Skip to content

build(deps): bump jsonpath-plus from 10.4.0 to 11.1.0 - #3090

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/main/jsonpath-plus-11.1.0
Open

build(deps): bump jsonpath-plus from 10.4.0 to 11.1.0#3090
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/main/jsonpath-plus-11.1.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026

Copy link
Copy Markdown
Contributor

Bumps jsonpath-plus from 10.4.0 to 11.1.0.

Release notes

Sourced from jsonpath-plus's releases.

v10.4.1

What's Changed

New Contributors

Full Changelog: JSONPath-Plus/JSONPath@v10.4.0...v10.4.1

Changelog

Sourced from jsonpath-plus's changelog.

11.1.0

  • fix: allow bare @ in any position (e.g., $[?(@>1)], $[?(@)], $[?(!@)]) and stop rewriting @ inside quoted string literals (@​spokodev)
  • fix: support unions of quoted property names (e.g., $['x','y'], $["a,b",'c.d']) as literal names (fixes #159; see #268)
  • fix: support quoted property names containing commas (e.g., $['a,b'])
  • fix: support \', \", and \\ escapes within quoted property names and escape ' and \ in toPathString output so paths round-trip

11.0.1

11.0.0

BREAKING CHANGES

  • Require Node >= 22; drops older browser version support

  • JSONPath.cache is no longer exposed or mutable. Consumers that used JSONPath.cache to inspect, modify, or clear entries must remove that usage and call JSONPath.clearCache() when cache invalidation is needed.

  • chore: bump engines and browserslist and use v flag

  • chore: various changes in types, particularly with return values changing from any to unknown to ensure type safety (by forcing type casts of the results on the user).

  • fix!: isolate caches and add cache reset API

Other changes:

  • feat: add customTypes option for providing own other type callbacks (e.g., @blob()) (@​brettz9)
  • fix(slice): explicit zero end no longer returns the whole array (#265) (@​spokodev)
  • fix: indicate that the OtherTypeCallback callback type can accept a parentPropName with type number (@​brettz9)
  • fix: separate JSONPath path and script caches (@​brettz9)
  • fix: restore JSONPath.prototype.evaluate, safeVm, and vm compatibility
  • fix(safe-eval): harden operator lookup against prototype inheritance (@​brettz9)
  • fix(security): block indirect Function-constructor access in safe eval (reported by @c0rydoras: Arthur Deierlein <info@c0rydoras.dev>)
  • refactor: expose JSONPathClass prototype through JSONPath for compatibility
  • docs: security notes
  • test(safe-eval): guard bind() escape route for constructor access (@​brettz9)
  • test: restore full test coverage (@​brettz9)
  • chore: pnpm update (@​brettz9)
  • refactor: implement TypeScript-as-JSDoc and auto-build declaration files from this (avoiding need for maintaining declaration file manually)
  • chore: update devDeps
  • chore: lint
  • build(deps-dev): bump rollup from 4.53.2 to 4.59.0 (@​dependabot[bot])
  • build(deps): bump minimatch from 9.0.5 to 9.0.9 (@​dependabot[bot])
  • build(deps): bump serialize-javascript (via audit fix) (@​dependabot[bot])
  • build(deps): bump ajv from 6.12.6 to 6.14.0 (#253) (@​dependabot[bot])
  • build(deps): bump qs from 6.14.0 to 6.14.2 (#252) (@​dependabot[bot])

... (truncated)

Commits
  • 6451f7e chore: update build and docs
  • ceb861d fix: support unions of quoted property names (e.g., $['x','y'],
  • a54beff fix: allow bare @ in any position (e.g., $[?(@)], $[?(!@)],
  • 935c782 fix(filter): allow bare @ adjacent to an operator without whitespace
  • 3e146f7 chore: update types
  • 5658994 chore: bump version (11.0.1)
  • 8ea07f2 chore: update build and CHANGES
  • 7886251 fix(security) nested filter bypass exploit
  • 799e448 chore: update devDeps.; linting
  • 8c5173a test: update browser tests
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): bump jsonpath-plus from 10.4.0 to 11.1.0
2e26663 
Bumps [jsonpath-plus](https://github.com/s3u/JSONPath) from 10.4.0 to 11.1.0.
- [Release notes](https://github.com/s3u/JSONPath/releases)
- [Changelog](https://github.com/JSONPath-Plus/JSONPath/blob/main/CHANGES.md)
- [Commits](JSONPath-Plus/JSONPath@v10.4.0...v11.1.0)

---
updated-dependencies:
- dependency-name: jsonpath-plus
  dependency-version: 11.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Oct 5, 2026
@dependabot dependabot Bot mentioned this pull request Oct 5, 2026
Closed
@kubernetes-prow kubernetes-prow Bot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Oct 5, 2026
@kubernetes-prow

kubernetes-prow Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign cjihrig for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubernetes-prow kubernetes-prow Bot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Oct 5, 2026
@brendandburns

brendandburns commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

@copilot please fix CI/CD

@brendandburns
fix: type jsonpath auth values
19b4d54 
Co-authored-by: brendandburns <5751682+brendandburns@users.noreply.github.com>
@linux-foundation-easycla

linux-foundation-easycla Bot commented Oct 6, 2026

Copy link
Copy Markdown

CLA Not Signed

@kubernetes-prow kubernetes-prow Bot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. and removed cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Oct 6, 2026

Copilot AI commented Oct 6, 2026

Copy link
Copy Markdown
Contributor

@copilot please fix CI/CD

Fixed the CI TypeScript errors caused by jsonpath-plus 11.1.0 returning unknown; build, lint, and unit tests pass locally. Commit: 19b4d54. This commit should trigger CI again.

@dependabot @github

dependabot Bot commented on behalf of github Oct 9, 2026

Copy link
Copy Markdown
Contributor Author

A newer version of jsonpath-plus exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@brendandburns brendandburns Awaiting requested review from brendandburns
@cjihrig cjihrig Awaiting requested review from cjihrig

Assignees

No one assigned

Labels

cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@brendandburns