github.com/squidfunk/mkdocs-material/issues/8396): Videos do not autoplay when inside a content tab - Fixed [#​8394](https://redirect.github.com/squidfunk/mkdocs-material/issues/8394): Stroke width not effective in Mermaid.js diagrams - Fixed disappearing version selector when hiding page title </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/splunk/addonfactory-ucc-generator). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC42MS4zIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMyIsInRhcmdldEJyYW5jaCI6ImRldmVsb3AiLCJsYWJlbHMiOltdfQ==--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
> ℹ️ **Note**
>
> This PR body was truncated due to platform limits.
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [babel-jest](https://redirect.github.com/jestjs/jest)
([source](https://redirect.github.com/jestjs/jest/tree/HEAD/packages/babel-jest))
| [`^30.4.1` →
`^30.5.0`](https://renovatebot.com/diffs/npm/babel-jest/30.4.1/30.5.0) |
|
|
| [css-loader](https://redirect.github.com/webpack/css-loader) |
[`^7.1.4` →
`^7.1.5`](https://renovatebot.com/diffs/npm/css-loader/7.1.4/7.1.5) |
|
|
|
[eslint-plugin-jest](https://redirect.github.com/jest-community/eslint-plugin-jest)
| [`^29.16.2` →
`^29.16.6`](https://renovatebot.com/diffs/npm/eslint-plugin-jest/29.16.2/29.16.6)
|
|
|
| [jest](https://jestjs.io/)
([source](https://redirect.github.com/jestjs/jest/tree/HEAD/packages/jest))
| [`^30.4.2` →
`^30.5.0`](https://renovatebot.com/diffs/npm/jest/30.4.2/30.5.0) |
|
|
| [jest-environment-jsdom](https://redirect.github.com/jestjs/jest)
([source](https://redirect.github.com/jestjs/jest/tree/HEAD/packages/jest-environment-jsdom))
| [`^30.4.1` →
`^30.5.0`](https://renovatebot.com/diffs/npm/jest-environment-jsdom/30.4.1/30.5.0)
|
|
|
| [react-router-dom](https://redirect.github.com/remix-run/react-router)
([source](https://redirect.github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom))
| [`7.18.2` →
`7.18.3`](https://renovatebot.com/diffs/npm/react-router-dom/7.18.2/7.18.3)
|
|
|
| [zod](https://zod.dev)
([source](https://redirect.github.com/colinhacks/zod)) | [`^4.4.3` →
`^4.5.4`](https://renovatebot.com/diffs/npm/zod/4.4.3/4.5.4) |
|
|
---
> [!WARNING]
> Some dependencies could not be looked up. Check the warning logs for
more information.
---
### Release Notes
<details>
<summary>jestjs/jest (babel-jest)</summary>
###
[`v30.5.0`](https://redirect.github.com/jestjs/jest/blob/HEAD/CHANGELOG.md#3050)
[Compare
Source](https://redirect.github.com/jestjs/jest/compare/v30.4.1...v30.5.0)
##### Features
- `[@jest/expect-utils, jest-mock]` Add `mockFn.whenCalledWith(...args)`
for configuring return values per argument list, with first-class
asymmetric-matcher support
([#​16053](https://redirect.github.com/jestjs/jest/pull/16053))
- `[@jest/expect-utils]` Export `AsymmetricMatcher` and
`FunctionParameters` types (previously private to `expect`)
([#​16053](https://redirect.github.com/jestjs/jest/pull/16053))
- `[jest-circus, jest-core, jest-jasmine2, jest-test-result,
jest-types]` `--collectTests` now expands `test.each`/`describe.each`
cases and reports per-status counts (skipped/todo via the new `wouldRun`
flag for selected tests) plus a summary line that match a real run,
including under `--testNamePattern` and `.only`/`fdescribe` focus on
both the circus and jasmine2 runners
([#​16259](https://redirect.github.com/jestjs/jest/pull/16259))
- `[jest-circus, jest-environment, jest-runtime, jest-types]` Add
describe-level retries via `jest.retryTimes(..., {entireDescribe:
true})`
([#​16322](https://redirect.github.com/jestjs/jest/pull/16322))
- `[jest-circus, jest-message-util, jest-reporters, jest-types]` Add
`retryMessages` to `AssertionResult` and export `formatErrorStack`, so
the retry log renders nested `cause` and `AggregateError` sections with
code frames instead of serialized `[cause]:`/`[errors]:` markers
([#​16316](https://redirect.github.com/jestjs/jest/pull/16316))
- `[jest-circus, jest-types]` Add `unhandledErrorsDetailed` to
`Circus.RunResult`, so an unhandled rejection reports its `cause` chain
and `AggregateError` entries with code frames instead of a
pre-serialized stack
([#​16316](https://redirect.github.com/jestjs/jest/pull/16316))
- `[jest-haste-map]` Replace `NodeWatcher` and `FSEventsWatcher` with
`@parcel/watcher` for the non-watchman watch path
([#​16188](https://redirect.github.com/jestjs/jest/pull/16188))
- `[jest-resolve]` Bump `unrs-resolver` to 1.12.1, remove
`jest-pnp-resolver` and unnecessary checks
([#​15721](https://redirect.github.com/jestjs/jest/pull/15721))
- `[jest-resolve]` Honor Node's `--preserve-symlinks` /
`NODE_PRESERVE_SYMLINKS` in the default resolver by passing `symlinks:
false` to `unrs-resolver`
([#​16260](https://redirect.github.com/jestjs/jest/pull/16260))
- `[jest-runtime]` Apply automocking and manual `__mocks__` files to
synchronously evaluable ESM graphs on Node 24.9+ - static imports,
dynamic `import()` and `require()` of an ESM file now generate an
automock from the real module's namespace instead of failing with
"Attempting to import a mock without a factory". Graphs that need async
evaluation (top-level await) or an async-only resolver or transformer
still throw
([#​16391](https://redirect.github.com/jestjs/jest/pull/16391))
- `[jest-runtime]` Route `process.getBuiltinModule` through the sandbox,
so it returns the sandbox `process` and the hooked `node:module` instead
of the host's
([#​16391](https://redirect.github.com/jestjs/jest/pull/16391))
- `[jest-runtime]` Throw an actionable error from `module.register()`
and `module.registerHooks()` inside a test - the hooks attached to the
loader running Jest itself, never saw the sandboxed requires they were
meant for, and stayed registered for every later test file in the worker
([#​16391](https://redirect.github.com/jestjs/jest/pull/16391))
- `[jest-runtime]` Surface resolution and import-attribute errors in an
ESM graph before executing any of its CJS dependencies on Node 24.9+,
matching Node's run-nothing-on-a-broken-graph behavior; the legacy
loader on older versions keeps its linking-time execution order
([#​16391](https://redirect.github.com/jestjs/jest/pull/16391))
- `[jest-runtime]` Throw `ERR_SOURCE_PHASE_NOT_DEFINED` with an
actionable message for `import source` and `import.source()`, instead of
failing at instantiation with V8's bare "Source phase import object is
not defined"
([#​16391](https://redirect.github.com/jestjs/jest/pull/16391))
- `[jest-runtime]` Emit the JSON-without-import-attribute deprecation
warning once per test file instead of once per worker, so it is no
longer silently swallowed for every file after the first
([#​16391](https://redirect.github.com/jestjs/jest/pull/16391))
- `[jest-runtime]` Set `import.meta.main` to `true` in the test file and
`false` in every module it loads, matching Node 24+
([#​16367](https://redirect.github.com/jestjs/jest/pull/16367))
- `[jest-runtime]` Resolve the `module-sync` export condition, so a
package that exposes its ESM entry point for `require()` loads the same
file Node would
([#​16336](https://redirect.github.com/jestjs/jest/pull/16336))
- `[jest-snapshot]` Add external snapshot paths to custom reporter
failure details
([#​16374](https://redirect.github.com/jestjs/jest/pull/16374))
##### Fixes
- `[jest-console, jest-reporters]` `CustomConsole` now buffers console
output so `TestResult.console` is populated for reporters when `verbose`
is enabled, while `GitHubActionsReporter` avoids replaying buffered
output in verbose mode
([#​16155](https://redirect.github.com/jestjs/jest/pull/16155))
- `[expect, jest-message-util, jest-pattern, jest-regex-util,
jest-util]` Revert `node:` protocol imports to restore
webpack/browser-bundle compatibility
([#​16167](https://redirect.github.com/jestjs/jest/pull/16167))
- `[expect]` Widen `toMatchObject` and `objectContaining` parameter type
from `Record<string, unknown>` to `object` so class instances are
accepted
([#​16196](https://redirect.github.com/jestjs/jest/pull/16196))
- `[jest-circus]` Call a generator test body with the shared test
context, so `this` matches what a regular test function receives
([#​16347](https://redirect.github.com/jestjs/jest/pull/16347))
- `[jest-circus]` Capture the error listeners of the parent process
instead of the in-sandbox `process`, so listeners registered before the
test file survive teardown and sandbox listeners no longer leak onto the
parent
([#​16347](https://redirect.github.com/jestjs/jest/pull/16347))
- `[jest-circus]` Clear `currentlyRunningTest` after skipped and todo
tests
([#​16342](https://redirect.github.com/jestjs/jest/pull/16342))
- `[jest-circus]` Prevent late `done()` callbacks from affecting later
test or hook invocations
([#​16343](https://redirect.github.com/jestjs/jest/pull/16343))
- `[jest-circus, jest-jasmine2]` Honor `--expand` when formatting
`node:assert` failures, instead of always collapsing the diff
([#​16347](https://redirect.github.com/jestjs/jest/pull/16347))
- `[jest-circus, jest-jasmine2, jest-message-util]` Serialize the inner
errors of an `AggregateError` into `failureMessages`, `retryReasons` and
