⬆️ Bump the npm_and_yarn group across 6 directories with 15 updates

[dependabot]

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package	From	To
vite	6.3.6	6.4.3
@astrojs/rss	4.0.11	4.0.19
astro	5.14.1	7.1.1
brace-expansion	2.0.2	2.1.4
fast-uri	3.0.6	3.1.6
follow-redirects	1.15.11	1.16.0
sharp	0.34.4	0.35.3

Bumps the npm_and_yarn group with 2 updates in the /hub/graphql-mesh directory: brace-expansion and js-yaml.
Bumps the npm_and_yarn group with 3 updates in the /hub/tldraw/src directory: vite, linkify-it and markdown-it.
Bumps the npm_and_yarn group with 1 update in the /packages/app directory: vite.
Bumps the npm_and_yarn group with 1 update in the /packages/scripts directory: brace-expansion.
Bumps the npm_and_yarn group with 5 updates in the /packages/website directory:

Package	From	To
@astrojs/rss	4.0.11	4.0.19
astro	5.4.2	7.1.1
brace-expansion	2.0.1	2.1.4
fast-uri	3.0.3	3.1.6
follow-redirects	1.15.9	1.16.0

Updates vite from 6.3.6 to 6.4.3

Release notes

Sourced from vite's releases.

v6.4.3

Please refer to CHANGELOG.md for details.

v6.4.2

Please refer to CHANGELOG.md for details.

v6.4.1

Please refer to CHANGELOG.md for details.

v6.4.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

6.4.3 (2026-06-01)

• fix: backport #22572, reject windows alternate paths (#22576) (96b0c10), closes #22572 #22576
• fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#22575) (8fed5cf), closes #22571 #22575

6.4.2 (2026-04-06)

• fix: apply server.fs check to env transport (#22159) (#22163) (fe28e47), closes #22159 #22163
• fix: avoid path traversal with optimize deps sourcemap handler (#22161) (ca4da5d), closes #22161

6.4.1 (2025-10-20)

• fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969) (1114b5d), closes #20968 #20969

6.4.0 (2025-10-15)

• feat: allow passing down resolved config to vite's createServer (#20932) (ca6455e), closes #20932

6.3.7 (2025-10-14)

• fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (#20940) (c59a222), closes #20940

Commits

• 6c2c881 release: v6.4.3
• 96b0c10 fix: backport #22572, reject windows alternate paths (#22576)
• 8fed5cf fix(deps): backport #22571, reject UNC paths for launch-editor-middleware (#2...
• 6b3fad0 release: v6.4.2
• ca4da5d fix: avoid path traversal with optimize deps sourcemap handler (#22161)
• fe28e47 fix: apply server.fs check to env transport (#22159) (#22163)
• 5487f4f release: v6.4.1
• 1114b5d fix(dev): trim trailing slash before server.fs.deny check (#20968) (#20969)
• f12697c release: v6.4.0
• ca6455e feat: allow passing down resolved config to vite's createServer (#20932)
• Additional commits viewable in compare view

Updates @astrojs/rss from 4.0.11 to 4.0.19

Changelog

Sourced from @​astrojs/rss's changelog.

4.0.19

Patch Changes

• #17209 fbcfa03 Thanks @​matthewp! - Hardens RSS feed generation by escaping the source and enclosure item fields. These fields are now serialized as structured XML values, ensuring that special characters in values like source.title and enclosure.type are always treated as text rather than markup, consistent with how other feed fields are handled.

