From 225d1f61e2b09f7ce86672132c26b43934a84376 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 20 Mar 2026 10:06:25 +0100
Subject: [PATCH 1/9] build(deps): bump fast-xml-parser from 5.5.6 to 5.5.7
(#387)
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.5.6 to 5.5.7.
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.5.6...v5.5.7)
---
updated-dependencies:
- dependency-name: fast-xml-parser
dependency-version: 5.5.7
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <0?X:t[r][1]}function ar(n){return Wr(this.__data__,n)>-1}function lr(n,t){var r=this.__data__,e=Wr(r,n);return e<0?(++this.size,r.push([n,t])):r[e][1]=t,this}function sr(n){var t=-1,r=null==n?0:n.length;for(this.clear();++t<"!==t[s]){if(u(t[s]))continue;return N("InvalidChar","char '"+t[s]+"' is not expected.",y(t,s))}var o=s;if("!"===t[++s]){s=d(t,s);continue}var a=!1;"/"===t[s]&&(a=!0,s++);for(var l="";s0&&"object"==typeof e&&e.updateCurrent&&e.updateCurrent(a);for(var d=0;d",s,"Closing Tag is not closed."),a=t.substring(s+2,o).trim();if(this.options.removeNSPrefix){var h=a.indexOf(":");-1!==h&&(a=a.substr(h+1))}a=ot(this.options.transformTagName,a,"",this.options).tagName,i&&(r=this.saveTextToParentTag(r,i,this.matcher));var l=this.matcher.getCurrentTag();if(a&&-1!==this.options.unpairedTags.indexOf(a))throw new Error("Unpaired tag can not be used as closing tag: "+a+">");l&&-1!==this.options.unpairedTags.indexOf(l)&&(this.matcher.pop(),this.tagsNodeStack.pop()),this.matcher.pop(),this.isCurrentNodeStopNode=!1,i=this.tagsNodeStack.pop(),r="",s=o}else if("?"===t[s+1]){var u=it(t,s,!1,"?>");if(!u)throw new Error("Pi Tag is not closed.");if(r=this.saveTextToParentTag(r,i,this.matcher),this.options.ignoreDeclaration&&"?xml"===u.tagName||this.options.ignorePiTags);else{var p=new I(u.tagName);p.add(this.options.textNodeName,""),u.tagName!==u.tagExp&&u.attrExpPresent&&(p[":@"]=this.buildAttributesMap(u.tagExp,this.matcher,u.tagName)),this.addChild(i,p,this.matcher,s)}s=u.closeIndex+1}else if("!--"===t.substr(s+1,3)){var d=et(t,"--\x3e",s+4,"Comment is not closed.");if(this.options.commentPropName){var f,c=t.substring(s+4,d-2);r=this.saveTextToParentTag(r,i,this.matcher),i.add(this.options.commentPropName,[(f={},f[this.options.textNodeName]=c,f)])}s=d}else if("!D"===t.substr(s+1,2)){var g=n.readDocType(t,s);this.docTypeEntities=g.entities,s=g.i}else if("!["===t.substr(s+1,2)){var m=et(t,"]]>",s,"CDATA is not closed.")-2,x=t.substring(s+9,m);r=this.saveTextToParentTag(r,i,this.matcher);var v,N=this.parseTextData(x,i.tagname,this.matcher,!0,!1,!0,!0);null==N&&(N=""),this.options.cdataPropName?i.add(this.options.cdataPropName,[(v={},v[this.options.textNodeName]=x,v)]):i.add(this.options.textNodeName,N),s=m+2}else{var b=it(t,s,this.options.removeNSPrefix);if(!b){var E=t.substring(Math.max(0,s-50),Math.min(t.length,s+50));throw new Error("readTagExp returned undefined at position "+s+'. Context: "'+E+'"')}var y=b.tagName,w=b.rawTagName,T=b.tagExp,S=b.attrExpPresent,P=b.closeIndex,A=ot(this.options.transformTagName,y,T,this.options);if(y=A.tagName,T=A.tagExp,this.options.strictReservedNames&&(y===this.options.commentPropName||y===this.options.cdataPropName))throw new Error("Invalid tag name: "+y);i&&r&&"!xml"!==i.tagname&&(r=this.saveTextToParentTag(r,i,this.matcher,!1));var C=i;C&&-1!