Bump the npm_and_yarn group across 21 directories with 15 updates

[dependabot]

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package	From	To
danger	11.2.3	13.0.8
undici	5.28.4	6.28.1
electron	23.1.2	41.10.6
immutable	4.0.0-rc.12	4.3.9
adm-zip	0.4.13	0.4.16
browserslist	4.8.5	4.29.3
nanoid	3.3.7	3.3.19

Bumps the npm_and_yarn group with 5 updates in the /compiler directory:

Package	From	To
undici	6.23.0	6.29.0
browserslist	4.24.4	4.29.3
js-yaml	3.14.1	3.15.2
qs	6.14.0	6.16.0
joi	17.13.1	17.13.8

Bumps the npm_and_yarn group with 6 updates in the /compiler/apps/playground directory:

Package	From	To
browserslist	4.24.0	4.29.3
js-yaml	4.1.0	4.3.2
nanoid	3.3.7	3.3.19
joi	17.13.3	17.13.8
next	15.5.9	15.5.24
sharp	0.34.3	0.35.5

Bumps the npm_and_yarn group with 1 update in the /compiler/packages/react-forgive/server directory: browserslist.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/art directory: browserslist and qs.
Bumps the npm_and_yarn group with 1 update in the /fixtures/eslint-v6 directory: js-yaml.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/eslint-v7 directory: js-yaml and fast-uri.
Bumps the npm_and_yarn group with 1 update in the /fixtures/eslint-v8 directory: js-yaml.
Bumps the npm_and_yarn group with 1 update in the /fixtures/eslint-v9 directory: js-yaml.
Bumps the npm_and_yarn group with 1 update in the /fixtures/fizz directory: browserslist.
Bumps the npm_and_yarn group with 5 updates in the /fixtures/flight directory:

Package	From	To
undici	5.28.4	6.28.1
browserslist	4.21.3	4.28.7
js-yaml	3.13.1	3.15.2
nanoid	3.3.4	3.3.19
colord	2.9.3	2.10.0

Bumps the npm_and_yarn group with 2 updates in the /fixtures/flight-parcel directory: browserslist and js-yaml.
Bumps the npm_and_yarn group with 3 updates in the /fixtures/flight-ssr-bench directory: browserslist, fast-uri and baseline-browser-mapping.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/legacy-jsx-runtimes directory: browserslist and js-yaml.
Bumps the npm_and_yarn group with 4 updates in the /fixtures/owner-stacks directory: browserslist, nanoid, fast-uri and colord.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/webpack-alias/dev directory: qs.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/webpack-alias/prod directory: qs.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/webpack/dev directory: qs.
Bumps the npm_and_yarn group with 1 update in the /fixtures/packaging/webpack/prod directory: qs.
Bumps the npm_and_yarn group with 2 updates in the /fixtures/ssr2 directory: browserslist and qs.
Bumps the npm_and_yarn group with 4 updates in the /fixtures/view-transition directory: browserslist, nanoid, fast-uri and colord.

Updates danger from 11.2.3 to 13.0.8

Release notes

Sourced from danger's releases.

Release 13.0.8

No release notes provided.

Release 13.0.5

No release notes provided.

Release 13.0.4

---

Fun sidenote, it's been exactly a year and we had to update the node version etc

Release 12.3.4

No release notes provided.

Release 12.3.3

No release notes provided.

Release 12.3.2

No release notes provided.

Release 12.3.1

No release notes provided.

Release 12.3.0

No release notes provided.

Release 12.2.1

No release notes provided.

Release 12.2.0

No release notes provided.

Release 12.1.0

It's been 7 years since I looked at danger init and err, the world of CI has changed quite a bit since then. So, Danger JS's init command now knows that GitHub Actions exists and will correctly offer some advice on how to set up a Dangerfile for it. - [@​orta]

---

12.0.1

Bumping to 12.x because we've raised the minimum to node version from 14 to 18. This is due to some of our dependencies requiring a newer version of node. This is a breaking change for some folk! Also, 14 has been out of support for quite a while now and Node 18 gives us a full year. - [@​orta]

• Remove the user checks in GitHub comment/inline comment lookups, to allow using app tokens #1433 - [@​orta]
• Upgrade node engine from >=14.13.1 to >=18 [@​heltoft]
• Upgrade @types/node from ^10.11.3 to 18.19.18 [@​heltoft]
• GitLab: #1386 Move from @gitbeaker/node to @gitbeaker/rest [@​heltoft]

... (truncated)

Changelog

Sourced from danger's changelog.