4.0.18

Patch Changes

• #16037 fdd2c5a Thanks @​blimmer! - Unpin fast-xml-parser to ^5.5.7 to resolve entity expansion CVEs

4.0.17

Patch Changes

• #15830 8d3f3aa Thanks @​Princesseuh! - Pin fast-xml-parser to 5.4.1 in order to fix an upstream bug

4.0.16

Patch Changes

• #15187 bbb5811 Thanks @​matthewp! - Update to Astro 6 beta

• #14956 0ff51df Thanks @​matthewp! - Updates usage of zod to own dependency rather than relying on astro/zod

• #15561 413b0f7 Thanks @​renovate! - Updates fast-xml-parser to v5.3.6

• #15283 daf41c6 Thanks @​eldair! - Updates validation to use Zod v4

• #15373 14252b2 Thanks @​renovate! - Updates zod to v4

4.0.15-beta.4

Patch Changes

• #15561 413b0f7 Thanks @​renovate! - Updates fast-xml-parser to v5.3.6

4.0.15-beta.3

Patch Changes

• #15373 14252b2 Thanks @​renovate! - Updates zod to v4

4.0.15-beta.2

Patch Changes

• #15283 daf41c6 Thanks @​eldair! - Updates validation to use Zod v4

... (truncated)

Commits

• 5978993 [ci] release (#17213)
• 2bfb179 chore: simpler package.json types (#17229)
• fbcfa03 Escape source and enclosure fields in RSS feed generation (#17209)
• 5a8cd09 refactor: update tsconfig to use TypeScript project references (#16505)
• 46633f5 refactor(create-astro): migrate tests to typescript (#16400)
• 747a5b3 refactor: migrate astro-rss tests to typescript (#16357)
• 88fcc98 fix integrations links across docs (#16098)
• 4a6ff2a [ci] release (#16020)
• fdd2c5a fix(rss): unpin fast-xml-parser to resolve entity expansion CVEs (#16037)
• a2fff74 [ci] release (#15826)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​astrojs/rss since your current version.

Updates astro from 5.14.1 to 7.1.1

Release notes

Sourced from astro's releases.

astro@7.1.1

Patch Changes

• #17399 4b03702 Thanks @​matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

astro@7.1.0

Minor Changes

• #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

  When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

  This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

  // src/content.config.ts
  import { defineCollection } from 'astro:content';
  import { glob } from 'astro/loaders';
  const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
  });

  By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

• #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

  By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

  Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  collectionStorage: 'chunked',
  },
  });

  Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

• #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

  Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

  Scoping sources and hashes in your config

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.1

Patch Changes

• #17399 4b03702 Thanks @​matthewp! - Fixes encoded request paths being routed incorrectly when using domain-based i18n

7.1.0

Minor Changes

• #17302 5f4dc03 Thanks @​astrobot-houston! - Adds a new deferRender option to the glob() content loader

  When set to true, renderable entries (such as Markdown) are not rendered during content sync. Instead, rendering is deferred until the entry is actually rendered in a page, using the same on-demand path that .mdx files already use.

  This reduces memory usage during astro build for large collections whose rendered output is much larger than the source — for example, Markdown that uses heavy rehype plugins like rehype-katex. Such builds could previously run out of memory while storing the eagerly-rendered HTML for every entry.

  // src/content.config.ts
  import { defineCollection } from 'astro:content';
  import { glob } from 'astro/loaders';
  const docs = defineCollection({
  loader: glob({ pattern: '**/*.md', base: 'src/content/docs', deferRender: true }),
  });

  By default deferRender is false, preserving the existing behavior of rendering entries eagerly during sync so their rendered HTML can be cached across builds.

• #17296 30698a2 Thanks @​ematipico! - Adds a new experimental collectionStorage option for controlling how the content layer persists its data store

  By default, Astro serializes the entire content layer data store to a single file (.astro/data-store.json). For very large content collections, this file can grow large enough to hit platform file-size limits.

  Set experimental.collectionStorage: 'chunked' to instead split the data store across many smaller, content-addressed files inside a .astro/data-store/ directory, described by a manifest:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  collectionStorage: 'chunked',
  },
  });

  Because each part file is named by a hash of its contents, unchanged parts keep the same name across builds and are not rewritten, and identical parts are deduplicated. The default value is 'single-file', which preserves the current behavior.

• #17214 44c4989 Thanks @​ematipico! - Adds support for the more specific CSP directives script-src-elem, script-src-attr, style-src-elem, and style-src-attr through a new kind option.

  Previously, CSP was only scoped to generic script-src/style-src directives. Now each source or hash can be scoped to a narrower directive — for example, to allow inline style attributes (such as those from define:vars or Shiki) without loosening the policy for your <style> and <link> elements.