`unhandledErrors`, so `--json` output and reporter annotations include
them
([#​16316](https://redirect.github.com/jestjs/jest/pull/16316))
- `[jest-circus, jest-snapshot]` Keep snapshot state and counts correct
when a test retries
([#​16344](https://redirect.github.com/jestjs/jest/pull/16344))
- `[@jest/create-cache-key-function]` Include the caller support flags
in the generated key, so a transformer that emits ESM or CJS based on
them no longer shares one cache entry between the two
([#​16331](https://redirect.github.com/jestjs/jest/pull/16331))
- `[@jest/create-cache-key-function]` Include the stringified project
config in the generated key, so editing a transformer's own settings
invalidates what it cached
([#​16331](https://redirect.github.com/jestjs/jest/pull/16331))
- `[@jest/transform]` Include the caller support flags in a transform's
cache key, so a file transformed both as ESM and as CJS no longer serves
one shape's output for the other
([#​16331](https://redirect.github.com/jestjs/jest/pull/16331))
- `[jest-config]` Add missing `findRelatedTests`, `outputFile`, and
`replname` entries to `ValidConfig` so they no longer trigger spurious
"Unknown option" warnings
([#​16224](https://redirect.github.com/jestjs/jest/pull/16224))
- `[jest-config]` Use `--config` for the global config when multiple
`--projects` are specified
([#​16273](https://redirect.github.com/jestjs/jest/pull/16273))
- `[jest-core]` Serialize `bigint` values in `--json` and `--outputFile`
output as their literal form (`4n`), instead of failing the run with
`TypeError: Do not know how to serialize a BigInt`
([#​16338](https://redirect.github.com/jestjs/jest/pull/16338))
- `[jest-core]` Do not report a `CustomGC` async resource (used by N-API
addons such as napi-rs for per-isolate GC bookkeeping) as an open
handle, since it is `napi_unref`'d by the addon and can never keep the
event loop alive
([#​16379](https://redirect.github.com/jestjs/jest/pull/16379))
- `[jest-each]` Keep a `$&`, `` $` ``, `$'` or `$$` inside a `%p` param
value out of the replacement, so the title shows the value instead of
the text around it
([#​16338](https://redirect.github.com/jestjs/jest/pull/16338))
- `[jest-each]` Interpolate a `bigint` into a `%j` title as its literal
form (`"4n"`) at any depth, instead of throwing `TypeError: Do not know
how to serialize a BigInt` while collecting the tests
([#​16338](https://redirect.github.com/jestjs/jest/pull/16338))
- `[jest-environment, jest-runtime]` Bind `sandboxInjectedGlobals` to
the right values when `injectGlobals` is `false`, instead of shifting
every one of them by a position
([#​16377](https://redirect.github.com/jestjs/jest/pull/16377))
- `[jest-environment-node, jest-util]` Only warn about a conflicting
`globalsCleanup` mode when one was explicitly configured, and follow the
mode that is actually in effect
([#​16323](https://redirect.github.com/jestjs/jest/pull/16323))
- `[jest-environment-node, jest-util]` Stop resolving lazy globals when
setting up an environment, so Node 26's builtin module globals are no
longer loaded (and no longer emit their deprecation warnings) for every
test file
([#​16324](https://redirect.github.com/jestjs/jest/pull/16324))
- `[jest-haste-map]` Keep watch mode alive when an outside process
briefly makes a file unreadable on Windows, instead of tearing the
watcher down on `EPERM`
([#​16295](https://redirect.github.com/jestjs/jest/pull/16295))
- `[jest-haste-map]` Keep indexing when an outside process holds a file
open on Windows, instead of failing the whole crawl on `EPERM`
([#​16358](https://redirect.github.com/jestjs/jest/pull/16358))
- `[jest-haste-map]` Keep a duplicated manual mock resolving when the
file it pointed at is deleted in watch mode
([#​16360](https://redirect.github.com/jestjs/jest/pull/16360))
- `[jest-haste-map]` Shut the worker farm down when a duplicate manual
mock aborts the build under `throwOnModuleCollision`
([#​16354](https://redirect.github.com/jestjs/jest/pull/16354))
- `[jest-haste-map]` Attach the watchman client's `error` listener
before the first command, so a watchman failure falls back to the node
crawler instead of crashing on an unhandled `error` event, and always
end the client
([#​16355](https://redirect.github.com/jestjs/jest/pull/16355))
- `[jest-haste-map]` Stop delivering watch events after
`WatchmanWatcher` is closed, and route its warnings through the
configured console
([#​16355](https://redirect.github.com/jestjs/jest/pull/16355))
- `[jest-haste-map]` Restore the nested `duplicates` index correctly in
`ModuleMap.fromJSON`, so a haste collision reported inside a test worker
raises `DuplicateHasteCandidatesError` instead of a `TypeError`
([#​16353](https://redirect.github.com/jestjs/jest/pull/16353))
- `[jest-haste-map]` Match watched files on a full extension, so
`moduleFileExtensions: ['js']` no longer accepts `foo.mjs`
([#​16352](https://redirect.github.com/jestjs/jest/pull/16352))
- `[jest-haste-map]` Delimit the fields that make up the haste map cache
key, so two different option sets cannot hash to the same cache file
([#​16352](https://redirect.github.com/jestjs/jest/pull/16352))
- `[jest-message-util]` Print the inner errors of an `AggregateError`
thrown inside a test
([#​16316](https://redirect.github.com/jestjs/jest/pull/16316))
- `[jest-message-util]` Indent nested `cause` and `AggregateError`
sections of a test failure by one level per depth, so the nesting is
legible instead of rendering flat
([#​16316](https://redirect.github.com/jestjs/jest/pull/16316))
- `[jest-message-util]` Color stack traces line by line so blank lines
stay blank
([#​16316](https://redirect.github.com/jestjs/jest/pull/16316))
- `[jest-message-util]` Detect Jest's own frames without assuming the
checkout directory's name, and cover `@jest/*` packages, so stack traces
and code frames point at user code
([#​16326](https://redirect.github.com/jestjs/jest/pull/16326))
- `[jest-mock]` `mockResolvedValue` / `mockRejectedValue` now see all
overload return types, so a Promise-returning overload survives even
when a later overload returns a non-Promise (e.g. `pg.Client['end']`)
([#​16237](https://redirect.github.com/jestjs/jest/pull/16237))
- `[@jest-environment/jsdom-abstract]` Make `@types/jsdom` a peer
dependency
([#​16166](https://redirect.github.com/jestjs/jest/pull/16166))
- `[jest-mock]` Remove the leftover own accessor descriptor when
restoring a `spyOn` of an inherited getter or setter, so the instance
keeps reflecting the prototype
([#​16226](https://redirect.github.com/jestjs/jest/pull/16226))
- `[jest-resolve]` Include `extensionsToTreatAsEsm` in the
`shouldLoadAsEsm` cache key, so projects with different extension lists
don't read each other's answers
([#​16369](https://redirect.github.com/jestjs/jest/pull/16369))
- `[jest-resolve]` Make `getModuleIDAsync` build and cache `data:` URI
module IDs the same way as `getModuleID`
([#​16370](https://redirect.github.com/jestjs/jest/pull/16370))
- `[jest-resolve]` Keep the `node:` prefix when resolving a core module
asynchronously, so a builtin that only exists prefixed (`node:sea`,
`node:sqlite`, `node:test`, `node:test/reporters`) resolves instead of
failing as a missing bare package
([#​16388](https://redirect.github.com/jestjs/jest/pull/16388))
- `[jest-resolve]` Look up manual mocks for `node:` protocol specifiers
under the unprefixed name they are stored as
([#​16388](https://redirect.github.com/jestjs/jest/pull/16388))
- `[jest-resolve]` Apply `moduleNameMapper` consistently to both
spellings of core module specifiers (`fs` vs `node:fs`)
([#​16390](https://redirect.github.com/jestjs/jest/pull/16390))
- `[jest-resolve]` Keep virtual and ordinary mock module IDs isolated
across test files
([#​16296](https://redirect.github.com/jestjs/jest/pull/16296))
- `[jest-resolve]` Guard missing `require.resolve.paths`
([#​16052](https://redirect.github.com/jestjs/jest/pull/16052))
- `[jest-resolve, jest-config, jest-runner]` Support a user resolver
written as an ES module
([#​16332](https://redirect.github.com/jestjs/jest/pull/16332))
- `[jest-resolve, jest-runtime]` Throw the CJS parse error for ESM
syntax in a `"type": "commonjs"` package or a `.cjs` file instead of
loading it as ESM, matching Node
([#​16368](https://redirect.github.com/jestjs/jest/pull/16368))
- `[@jest/source-map]` Keep source map sources that name a scheme, such
as `webpack:///`, instead of resolving them into a path that does not
exist
([#​16327](https://redirect.github.com/jestjs/jest/pull/16327))
- `[@jest/source-map]` Look up `--testLocationInResults` positions at
the right column, and keep a mapping to the first column instead of
discarding it
([#​16327](https://redirect.github.com/jestjs/jest/pull/16327))
- `[@jest/source-map]` Warn when a source map cannot be parsed, instead
of silently leaving its frames untranslated
([#​16327](https://redirect.github.com/jestjs/jest/pull/16327))
- `[jest-runner, @jest/source-map]` Keep a source-mapped stack for an
error thrown after the test environment was torn down
([#​16327](https://redirect.github.com/jestjs/jest/pull/16327))