Main

The Docker image behind the Danger GitHub Action now runs on node 22 instead of node 20. The image had stopped building entirely after the recent binary changes, so this gets the action publishing again. - [@​orta]

14.0.7

The Docker image behind the Danger GitHub Action now runs on node 22 instead of node 20. The image had stopped building entirely after the recent binary changes, so this gets the action publishing again. - [@​orta]

14.0.6

The prebuilt macOS binaries (what brew install danger/tap/danger-js gives you) now embed node 24 instead of node 18. Those binaries ship their own copy of node, and the old one was too old for the networking library Danger uses, so every call to GitHub failed with TypeError: terminated. They work again. - [@​orta]

14.0.0-5

Release faff as I migrate to OIDC deploys for danger - orta

14.0.0

Danger now installs undici 7 by default. undici is what Danger uses to talk to GitHub, GitLab and Bitbucket, and version 7 requires node 20.18.1 or newer — so for most people that is Danger's new effective minimum. Node 18 has not been dropped: you can pin undici back to the 6.x line yourself and everything keeps working. - [@​orta]

The reason for the switch is that it puts you in control of your own undici version. Previously Danger pinned undici to the 6.x line, so if a security advisory landed you had to wait for a Danger release to pick up the fix. undici is now an optional peer dependency accepting ^6.28.0 || ^7, which means moving it in either direction is a supported thing to do rather than a workaround.

• github.reviews now reports the review states GitHub actually sends, so checking for a review that requested changes works - fixes #1443 [@​Socialpranker]

... (truncated)

Commits

• 58355dc Release 13.0.8
• ed3f089 Fix up the JSON schema process which was blocking deploys
• 4ea156e Merge pull request #1513 from danger/danger-exec
• 087a729 Adds a fix for a potential local shell execution based on a filename - thanks...
• a9f198a Merge pull request #1509 from glensc/build-sequence
• af06dbf Merge branch 'main' into build-sequence
• 0a438e3 Merge pull request #1508 from glensc/scripts-fail
• e3be890 Move chmod danger.js to build
• 58e96f3 Use && to fail on scripts on error
• d38955b Note otp
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates undici from 5.28.4 to 6.28.1

Release notes

Sourced from undici's releases.

v6.28.1

⚠️ Security fixes

High severity

• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

• perf: reduce EventSourceStream parser allocations (#5032) by @​mcollina in nodejs/undici#5647
• [v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @​mcollina in nodejs/undici#5770

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

v6.28.0

⚠️ Security fixes

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

... (truncated)

Commits

• ffc8aa0 Bumped v6.28.1 (#5773)
• 3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
• ce31bc8 fix(retry): validate resumed response framing
• 2af0faf fix(websocket): reject unrequested subprotocols
• 07c60d9 fix(websocket): destroy inflater after decompression limit
• bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
• 01a912e Bumped v6.28.0 (#5591)
• 481ecfc Use Node 22 and npm 11 to release
• 740a0b7 fix: validate blob body content type
• 2698e49 fix: validate coerced header values for CRLF (#5579)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for undici since your current version.

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates electron from 23.1.2 to 41.10.6

Release notes

Sourced from electron's releases.

electron v41.10.6

Release Notes for v41.10.6

Fixes

• Fixed registerFileProtocol and registerHttpProtocol returning readable responses to cross-origin no-cors fetches; they now return opaque responses like protocol.handle. #52854 (Also in 42, 43, 44)
• Fixed an issue on Windows where the app process could fail to exit after app.quit() while a shell.openExternal() or shell.openPath() call was still waiting on a system "Open with" dialog. #52899 (Also in 43, 44)
• Fixed windows opened by a sandboxed top-level frame not inheriting the opener's sandbox restrictions. #52849 (Also in 42, 43, 44)
• <webview> and window.open now inherit nodeIntegrationInWorker from the embedder, consistent with the other Node and sandbox preferences. #52829 (Also in 42, 43, 44)

Other Changes

• Backported fixes from upstream ANGLE, Chromium and Skia. #52707
• Backported fixes from upstream Chromium and V8. #52775

electron v41.10.5

Release Notes for v41.10.5

Fixes

• Fixed an issue where the Squirrel.Mac installer could resolve the target bundle path to different locations at different stages of an install. #50764 (Also in 39, 42)