... (truncated)

Commits

• 91c645a [ci] release (#17403)
• 4b03702 Normalize domain-based i18n request paths consistently (#17399)
• fdd673c [ci] release (#17387)
• d9f99e1 Preserve CSP resource defaults for element directives (#17394)
• 092da56 Add more escaping for rendered content (#17393)
• 186a1e7 fix(logger): allows setting in updateConfig() (#17391)
• 4407483 fix(logger): use console API in JSON logger for cross-runtime compatibility...
• 16de021 feat(logger): allow passing entrypoint as URL (#17389)
• ed71eaf fix(logger): make AstroLoggerDestination not generic (#17390)
• 30698a2 feat: chunk data store (#17296)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for astro since your current version.

Updates brace-expansion from 2.0.2 to 2.1.4

Release notes

Sourced from brace-expansion's releases.

v2.1.1

• Backport v5.0.6 change to v2 (#109) c3a817c

---

juliangruber/brace-expansion@v2.1.0...v2.1.1

Commits

• b25213d 2.1.4
• 1e30c93 Merge commit from fork
• 878df39 2.1.3
• c8bd93c npm ignore .claude
• d13ff45 fix: backport GHSA-mh99-v99m-4gvg (#130)
• 9e67a3b 2.1.2
• 835d6be fix: v2 backport for CVE-2026-13149 (#123)
• 64b71d3 2.1.1
• c3a817c Backport v5.0.6 change to v2 (#109)
• 1ee4a90 2.1.0
• Additional commits viewable in compare view

Updates devalue from 5.3.2 to 5.9.1

Release notes

Sourced from devalue's releases.

v5.9.1

Patch Changes

• 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
• 686e379: fix: emit valid JS for Node Buffer in uneval
• 376b65c: fix: preserve -0 in float typed arrays in uneval

v5.9.0

Minor Changes

• 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
• 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
• 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

v5.8.2

Patch Changes

• 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
• cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
• 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
• 8c0db06: fix: serialize Temporal values referenced more than once in uneval
• 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
• 756265a: fix: preserve shared-reference identity for Map keys in uneval
• faa8a05: fix: emit uneval reconstructions before the statements that reference them
• 06129ad: fix: do not grow sparse arrays by one slot in uneval

v5.8.1

Patch Changes

• 206ca67: fix: force sparse arrays to allocate sparsely

v5.8.0

Minor Changes

• c5115b0: feat: add stringifyAsync for async serialization

v5.7.1

Patch Changes

• 8becc7c: fix: handle regexes consistently in uneval's value and reference formats

v5.7.0

Minor Changes

• df2e284: feat: use native alternatives to encode/decode base64
• 498656e: feat: add DataView support
• a210130: feat: whitelist Float16Array
• df2e284: feat: simplify TypedArray slices

Patch Changes

... (truncated)

Changelog

Sourced from devalue's changelog.

5.9.1

Patch Changes

• 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
• 686e379: fix: emit valid JS for Node Buffer in uneval
• 376b65c: fix: preserve -0 in float typed arrays in uneval

5.9.0

Minor Changes

• 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
• 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
• 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

5.8.2

Patch Changes

• 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
• cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
• 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
• 8c0db06: fix: serialize Temporal values referenced more than once in uneval
• 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
• 756265a: fix: preserve shared-reference identity for Map keys in uneval
• faa8a05: fix: emit uneval reconstructions before the statements that reference them
• 06129ad: fix: do not grow sparse arrays by one slot in uneval

5.8.1

Patch Changes

• 206ca67: fix: force sparse arrays to allocate sparsely

5.8.0

Minor Changes

• c5115b0: feat: add stringifyAsync for async serialization

5.7.1

Patch Changes

• 8becc7c: fix: handle regexes consistently in uneval's value and reference formats

5.7.0

Minor Changes

• df2e284: feat: use native alternatives to encode/decode base64
• 498656e: feat: add DataView support
• a210130: feat: whitelist Float16Array
• df2e284: feat: simplify TypedArray slices

