chore: bump the minor-patch group across 1 directory with 28 updates by dependabot[bot] · Pull Request #73 · BCSDLab/BCSD_united

dependabot · 2026-11-11T08:34:22Z

Bumps the minor-patch group with 28 updates in the / directory:

Package	From	To
@cloudflare/workers-types	`5.20261029.1`	`5.20261108.1`
oxfmt	`0.75.0`	`0.77.0`
oxlint	`1.90.0`	`1.92.0`
wrangler	`4.156.0`	`4.158.0`
fast-xml-parser	`5.11.2`	`5.12.0`
hono	`4.13.14`	`4.13.17`
parse5	`8.0.1`	`8.1.1`
@aws-sdk/client-s3	`3.1160.0`	`3.1164.0`
@slack/web-api	`8.2.0`	`8.3.0`
nitropack	`2.13.5`	`2.13.6`
vitest	`5.0.5`	`5.1.0`
@opentelemetry/core	`3.0.0`	`3.1.0`
@sentry/core	`11.10.0`	`11.11.0`
@sentry/react	`11.10.0`	`11.11.0`
@tanstack/react-query	`5.105.0`	`5.107.1`
@tanstack/react-start	`1.169.4`	`1.169.5`
framer-motion	`14.8.0`	`14.10.1`
swiper	`14.3.0`	`14.4.0`
zustand	`5.0.16`	`5.1.0`
@cloudflare/vite-plugin	`1.66.0`	`1.67.0`
@sentry/vite-plugin	`11.10.0`	`11.11.0`
@tanstack/eslint-plugin-query	`5.105.0`	`5.107.1`
@types/navermaps	`3.9.2`	`3.10.0`
@vitejs/plugin-react	`6.1.2`	`6.2.1`
globals	`17.13.0`	`17.14.0`
oxc-transform-react	`0.152.0`	`0.157.0`
sass	`1.107.0`	`1.108.1`
vite	`8.3.5`	`8.3.6`

Updates @cloudflare/workers-types from 5.20261029.1 to 5.20261108.1

Commits

See full diff in compare view

Updates oxfmt from 0.75.0 to 0.77.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.77.0

💥 BREAKING CHANGES

00d1a67 oxfmt: [BREAKING] Format parser:vue files by oxc_formatter_htmlish (#28848) (leaysgur)

🚀 Features

9a81e58 formatter_htmlish: Format Vue templates (#28847) (leaysgur)

119d82f formatter: Format a template's expressions and handlers as JsRoot (#28846) (leaysgur)

🐛 Bug Fixes

fa66fde oxlint,oxfmt: Resolve Vite+ config root from the config file directory (#28801) (MK (fengmk2))

4d4104d formatter_htmlish: Preserve doctype case in embedded (#28797) (leaysgur)

ebfd40a formatter: Sort Tailwind calls printed as member chains (#28800) (Yuji Sugiura)

e62e5cb formatter: Decide quotes of a Tailwind key printed as one class (#28798) (Yuji Sugiura)

959edc1 formatter: Don't sort templates in nested non-Tailwind calls (#28794) (Yuji Sugiura)

6ffbe32 formatter/jsdoc: Prevent @tag from being moved to the line start (#28835) (leaysgur)

94fbef5 formatter_css: Treat comments in style attr as fill items (#28832) (leaysgur)

e4a80f7 formatter_css: Normalize selectors inside :deep, :slotted and :local (#28805) (leaysgur)

255c5cc formatter: Measure Tailwind class argument after collapsing whitespace (#28745) (Lee Jaeha / Adam)

e6c4fef formatter: Decide template and object key layouts from collapsed Tailwind classes (#28791) (Yuji Sugiura)

0b44164 formatter: Decide JSX opening element layout from collapsed Tailwind class string (#28744) (Lee Jaeha / Adam)

b8ba9ae formatter: Print decorators on rest parameters (#28731) (YT)

⚡ Performance

2766d07 oxfmt: Spawn Prettier workers on demand (#28789) (YT)

07627f7 oxfmt: Use worker_threads for tinypool again (#28787) (Yuji Sugiura)

oxfmt v0.76.0

💥 BREAKING CHANGES

296623d oxfmt: [BREAKING] Format parser:html files by oxc_formatter_htmlish (#28273) (Yuji Sugiura)

🚀 Features

336b2c1 oxfmt: Support html-in-js templates closing a dynamic tag name (#28389) (Yuji Sugiura)

0a42af6 formatter_htmlish: Format end tags of omitted html, head and body (#28388) (Yuji Sugiura)

44d8c2b formatter_htmlish: Implement HTML-ish formatter Html variant (#28272) (Yuji Sugiura)

36e5ddb oxfmt: Add debug span for reading files (#28204) (leaysgur)

🐛 Bug Fixes

dbcc358 formatter: Keep arrow conditional body parens before a leading function/class (#28710) (Yuji Sugiura)

fef809a formatter_htmlish: Handle XHTML (#28703) (leaysgur)

f3dd201 formatter_htmlish: Keep SVG text under xml:space="preserve" as written (#28382) (Yuji Sugiura)

fb3aefa formatter: Keep source parens around html-in-js placeholders past comments (#28381) (Yuji Sugiura)

e738dae formatter: Quote keys added in an HTML event handler with single quotes (#28380) (Yuji Sugiura)

2e7a629 oxfmt: Format HTML in a <script> body as an embedded part (#28379) (Yuji Sugiura)

... (truncated)

Commits

29daf90 release(apps): oxlint v1.92.0 && oxfmt v0.77.0 (#28906)
f3fcdcc release(apps): oxlint v1.91.0 && oxfmt v0.76.0 (#28718)
See full diff in compare view

Updates oxlint from 1.90.0 to 1.92.0

Release notes

Sourced from oxlint's releases.