Other Changes

• Backported fixes from upstream ANGLE, Chromium, Skia and V8. #52702
• No user-facing change; semver/none. #52734

electron v41.10.4

Release Notes for v41.10.4

Fixes

• Fixed a UAF with protocol.registerStreamProtocol when an error is emitted during a read. #52513 (Also in 42, 43, 44)
• Fixed a crash that could occur when closing DevTools while the host WebContents was being destroyed. #52512 (Also in 42, 43, 44)
• Windows opened from links inside a sandboxed iframe now inherit the iframe's sandbox restrictions unless allow-popups-to-escape-sandbox is set. #52486 (Also in 42, 43)

electron v41.10.3

Release Notes for v41.10.3

Fixes

• Fixed app.disableHardwareAcceleration() not fully disabling GPU hardware usage on Windows starting from Electron 38. #52368 (Also in 42, 43, 44)
• Fixed unnecessary autofill popup creation for fields without datalist suggestions, which could cause input latency on macOS. #52320 (Also in 42, 43, 44)

Other Changes

• Backported fixes from upstream Chromium and V8. #52396

electron v41.10.2

Release Notes for v41.10.2

Fixes

... (truncated)

Commits

• 832e70a fix: don't let pending shell operations block app exit on Windows (#52899)
• b8d49a4 chore: cherry-pick 39 changes from angle, chromium and skia (#52707)
• 29fc130 fix: inherit sandbox flags in windows opened by a sandboxed top-level frame (...
• c595b05 fix: return opaque responses from file and http protocol handlers for cross-o...
• 6462a2e fix: inherit nodeIntegrationInWorker from the embedder for <webview> and wind...
• d9c6215 chore: cherry-pick 4 changes from chromium and v8 (#52775)
• a46a5af build: run the Windows builds on the VM runners (41-x-y) (#52770)
• 5bff19c build: add release-assets.json expected-asset manifest (41-x-y) (#52734)
• 15e2928 fix: resolve target bundle path once at start of install (#50764)
• 2ba8050 chore: cherry-pick 33 changes from angle, chromium, skia and v8 (#52702)
• Additional commits viewable in compare view

Updates immutable from 4.0.0-rc.12 to 4.3.9

Release notes

Sourced from immutable's releases.

v4.3.9

What's changed

• fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735
• perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

Full Changelog: immutable-js/immutable-js@v4.3.8...v4.3.9

v4.3.8

Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

v4.3.7

What's Changed

• Fix issue with slice negative of filtered sequence by @​jdeniau in immutable-js/immutable-js#2006

Full Changelog: immutable-js/immutable-js@v4.3.6...v4.3.7

v4.3.6

What's Changed

• Fix Repeat().equals(undefined) incorrectly returning true by @​butchler in immutable-js/immutable-js#1994

Internals

• change youtube image by @​jdeniau in immutable-js/immutable-js#1973
• Upgrade eslint and ignore no-constructor-return rule for actual constructors by @​jdeniau in immutable-js/immutable-js#1974
• upgrate documentation website to next 14 by @​jdeniau in immutable-js/immutable-js#1975
• start migrating to nextjs app router by @​jdeniau in immutable-js/immutable-js#1976
• upgrade next sitemap by @​jdeniau in immutable-js/immutable-js#1978

New Contributors

• @​butchler made their first contribution in immutable-js/immutable-js#1994

Full Changelog: immutable-js/immutable-js@v4.3.5...v4.3.6

v4.3.5

What's Changed

• Fix Set.fromKeys types with Map constructor in TS 5.0 by @​jdeniau in immutable-js/immutable-js#1971
• upgrade to TS 5.1 by @​jdeniau in immutable-js/immutable-js#1972
• fix dist-stats command by @​jdeniau in immutable-js/immutable-js#1964
• fix Read the Docs link on readme by @​joshding in immutable-js/immutable-js#1970

New Contributors

• @​joshding made their first contribution in immutable-js/immutable-js#1970

Full Changelog: immutable-js/immutable-js@v4.3.4...v4.3.5

4.3.4

What's Changed

• Rollback toJS type due to circular reference error by @​jdeniau in immutable-js/immutable-js#1958

... (truncated)

Changelog

Sourced from immutable's changelog.