Patch Changes

... (truncated)

Commits

• 3e01a6c Version Packages (#179)
• 686e379 fix: emit valid JS for Node Buffer in uneval (#175)
• 39457ce fix: uneval emits valid JS for graphs with more than 65534 repeated reference...
• 376b65c fix: preserve -0 in float typed arrays in uneval (#178)
• e82bc08 Version Packages (#174)
• 07d6a38 feat: pluggable operations for parse (#173)
• 5b53532 feat: pluggable operations for stringify (#172)
• d4e10da Version Packages (#167)
• faa8a05 fix: uneval loses a repeated typed array/DataView referenced inside a cycle (...
• 3770846 fix: emit valid JS for BigInt64Array and BigUint64Array in uneval (#171)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for devalue since your current version.

Updates fast-uri from 3.0.6 to 3.1.6

Release notes

Sourced from fast-uri's releases.

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding
• GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

v3.1.5

⚠️ Security Warning

Fix for GHSA-7p8r-x3mc-p8w7

Full Changelog: fastify/fast-uri@v3.1.4...v3.1.5

v3.1.4

⚠️ Security Release

Fix for GHSA-v2hh-gcrm-f6hx

Full Changelog: fastify/fast-uri@v3.1.3...v3.1.4

v3.1.3

⚠️ Security Release

• Fixes: GHSA-4c8g-83qw-93j6

Full Changelog: fastify/fast-uri@v3.1.2...v3.1.3

v3.1.2

⚠️ Security Release

• Fix for GHSA-v39h-62p7-jpjc

What's Changed

• Handle malformed fragment decoding as a parse error by @​mcollina in fastify/fast-uri#171

Full Changelog: fastify/fast-uri@v3.1.1...v3.1.2

v3.1.1

⚠️ Security Release

• Fix for GHSA-q3j6-qgpj-74h6

... (truncated)

Commits

• 6f970b2 Bumped v3.1.6
• d941579 fix: never run IDN canonicalization on bracketed IP literals
• c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
• 37f3417 Merge commit from fork
• 607bfbe Merge commit from fork
• ae92a4c Merge commit from fork
• 444ecda Merge commit from fork
• f1138cf fix: handle malformed URNs without throwing (#211)
• 4ebffaa fix: preserve malformed URN input (#210)
• 0819d5f fix: preserve URI component case in equality (#207)
• Additional commits viewable in compare view

Updates fast-xml-parser from 4.5.3 to 5.11.0

Release notes

Sourced from fast-xml-parser's releases.

v5.11.0

What's Changed

• add support for endIndex in node metadata (5.x edition) by @​Wain-PC in NaturalIntelligence/fast-xml-parser#850
• fix: don't crash on a closing tag with no matching opening tag by @​hdimer in NaturalIntelligence/fast-xml-parser#861

New Contributors

• @​Wain-PC made their first contribution in NaturalIntelligence/fast-xml-parser#850
• @​hdimer made their first contribution in NaturalIntelligence/fast-xml-parser#861

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0

v5.10.1

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

v5.10.0

What's Changed

• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#849
• Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#848

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

v5.9.3

What's Changed

• Harden GitHub Actions workflows by @​martincostello in NaturalIntelligence/fast-xml-parser#841
• GitHub Actions workflow fixes by @​martincostello in NaturalIntelligence/fast-xml-parser#844

New Contributors

• @​martincostello made their first contribution in NaturalIntelligence/fast-xml-parser#841

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.2...v5.9.3

v5.9.2

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.1...v5.9.2

v5.9.1

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.0...v5.9.1

update strnum, use is-unsafe

• update strnum to 2.3.0
  • you can set hex, binary, enotation, infinity, unicode
• validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

update strnum, FXB. Use xml-naming for DOCTYPE

• integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)
  • This will consider xml-version as well. '1.0' is default
• update strnum to 2.3.0
  • You can set octal and binary parsing which is by deault off
• update fast-xml-builder to 1.2.0
  • can sanitize tag names if found invalid