oxlint v1.92.0

🚀 Features

4a52ba2 oxlint: Discover tsrs for type-aware linting (#28751) (camc314)

b7d2c75 linter/eslint/no-redeclare: Add ignoreDeclarationMerge option (#28816) (Cam McHenry)

🐛 Bug Fixes

fa66fde oxlint,oxfmt: Resolve Vite+ config root from the config file directory (#28801) (MK (fengmk2))

2091564 linter/jsdoc/require-param: Ignore enclosing function JSDoc (#28866) (camc314)

c6ec50b linter/react/only-export-components: Classify JSX values as non-components (#28761) (camc314)

3c051ab linter/vitest/prefer-called-exactly-once-with: Preserve neighboring code in autofix (#28864) (camc314)

674b962 linter/eslint/no-misleading-character-class: Use lazy regex for combining marks (#28822) (Sysix)

838d339 linter/vitest/prefer-called-exactly-once-with: Avoid panic on non-ASCII text (#28850) (YT)

8d24c26 linter/jsx-a11y/aria-role: Allow role={undefined} (#28804) (Abhay Godavarthy)

a7143bf linter/eslint/no-restricted-imports: Respect allowTypeImports correctly for empty patterns (#28842) (Cam McHenry)

3d3a6f4 react-compiler: Ignore callback-local reassignments (#28820) (camc314)

0cc6515 linter/unicorn/prefer-type-error: Report throws in unbraced if branches (#28819) (camc314)

ae43c80 linter/unicorn/prefer-single-call: Remove duplicate fix status (#28763) (Mikhail Baev)

a8a621a linter/eslint/no-fallthrough: Ignore unreachable exits from infinite loops (#28755) (camc314)

7a17a80 linter/eslint/prefer-spread: Report calls on non-member expressions (#28753) (camc314)

28442f7 oxlint: Prevent --init from overwriting existing configs (#28754) (camc314)

0ae350d linter/unicorn/no-zero-fractions: Preserve exponent case (#28752) (camc314)

b5b3f3f linter/eslint/no-misleading-character-class: Detect more combining characters (#28733) (Sysix)

⚡ Performance

74d50c1 linter: Overlap import graph batches instead of polling on a pool worker (#28323) (Dunqing)

oxlint v1.91.0

🚀 Features

004647a track_memory_allocs: Add allocation tracking for linter rules (#28470) (Cam McHenry)

419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)

🐛 Bug Fixes

a205cd3 linter/eslint/no-control-regex: Detect raw control characters (#28548) (camc314)

7c65777 linter/unicorn/prefer-global-this: Align typeof and worker API handling (#28549) (camc314)

987d5f1 linter/unicorn/no-invalid-fetch-options: Avoid treating unknown methods as GET (#28547) (camc314)

e234dc8 linter/unicorn/no-useless-error-capture-stack-trace: Move to suspicious category (#28545) (camc314)

b3dc411 linter/typescript/no-non-null-asserted-nullish-coalescing: Move to suspicious category (#28546) (camc314)

cb64638 regular_expression: Reject incomplete Unicode atom escapes (#28448) (Boshen)

c67167e linter: Only run React Compiler rules on files with top-level components or hooks (Boshen)

4c9d5aa linter: Treat Reanimated shared values as ref-like in React Compiler rules (Boshen)

61fe2af linter/react: Ignore impure calls in async components in react/purity (Rahul Kashyap)

ed7df7d ast/estree: Include comments in TS Program span (#28326) (camc314)

31cbe37 linter: Make gitlab fingerprints unique per diagnostic (#28307) (camc314)

⚡ Performance

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.92.0] - 2026-11-06

🚀 Features

b7d2c75 linter/eslint/no-redeclare: Add ignoreDeclarationMerge option (#28816) (Cam McHenry)

[1.91.0] - 2026-11-02

🚀 Features

419c1b0 linter: Add allow and allowPattern options to react/capitalized-calls (Christian Vuerings)

Commits

29daf90 release(apps): oxlint v1.92.0 && oxfmt v0.77.0 (#28906)
b7d2c75 feat(linter/eslint/no-redeclare): add ignoreDeclarationMerge option (#28816)
f3fcdcc release(apps): oxlint v1.91.0 && oxfmt v0.76.0 (#28718)
419c1b0 feat(linter): add allow and allowPattern options to react/capitalized-calls
See full diff in compare view

Updates wrangler from 4.156.0 to 4.158.0

Release notes

Sourced from wrangler's releases.

wrangler@4.158.0

Minor Changes

#16186 f1d81a2 Thanks @leostera! - Support local Artifacts across Wrangler, Vite, and Workers Vitest

Set remote: false on an Artifacts binding to opt into the Miniflare simulator and persistent local repositories during development. Omitted remote continues to use the deployed resource, with a warning that changes affect real repositories; remote: true explicitly selects it. When remote bindings are disabled (wrangler dev --local, or Vite's remoteBindings: false), Artifacts bindings use the local simulator. Workers Vitest uses the local simulator when remote is omitted, so tests do not change real repositories by accident; set remote: true to test against the deployed resource. Local development does not require Cloudflare credentials, but does require Git 2.32 or newer on the host.

In Miniflare's own options, Artifacts bindings route like every other binding: only dev.remote: true with a remote proxy connection uses the deployed resource. Wrangler and Vite resolve the deployed-by-default rule, and Workers Vitest its local default, before passing options to Miniflare.

Patch Changes

#16700 dc35efb Thanks @cjol! - Bump bundled brace-expansion to pick up security fixes

These packages bundle brace-expansion (a dependency of minimatch), and the bundled versions were affected by published advisories. The bundles now include brace-expansion 2.1.7 (from 2.0.1) and 5.0.12 (from 5.0.5). Normal glob patterns expand as before; only the pathological patterns targeted by the advisories are handled differently.