4.3.9

• fix(List): guard oversized bounds in setListBounds. Fixes CVE GHSA-v56q-mh7h-f735
• perf(Map): index large hash-collision buckets for faster lookups. Fixes CVE GHSA-xvcm-6775-5m9r

5.1.7

• fix(Repeat): lastIndexOf returned size instead of size - 1 by @​chatman-media in immutable-js/immutable-js#2227. Fixes CVE CVE-2026-29063
• fix(IndexedCollection): has(index) on a lazy Seq of unknown size now checks index existence instead of searching for a value equal to the index #2203
• [TypeScript]: reduce/reduceRight without an initial value now infer the result type from the collection's values when the reducer returns a value (e.g. list.reduce((a, b) => a + b) infers number), matching Array#reduce. Previously an explicit type argument was required. #2205

5.1.6

• fix(reverseFactory): read reversedSequence.size in __iterator instead of this #2196

5.1.5

• Fix Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in immutable

5.1.4

• Migrate some files to TS by @​jdeniau in immutable-js/immutable-js#2125
  • Iterator.ts
  • PairSorting.ts
  • toJS.ts
  • Math.ts
  • Hash.ts
• Extract CollectionHelperMethods and convert to TS by @​jdeniau in immutable-js/immutable-js#2131
• Use npm trusted publishing only to avoid token stealing.

Documentation

• Fix/a11y issues by @​lyannel in immutable-js/immutable-js#2136
• Doc add Map.get signature update by @​borracciaBlu in immutable-js/immutable-js#2138
• fix(doc):minor-issues#2132 by @​JayMeDotDot in immutable-js/immutable-js#2133
• Fix algolia search by @​jdeniau in immutable-js/immutable-js#2135
• Typo in OrderedMap by @​jdeniau in immutable-js/immutable-js#2144

Internal

• chore: Sort all imports and activate eslint import rule by @​jdeniau in immutable-js/immutable-js#2119

5.1.3

TypeScript

• fix: allow readonly map entry constructor by @​septs in immutable-js/immutable-js#2123

Documentation

... (truncated)

Commits

• 5da7919 4.3.9
• 794a1a9 Merge commit from fork
• 3dd7e56 perf(Map): index large hash-collision buckets for faster lookups
• 62d0b58 fix ts in tests
• 8c0e5f8 Merge commit from fork
• f0bc997 Merge commit from fork
• 8ac83f4 change tag
• f7373e5 use id-token to deploy 4.x version
• 2f545ad changelog
• 485cbe0 4.3.8
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for immutable since your current version.

Updates adm-zip from 0.4.13 to 0.4.16

Changelog

Sourced from adm-zip's changelog.

0.4.16 / 2020-06-23

• Updated mocha version to fix vulnerability (cthackers)
• Update project version (cthackers)
• fix: throw real exception objects on error (Matthew Sainsbury)
• Version number incremented (Saqib M)
• Update zipFile.js (Saqib M)
• Update README.md with the latest URLs (Takuya Noguchi)
• Update Node.js version to use in CI tests (Takuya Noguchi)
• process.versions is null when the library is used in browser (Emiliano Necciari)

0.4.14 / 2020-02-06

• Version increment for npm publish (cthackers)
• Iterate over entries without storing their metadata (Pierre Lehnen)
• Add partial support for zip64 (larger number of entries) (Pierre Lehnen)
• Escape $ sign for regex in addLocalFolder() (William)
• fix accent filename (mart_-)
• Removed improperly raised error while decompressing empty file asynchronously. (Nicolas Leclerc)
• fix: CRC is unexpectedly changed after zip is re-created (teppeis)

Commits

• 9d2eb0b Updated mocha version to fix vulnerability
• 9bb5fb9 Update project version
• 10a8c1c Merge pull request #250 from opichals/patch-1
• c87b983 Merge pull request #279 from willjouo/master
• de614ea Merge pull request #308 from tnir/copyedit-docs-with-https
• b94b8e5 Merge pull request #307 from tnir/update-nodejs-for-testing
• ff355f5 Merge pull request #313 from mattsains/master
• a13f520 Merge pull request #312 from saqibmushtaq/master
• 79c21ff fix: throw real exception objects on error
• 235e7bf Version number incremented
• Additional commits viewable in compare view

Updates browserslist from 4.8.5 to 4.29.3

Release notes

Sourced from browserslist's releases.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improve or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

4.28.2

• Fix prototype pollution (by @​chluo1997).

4.28.1

• Removed Baseline warning since we have it own warning.

4.27.0

• Added BROWSERSLIST_TRACE_WARNING environment variable.

4.26.3

• Fixed throwOnMissing with extends query (by @​alexander-akait).

... (truncated)

Changelog

Sourced from browserslist's changelog.

4.29.3

• Updated Firefox ESR.

4.29.2

• Fixed ignoring null usage in cover X in Y query (by @​wahidrizka).

4.29.1

• Fixed config name loading protection on Windows (by @​oss-security-shop).
• Fixed case-insensitive negation queries (by @​jakezwang).
• Fixed percentage and supports queries case-insensitive (by @​wahidrizka).
• Fixed old Node.js tests (by @​aaron-belenky).
• Reduced code (by @​charmander).