- `[jest-runtime, @jest/source-map]` Keep source maps past teardown and
past the next test file's `install`, so a stack from a file no earlier
stack mentioned still points at the original source
([#​16330](https://redirect.github.com/jestjs/jest/pull/16330))
- `[jest-runtime]` Report that no coverage was collected when
`getAllV8CoverageInfoCopy` is called after `teardown`, instead of
returning an empty result
([#​16385](https://redirect.github.com/jestjs/jest/pull/16385))
- `[jest-runtime]` Cache a CJS module's parsed exports before walking
its re-exports, so two modules that re-export each other no longer
overflow the stack when imported from ESM
([#​16363](https://redirect.github.com/jestjs/jest/pull/16363))
- `[jest-runtime]` Keep a re-exported ES module's parse failure from
marking the re-exporting CommonJS file as ESM, so `module.exports =
require('./dep.mjs')` loads instead of failing with `module is not
defined`
([#​16363](https://redirect.github.com/jestjs/jest/pull/16363))
- `[jest-runtime]` Scope module mocks instantiated inside
`jest.isolateModules`/`isolateModulesAsync` to that block, so a mock
first imported there no longer outlives it - matching how CommonJS mocks
already behave
([#​16365](https://redirect.github.com/jestjs/jest/pull/16365))
- `[jest-runtime]` Suspend module isolation while generating an
automock, so loading the real module to read its shape no longer
populates the isolated registry
([#​16365](https://redirect.github.com/jestjs/jest/pull/16365))
- `[jest-runtime]` Check a cached ES module's status before `require()`
returns it, so a module whose evaluation threw rethrows that error and
one left linked by a failed sibling is evaluated instead of returning
uninitialized bindings
([#​16364](https://redirect.github.com/jestjs/jest/pull/16364))
- `[jest-runtime]` Report the original `ERR_REQUIRE_ASYNC_MODULE` when a
`require()` of a top-level-await graph is retried, instead of a spurious
"concurrent `import()`" error
([#​16364](https://redirect.github.com/jestjs/jest/pull/16364))
- `[jest-runtime]` Throw the evaluation error when another caller's
`import()` of the same module failed while we awaited it, instead of
resolving with the errored module
([#​16364](https://redirect.github.com/jestjs/jest/pull/16364))
- `[jest-runtime]` Mark the result of `require()`ing an ES module that
has a default export with `__esModule: true` through a live-binding
facade, and serve the same object from `require.cache`, matching Node
([#​16367](https://redirect.github.com/jestjs/jest/pull/16367))
- `[jest-runtime]` Provide a CommonJS module's exports under the
`'module.exports'` named export when imported from ESM, matching Node
23+
([#​16367](https://redirect.github.com/jestjs/jest/pull/16367))
- `[jest-runtime]` Give the test file itself a non-null `require.main`
([#​16367](https://redirect.github.com/jestjs/jest/pull/16367))
- `[jest-runtime]` Populate `module.children` with the modules a file
loads, matching Node
([#​16368](https://redirect.github.com/jestjs/jest/pull/16368))
- `[jest-runtime]` Provide `import.meta.resolve` and `import.meta.jest`
in `data:` URI modules, accept any-case mediatype parameters, and use
Node's error codes for invalid `data:` URIs
([#​16368](https://redirect.github.com/jestjs/jest/pull/16368))
- `[jest-runtime]` Key ES modules by full URL, so query and fragment
suffixes create the same module instances as Node and show up in
`import.meta.url`
([#​16375](https://redirect.github.com/jestjs/jest/pull/16375))
- `[jest-runtime]` Share modules between overlapping graphs when a
CommonJS module `require()`s an ES module mid-load, instead of
evaluating shared dependencies twice
([#​16375](https://redirect.github.com/jestjs/jest/pull/16375))
- `[jest-runtime]` Throw `ERR_REQUIRE_CYCLE_MODULE` like Node when a
CommonJS module `require()`s an ES module that is still being loaded,
instead of evaluating the module a second time
([#​16366](https://redirect.github.com/jestjs/jest/pull/16366))
- `[jest-runtime]` Key builtin modules in the ESM registry by one
canonical specifier
([#​16341](https://redirect.github.com/jestjs/jest/pull/16341))
- `[jest-runtime]` `import.meta.resolve()` for a builtin uses its
`node:` specifier
([#​16341](https://redirect.github.com/jestjs/jest/pull/16341))
- `[jest-runtime]` Fall back to native ESM when a `.js` file contains
ESM syntax but has no `"type":"module"` marker
([#​16152](https://redirect.github.com/jestjs/jest/pull/16152))
- `[jest-runtime]` Allow `require()` of ESM-marked files on Node < 24.9
via transform fallback
([#​16244](https://redirect.github.com/jestjs/jest/pull/16244))
- `[jest-runtime, @jest/transform]` Surface actionable `ERR_REQUIRE_ESM`
error for files with untransformed ESM syntax instead of the generic
"unexpected token" message
([#​16244](https://redirect.github.com/jestjs/jest/pull/16244))
- `[jest-runtime]` Support older test environments whose `moduleMocker`
does not implement `clearMocksOnScope`
([#​16169](https://redirect.github.com/jestjs/jest/pull/16169))
- `[jest-runtime]` Apply `jest.unstable_mockModule` when the mocked file
itself is `require()`d, not only when it is imported as a dependency
([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Apply `jest.unstable_mockModule` to statically
imported `data:` URIs on Node 24.9+, matching dynamic `import()`
([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Run an async `jest.unstable_mockModule` factory once
per module instead of twice, and fail the import instead of crashing the
worker when the factory rejects
([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Hide a `require(esm)` module that failed to evaluate
from `require.cache`, as Node does, instead of exposing a namespace with
uninitialized bindings
([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Strip the byte-order mark when importing a JSON
module, matching `require()` and Node
([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Throw `ERR_REQUIRE_ASYNC_MODULE` when `require(esm)`
runs under an async-only custom resolver, instead of silently resolving
with the default resolver
([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Parse imported JSON modules with the test realm's
`JSON`, so their objects pass `instanceof Object` inside the test like
`require()`d JSON does
([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Accept every `file:` URL string in the sandboxed
`module.createRequire`, including one with a `localhost` authority, as
Node does
([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-runtime]` Point at `{virtual: true}` when `jest.mock` or
`jest.unstable_mockModule` is given a module that cannot be resolved
([#​16389](https://redirect.github.com/jestjs/jest/pull/16389))
- `[jest-reporters]` Fix coverage report table formatting in CI/GitHub
Actions environments where `process.stdout.columns` is undefined by
falling back to the `COLUMNS` env var or `80` columns in CI, preserving
existing behaviour in other non-TTY environments
([#​16227](https://redirect.github.com/jestjs/jest/pull/16227))
- `[jest-runtime]` Support CJS-in-ESM exports via `"module.exports"`
named exports
([#​16277](https://redirect.github.com/jestjs/jest/pull/16277))
- `[jest-snapshot]` Keep a skipped or failed test's hinted snapshots,
instead of reporting them obsolete
([#​16348](https://redirect.github.com/jestjs/jest/pull/16348))
- `[jest-util]` Stop `globsToMatcher` reusing a cached matcher compiled
with different picomatch options, and keep its `dot: true` default when
`dot` is passed as `undefined`
([#​16381](https://redirect.github.com/jestjs/jest/pull/16381))
- `[pretty-format]` Move the `react-is` aliases into the `@jest` scope,
so they cannot be shadowed by unrelated packages published under the
alias names
([#​16333](https://redirect.github.com/jestjs/jest/pull/16333))
##### Chore & Maintenance
- `[docs]` Document the intentional divergences from Node's module
system in the ECMAScript Modules page
([#​16368](https://redirect.github.com/jestjs/jest/pull/16368))
- `[docs]` Note deprecation of `react-test-renderer` in React Native
tutorial and `pretty-format` README
([#​16294](https://redirect.github.com/jestjs/jest/pull/16294))
- `[docs]` Use `@testing-library/react-native` in the React Native
tutorial instead of the deprecated `react-test-renderer`
([#​16318](https://redirect.github.com/jestjs/jest/pull/16318))
- `[babel-jest, @jest/transform]` Update `babel-plugin-istanbul` to v8
([#​16049](https://redirect.github.com/jestjs/jest/pull/16049))
- `[jest-config, @jest/reporters, jest-runtime]` Update `glob` to v13
([#​16397](https://redirect.github.com/jestjs/jest/pull/16397))
- `[jest-haste-map]` Refactor massive class into multiple files
([#​16180](https://redirect.github.com/jestjs/jest/pull/16180))
- `[jest-haste-map]` Drop `walker` dependency; replace hand-rolled
directory recursion in the JS crawler and watcher startup with `fdir`
([#​16187](https://redirect.github.com/jestjs/jest/pull/16187))
- `[jest-haste-map]` Reuse cached metadata for files whose haste name is