#16700 dc35efb Thanks @cjol! - Bump bundled fast-xml-parser from 4.4.1 to 4.5.5 to pick up security fixes

Miniflare bundles fast-xml-parser into its local R2 S3 API, and Wrangler bundles it through the AWS SDK used by wrangler pipelines. Version 4.4.1 is affected by several published advisories, and 4.5.5 includes their fixes. XML handling does not change.

#16700 dc35efb Thanks @cjol! - Bump bundled minimatch from 5.1.6 to 5.1.9 to pick up security fixes

These packages bundle minimatch, and 5.1.6 is affected by published ReDoS advisories. Version 5.1.9 includes the fixes. 5.1.8 is skipped because it broke recursive ** matching, which D1's migrations_pattern relies on.

#16700 dc35efb Thanks @cjol! - Bump bundled shell-quote from 1.10.0 to 1.11.0 to pick up a security fix

shell-quote is bundled into Wrangler, which uses it to parse and quote shell commands such as custom build and Pages dev commands. Version 1.10.0 is affected by a published advisory, and 1.11.0 includes the fix. Command parsing does not change.

#16700 dc35efb Thanks @cjol! - Bump bundled yaml from 2.8.1 to 2.9.0 to pick up a security fix

yaml is bundled into Wrangler, which uses it to show container application details. Version 2.8.1 is affected by a published advisory, and versions from 2.8.3 onwards include the fix. Output does not change.

#16688 fa3edb3 Thanks @FlorentCollin! - Use the account_id from the configuration file in wrangler d1 migrations list --remote

Before this change, the command ignored the account_id in the configuration file. When your login had access to more than one account, the command failed in non-interactive mode. In interactive mode, it asked you to select an account. The command now uses the configured account_id, as wrangler d1 migrations apply does.

#16695 b2061f4 Thanks @dependabot! - Update DEFAULT_COMPAT_DATE to 2026-11-04

Use the bundled workerd release's compatibility date by default when scaffolding new projects or when no compatibility date is configured.

#16695 b2061f4 Thanks @dependabot! - Update dependencies of "miniflare", "wrangler"

The following dependency versions have been updated:

Dependency From To

@cloudflare/workers-types ^5.20261103.1 ^5.20261104.1

workerd 1.20261103.1 1.20261104.1

#16306 36e64f2 Thanks @efalcao! - Report Cloudflare Access login redirects on remote bindings instead of looping until "Too many redirects"

... (truncated)

Commits

c579d50 Version Packages (#16681)
f1d81a2 [miniflare] Enable local Artifacts in development tools [3/3] (#16186)
dc35efb Bump dependencies to clear 101 Dependabot alerts (#16700)
4d88a45 [miniflare] Stabilize Artifacts integration tests on Windows (#16693)
0083f80 [wrangler] Harden the local KV pagination regression test (#16697)
fa3edb3 [wrangler] Use config account_id in d1 migrations list --remote (#16688)
9a0732c Version Packages (#16654)
44d1ee4 fix(wrangler): stop wrangler delete orphaning Container applications (#16011)
8ac43df Require explicit route metadata flags when downloading Worker configuration (...
680666e Version Packages (#16646)
Additional commits viewable in compare view

Updates fast-xml-parser from 5.11.2 to 5.12.0

Release notes

Sourced from fast-xml-parser's releases.

v5.12.0

What's Changed

fix: add endIndex to the CommonJS XMLMetaData declaration by @dualfroz in NaturalIntelligence/fast-xml-parser#896

Bump zizmorcore/zizmor-action from 0.6.1 to 0.8.0 by @dependabot[bot] in NaturalIntelligence/fast-xml-parser#906

Bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot[bot] in NaturalIntelligence/fast-xml-parser#904

fix: preserve original metadata offsets for CRLF input by @Sskift in NaturalIntelligence/fast-xml-parser#911

docs: update NASA link in users list by @CodeVertex55 in NaturalIntelligence/fast-xml-parser#885

README.md: fix documentation links by @maxlath in NaturalIntelligence/fast-xml-parser#872

test: drop shadowed ignoreAttributes option by @rajanpanth in NaturalIntelligence/fast-xml-parser#863

New Contributors

@dualfroz made their first contribution in NaturalIntelligence/fast-xml-parser#896

@Sskift made their first contribution in NaturalIntelligence/fast-xml-parser#911

@CodeVertex55 made their first contribution in NaturalIntelligence/fast-xml-parser#885

@maxlath made their first contribution in NaturalIntelligence/fast-xml-parser#872

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.2...v5.12.0

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.12.0 / 2026-11-03

perf improvement for stop node: After the first failure in a given stop node, the function stops using readTagExp and switches to a cheap fallback.

devdep:jasmine 7.0

deps:

@nodable/entities v3.1.0

fast-xml-builder v1.3.1

is-unsafe v2.0.3

strnum v2.5.1

fix cjs typing

fix: preserve original metadata offsets for CRLF input (#911) (By sskift)

5.11.2 / 2026-09-29

fix (#875): decode Uint8Array XML input as UTF-8 (By emme1t)

fix (#880) :type EntityDecoderOptions.setXmlVersion's version as a number (By Yevhenii Kotyrlo)

5.11.1 / 2026-08-27

fix: validator; Replace regex with a single-pass scanner for attribute tokens, eliminating quadratic behavior on long whitespace runs.