4.29.0

• Added query continuations across lines and array entries (by @​fzlzjerry).

4.28.9

• Improved or parsing performance (by @​NotAFlightRisk).

4.28.8

• Fixed including kaios in baseline queries (by @​Jaybhade).

4.28.7

• Improved parsing performance.
• Fixed unbounded memory growth (by @​alanturing881).
• Fixed prototype write issue (by @​alanturing881).

4.28.6

• Fixed Electron version queries (by @​spokodev).

4.28.5

• Fixed > and >= queries (by @​spokodev).

4.28.4

• Fixed SyntaxError regression of 4.28.3.

4.28.3

• Fixed baseline query case-insensitivity (by @​swwind).

... (truncated)

Commits

• b4809dd Release 4.29.3 version
• 9d844f8 Update Firefox ESR
• 0033f34 Update dependencies
• 906d329 Release 4.29.2 version
• ff8c83f Update dependencies
• 067f4a1 Merge pull request #952 from wahidrizka/fix-cover-null-usage
• f760921 Do not add versions without usage data to cover queries
• 5be63f5 Merge pull request #953 from wahidrizka/docs-android-latest-version
• 1e5356f Note that Android version queries return only the latest version
• 5b7e941 Add missed changes to ChangeLog
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for browserslist since your current version.

Updates nanoid from 3.3.7 to 3.3.19

Release notes

Sourced from nanoid's releases.

3.3.19

• Fixed killing the app by setting huge user ID.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

3.3.16

• Fixed infinite loop on negative size (by @​greymoth-jp).

3.3.15

• Fixed npm provenance error.

3.3.14

• Fixed random pool corruption on big ID sizes.

3.3.13

• Reduced npm package size.

3.3.12

• Fixed breaking Nano ID by requesting big ID.

3.3.11

• Fixed React Native support.

3.3.10

• Fixed React Native support (by @​steida).

3.3.9

• Reduced npm package size.

Changelog

Sourced from nanoid's changelog.

3.3.19

• Fixed killing the app by setting huge user ID (by @​geoffrey-diederichs).

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

3.3.16

• Fixed infinite loop on negative size (by @​greymoth-jp).

3.3.15

• Fixed npm provenance error.

3.3.14

• Fixed random pool corruption on big ID sizes.

3.3.13

• Reduced npm package size.

3.3.12

• Fixed breaking Nano ID by requesting big ID.

3.3.11

• Fixed React Native support.

3.3.10

• Fixed React Native support (by @​steida).

3.3.9

• Reduced npm package size.

3.3.8

• Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

Commits

• eb63bd6 Release 3.3.19 version
• 9067e03 Sync CJS and ESM
• 9ad9805 Release 3.3.18 version
• 55e50a0 Update CI action
• e10f8d4 Update index.native.js (#606)
• 73d6716 Release 3.3.17 version
• f9d13f1 Sync 0 size behaviour with PostCSS 5
• 9760e11 Release 3.3.16 version
• e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
• 96dd086 Update CI action
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates undici from 6.23.0 to 6.29.0

Release notes

Sourced from undici's releases.

v6.28.1

⚠️ Security fixes

High severity

• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

• perf: reduce EventSourceStream parser allocations (#5032) by @​mcollina in nodejs/undici#5647
• [v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @​mcollina in nodejs/undici#5770

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

v6.28.0

⚠️ Security fixes

• GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 740a0b7c.
• GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by cba3a52a, with corrected fixtures in 4fd5a0c6.
• GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by af748404.

GHSA-4cwx-7wf7-3272 and GHSA-jr45-8vmc-qm54 affect the cache interceptor in Undici v7 and v8; Undici v6 is not in their affected version ranges.

Full Changelog: nodejs/undici@v6.27.0...v6.28.0

v6.27.0

⚠️ Security Release

This release line addresses 4 security advisories.

Action required: Upgrade to undici 6.27.0 or later.

npm install undici@^6.27.0

Note on patched version: the v6 fixes shipped in v6.27.0, not 6.26.0 — v6.26.0 contains only the chunked-EOF fix (#5308) and the version bump, none of the security fixes below.

... (truncated)

Commits

• ffc8aa0 Bumped v6.28.1 (#5773)
• 3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
• ce31bc8 fix(retry): validate resumed response framing
• 2af0faf fix(websocket): reject unrequested subprotocols
• 07c60d9 fix(websocket): destroy inflater after decompression limit
• bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
• 01a912e Bumped v6.28.0 (#5591)
• 481ecfc Use Node 22 and npm 11 to release