a known duplicate, instead of re-reading and re-parsing them on every
startup
([#​16351](https://redirect.github.com/jestjs/jest/pull/16351))
- `[jest-haste-map]` Cache the watchman socket path and replace the
`watchman --version` probe with `get-sockname`, so warm runs spawn no
watchman processes
([#​16386](https://redirect.github.com/jestjs/jest/pull/16386))
- `[jest-resolve]` Store the per-directory package-type lookup in the
cache it reads, so it actually memoizes
([#​16369](https://redirect.github.com/jestjs/jest/pull/16369))
- `[jest-resolve, jest-runtime]` Cut repeated work on the resolution hot
path: hoist the platform-extension list to construction, memoize
`isCoreModule` and the options cache-key serialization, skip mapper
preparation when no `moduleNameMapper` is configured, run each mapper
regex once, and stop re-parsing `NODE_OPTIONS` on every default-resolver
call
([#​16371](https://redirect.github.com/jestjs/jest/pull/16371))
- `[jest-resolve]` Cut warm resolution cost to about a third: reuse one
`unrs-resolver` factory per options shape instead of cloning per
resolution, compose the factory cache key from per-array cached strings
instead of serializing options, and stop constructing an `Error` for
misses that `findNodeModule` swallows; add a `__benchmarks__` suite for
the default resolver
([#​16373](https://redirect.github.com/jestjs/jest/pull/16373))
- `[jest-runner, @jest/source-map]` Replace `source-map-support` with an
implementation in `@jest/source-map`
([#​16327](https://redirect.github.com/jestjs/jest/pull/16327))
- `[jest-snapshot]` Load babel, semver and synckit lazily, so requiring
the package (which every test process does through `@jest/expect`) no
longer loads \~200 modules that only writing inline snapshots needs
([#​16387](https://redirect.github.com/jestjs/jest/pull/16387))
- `[jest-runtime]` Reduce per-require overhead: skip module ID
resolution when no mock can apply, answer core modules before probing
for a manual mock, share one `require.cache` proxy across modules, and
cache empty files
([#​16376](https://redirect.github.com/jestjs/jest/pull/16376))
- `[@jest/source-map]` Deprecate `getCallsite` in favour of
`SourceMapSupport#getCallsite`
([#​16327](https://redirect.github.com/jestjs/jest/pull/16327))
- `[jest-runtime]` Avoid magical `null` value in ESM loader
([#​16160](https://redirect.github.com/jestjs/jest/pull/16160))
</details>
<details>
<summary>webpack/css-loader (css-loader)</summary>
###
[`v7.1.5`](https://redirect.github.com/webpack/css-loader/blob/HEAD/CHANGELOG.md#715-2026-08-28)
[Compare
Source](https://redirect.github.com/webpack/css-loader/compare/v7.1.4...v7.1.5)
</details>
<details>
<summary>jest-community/eslint-plugin-jest
(eslint-plugin-jest)</summary>
###
[`v29.16.6`](https://redirect.github.com/jest-community/eslint-plugin-jest/blob/HEAD/CHANGELOG.md#29166-2026-08-30)
[Compare
Source](https://redirect.github.com/jest-community/eslint-plugin-jest/compare/v29.16.5...v29.16.6)
##### Bug Fixes
- **prefer-to-have-been-called:** don't crash on matcher without an
argument
([#​2016](https://redirect.github.com/jest-community/eslint-plugin-jest/issues/2016))
([58e487f](https://redirect.github.com/jest-community/eslint-plugin-jest/commit/58e487fecda05ddafcac2fcf67475d90bd515957))
- **prefer-to-have-length:** don't crash on `expect` chain without a
value
([#​2014](https://redirect.github.com/jest-community/eslint-plugin-jest/issues/2014))
([3629019](https://redirect.github.com/jest-community/eslint-plugin-jest/commit/3629019d8e84e096115c8774a34178ff5b83aaf2))
###
[`v29.16.5`](https://redirect.github.com/jest-community/eslint-plugin-jest/blob/HEAD/CHANGELOG.md#29165-2026-08-27)
[Compare
Source](https://redirect.github.com/jest-community/eslint-plugin-jest/compare/v29.16.4...v29.16.5)
##### Bug Fixes
- **no-export:** handle literal property accessors
([#​2011](https://redirect.github.com/jest-community/eslint-plugin-jest/issues/2011))
([d848f70](https://redirect.github.com/jest-community/eslint-plugin-jest/commit/d848f70d5ae1a143d4ae2ef52bf00c6658f5070d))
###
[`v29.16.4`](https://redirect.github.com/jest-community/eslint-plugin-jest/blob/HEAD/CHANGELOG.md#29164-2026-08-27)
[Compare
Source](https://redirect.github.com/jest-community/eslint-plugin-jest/compare/v29.16.3...v29.16.4)
##### Bug Fixes
- **no-export:** handle nested assignment chains
([#​2009](https://redirect.github.com/jest-community/eslint-plugin-jest/issues/2009))
([14b559a](https://redirect.github.com/jest-community/eslint-plugin-jest/commit/14b559af7f3d93ca585f65deae97c4b24a83e900))
###
[`v29.16.3`](https://redirect.github.com/jest-community/eslint-plugin-jest/blob/HEAD/CHANGELOG.md#29163-2026-08-27)
[Compare
Source](https://redirect.github.com/jest-community/eslint-plugin-jest/compare/v29.16.2...v29.16.3)
##### Bug Fixes
- **no-export:** check for `exports` global
([#​1988](https://redirect.github.com/jest-community/eslint-plugin-jest/issues/1988))
([f506cb2](https://redirect.github.com/jest-community/eslint-plugin-jest/commit/f506cb2b90743767d9619f22ebfe29b4ff047783))
</details>
<details>
<summary>remix-run/react-router (react-router-dom)</summary>
###
[`v7.18.3`](https://redirect.github.com/remix-run/react-router/compare/react-router-dom@7.18.2...react-router-dom@7.18.3)
[Compare
Source](https://redirect.github.com/remix-run/react-router/compare/react-router-dom@7.18.2...react-router-dom@7.18.3)
</details>
<details>
<summary>colinhacks/zod (zod)</summary>
###
[`v4.5.4`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.5.4)
[Compare
Source](https://redirect.github.com/colinhacks/zod/compare/v4.5.3...v4.5.4)
#### Commits:
-
[`84e416f`](https://redirect.github.com/colinhacks/zod/commit/84e416fbf4740527bbc8f319634f4e1b065bb42c)
fix(v4): stop the cycle walk from firing a default factory
([#​6500](https://redirect.github.com/colinhacks/zod/issues/6500))
-
[`e8e206f`](https://redirect.github.com/colinhacks/zod/commit/e8e206fa33ac5fe7ce20a2beb12d57b1cb3df653)
4.5.4
###
[`v4.5.3`](https://redirect.github.com/colinhacks/zod/compare/v4.5.2...1a16102a494b03ce1df7b80b663ae2df465f419e)
[Compare
Source](https://redirect.github.com/colinhacks/zod/compare/v4.5.2...v4.5.3)
###
[`v4.5.2`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.5.2)
[Compare
Source](https://redirect.github.com/colinhacks/zod/compare/v4.5.1...v4.5.2)
#### Commits:
-
[`a354314`](https://redirect.github.com/colinhacks/zod/commit/a354314ac04fdd5484aa62dd5c3a4b553211a0e4)
fix(docs): keep blog posts out of the docs collection
([#​6484](https://redirect.github.com/colinhacks/zod/issues/6484))
-
[`d378c42`](https://redirect.github.com/colinhacks/zod/commit/d378c42aff6869f0929058a7923cd775880f5c4c)
ci: drop canary publishing from the release workflow
([#​6487](https://redirect.github.com/colinhacks/zod/issues/6487))
-
[`212b941`](https://redirect.github.com/colinhacks/zod/commit/212b941791e7faae078e17645eb612824fd8f79a)
fix(v4): let a prototype method getter answer a bare call so vi.spyOn
works
([#​6488](https://redirect.github.com/colinhacks/zod/issues/6488))
-
[`e7576f5`](https://redirect.github.com/colinhacks/zod/commit/e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98)
docs(blog): let the page show through the navbar in dark mode
([#​6489](https://redirect.github.com/colinhacks/zod/issues/6489))
-
[`fedb06f`](https://redirect.github.com/colinhacks/zod/commit/fedb06fafe33a66ce0b5c236ad2557e0a5a170fe)
fix(docs): match the blog TOC hover bar to the 2px active indicator
-
[`6c932fc`](https://redirect.github.com/colinhacks/zod/commit/6c932fcb2eea6eb671710ea058ca9fdc382ada89)
chore: bump devcontainer image to Node 24
([#​6470](https://redirect.github.com/colinhacks/zod/issues/6470))
-
[`6635d9d`](https://redirect.github.com/colinhacks/zod/commit/6635d9dd367a664109de83c021995821f48efa29)
docs(blog): soften the "method memoization" attribution
-
[`019ae29`](https://redirect.github.com/colinhacks/zod/commit/019ae299cc75daa132bf1acf59086a520abf6b85)
fix(docs): drop ISR on the docs route so the home page hydrates
-
[`652bb43`](https://redirect.github.com/colinhacks/zod/commit/652bb438aa4c626c1cd7948c6849c4691239fca7)
chore(docs): drop the scroll log from the route-change scroller
-
[`571c8e8`](https://redirect.github.com/colinhacks/zod/commit/571c8e8a3d73b4305f4abfdd6977773cc12f2bf5)
fix(docs): render blog tabs with the stock fumadocs tab card
-
[`9a193aa`](https://redirect.github.com/colinhacks/zod/commit/9a193aa24b4efa3b315b91d4c56c8bc385b8513f)
4.5.2
###
[`v4.5.1`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.5.1)
[Compare
Source](https://redirect.github.com/colinhacks/zod/compare/v4.5.0...v4.5.1)
#### Commits:
-
[`2e862db`](https://redirect.github.com/colinhacks/zod/commit/2e862dbf89da2835e5206a8fd3d3be61afe3cf7f)
ci: gate the GitHub release and JSR publish on the version being live on
npm
-
[`8e03380`](https://redirect.github.com/colinhacks/zod/commit/8e03380510db36fa6fda979fc78a375fdea8021c)
4.5.1
###
[`v4.5.0`](https://redirect.github.com/colinhacks/zod/releases/tag/v4.5.0)
[Compare
Source](https://redirect.github.com/colinhacks/zod/compare/v4.4.3...v4.5.0)
Zod 4.5 is now available.