5.11.0 / 2026-08-16

feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]

fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]

fix: DOCTYPE to read SYSTEM/PUBLIC

deps: strnum v2.4.2

5.10.1 / 2026-07-17

fix: multiple DOCTYPE declarations.

deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

upgrade:

xml-naming v0.3.0: cache support

PEM v1.6.2: sibling bug fix

is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

update strnum

*5.9.2 / 2026-06-17

dummy release to test changes in github action

*5.9.1 / 2026-06-17

dummy release to test release from github action

*5.9.0 / 2026-06-15

update strnum to 2.3.0

... (truncated)

Commits

976470f 5.12.0
e6703ce update changelog
cad3004 update browser bundle
404b15e deps update
1792392 devdep: jasmine 7
edea043 specs: No duplicate suit or test name
0c36593 perf: stopnode
5680565 test: drop shadowed ignoreAttributes option (#863)
6b855c2 README.md: fix documentation links (#872)
4ad1388 docs: update NASA link in users list (#885)
Additional commits viewable in compare view

Updates hono from 4.13.14 to 4.13.17

Release notes

Sourced from hono's releases.

v4.13.17

What's Changed

fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in honojs/hono#5608

fix(utils/url): do not match a query key across separators in honojs/hono#5607

fix(etag,pretty-json): cancel the discarded response body in honojs/hono#5606

fix(client): detect the JSON media type with whitespace before a parameter in honojs/hono#5609

fix(timing): honor a precision of 0 in setMetric in honojs/hono#5363

fix(utils/mime,ssg): match media types case-insensitively in honojs/hono#5449

fix(timing): escape double quotes and backslashes in Server-Timing descriptions in honojs/hono#5478

fix(etag): preserve commas within quoted entity tags in honojs/hono#5353

fix(accepts): preserve exact media type quality over subtype wildcards in honojs/hono#5427

fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in CookieConstraint in honojs/hono#5611

fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary in honojs/hono#5430

fix(ssg): do not reuse created directories across toSSG runs in honojs/hono#5381

fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events in honojs/hono#5483

fix(jsx): escape element and object attribute values in honojs/hono#5512

fix(jsx): do not render ref objects as attributes in honojs/hono#5615

fix(factory): keep independent return types for nine handlers in honojs/hono#5618

Full Changelog: honojs/hono@v4.13.16...v4.13.17

v4.13.16

Security fixes

This release includes fixes for the following security issues:

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

Affects: mount() in hono/mount and app.mount(). A dynamic prefix such as /api/:tenant/* was removed by the length of the route pattern. The forwarded path was also re-normalized by the URL parser, so a decoded \ became / and .. collapsed. Both let a crafted request skip middleware scoped inside the mount prefix. Routes such as /assets* and duplicate parameter names now throw. GHSA-4m76-xfj5-7975

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

Affects: RegExpRouter, including the default SmartRouter. Wildcard middleware was not applied in three cases: a parameter written as {[^/]+} in the middleware path only, a /prefix* route next to /prefix/* middleware, and a path with an encoded line terminator. RegExpRouter now covers the same routes as the other routers. Custom patterns that can match the empty string, such as {[0-9]*}, throw UnsupportedPathError. Regenerate PreparedRegExpRouter data. GHSA-h7mg-cq63-vhpq

validator('form') skips validation for multipart/form-data requests with extra parameters

Affects: validator('form') in hono/validator. A multipart/form-data request with an extra parameter such as charset was not recognized as a form. The validator then saw an empty object while the handler could read all fields. GHSA-4h7h-rv7c-7m2v

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

Affects: css in hono/css. A </style> split between the template and a value, or between two values, was not escaped. Closing tags are now escaped after minification. GHSA-3gg2-335m-rxc6

csrf() does not check requests sent by hyperlink auditing (text/ping)

Affects: csrf() in hono/csrf. A POST sent by Chromium's <a ping> has the content type text/ping and was not checked against Origin and Sec-Fetch-Site. GHSA-46wx-v44x-9hh2

Users who rely on path-scoped middleware with mount(), wildcard middleware with the default router, validator('form'), the css helper with untrusted values, or csrf() are strongly encouraged to upgrade to this version.

... (truncated)

Commits

61f7c59 4.13.17
1534ffa fix(factory): keep independent return types for nine handlers (#5618)
eb754bd fix(jsx): do not render ref objects as attributes (#5615)
6cbe361 fix(jsx): escape element and object attribute values (#5512)
8b7f9e9 fix(aws-lambda): sanitize non-ASCII header values in API Gateway v2 events (#...
7852e0a fix(ssg): do not reuse created directories across toSSG runs (#5381)
bcfd02b fix(jsx): add the CSP nonce to all scripts generated by ErrorBoundary (#5430)
456fe46 fix(cookie): match the __Secure- and __Host- prefixes case-insensitively in C...
98b35af fix(accepts): preserve exact media type quality over subtype wildcards (#5427)
b3f1272 fix(etag): preserve commas within quoted entity tags (#5353)
Additional commits viewable in compare view

Updates parse5 from 8.0.1 to 8.1.1

Release notes

Sourced from parse5's releases.

v8.1.1

This release fixes nineteen security-relevant issues in the tokenizer, serializer, SAX parser, rewriting stream, tree adapters and tree construction, reported by outside researchers and by Anthropic, and further issues of the same kinds found while reviewing them. The issues include crashes from a few bytes of input, parse time and memory far out of proportion to the input, and serializer output that re-parses into markup the parsed tree did not contain. Everyone who runs parse5 on untrusted input should update.

There are no CVEs or GitHub security advisories for these issues: private vulnerability reporting on this repository is only accessible to @inikulin. The current maintainers cannot access it, so the reports could not be filed or published as advisories here.

Security fixes

9b57bf87 High: a crash from two code units. A lone low surrogate followed by another low surrogate was decoded as a pair, and String.fromCodePoint then threw out of every parser entry point. Only a high surrogate now starts a pair. Reported by Joshua Rogers and by Anthropic.