==this.options.unpairedTags.indexOf(C.tagname)&&(i=this.tagsNodeStack.pop(),this.matcher.pop());var O=!1;T.length>0&&T.lastIndexOf("/")===T.length-1&&(O=!0,T="/"===y[y.length-1]?y=y.substr(0,y.length-1):T.substr(0,T.length-1),S=y!==T);var $,_=null;$=B(w),y!==e.tagname&&this.matcher.push(y,{},$),y!==T&&S&&(_=this.buildAttributesMap(T,this.matcher,y))&&U(_,this.options),y!==e.tagname&&(this.isCurrentNodeStopNode=this.isItStopNode(this.stopNodeExpressions,this.matcher));var D=s;if(this.isCurrentNodeStopNode){var V="";if(O)s=b.closeIndex;else if(-1!==this.options.unpairedTags.indexOf(y))s=b.closeIndex;else{var k=this.readStopNodeData(t,w,P+1);if(!k)throw new Error("Unexpected end of "+w);s=k.i,V=k.tagContent}var M=new I(y);_&&(M[":@"]=_),M.add(this.options.textNodeName,V),this.matcher.pop(),this.isCurrentNodeStopNode=!1,this.addChild(i,M,this.matcher,D)}else{if(O){var F=ot(this.options.transformTagName,y,T,this.options);y=F.tagName,T=F.tagExp;var L=new I(y);_&&(L[":@"]=_),this.addChild(i,L,this.matcher,D),this.matcher.pop(),this.isCurrentNodeStopNode=!1}else{if(-1!==this.options.unpairedTags.indexOf(y)){var G=new I(y);_&&(G[":@"]=_),this.addChild(i,G,this.matcher,D),this.matcher.pop(),this.isCurrentNodeStopNode=!1,s=b.closeIndex;continue}var R=new I(y);if(this.tagsNodeStack.length>this.options.maxNestedTags)throw new Error("Maximum nested tags exceeded");this.tagsNodeStack.push(i),_&&(R[":@"]=_),this.addChild(i,R,this.matcher,D),i=R}r="",s=P}}else r+=t[s];return e.child};function K(t,e,i,r){this.options.captureMetaData||(r=void 0);var n=this.options.jPath?i.toString():i,s=this.options.updateTag(e.tagname,n,e[":@"]);!1===s||("string"==typeof s?(e.tagname=s,t.addChild(e,r)):t.addChild(e,r))}function Q(t,e,i){var r=this.options.processEntities;if(!r||!r.enabled)return t;if(r.allowedTags){var n=this.options.jPath?i.toString():i;if(!(Array.isArray(r.allowedTags)?r.allowedTags.includes(e):r.allowedTags(e,n)))return t}if(r.tagFilter){var s=this.options.jPath?i.toString():i;if(!r.tagFilter(e,s))return t}for(var o=0,a=Object.keys(this.docTypeEntities);o<"!==t[s]){if(l(t[s]))continue;return b("InvalidChar","char '"+t[s]+"' is not expected.",y(t,s))}var o=s;if("!"===t[++s]){s=d(t,s);continue}var a=!1;"/"===t[s]&&(a=!0,s++);for(var u="";s0&&"object"==typeof e&&e.updateCurrent&&e.updateCurrent(a);for(var d=0;d",s,"Closing Tag is not closed."),a=t.substring(s+2,o).trim();if(this.options.removeNSPrefix){var h=a.indexOf(":");-1!==h&&(a=a.substr(h+1))}a=ot(this.options.transformTagName,a,"",this.options).tagName,i&&(r=this.saveTextToParentTag(r,i,this.matcher));var u=this.matcher.getCurrentTag();if(a&&-1!==this.options.unpairedTags.indexOf(a))throw new Error("Unpaired tag can not be used as closing tag: "+a+">");u&&-1!==this.options.unpairedTags.indexOf(u)&&(this.matcher.pop(),this.tagsNodeStack.pop()),this.matcher.pop(),this.isCurrentNodeStopNode=!1,i=this.tagsNodeStack.pop(),r="",s=o}else if("?"===t[s+1]){var l=it(t,s,!1,"?>");if(!l)throw new Error("Pi Tag is not closed.");if(r=this.saveTextToParentTag(r,i,this.matcher),this.options.ignoreDeclaration&&"?xml"===l.tagName||this.options.ignorePiTags);else{var p=new I(l.tagName);p.add(this.options.textNodeName,""),l.tagName!==l.tagExp&&l.attrExpPresent&&(p[":@"]=this.buildAttributesMap(l.tagExp,this.matcher,l.tagName)),this.addChild(i,p,this.matcher,s)}s=l.closeIndex+1}else if("!