```sh
npm install zod@latest
```
At a glance:
- [`z.compile()`](#zcompile) — the flagship feature of Zod 4.5
- [`z.creditCard()`](#zcreditcard) — 12–19 digits plus Luhn checksum
- [`z.properties()`](#zproperties) — the multi-property counterpart to
`z.property()`
- [`z.deepPartial()`](#zdeeppartial)/[`.exactPartial()`](#exactpartial)
- [`z.validate(): boolean`](#zvalidate) — a fast-path to verify input
validity without a full parse (up to 16x faster on invalid data)
- [9x reduction in memory
footprint](#​9x-reduction-in-schema-memory-footprint)
- [New locales](https://zod.dev/error-customization#locales): Bengali
(`bn`), Central Kurdish (`ckb`), Hindi (`hi`), Kannada (`kn`), Norwegian
Nynorsk (`nn`), Brazilian Portuguese (`pt-BR`), Slovak (`sk`), Turkmen
(`tk`)
#### `z.compile()`
You can now pre-compile any Zod schema using `z.compile(schema)`. This
dramatically speeds up parsing performance.
```ts
import * as z from "zod";
const Player = z.object({
username: z.string(),
bio: z.string(),
xp: z.number()
});
const CompiledPlayer = z.compile(Player);
```
A compiled schema can be used *exactly* like an uncompiled one. There
are no special rules around compiled schemas. They're just faster.
```ts
Player.parse({ ... });
CompiledPlayer.parse({ ... }); // ~2x faster
```
On objects, arrays, and unions, this speeds up parsing by a factor of
\~3–7. More complex schemas stand to benefit more than simpler ones.
<picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://zod.dev/blog/compile-speedup-dark.svg">
<img alt="Time per parse on a shared nanosecond axis, standard parser as
a gray bar with the compiled time as a blue bar inside it: an array of
10 objects 377 ns to 68 ns (5.5x), a 20-key object 301 ns to 38 ns
(7.8x), an array of 10 strings 241 ns to 33 ns (7.3x), a union of 3
objects 190 ns to 36 ns (5.3x), a 3-element tuple 119 ns to 33 ns
(3.6x), a 5-key strict object 117 ns to 32 ns (3.7x), a discriminated
union 92 ns to 27 ns (3.4x), a 5-key object 76 ns to 28 ns (2.8x); up to
7.8x faster when compiled"
src="https://zod.dev/blog/compile-speedup-light.svg">
</picture>
*Time per parse by schema type, standard parser vs compiled — lower is
better
([benchmark](https://redirect.github.com/colinhacks/zod/blob/main/packages/bench/compile-matrix.ts))*
Below are the Moltar benchmark results comparing Zod (compiled and
uncompiled) against the [**Moltar
ParseSafe**](https://redirect.github.com/moltar/typescript-runtime-type-benchmarks)
bench.
<picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://zod.dev/blog/moltar-dark.svg">
<img alt="Bar chart of operations per second on the moltar benchmark
fixture, parseSafe category: Zod 4 compiled 47.5M, typia 45.3M, Zod 4
11.6M, valibot 1.8M, effect 1.7M, Zod 3 1.2M, arktype 152k, yup 121k"
src="https://zod.dev/blog/moltar-light.svg">
</picture>
*Throughput on the moltar benchmark fixture (parseSafe: returns a new
object with unknown keys stripped) — higher is better
([benchmark](https://redirect.github.com/moltar/typescript-runtime-type-benchmarks/pull/2329))*
And the equivalent results for the Moltar AssertLoose bench. Tested
against the new `z.validate(schema, input)` function (detailed later in
the post).
<picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://zod.dev/blog/moltar-assertLoose-dark.svg">
<img alt="Bar chart of operations per second on the moltar benchmark
fixture, assertLoose category: typia 74.9M, arktype 66.2M, Zod 4
compiled 60.6M, Zod 4 6.5M, valibot 1.9M, effect 1.7M, Zod 3 1.2M, yup
124k" src="https://zod.dev/blog/moltar-assertLoose-light.svg">
</picture>
*Throughput on the moltar benchmark fixture (assertLoose: returns a
boolean, unknown keys allowed) — higher is better
([benchmark](https://redirect.github.com/moltar/typescript-runtime-type-benchmarks/pull/2329))*
Zod's entire test suite runs twice—once normally and again with
auto-compilation enabled globally—to ensure perfect fidelity.
<details>
<summary>How it works</summary>
Under the hood, `z.compile()` walks the entire schema once and produces
a hyperoptimized snippet of flat, loop-free JavaScript that can validate
inputs far faster than a standard runtime validator. This snippet can be
executed via `new Function()` (effectively a more powerful `eval`) to
serve as a fast-path validator. Schemas use this to "fast check"
validity, falling back to the regular runtime logic on validation
failure to provide granular error information.
Take this simple `Point` schema:
```ts
const Point = z.object({
x: z.number(),
y: z.number()
});
```
Here is the generated snippet for it:
```ts
const isPoint = new Function("input", `
if (typeof input !== "object" || input === null) return false;
if (typeof input.x !== "number") return false;
if (typeof input.y !== "number") return false;
return true;
`);
isPoint({ x: 1, y: 2 }); // true
isPoint({ x: "1" }); // false
```
For the large majority of inputs, the generated function validates the
data with the fastest logic JavaScript can express: straight-line
`typeof` checks and property reads, with no interpreter in between. When
it can't handle an input, Zod falls back to the standard parser.
This is the function Zod generates for the `Player` schema above:
```js
if (typeof input !== "object" || input === null || Array.isArray(input)) return INVALID;
const v0 = input["username"];
if (typeof v0 !== "string") return INVALID;
const v1 = input["bio"];
if (typeof v1 !== "string") return INVALID;
const v2 = input["xp"];
if (typeof v2 !== "number" || !Number.isFinite(v2)) return INVALID;
const v3 = { "username": v0, "bio": v1, "xp": v2 };
return v3;
```
Armed with the power of `new Function()`, this happens in-process at
runtime. There is no need to integrate with your build system.
> The compiled schema is purely additive on top of the existing schema.
It tacks on the pre-compiled fast path for checking valid inputs. When
invalid data is detected, it returns the `INVALID` symbol to signal that
parsing should fall back to the uncompiled parser. This structurally
prevents subtle deviations in error reporting between compiled and
uncompiled variants.
</details>
##### `import "zod/compile"`
To compile every schema in an application, import `zod/compile` once at
the top of your entry point. Every schema constructed after that import
is *automatically compiled* the first time it's used to parse data.
