[dependabot]

Bumps jsonpath-plus from 10.4.0 to 11.1.0.

Release notes

Sourced from jsonpath-plus's releases.

v10.4.1

What's Changed

• build(deps): bump minimatch from 3.1.2 to 3.1.4 by @​dependabot[bot] in JSONPath-Plus/JSONPath#255
• build(deps): bump markdown-it from 14.1.0 to 14.1.1 by @​dependabot[bot] in JSONPath-Plus/JSONPath#251
• build(deps): bump qs from 6.14.0 to 6.14.2 by @​dependabot[bot] in JSONPath-Plus/JSONPath#252
• build(deps): bump ajv from 6.12.6 to 6.14.0 by @​dependabot[bot] in JSONPath-Plus/JSONPath#253
• build(deps): bump serialize-javascript from 6.0.2 to 7.0.5 (via audit fix) by @​dependabot[bot] in JSONPath-Plus/JSONPath#260
• build(deps): bump minimatch from 9.0.5 to 9.0.9 by @​dependabot[bot] in JSONPath-Plus/JSONPath#262
• build(deps-dev): bump rollup from 4.53.2 to 4.59.0 by @​dependabot[bot] in JSONPath-Plus/JSONPath#257
• fix(slice): explicit zero end no longer returns the whole array by @​spokodev in JSONPath-Plus/JSONPath#265

New Contributors

• @​spokodev made their first contribution in JSONPath-Plus/JSONPath#265

Full Changelog: JSONPath-Plus/JSONPath@v10.4.0...v10.4.1

Changelog

Sourced from jsonpath-plus's changelog.

11.1.0

• fix: allow bare @ in any position (e.g., $[?(@>1)], $[?(@)], $[?(!@)]) and stop rewriting @ inside quoted string literals (@​spokodev)
• fix: support unions of quoted property names (e.g., $['x','y'], $["a,b",'c.d']) as literal names (fixes #159; see #268)
• fix: support quoted property names containing commas (e.g., $['a,b'])
• fix: support \', \", and \\ escapes within quoted property names and escape ' and \ in toPathString output so paths round-trip

11.0.1

• fix(security) nested filter bypass exploit (@​andrewmacheret)

11.0.0

BREAKING CHANGES

• Require Node >= 22; drops older browser version support

• JSONPath.cache is no longer exposed or mutable. Consumers that used JSONPath.cache to inspect, modify, or clear entries must remove that usage and call JSONPath.clearCache() when cache invalidation is needed.

• chore: bump engines and browserslist and use v flag

• chore: various changes in types, particularly with return values changing from any to unknown to ensure type safety (by forcing type casts of the results on the user).

• fix!: isolate caches and add cache reset API

Other changes:

• feat: add customTypes option for providing own other type callbacks (e.g., @blob()) (@​brettz9)
• fix(slice): explicit zero end no longer returns the whole array (#265) (@​spokodev)
• fix: indicate that the OtherTypeCallback callback type can accept a parentPropName with type number (@​brettz9)
• fix: separate JSONPath path and script caches (@​brettz9)
• fix: restore JSONPath.prototype.evaluate, safeVm, and vm compatibility
• fix(safe-eval): harden operator lookup against prototype inheritance (@​brettz9)
• fix(security): block indirect Function-constructor access in safe eval (reported by @c0rydoras: Arthur Deierlein <info@c0rydoras.dev>)
• refactor: expose JSONPathClass prototype through JSONPath for compatibility
• docs: security notes
• test(safe-eval): guard bind() escape route for constructor access (@​brettz9)
• test: restore full test coverage (@​brettz9)
• chore: pnpm update (@​brettz9)
• refactor: implement TypeScript-as-JSDoc and auto-build declaration files from this (avoiding need for maintaining declaration file manually)
• chore: update devDeps
• chore: lint
• build(deps-dev): bump rollup from 4.53.2 to 4.59.0 (@​dependabot[bot])
• build(deps): bump minimatch from 9.0.5 to 9.0.9 (@​dependabot[bot])
• build(deps): bump serialize-javascript (via audit fix) (@​dependabot[bot])
• build(deps): bump ajv from 6.12.6 to 6.14.0 (#253) (@​dependabot[bot])
• build(deps): bump qs from 6.14.0 to 6.14.2 (#252) (@​dependabot[bot])

... (truncated)

Commits

• 6451f7e chore: update build and docs
• ceb861d fix: support unions of quoted property names (e.g., $['x','y'],
• a54beff fix: allow bare @ in any position (e.g., $[?(@)], $[?(!@)],
• 935c782 fix(filter): allow bare @ adjacent to an operator without whitespace
• 3e146f7 chore: update types
• 5658994 chore: bump version (11.0.1)
• 8ea07f2 chore: update build and CHANGES
• 7886251 fix(security) nested filter bypass exploit
• 799e448 chore: update devDeps.; linting
• 8c5173a test: update browser tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.

[dependabot]

Superseded by #392.