--"===t.substr(s+1,3)){var d=et(t,"--\x3e",s+4,"Comment is not closed.");if(this.options.commentPropName){var f,c=t.substring(s+4,d-2);r=this.saveTextToParentTag(r,i,this.matcher),i.add(this.options.commentPropName,[(f={},f[this.options.textNodeName]=c,f)])}s=d}else if("!D"===t.substr(s+1,2)){var g=n.readDocType(t,s);this.docTypeEntities=g.entities,s=g.i}else if("!["===t.substr(s+1,2)){var m=et(t,"]]>",s,"CDATA is not closed.")-2,x=t.substring(s+9,m);r=this.saveTextToParentTag(r,i,this.matcher);var v,b=this.parseTextData(x,i.tagname,this.matcher,!0,!1,!0,!0);null==b&&(b=""),this.options.cdataPropName?i.add(this.options.cdataPropName,[(v={},v[this.options.textNodeName]=x,v)]):i.add(this.options.textNodeName,b),s=m+2}else{var N=it(t,s,this.options.removeNSPrefix);if(!N){var E=t.substring(Math.max(0,s-50),Math.min(t.length,s+50));throw new Error("readTagExp returned undefined at position "+s+'. Context: "'+E+'"')}var y=N.tagName,w=N.rawTagName,T=N.tagExp,S=N.attrExpPresent,P=N.closeIndex,A=ot(this.options.transformTagName,y,T,this.options);if(y=A.tagName,T=A.tagExp,this.options.strictReservedNames&&(y===this.options.commentPropName||y===this.options.cdataPropName||y===this.options.textNodeName||y===this.options.attributesGroupName))throw new Error("Invalid tag name: "+y);i&&r&&"!xml"!==i.tagname&&(r=this.saveTextToParentTag(r,i,this.matcher,!1));var C=i;C&&-1!==this.options.unpairedTags.indexOf(C.tagname)&&(i=this.tagsNodeStack.pop(),this.matcher.pop());var O=!1;T.length>0&&T.lastIndexOf("/")===T.length-1&&(O=!0,T="/"===y[y.length-1]?y=y.substr(0,y.length-1):T.substr(0,T.length-1),S=y!==T);var $,_=null;$=B(w),y!==e.tagname&&this.matcher.push(y,{},$),y!==T&&S&&(_=this.buildAttributesMap(T,this.matcher,y))&&U(_,this.options),y!==e.tagname&&(this.isCurrentNodeStopNode=this.isItStopNode(this.stopNodeExpressions,this.matcher));var D=s;if(this.isCurrentNodeStopNode){var V="";if(O)s=N.closeIndex;else if(-1!==this.options.unpairedTags.indexOf(y))s=N.closeIndex;else{var k=this.readStopNodeData(t,w,P+1);if(!k)throw new Error("Unexpected end of "+w);s=k.i,V=k.tagContent}var M=new I(y);_&&(M[":@"]=_),M.add(this.options.textNodeName,V),this.matcher.pop(),this.isCurrentNodeStopNode=!1,this.addChild(i,M,this.matcher,D)}else{if(O){var F=ot(this.options.transformTagName,y,T,this.options);y=F.tagName,T=F.tagExp;var L=new I(y);_&&(L[":@"]=_),this.addChild(i,L,this.matcher,D),this.matcher.pop(),this.isCurrentNodeStopNode=!1}else{if(-1!==this.options.unpairedTags.indexOf(y)){var G=new I(y);_&&(G[":@"]=_),this.addChild(i,G,this.matcher,D),this.matcher.pop(),this.isCurrentNodeStopNode=!1,s=N.closeIndex;continue}var R=new I(y);if(this.tagsNodeStack.length>this.options.maxNestedTags)throw new Error("Maximum nested tags exceeded");this.tagsNodeStack.push(i),_&&(R[":@"]=_),this.addChild(i,R,this.matcher,D),i=R}r="",s=P}}else r+=t[s];return e.child};function K(t,e,i,r){this.options.captureMetaData||(r=void 0);var n=this.options.jPath?i.toString():i,s=this.options.updateTag(e.tagname,n,e[":@"]);!1===s||("string"==typeof s?(e.tagname=s,t.addChild(e,r)):t.addChild(e,r))}function Q(t,e,i){var r=this.options.processEntities;if(!r||!r.enabled)return t;if(r.allowedTags){var n=this.options.jPath?i.toString():i;if(!(Array.isArray(r.allowedTags)?r.allowedTags.includes(e):r.allowedTags(e,n)))return t}if(r.tagFilter){var s=this.options.jPath?i.toString():i;if(!r.tagFilter(e,s))return t}for(var o=0,a=Object.keys(this.docTypeEntities);o
Install [n_](https://www.npmjs.com/package/n_) for Lodash use in the Node.js < 6 REPL.