```ts
import "zod/compile"; // must come before modules that define schemas
import * as z from "zod";
const schema = z.object({ name: z.string() });
schema.parse({ name: "ok" }); // compiled on first parse
```
It also works as a Node.js CLI flag, which guarantees it runs before any
module defines a schema:
```sh
node --import zod/compile app.js
```
Or set `preload` in
[`bunfig.toml`](https://bun.com/docs/runtime/bunfig#preload) or
[`nub.jsonc`](https://nubjs.com/docs/config#preload).
```jsonc
{
"preload": ["zod/compile"]
}
```
All schemas benefit to varying degrees, though complex
object/tuple/array schemas benefit more than simple scalar validators.
> Read the [docs](https://zod.dev/compile), or the full technical
writeup: [Introducing
`z.compile()`](https://zod.dev/blog/introducing-z-compile)
#### `z.creditCard()`
A new string format: 12–19 digits, optionally separated by single spaces
or hyphens, with a valid Luhn checksum.
([#​5931](https://redirect.github.com/colinhacks/zod/pull/5931))
```ts
z.creditCard().parse("4111 1111 1111 1111"); // ✅
z.creditCard().parse("4111 1111 1111 1112"); // ❌ bad checksum
```
#### `z.properties()`
The multi-property counterpart to `z.property()`.
([#​5912](https://redirect.github.com/colinhacks/zod/pull/5912))
```ts
const httpsUrl = z.instanceof(URL).check(
...z.properties({
protocol: z.literal("https:" as string),
hostname: z.string().regex(z.regexes.domain),
})
);
httpsUrl.parse(new URL("https://example.com")); // ✅
httpsUrl.parse(new URL("http://localhost")); // ❌ protocol
```
#### `z.deepPartial()`
Back in functional form after being removed as a method in Zod 4.
([#​5928](https://redirect.github.com/colinhacks/zod/pull/5928))
```ts
const Post = z.object({
title: z.string(),
author: z.object({ name: z.string(), email: z.string() }),
});
const PartialPost = z.deepPartial(Post);
type PartialPost = z.output<typeof PartialPost>;
// => { title?: string; author?: { name?: string; email?: string } }
PartialPost.parse({ author: {} }); // ✅
```
The result is still a `ZodObject`, so `.shape` and `.extend()` keep
working.
#### `.exactPartial()`
Like `.partial()`, but wraps each field in `z.exactOptional()` instead
of `z.optional()`: keys may be omitted, but an explicit `undefined` is
rejected. This matches TypeScript's `Partial<>` under
`exactOptionalPropertyTypes`.
([#​6065](https://redirect.github.com/colinhacks/zod/pull/6065))
```ts
const Recipe = z.object({ title: z.string(), servings: z.number() });
const PartialRecipe = Recipe.exactPartial();
PartialRecipe.parse({}); // ✅
PartialRecipe.parse({ title: undefined }); // ❌
```
In Zod Mini it's a top-level function: `z.exactPartial(Recipe)`.
#### `z.validate()`
Standalone boolean validation, in Zod, Zod Mini, and Zod Core. It
answers "is this input valid?" without constructing a `ZodError`, which
makes rejection cheap: on invalid input it is up to 16x faster than
`.safeParse().success`. The return type is a guard on the schema's input
type, and `z.validateAsync()` covers schemas with async refinements.
([#​6471](https://redirect.github.com/colinhacks/zod/pull/6471))
```ts
z.validate(z.string(), "hi"); // true
z.validate(z.string(), 42); // false
```
#### `z.input()` / `z.output()`
Project a schema onto its input or output side. Useful for validating
the two halves of a codec independently.
([#​5928](https://redirect.github.com/colinhacks/zod/pull/5928))
```ts
const isoDate = z.codec(z.iso.datetime(), z.date(), {
decode: (s) => new Date(s),
encode: (d) => d.toISOString(),
});
const Event = z.object({ name: z.string(), at: isoDate });
z.input(Event).parse({ name: "launch", at: "2024-01-01T00:00:00Z" }); // ✅
z.output(Event).parse({ name: "launch", at: new Date() }); // ✅
```
This is a no-op on schemas not containing codecs/pipes.
#### `z.toZod<T>()`
A utility to define a Zod schema that agrees exactly with a static type,
often one that is handwritten or externally defined.
([#​5913](https://redirect.github.com/colinhacks/zod/pull/5913))
```ts
type Player = { username: string; xp: number };
const Player = z.toZod<Player>()(
z.object({
username: z.string(),
xp: z.number(),
})
);
Player.shape.username; // ZodString — the schema is returned unchanged
```
#### `z.getDiscriminatedOption()`
Extract a discriminated union member by discriminator value.
([#​5947](https://redirect.github.com/colinhacks/zod/pull/5947))
```ts
const Fruit = z.object({ type: z.literal("fruit"), seeds: z.boolean() });
const Veg = z.object({ type: z.literal("vegetable"), leafy: z.boolean() });
const Produce = z.discriminatedUnion("type", [Fruit, Veg]);
z.getDiscriminatedOption(Produce, "fruit"); // typeof Fruit
z.getDiscriminatedOption(Produce, "meat"); // ❌ TypeScript error
```
#### Cyclical inputs
Zod recursive schemas now support cyclical data. For bundle size
reasons, Zod Mini requires you to register a memoizer explicitly.
([#​6387](https://redirect.github.com/colinhacks/zod/pull/6387),
[#​6482](https://redirect.github.com/colinhacks/zod/pull/6482))
**Zod**
```ts
const Category = z.object({
name: z.string(),
get subcategories() {
return z.array(Category);
},
});
const input: any = { name: "root", subcategories: [] };
input.subcategories.push(input);
const result = Category.parse(input);
result.subcategories[0] === result; // true
```
**Zod Mini**
```ts
// register a memoizer before defining any schemas
z.config({ memoizer: z.memoizer() });
const result = Category.parse(input);
result.subcategories[0] === result; // true
```
#### 9x reduction in schema memory footprint
In Zod 4.4 a bare `z.string()` retained 7.5kb of heap. In Zod 4.5 it
retains 784 bytes.
<picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://zod.dev/blog/memory-dark.svg">
<img alt="Bar chart of heap retained by one schema instance, zod 4.4.3
versus 4.5: a 10-key object 82.0kb to 11.0kb, a union 17.5kb to 2.13kb,
z.string().min(1) 16.7kb to 3.37kb, a record 16.4kb to 2.64kb,
z.string().optional() 12.6kb to 1.50kb, an array of strings 11.2kb to
1.93kb, z.string() 7.53kb to 784b, z.number() 4.44kb to 706b. Up to 9.8x
smaller than 4.4.3." src="https://zod.dev/blog/memory-light.svg">
</picture>
*Retained heap per schema instance, Zod 4.4.3 vs 4.5
([benchmark](https://redirect.github.com/colinhacks/zod/blob/main/packages/bench/memory/schema-footprint.ts))*
In Zod 4.4 and earlier, all schema methods were automatically bound to
the instance itself. This allowed users to pluck methods from schemas
without causing issues due to `this`-binding.
```ts
const { parse } = z.string();
parse("some data");
```
A consequence of this is that each bound method allocates space on the
heap; method implementations are not shared across all instances via
`prototype`, as you'd expect. Zod 4.5 implements a method memoization
pattern that avoids allocating bound methods until they are actually
accessed.
> Read the deep dive: [Reducing Zod's memory footprint by an order of
magnitude](https://zod.dev/blog/reducing-memory-footprint)
#### Faster failures
Zod `.parse()`/`.safeParse()` instantiates a JavaScript `Error`, which
captures a stack trace. In the case of validation failures, this is
often much slower than the parsing logic itself. When using
`.safeParse()`, Zod no longer captures this stack trace, speeding up
failure-path parses by a factor of \~7.5x.
([#​6316](https://redirect.github.com/colinhacks/zod/pull/6316),
[#​6450](https://redirect.github.com/colinhacks/zod/pull/6450))
```ts
const result = Player.safeParse({ username: 42, bio: "hello", xp: 12 });
result.success; // false — ~7.5x faster than Zod 4.4
```
<picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://zod.dev/blog/fail-dark.svg">
<img alt="Bar chart of time per failing safeParse: zod 4.4 at 6.3
microseconds, zod 4.5 at 840 nanoseconds — 7.6x faster"
src="https://zod.dev/blog/fail-light.svg">
</picture>
*Player schema
([benchmark](https://redirect.github.com/colinhacks/zod/blob/main/packages/bench/failing-safeparse.ts))*
#### Symbol keys in `z.object()`
A shape can now declare a symbol key. TypeScript tracks it: a `const`
symbol infers as `unique symbol`, so `z.infer` makes the key required
and checks its value type. Undeclared symbol keys are still ignored.