98a4bb34 High: a crash, also through cheerio's $.html(). Serialization recursed once per DOM level, so a few KB of nesting exhausted the call stack. It now uses an explicit stack, and the output is unchanged byte for byte. Reported by SnailSploit.

ea240155 High: quadratic parse time. The SAX parser's namespace stack was shifted from the front for every element, quadratic in the nesting. It is kept at its tail. Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina.

fa1eb9b0 High: a crash, and quadratic time before it. Nested templates were closed recursively at EOF, and the template insertion-mode stack was shifted per template. Both are iterative now. Reported by SnailSploit and by the three reporters above.

20591465 High: quadratic parse time. Foster parenting scanned all preceding siblings of the table for every insertion. The reference is found without scanning. Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina.

6c705d57 High: 8,002,000 attribute records from 39 KB of input. Integration-point checks read the attribute list of every element, which the htmlparser2 adapter allocates on each call. Only annotation-xml needs it, and its list is now read once per element, as the HTML Standard decides by the start tag (rereading it on every pop took 7 s for 8,000 attributes and children; a script that edits encoding mid-parse no longer changes the verdict, stated in the commit). Reported by Anthropic; the rereads on every pop were found while reviewing this series.

0a61bd54 High: 210 ms from 35 KB, growing quadratically. adoptAttributes rebuilt the recipient's name Set for an empty merge, so repeated <html> and <body> tags without attributes were quadratic. It returns early. Tags that each add an attribute rebuilt it too (816 ms for 8,000 <html> tags), so the adapter now keeps the names between merges and re-indexes when the list changed under it; a script that renames an attribute between two merges to a name the cache has never seen is the one documented difference (stated in the commit). Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina; the merges that add attributes were found while reviewing this series.

89dceda8 High: a crash and mutation XSS. Resetting the insertion mode matched foreign elements by tag id, so an SVG select or template selected an HTML mode; a TypeError followed from 50 bytes, and a longer shape serialized into an <img onerror> absent from the tree. Foreign elements are skipped. Reported by Anthropic.

f5d58d8f High: quadratic parse time from formatting tags. Formatting tags with distinct attributes (<b a=1><b a=2>…) made every insertion into the list of active formatting elements scan the list for Noah's Ark, and formatting end tags scanned and spliced it. The list is now linked and indexed by tag and by attributes, so insertion costs the tag's attributes and removal and lookup are constant. An attribute group leaves the index with its last entry, so the index does not grow with the distinct attribute sets of the input. Reported by Liyi Zhou, Ziyue Wang, Strick Sheng, Maurice Ng and Chenchen Yu (University of Sydney), and by Anthropic.

e2901d06 High: 13–18 s from 300 KB, also through cheerio's .append(), .html() and $(). Moving a node's children (every parseFragment result out of its root, the adoption agency's furthest block) detached them one at a time from the front of the child list, quadratic in their number. The children are copied once, detached from the end and appended in order, and both bundled adapters check the last child before searching the list, as insertBefore already did; the adapter interface is unchanged. parseFragment of 100,000 <b></b>: 4.1 s → 45 ms. Reported by Anthropic.

fcce48d0 High: the reported deep-nesting quadratic. Every search of the stack of open elements cost up to its depth per token: scope checks, list items, generic end tags, insertion-mode resets, end tags in foreign content, foster parenting and the adoption agency's up to eight passes per end tag. 391 KB of nested <div>s took 23.7 s, and 256 repetitions of <b>, 255 <span><div> pairs and 33 </b> took 17.2 s from 735 KB. Once 64 elements are open, the stack indexes them by tag and counts the special elements and scope boundaries at or below each, so every search is constant per token, and the adoption agency leaves a removed element's slot free instead of shifting the stack; the two documents take 39 ms and 104 ms. Stacks that never reach 64 elements are scanned as before; a stack that does keeps the index for the rest of the parse and pays for it on every push and pop (300 nested tables parse about 20% slower). Reported by iaohkut, José Antonio Zamudio Amaya and Ravindu Lakmina; the adoption-agency and foreign-content cases were found while reviewing this series.

#1922 High: quadratic tokenizer time from a tag with many attributes. The duplicate-attribute check compared every new name with every earlier one; tags with more than 64 attributes now use a set. Reported by SameerJS6 in #1901.

53d1261c Medium: a script-stripping rewriter misses a script. When the parsed chunk was dropped between the two code points of a character reference, input after the reference was skipped: no tag events for it, while RewritingStream forwarded its raw bytes. The position is recomputed from the current buffer. Reported by Anthropic.

4bffbe64 Medium: a filter bypass once the output is embedded in a page. At EOF inside a tag, the pending text's source range covered the dropped tag, so RewritingStream forwarded an unfinished tag that no listener saw. The text now ends where the tag starts. Reported by Anthropic.

e02abba4 Medium: XSS through the rewriter. RewritingStream#emitText chose raw output from lastStartTagName, so text after </script>, before <script> or in an SVG <style> was written unescaped and entity-encoded input became live markup. It now tracks inRawText from the tokenizer state. Reported by Joshua Rogers and by Anthropic.

ac2f60d5 Medium: memory proportional to an uncapped stream. The streaming parsers kept a whole run of text as one pending token until a tag; memory grew with the stream. Completed text is flushed when a parsed chunk is dropped, with exact source ranges, in every state without an unfinished token, so a stream whose every chunk ends inside a CDATA ]], a named reference or an escaped-script < is flushed too and only the pending construct stays buffered. Reported by Liyi Zhou, Ziyue Wang, Strick Sheng, Maurice Ng and Chenchen Yu (University of Sydney); the chunks ending in a delimiter or reference were found while reviewing this series.

fd22254c Medium: mutation XSS. The adoption agency acted on an older formatting element behind a scope boundary and moved the boundary element; the serialized tree re-parsed into an <img> absent from the input. It runs on the identified element. Reported by Anthropic.