diff --git a/node_modules/lodash/_baseOrderBy.js b/node_modules/lodash/_baseOrderBy.js
index 775a0174..cf588c69 100644
--- a/node_modules/lodash/_baseOrderBy.js
+++ b/node_modules/lodash/_baseOrderBy.js
@@ -23,7 +23,7 @@ function baseOrderBy(collection, iteratees, orders) {
if (isArray(iteratee)) {
return function(value) {
return baseGet(value, iteratee.length === 1 ? iteratee[0] : iteratee);
- }
+ };
}
return iteratee;
});
diff --git a/node_modules/lodash/_baseUnset.js b/node_modules/lodash/_baseUnset.js
index 05aa28f0..e4eccb0a 100644
--- a/node_modules/lodash/_baseUnset.js
+++ b/node_modules/lodash/_baseUnset.js
@@ -20,7 +20,9 @@ var hasOwnProperty = objectProto.hasOwnProperty;
function baseUnset(object, path) {
path = castPath(path, object);
- // Prevent prototype pollution, see: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
+ // Prevent prototype pollution:
+ // https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
+ // https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
var index = -1,
length = path.length;
@@ -28,32 +30,17 @@ function baseUnset(object, path) {
return true;
}
- var isRootPrimitive = object == null || (typeof object !== 'object' && typeof object !== 'function');
-
while (++index < length) {
- var key = path[index];
-
- // skip non-string keys (e.g., Symbols, numbers)
- if (typeof key !== 'string') {
- continue;
- }
+ var key = toKey(path[index]);
// Always block "__proto__" anywhere in the path if it's not expected
if (key === '__proto__' && !hasOwnProperty.call(object, '__proto__')) {
return false;
}
- // Block "constructor.prototype" chains
- if (key === 'constructor' &&
- (index + 1) < length &&
- typeof path[index + 1] === 'string' &&
- path[index + 1] === 'prototype') {
-
- // Allow ONLY when the path starts at a primitive root, e.g., _.unset(0, 'constructor.prototype.a')
- if (isRootPrimitive && index === 0) {
- continue;
- }
-
+ // Block constructor/prototype as non-terminal traversal keys to prevent
+ // escaping the object graph into built-in constructors and prototypes.
+ if ((key === 'constructor' || key === 'prototype') && index < length - 1) {
return false;
}
}
diff --git a/node_modules/lodash/_setCacheHas.js b/node_modules/lodash/_setCacheHas.js
index 9a492556..2062af8f 100644
--- a/node_modules/lodash/_setCacheHas.js
+++ b/node_modules/lodash/_setCacheHas.js
@@ -5,7 +5,7 @@
* @name has
* @memberOf SetCache
* @param {*} value The value to search for.
- * @returns {number} Returns `true` if `value` is found, else `false`.
+ * @returns {boolean} Returns `true` if `value` is found, else `false`.
*/
function setCacheHas(value) {
return this.__data__.has(value);
diff --git a/node_modules/lodash/compact.js b/node_modules/lodash/compact.js
index 031fab4e..623b05d3 100644
--- a/node_modules/lodash/compact.js
+++ b/node_modules/lodash/compact.js
@@ -1,6 +1,6 @@
/**
* Creates an array with all falsey values removed. The values `false`, `null`,
- * `0`, `""`, `undefined`, and `NaN` are falsey.
+ * `0`, `-0`, `0n`, `""`, `undefined`, and `NaN` are falsy.
*
* @static
* @memberOf _
diff --git a/node_modules/lodash/core.js b/node_modules/lodash/core.js
index caf078f6..694ed51d 100644
--- a/node_modules/lodash/core.js
+++ b/node_modules/lodash/core.js
@@ -1,7 +1,7 @@
/**
* @license
* Lodash (Custom Build)