([#​6448](https://redirect.github.com/colinhacks/zod/pull/6448))
```ts
const TAG = Symbol("tag");
const schema = z.object({ name: z.string(), [TAG]: z.number() });
schema.parse({ name: "alice", [TAG]: 42 }); // ✅ { name: "alice", [TAG]: 42 }
schema.safeParse({ name: "alice" }); // ❌ the symbol key is required
```
#### Bug fixes
All of these fix soundness issues, so a schema that relied on the old
behavior may now reject input it used to accept.
##### ⚠️ `z.iso.datetime()` requires seconds
RFC 3339 mandates seconds. `z.iso.datetime()` and `z.iso.datetime({
offset: true })` no longer accept minute-precision input like
`2020-01-01T06:15Z`. `local: true` still admits `2020-01-01T06:15`,
since an unqualified datetime is outside RFC 3339 either way.
([#​6457](https://redirect.github.com/colinhacks/zod/pull/6457))
```ts
z.iso.datetime().parse("2020-01-01T06:15:00Z"); // ✅
z.iso.datetime().parse("2020-01-01T06:15Z"); // ❌ was accepted in 4.4
```
To accept both forms, union the two precisions:
```ts
z.union([z.iso.datetime(), z.iso.datetime({ precision: -1 })]);
```
##### ⚠️ String length counts code points
`.min()`, `.max()`, and `.length()` counted UTF-16 code units, so
`z.string().max(5)` rejected five emoji. They now count Unicode code
points, which is what every non-JS consumer of a length bound does
(Postgres, MySQL, Go, Python, and the `maxLength` that
`z.toJSONSchema()` emits). `.max()` only loosens; `.min()` and
`.length()` tighten for astral input. Graphemes are unchanged — a ZWJ
sequence is still several code points.
([#​6441](https://redirect.github.com/colinhacks/zod/pull/6441))
```ts
z.string().max(5).parse("😀😀😀😀😀"); // was too_big, now passes
z.string().min(5).parse("😀😀😀"); // was fine, now too_small
```
Closes
[#​3355](https://redirect.github.com/colinhacks/zod/issues/3355).
##### ⚠️ Record keys and intersections match TypeScript
A record's key schema now governs only the keys that match it, the way
TypeScript treats an index signature. Intersecting an object with a
pattern-keyed record no longer rejects the object's own keys.
([#​6412](https://redirect.github.com/colinhacks/zod/pull/6412))
```ts
z.object({ name: z.string() })
.and(z.record(z.string().regex(/^S_/), z.string()))
.parse({ name: "a", S_a: "s" });
// 4.4: throws invalid_key on "name"
// 4.5: { name: "a", S_a: "s" }
```
Separately, an `unrecognized_keys` issue no longer aborts the schema it
came from, so a strict object with an extra key *and* a bad value now
reports both issues instead of just the first. Closes
[#​2200](https://redirect.github.com/colinhacks/zod/issues/2200),
[#​2573](https://redirect.github.com/colinhacks/zod/issues/2573),
[#​4017](https://redirect.github.com/colinhacks/zod/issues/4017),
[#​5663](https://redirect.github.com/colinhacks/zod/issues/5663).
##### ⚠️ `__proto__` is always stripped
Object and record parsers now drop a `__proto__` key whether it comes
from the input, is declared by the schema, or is produced by a record
key transform. A key that a record's key schema *normalizes* to
`__proto__` is dropped too. `.strict()` reports an own `__proto__` input
key as `unrecognized_keys` instead of silently swallowing it. Error
formatters and both JSON Schema converters use own-property writes so a
`toString` or `constructor` path segment can't walk onto
`Object.prototype`
([#​6213](https://redirect.github.com/colinhacks/zod/pull/6213),
[#​6367](https://redirect.github.com/colinhacks/zod/pull/6367),
[#​6346](https://redirect.github.com/colinhacks/zod/pull/6346)).
([#​6386](https://redirect.github.com/colinhacks/zod/pull/6386),
[#​6354](https://re
> ✂ **Note**
>
> PR body was truncated to here.
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- "every 2 weeks on Sunday"
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/splunk/addonfactory-ucc-generator).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDkuMCIsInRhcmdldEJyYW5jaCI6ImRldmVsb3AiLCJsYWJlbHMiOltdfQ==-->
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: srv-rr-github-token <94607705+srv-rr-github-token@users.noreply.github.com>
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [apache/skywalking-eyes](https://redirect.github.com/apache/skywalking-eyes) | action | minor | `v0.8.0` → `v0.9.0` | --- ### Release Notes <details> <summary>apache/skywalking-eyes (apache/skywalking-eyes)</summary> ### [`v0.9.0`](https://redirect.github.com/apache/skywalking-eyes/releases/tag/v0.9.0) [Compare Source](https://redirect.github.com/apache/skywalking-eyes/compare/v0.8.0...v0.9.0) #### What's Changed - chore(deps): bump up go version by [@​kezhenxu94](https://redirect.github.com/kezhenxu94) in [#​251](https://redirect.github.com/apache/skywalking-eyes/pull/251) - Bump golang.org/x/crypto from 0.39.0 to 0.45.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​253](https://redirect.github.com/apache/skywalking-eyes/pull/253) - Bump github.com/sirupsen/logrus from 1.9.0 to 1.9.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​254](https://redirect.github.com/apache/skywalking-eyes/pull/254) - 🐛 fix(deps): Ruby: local path & recursive resolution of deps by [@​pboling](https://redirect.github.com/pboling) in [#​255](https://redirect.github.com/apache/skywalking-eyes/pull/255) - Fix: Compatibility issue with Node.js 24 (related to [apache/skywalking#13517](https://redirect.github.com/apache/skywalking/issues/13517)) by [@​XL-Zhao-23](https://redirect.github.com/XL-Zhao-23) in [#​252](https://redirect.github.com/apache/skywalking-eyes/pull/252) - fix: improve error message formatting in license template lookup by [@​kezhenxu94](https://redirect.github.com/kezhenxu94) in [#​256](https://redirect.github.com/apache/skywalking-eyes/pull/256) - feat: check headers concurrently by [@​ZacBlanco](https://redirect.github.com/ZacBlanco) in [#​257](https://redirect.github.com/apache/skywalking-eyes/pull/257) - Bump github.com/go-git/go-git/v5 from 5.13.0 to 5.16.5 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​258](https://redirect.github.com/apache/skywalking-eyes/pull/258) - feat: add Pkl language support by [@​jhult](https://redirect.github.com/jhult) in [#​261](https://redirect.github.com/apache/skywalking-eyes/pull/261) - feat: add Inko language support by [@​jhult](https://redirect.github.com/jhult) in [#​262](https://redirect.github.com/apache/skywalking-eyes/pull/262) - fix: Fish completion script corrupted by INFO log message by [@​jhult](https://redirect.github.com/jhult) in [#​259](https://redirect.github.com/apache/skywalking-eyes/pull/259) - fix: add helpful error message for git repository issues by [@​jhult](https://redirect.github.com/jhult) in [#​260](https://redirect.github.com/apache/skywalking-eyes/pull/260) - Bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​264](https://redirect.github.com/apache/skywalking-eyes/pull/264) - Bump setup-go to v6 by [@​adoroszlai](https://redirect.github.com/adoroszlai) in [#​265](https://redirect.github.com/apache/skywalking-eyes/pull/265) - feat: extend GoModResolver to support any valid Go \*.mod file by [@​ivankatliarchuk](https://redirect.github.com/ivankatliarchuk) in [#​268](https://redirect.github.com/apache/skywalking-eyes/pull/268) - ci: add golangci-lint GitHub Actions workflow by [@​ivankatliarchuk](https://redirect.github.com/ivankatliarchuk) in [#​269](https://redirect.github.com/apache/skywalking-eyes/pull/269) - fix: respect specified paths in git repository by [@​jhult](https://redirect.github.com/jhult) in [#​263](https://redirect.github.com/apache/skywalking-eyes/pull/263) - ci(action): harden header GitHub action by [@​domodwyer](https://redirect.github.com/domodwyer) in [#​270](https://redirect.github.com/apache/skywalking-eyes/pull/270) - build(deps): bump github.com/go-git/go-git/v5 from 5.16.5 to 5.18.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​271](https://redirect.github.com/apache/skywalking-eyes/pull/271) - fix: corrrect RoundBracketAsterisk comment style by [@​bthuilot](https://redirect.github.com/bthuilot) in [#​272](https://redirect.github.com/apache/skywalking-eyes/pull/272) - build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.1 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​275](https://redirect.github.com/apache/skywalking-eyes/pull/275) - feat: add `header diff` command to show header differences by [@​wu-sheng](https://redirect.github.com/wu-sheng) in [#​276](https://redirect.github.com/apache/skywalking-eyes/pull/276) - Add support for Ruby, ERB and slim by [@​afriqs](https://redirect.github.com/afriqs) in [#​266](https://redirect.github.com/apache/skywalking-eyes/pull/266) - build(deps): bump golang.org/x/net from 0.53.0 to 0.55.