61676e2b Medium, for consumers that inspect parse5's tree and forward the original bytes. Implied end tags popped foreign elements, so a </form> closed an SVG rp and parse5 read raw text where browsers see an <img onerror>. HTML elements only. Reported by Anthropic.

b9093da5 Medium, same consumer pattern. Foreign end tags were matched with toLowerCase, which folds U+212A KELVIN SIGN to k; the wrong ancestors stayed open and parse5 hid an <img> browsers render. Matching is ASCII case-insensitive. Reported by Anthropic.

69f69313 Medium, same consumer pattern. In a fragment, an unmatched foreign end tag was dropped at the root instead of being processed with the HTML rules, so a </form> did not reset the form pointer and a later <form action=javascript:…> was missing from the fragment. Reported by Anthropic.

d5f4f129 Medium, same consumer pattern. A fragment context's SVG form ancestor was taken as the form element pointer, suppressing the fragment's HTML form. Only an HTML form qualifies. Found while reviewing this series.

48aba8cb Low: a self-closing <svg/> or <math/> left its namespace frame in the SAX simulator, so a stream of such roots grew the frame stack without bound and following content was tokenized as foreign; integration-point end tags now close only the frame their element opened. Frames also follow tree construction for svg and math inside the other foreign namespace, mglyph and malignmark in a MathML text integration point, and </p> and </br>. Found while reviewing this series.

f52fa37f Documentation. SECURITY.md now says that the current maintainers cannot see reports filed through GitHub's private vulnerability reporting, and that Tidelift is the only channel for reports.

Other changes

docs: add usage examples for four parse5 packages by @Sinkleberg in inikulin/parse5#1878

fix(plain-text): default to the standard tree adapter types by @xiehuanyi in inikulin/parse5#1883

fix(parser-stream): require parse5 ^8.1.0 by @scttcper in inikulin/parse5#1916

chore: v8.1.1 by @fb55 in inikulin/parse5#1926

New Contributors

@Sinkleberg made their first contribution in inikulin/parse5#1878

@xiehuanyi made their first contribution in inikulin/parse5#1883

@scttcper made their first contribution in inikulin/parse5#1916

Packages

parse5 8.1.1, parse5-sax-parser 8.0.1, parse5-html-rewriting-stream 8.1.1, parse5-htmlparser2-tree-adapter 8.0.2, parse5-parser-stream 8.1.1, parse5-plain-text-conversion-stream 8.0.1. The dependent packages require the fixed parse5.

Full Changelog: inikulin/parse5@v8.1.0...v8.1.1

... (truncated)

Commits

8eea616 chore: v8.1.1 (#1926)
fcce48d perf(parser): find open elements without scanning a deep stack
e2901d0 perf(parser): move children between nodes without shifting the list
f5d58d8 perf(parser): find and remove formatting list entries in constant time
48aba8c fix(sax-parser): enter and leave foreign namespaces where tree construction does
f52fa37 docs(security): name Tidelift as the only channel for reports
d5f4f12 fix(parser): ignore a foreign form ancestor of the fragment context
69f6931 fix(parser): process unmatched foreign end tags at the root of a fragment
b9093da fix(parser): match foreign end tags ASCII case-insensitively
61676e2 fix(parser): generate implied end tags for HTML elements only
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by fb55, a new releaser for parse5 since your current version.

Updates @aws-sdk/client-s3 from 3.1160.0 to 3.1164.0

Release notes

Sourced from @aws-sdk/client-s3's releases.

v3.1164.0

3.1164.0(2026-11-06)

Chores

util-endpoints:

update aws partitions.json (616248b7)

update aws partitions.json (4acce3eb)

endpoints: update endpoints model (aa699bbb)

models: update API models (51f69a86)

Documentation Changes

lib-sqs: add README (#8405) (c57d0cb5)

New Features

client-mediaconvert: Smart subtitling uses AWS Elemental Inference to generate captions from your content's audio, in embedded, burn-in, DVB-Sub, IMSC, SMI, SRT, teletext, TTML, or WebVTT outputs. Also fixes HEVC passthrough writing an incomplete codecs string to DASH and HLS manifests. (cfc598fc)

client-bedrock-agent: Add support for configuring searchability for metadata fields via UpdateKnowledgeBase request for Managed Knowledge Base. Once a field is marked as searchable it can be queried via query text and is factored into Managed Knowledge Base's ranking algorithm. (c980a42b)

client-connectcases: Amazon Connect Cases adds two Bulk Case Actions operations. BatchCreateRelatedItem adds a Comment-type related item to up to 100 cases per request, BatchUpdateCase updates fields ...
Description has been truncated