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.11.0 / 2026-08-16

• feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]
• fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]
• fix: DOCTYPE to read SYSTEM/PUBLIC
• deps: strnum v2.4.2

5.10.1 / 2026-07-17

• fix: multiple DOCTYPE declarations.
• deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

• upgrade:
  • xml-naming v0.3.0: cache support
  • PEM v1.6.2: sibling bug fix
  • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

• update strnum

*5.9.2 / 2026-06-17

• dummy release to test changes in github action

*5.9.1 / 2026-06-17

• dummy release to test release from github action

*5.9.0 / 2026-06-15

• update strnum to 2.3.0
  • you can set hex, binary, enotation, infinity, unicode
• validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

• integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
  • This will consider xml-version as well. '1.0' is default
• update strnum to 2.3.0
  • You can set octal and binary parsing which is bydeault off
• update fast-xml-builder to 1.2.0
  • can sanitize tag names if found invalid
  • fix format output

5.7.3 / 2006-05-05

• fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
• fix stop node expression when ns prefix is removed (found by iruizsalinas)

... (truncated)

Commits

• f3c69ae 5.11.0
• fdbd072 update for release
• c5fcb5b update lock files
• 549452a update gitignore
• 3ed7b03 deps
• fee9b15 update README
• 57ad0d3 fix DOCTYPE to read SYSTEM/PUBLIC
• c8e2f28 fix: don't crash on a closing tag with no matching opening tag (#861)
• 4652011 add support for endIndex in node metadata (#850)
• 2ce7191 5.10.1
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-xml-parser since your current version.

Updates follow-redirects from 1.15.11 to 1.16.0

Commits

• 0c23a22 Release version 1.16.0 of the npm package.
• 844c4d3 Add sensitiveHeaders option.
• 5e8b8d0 ci: add Node.js 24.x to the CI matrix
• 7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
• 86dc1f8 Sanitizing input.
• See full diff in compare view

Updates nanoid from 3.3.9 to 3.3.18

Release notes

Sourced from nanoid's releases.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

3.3.16

• Fixed infinite loop on negative size (by @​greymoth-jp).

3.3.15

• Fixed npm provenance error.

3.3.14

• Fixed random pool corruption on big ID sizes.

3.3.13

• Reduced npm package size.

3.3.12

• Fixed breaking Nano ID by requesting big ID.

3.3.11

• Fixed React Native support.

3.3.10

• Fixed React Native support (by @​steida).

Changelog

Sourced from nanoid's changelog.

3.3.18

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

3.3.17

• Fixed infinite loop on zero size.

3.3.16

• Fixed infinite loop on negative size (by @​greymoth-jp).

3.3.15

• Fixed npm provenance error.

3.3.14

• Fixed random pool corruption on big ID sizes.

3.3.13

• Reduced npm package size.

3.3.12

• Fixed breaking Nano ID by requesting big ID.

3.3.11

• Fixed React Native support.

3.3.10

• Fixed React Native support (by @​steida).

Commits

• 9ad9805 Release 3.3.18 version
• 55e50a0 Update CI action
• e10f8d4 Update index.native.js (#606)
• 73d6716 Release 3.3.17 version
• f9d13f1 Sync 0 size behaviour with PostCSS 5
• 9760e11 Release 3.3.16 version
• e835c9b fix(non-secure): clamp negative size to prevent infinite loop (#601)
• 96dd086 Update CI action
• ba0bc3b Do not create latest release for v3
• 6819724 Release 3.3.15 version
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for nanoid since your current version.

Updates postcss from 8.5.3 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).
• Fixed raws after rehydrating a JSON AST (by @​sarathfrancis90).
• Fixed putting parent-less node in nodes of new node (by @​MahinAnowar).
• Fixed computing offset in positionBy() (by @​greymoth-jp).
• Fixed rangeBy() on index: 0 (by @​sarathfrancis90).

8.5.15

• Fixed declaration parsing performance (by @​homanp).

8.5.14

• Fixed custom syntax regression (by @​43081j).

8.5.13

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1Description has been truncated