fix(deps): update dependency jsonpath-plus to v11

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
jsonpath-plus	^10.0.0 → ^11.0.0

---

Release Notes

s3u/JSONPath (jsonpath-plus)

v11.1.0

Compare Source

• fix: allow bare @ in any position (e.g., $[?(@>1)], $[?(@)],
  $[?(!@)]) and stop rewriting @ inside quoted string literals
  (@​spokodev)
• fix: support unions of quoted property names (e.g., $['x','y'],
  $["a,b",'c.d']) as literal names (fixes #​159; see #​268)
• fix: support quoted property names containing commas (e.g., $['a,b'])
• fix: support \', \", and \\ escapes within quoted property names
  and escape ' and \ in toPathString output so paths round-trip

v11.0.1

Compare Source

• fix(security) nested filter bypass exploit (@​andrewmacheret)

v11.0.0

Compare Source

BREAKING CHANGES

• Require Node >= 22; drops older browser version support

• JSONPath.cache is no longer exposed or mutable. Consumers that used JSONPath.cache
  to inspect, modify, or clear entries must remove
  that usage and call JSONPath.clearCache() when cache invalidation is needed.

• chore: bump engines and browserslist and use v flag

• chore: various changes in types, particularly with return values changing from any to unknown to ensure type safety (by forcing type casts of the results on the user).

• fix!: isolate caches and add cache reset API

Other changes:

• feat: add customTypes option for providing own other type callbacks (e.g., @blob()) (@​brettz9)
• fix(slice): explicit zero end no longer returns the whole array (#​265) (@​spokodev)
• fix: indicate that the OtherTypeCallback callback type can accept a parentPropName with type number (@​brettz9)
• fix: separate JSONPath path and script caches (@​brettz9)
• fix: restore JSONPath.prototype.evaluate, safeVm, and vm compatibility
• fix(safe-eval): harden operator lookup against prototype inheritance (@​brettz9)
• fix(security): block indirect Function-constructor access in safe eval (reported by @c0rydoras: Arthur Deierlein <info@c0rydoras.dev>)
• refactor: expose JSONPathClass prototype through JSONPath for compatibility
• docs: security notes
• test(safe-eval): guard bind() escape route for constructor access (@​brettz9)
• test: restore full test coverage (@​brettz9)
• chore: pnpm update (@​brettz9)
• refactor: implement TypeScript-as-JSDoc and auto-build declaration files from this (avoiding need for maintaining declaration file manually)
• chore: update devDeps
• chore: lint
• build(deps-dev): bump rollup from 4.53.2 to 4.59.0 (@​dependabot[bot])
• build(deps): bump minimatch from 9.0.5 to 9.0.9 (@​dependabot[bot])
• build(deps): bump serialize-javascript (via audit fix) (@​dependabot[bot])
• build(deps): bump ajv from 6.12.6 to 6.14.0 (#​253) (@​dependabot[bot])
• build(deps): bump qs from 6.14.0 to 6.14.2 (#​252) (@​dependabot[bot])
• build(deps): bump markdown-it from 14.1.0 to 14.1.1 (#​251) (@​dependabot[bot])
• build(deps): bump minimatch from 3.1.2 to 3.1.4 (#​255) (@​dependabot[bot])

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.