Bumps the minor-patch group with 28 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@cloudflare/workers-types](https://github.com/cloudflare/workerd) | `5.20261029.1` | `5.20261108.1` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.75.0` | `0.77.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.90.0` | `1.92.0` | | [wrangler](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/wrangler) | `4.156.0` | `4.158.0` | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.11.2` | `5.12.0` | | [hono](https://github.com/honojs/hono) | `4.13.14` | `4.13.17` | | [parse5](https://github.com/inikulin/parse5) | `8.0.1` | `8.1.1` | | [@aws-sdk/client-s3](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/clients/client-s3) | `3.1160.0` | `3.1164.0` | | [@slack/web-api](https://github.com/slackapi/node-slack-sdk) | `8.2.0` | `8.3.0` | | [nitropack](https://github.com/nitrojs/nitro) | `2.13.5` | `2.13.6` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.5` | `5.1.0` | | [@opentelemetry/core](https://github.com/open-telemetry/opentelemetry-js) | `3.0.0` | `3.1.0` | | [@sentry/core](https://github.com/getsentry/sentry-javascript) | `11.10.0` | `11.11.0` | | [@sentry/react](https://github.com/getsentry/sentry-javascript) | `11.10.0` | `11.11.0` | | [@tanstack/react-query](https://github.com/TanStack/query/tree/HEAD/packages/react-query) | `5.105.0` | `5.107.1` | | [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start) | `1.169.4` | `1.169.5` | | [framer-motion](https://github.com/motiondivision/motion) | `14.8.0` | `14.10.1` | | [swiper](https://github.com/nolimits4web/Swiper) | `14.3.0` | `14.4.0` | | [zustand](https://github.com/pmndrs/zustand) | `5.0.16` | `5.1.0` | | [@cloudflare/vite-plugin](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vite-plugin-cloudflare) | `1.66.0` | `1.67.0` | | [@sentry/vite-plugin](https://github.com/getsentry/sentry-javascript) | `11.10.0` | `11.11.0` | | [@tanstack/eslint-plugin-query](https://github.com/TanStack/query/tree/HEAD/packages/eslint-plugin-query) | `5.105.0` | `5.107.1` | | [@types/navermaps](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/navermaps) | `3.9.2` | `3.10.0` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.2` | `6.2.1` | | [globals](https://github.com/sindresorhus/globals) | `17.13.0` | `17.14.0` | | [oxc-transform-react](https://github.com/oxc-project/oxc/tree/HEAD/napi/transform-react) | `0.152.0` | `0.157.0` | | [sass](https://github.com/sass/dart-sass) | `1.107.0` | `1.108.1` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.5` | `8.3.6` | Updates `@cloudflare/workers-types` from 5.20261029.1 to 5.20261108.1 - [Release notes](https://github.com/cloudflare/workerd/releases) - [Changelog](https://github.com/cloudflare/workerd/blob/main/RELEASE.md) - [Commits](https://github.com/cloudflare/workerd/commits) Updates `oxfmt` from 0.75.0 to 0.77.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.77.0/npm/oxfmt) Updates `oxlint` from 1.90.0 to 1.92.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.92.0/npm/oxlint) Updates `wrangler` from 4.156.0 to 4.158.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Commits](https://github.com/cloudflare/workers-sdk/commits/wrangler@4.158.0/packages/wrangler) Updates `fast-xml-parser` from 5.11.2 to 5.12.0 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.11.2...v5.12.0) Updates `hono` from 4.13.14 to 4.13.17 - [Release notes](https://github.com/honojs/hono/releases) - [Commits](honojs/hono@v4.13.14...v4.13.17) Updates `parse5` from 8.0.1 to 8.1.1 - [Release notes](https://github.com/inikulin/parse5/releases) - [Commits](inikulin/parse5@v8.0.1...v8.1.1) Updates `@aws-sdk/client-s3` from 3.1160.0 to 3.1164.0 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/clients/client-s3/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/v3.1164.0/clients/client-s3) Updates `@slack/web-api` from 8.2.0 to 8.3.0 - [Release notes](https://github.com/slackapi/node-slack-sdk/releases) - [Commits](https://github.com/slackapi/node-slack-sdk/compare/@slack/web-api@8.2.0...@slack/web-api@8.3.0) Updates `nitropack` from 2.13.5 to 2.13.6 - [Release notes](https://github.com/nitrojs/nitro/releases) - [Changelog](https://github.com/nitrojs/nitro/blob/main/changelog.config.ts) - [Commits](nitrojs/nitro@v2.13.5...v2.13.6) Updates `vitest` from 5.0.5 to 5.1.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.1.0/packages/vitest) Updates `@opentelemetry/core` from 3.0.0 to 3.1.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v3.0.0...v3.1.0) Updates `@sentry/core` from 11.10.0 to 11.11.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@11.10.0...11.11.0) Updates `@sentry/react` from 11.10.0 to 11.11.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@11.10.0...11.11.0) Updates `@tanstack/react-query` from 5.105.0 to 5.107.1 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/react-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/react-query@5.107.1/packages/react-query) Updates `@tanstack/react-start` from 1.169.4 to 1.169.5 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-start/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-start@1.169.5/packages/react-start) Updates `framer-motion` from 14.8.0 to 14.10.1 - [Changelog](https://github.com/motiondivision/motion/blob/main/CHANGELOG.md) - [Commits](motiondivision/motion@v14.8.0...v14.10.1) Updates `swiper` from 14.3.0 to 14.4.0 - [Release notes](https://github.com/nolimits4web/Swiper/releases) - [Changelog](https://github.com/nolimits4web/swiper/blob/master/CHANGELOG.md) - [Commits](nolimits4web/swiper@v14.3.0...v14.4.0) Updates `zustand` from 5.0.16 to 5.1.0 - [Release notes](https://github.com/pmndrs/zustand/releases) - [Commits](pmndrs/zustand@v5.0.16...v5.1.0) Updates `@cloudflare/vite-plugin` from 1.66.0 to 1.67.0 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/@cloudflare/vite-plugin@1.67.0/packages/vite-plugin-cloudflare/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vite-plugin@1.67.0/packages/vite-plugin-cloudflare) Updates `@sentry/vite-plugin` from 11.10.0 to 11.11.0 - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@11.10.0...11.11.0) Updates `@tanstack/eslint-plugin-query` from 5.105.0 to 5.107.1 - [Release notes](https://github.com/TanStack/query/releases) - [Changelog](https://github.com/TanStack/query/blob/main/packages/eslint-plugin-query/CHANGELOG.md) - [Commits](https://github.com/TanStack/query/commits/@tanstack/eslint-plugin-query@5.107.1/packages/eslint-plugin-query) Updates `@types/navermaps` from 3.9.2 to 3.10.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/navermaps) Updates `@vitejs/plugin-react` from 6.1.2 to 6.2.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.2.1/packages/plugin-react) Updates `globals` from 17.13.0 to 17.14.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.13.0...v17.14.0) Updates `oxc-transform-react` from 0.152.0 to 0.157.0 - [Release notes](https://github.com/oxc-project/oxc/releases) - [Changelog](https://github.com/oxc-project/oxc/blob/main/napi/transform-react/CHANGELOG.md) - [Commits](https://github.com/oxc-project/oxc/commits/crates_v0.157.0/napi/transform-react) Updates `sass` from 1.107.0 to 1.108.1 - [Release notes](https://github.com/sass/dart-sass/releases) - [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md) - [Commits](sass/dart-sass@1.107.0...1.108.1) Updates `vite` from 8.3.5 to 8.3.6 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.6/packages/vite) --- updated-dependencies: - dependency-name: "@cloudflare/workers-types" dependency-version: 5.20261108.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: oxfmt dependency-version: 0.77.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: oxlint dependency-version: 1.92.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: wrangler dependency-version: 4.158.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: fast-xml-parser dependency-version: 5.12.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: hono dependency-version: 4.13.17 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: parse5 dependency-version: 8.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@aws-sdk/client-s3" dependency-version: 3.1164.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@slack/web-api" dependency-version: 8.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: nitropack dependency-version: 2.13.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: vitest dependency-version: 5.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@opentelemetry/core" dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@sentry/core" dependency-version: 11.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@sentry/react" dependency-version: 11.11.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@tanstack/react-query" dependency-version: 5.107.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@tanstack/react-start" dependency-version: 1.169.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-patch - dependency-name: framer-motion dependency-version: 14.10.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: swiper dependency-version: 14.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: zustand dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@cloudflare/vite-plugin" dependency-version: 1.67.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@sentry/vite-plugin" dependency-version: 11.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@tanstack/eslint-plugin-query" dependency-version: 5.107.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@types/navermaps" dependency-version: 3.10.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: "@vitejs/plugin-react" dependency-version: 6.2.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: globals dependency-version: 17.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: oxc-transform-react dependency-version: 0.157.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: sass dependency-version: 1.108.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-patch - dependency-name: vite dependency-version: 8.3.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-11-11T08:34:31Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 625699cb-7b5c-49e3-838f-51d48138fd9f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