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​277](https://redirect.github.com/apache/skywalking-eyes/pull/277) - build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​278](https://redirect.github.com/apache/skywalking-eyes/pull/278) - fix: don't treat mid-file #! strings as Python shebangs by [@​cmaluend](https://redirect.github.com/cmaluend) in [#​279](https://redirect.github.com/apache/skywalking-eyes/pull/279) - fix: pin docker/login-action to an ASF-approved commit SHA by [@​wu-sheng](https://redirect.github.com/wu-sheng) in [#​280](https://redirect.github.com/apache/skywalking-eyes/pull/280) - build(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 by [@​dependabot](https://redirect.github.com/dependabot)\[bot] in [#​281](https://redirect.github.com/apache/skywalking-eyes/pull/281) - feat: resolve dependencies of pnpm-managed Node.js projects by [@​wu-sheng](https://redirect.github.com/wu-sheng) in [#​282](https://redirect.github.com/apache/skywalking-eyes/pull/282) - docs: fix typo seperated -> separated by [@​vaibhav8a](https://redirect.github.com/vaibhav8a) in [#​283](https://redirect.github.com/apache/skywalking-eyes/pull/283) #### New Contributors - [@​XL-Zhao-23](https://redirect.github.com/XL-Zhao-23) made their first contribution in [#​252](https://redirect.github.com/apache/skywalking-eyes/pull/252) - [@​ZacBlanco](https://redirect.github.com/ZacBlanco) made their first contribution in [#​257](https://redirect.github.com/apache/skywalking-eyes/pull/257) - [@​jhult](https://redirect.github.com/jhult) made their first contribution in [#​261](https://redirect.github.com/apache/skywalking-eyes/pull/261) - [@​adoroszlai](https://redirect.github.com/adoroszlai) made their first contribution in [#​265](https://redirect.github.com/apache/skywalking-eyes/pull/265) - [@​ivankatliarchuk](https://redirect.github.com/ivankatliarchuk) made their first contribution in [#​268](https://redirect.github.com/apache/skywalking-eyes/pull/268) - [@​domodwyer](https://redirect.github.com/domodwyer) made their first contribution in [#​270](https://redirect.github.com/apache/skywalking-eyes/pull/270) - [@​bthuilot](https://redirect.github.com/bthuilot) made their first contribution in [#​272](https://redirect.github.com/apache/skywalking-eyes/pull/272) - [@​afriqs](https://redirect.github.com/afriqs) made their first contribution in [#​266](https://redirect.github.com/apache/skywalking-eyes/pull/266) - [@​cmaluend](https://redirect.github.com/cmaluend) made their first contribution in [#​279](https://redirect.github.com/apache/skywalking-eyes/pull/279) - [@​vaibhav8a](https://redirect.github.com/vaibhav8a) made their first contribution in [#​283](https://redirect.github.com/apache/skywalking-eyes/pull/283) **Full Changelog**: <apache/skywalking-eyes@v0.8.0...v0.9.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "every 2 weeks on Sunday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://redirect.github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/splunk/addonfactory-ucc-generator). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40OS4wIiwidXBkYXRlZEluVmVyIjoiNDQuNjEuMyIsInRhcmdldEJyYW5jaCI6ImRldmVsb3AiLCJsYWJlbHMiOltdfQ==--> --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: kkedziak-splunk <kkedziak@splunk.com> Co-authored-by: srv-rr-github-token <94607705+srv-rr-github-token@users.noreply.github.com>
…oment(VULN-123527), fast-uri(VULN-123521), brace-expansion(VULN-123403)
… the toml file and generated the poetry
… changes the toml file and generated the poetry" This reverts commit c3a394b.
…crash Co-Authored-By: Claude Code <noreply@anthropic.com>
Splunkbase no longer accepts Basic auth on the package validation status endpoint, so `ucc-gen publish` failed with 403 after a successful upload. Exchange credentials for a JWT via the Splunk API login endpoint and use it as a Bearer token for both upload and validation status requests. Co-Authored-By: Claude Code <noreply@anthropic.com>
… on kernel 6.19+ Splunk 10.2/10.4 bundle MongoDB 8.0, which refuses to start on Linux 6.19+ (SERVER-121912). ubuntu-24.04 runners moved to kernel 7.0; ubuntu-22.04 is on 6.8. Co-Authored-By: Claude Code <noreply@anthropic.com>
…spect cloud checks AppInspect cloud now rejects python.required values other than 3.13/3.14 (check_*_python_required), so the 3.7 entry fails the appinspect api job. Co-Authored-By: Claude Code <noreply@anthropic.com>
Fixes CVE-2026-118773 (glob@13.0.6) and CVE-2026-118764 (minimatch@10.2.6). Bumps the direct glob dependency and adds path-scoped resolutions for the transitive jest/storybook/typescript-eslint/test-exclude consumers; dedupes stale jest 30.4 entries so test-exclude@6 keeps minimatch 3. Co-Authored-By: Claude Code <noreply@anthropic.com>
jest-runtime 30.5.0 throws on module.register(), which Storybook calls unconditionally when loading .storybook/test-runner.ts. Co-Authored-By: Claude Code <noreply@anthropic.com>
Mixed 22.04/24.04 runners; Splunk-based jobs need 22.04 to avoid the KVStore crash on newer kernels, so standardize on 22.04. Co-Authored-By: Claude Code <noreply@anthropic.com>
Python 3.7 support was dropped; the supported versions are 3.9 and 3.13. Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-Authored-By: Claude Code <noreply@anthropic.com>
AppInspect accepts 3.9 as a python.required value as long as 3.13 is also listed; the earlier cloud failure was caused by 3.7 only. Align the fixture with the 3.9, 3.13 format used everywhere else. Co-Authored-By: Claude <noreply@anthropic.com>
pip 26.3 rejects `pip show --version <pkg>` with "no such option: --version", so the splunktaucclib/solnlib checks failed and every build of an add-on with UI raised SplunktaucclibNotFound. Plain `pip show` already prints the Version: line the check parses. Co-Authored-By: Claude <noreply@anthropic.com>
**Issue number:** maplibre-gl(VULN-119082), moment(VULN-123527), fast-uri(VULN-123521), brace-expansion(VULN-123403) ### PR Type **What kind of change does this PR introduce?** * [ ] Feature * [ ] Bug Fix * [ ] Refactoring (no functional or API changes) * [ ] Documentation Update * [X] Maintenance (dependency updates, CI, etc.) ## Summary ### Changes Please provide a summary of the changes. ### User experience Please describe the user experience before and after this change. Screenshots are welcome for additional context. ## Checklist If an item doesn't apply to your changes, leave it unchecked. ### Review * [ ] self-review - I have performed a self-review of this change according to the [development guidelines](https://splunk.github.io/addonfactory-ucc-generator/contributing/#development-guidelines) * [ ] Changes are documented. The documentation is understandable, examples work [(more info)](https://splunk.github.io/addonfactory-ucc-generator/contributing/#documentation-guidelines) * [ ] PR title and description follows the [contributing principles](https://splunk.github.io/addonfactory-ucc-generator/contributing/#pull-requests) * [ ] meeting - I have scheduled a meeting or recorded a demo to explain these changes (if there is a video, put a link below and in the ticket) ### Tests See [the testing doc](https://splunk.github.io/addonfactory-ucc-generator/contributing/#build-and-test). * [ ] Unit - tests have been added/modified to cover the changes * [ ] Smoke - tests have been added/modified to cover the changes * [ ] UI - tests have been added/modified to cover the changes * [ ] coverage - I have checked the code coverage of my changes [(see more)](https://splunk.github.io/addonfactory-ucc-generator/contributing/#checking-the-code-coverage) **Demo/meeting:** *Reviewers are encouraged to request meetings or demos if any part of the change is unclear*
…2117) ## Summary Fixes [ADDON-91495](https://splunk.atlassian.net/browse/ADDON-91495): `ucc-gen publish` uploads the package successfully but then fails with `HTTP 403: Authentication credentials were not provided` when checking the package validation status. **Root cause:** Splunkbase no longer accepts HTTP Basic auth on `GET /api/v1/package/{id}/`. The Basic auth header is ignored, and the endpoint only accepts a Bearer JWT. The upload endpoint still accepts Basic auth, which is why the upload step worked. Splunkbase is asking publishers to move to JWT, as signalfx/splunk-otel-collector#8183 did. **Fix:** - New `get_auth_token()` exchanges the Splunkbase username/password for a JWT via `https://api.splunk.com/2.0/rest/login/splunk` (`data.token`). - `publish_package()` logs in once and sends `Authorization: Bearer <jwt>` on both the upload and the validation status requests. - CLI arguments (`--username` / `--password`) are unchanged, so existing workflows need no changes. - Docs updated in `docs/commands.md`. ## Test plan - [x] Unit tests updated and added for token exchange (success, missing token, HTTP error), Bearer headers, and the `publish_package` flow. `publish.py` coverage is 100%. - [x] `pre-commit run --all-files` passes - [x] Checked live endpoints with fake credentials: the package endpoint ignores Basic auth but recognizes Bearer. - [ ] End-to-end `ucc-gen publish` against Splunkbase with real credentials 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
srana-crest
approved these changes
Nov 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.