cloudflare-workers-and-pages · 2026-11-11T08:34:37Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	koin-api	`89993fd`	Nov 12 2026, 12:13 AM

cloudflare-workers-and-pages · 2026-11-11T08:34:46Z

Deploying with Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	koin-web	`89993fd`	Nov 12 2026, 12:13 AM

cloudflare-workers-and-pages · 2026-11-11T08:35:14Z

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	`89993fd`	2026-11-12T00:12:41.780Z	View logs ↗
Build: Success ✅ View logs ↗	No Preview URL. Enable ↗	`47e210d`	2026-11-11T08:34:51.966Z	View logs ↗

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 11, 2026

SimYunSup approved these changes Nov 11, 2026

View reviewed changes

fix(web): React Compiler 의존성 호환 범위를 맞춘다

89993fd

SimYunSup approved these changes Nov 12, 2026

View reviewed changes

Navigation Menu

Repository navigation

chore: bump the minor-patch group across 1 directory with 28 updates - #73

chore: bump the minor-patch group across 1 directory with 28 updates#73
dependabot[bot] wants to merge 2 commits into
developfrom
dependabot/npm_and_yarn/minor-patch-d6cfbf3c8b

dependabot Bot commented on behalf of github Nov 11, 2026

Uh oh!

coderabbitai Bot commented Nov 11, 2026 •

edited

Loading

Review skipped

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 11, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 11, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 11, 2026 •

edited

Loading

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Dependency	From	To
`@cloudflare/workers-types`	^5.20261103.1	^5.20261104.1
workerd	1.20261103.1	1.20261104.1

Conversation

dependabot Bot commented on behalf of github Nov 11, 2026

oxfmt v0.77.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

⚡ Performance

oxfmt v0.76.0

💥 BREAKING CHANGES

🚀 Features

🐛 Bug Fixes

oxlint v1.92.0

🚀 Features

🐛 Bug Fixes

⚡ Performance

oxlint v1.91.0

🚀 Features

🐛 Bug Fixes

⚡ Performance

[1.92.0] - 2026-11-06

🚀 Features

[1.91.0] - 2026-11-02

🚀 Features

wrangler@4.158.0

Minor Changes

Patch Changes

v5.12.0

What's Changed

New Contributors

v4.13.17

What's Changed

v4.13.16

Security fixes

mount() and app.mount() can forward a path that bypasses middleware scoped inside the mount prefix

RegExpRouter skips wildcard middleware for certain route patterns and for paths with an encoded line terminator

validator('form') skips validation for multipart/form-data requests with extra parameters

css helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

csrf() does not check requests sent by hyperlink auditing (text/ping)

v8.1.1

Security fixes

Other changes

New Contributors

Packages

v3.1164.0

3.1164.0(2026-11-06)

Chores

Documentation Changes

New Features

Uh oh!

coderabbitai Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying with Cloudflare Workers

Uh oh!

cloudflare-workers-and-pages Bot commented Nov 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix

`validator('form')` skips validation for `multipart/form-data` requests with extra parameters

`css` helper does not escape a closing tag assembled from template parts and values, allowing HTML injection

`csrf()` does not check requests sent by hyperlink auditing (`text/ping`)

coderabbitai Bot commented Nov 11, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Nov 11, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Nov 11, 2026 •

edited

Loading

cloudflare-workers-and-pages Bot commented Nov 11, 2026 •

edited

Loading