dec55b7\nBump main to v4.17.23 (#6088)19c9251\nfix: setCacheHas JSDoc return type should be boolean (#6071)b5e6729\njsdoc: Add -0 and BigInt zeros to _.compact falsey values list (#6062)edadd45\nPrevent prototype pollution on baseUnset function4879a7a\ndoc: fix autoLink function, conversion of source links (#6056)9648f69\nchore: remove yarn.lock file (#6053)dfa407d\nci: remove legacy configuration files (#6052)156e196\nfeat: add renovate setup (#6039)933e106\nci: add pipeline for Bun (#6023)072a807\ndocs: update links related to Open JS Foundation (#5968)Sourced from mdast-util-to-hast's\nreleases.
\n\n\n13.2.1
\nFix
\n\n
\n- ab3a795 Fix support for spaces in class names
\nTypes
\n\n
\n- efb5312 Refactor to use
\n@imports- a5bc210 Add declaration maps
\nFull Changelog: https://github.com/syntax-tree/mdast-util-to-hast/compare/13.2.0...13.2.1
\n
Sourced from node-forge's\nchangelog.
\n\n\n1.3.3 - 2025-12-02
\nFixed
\n\n
\n- [pkcs12] Make digestAlgorithm parameters optional to fix PKCS#12/PFX\nissues\nintroduced in 1.3.2.
\n1.3.2 - 2025-11-25
\nSecurity
\n\n
\n- HIGH: ASN.1 Validator Desynchronization\n
\n\n
\n- An Interpretation Conflict (CWE-436) vulnerability in node-forge\nversions\n1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1\nstructures to desynchronize schema validations, yielding a semantic\ndivergence that may bypass downstream cryptographic verifications and\nsecurity decisions.
\n- Reported by Hunter Wodzenski.
\n- CVE ID: CVE-2025-12816
\n- GHSA ID: GHSA-5gfm-wpxj-wjgq
\n- HIGH: ASN.1 Unbounded Recursion\n
\n\n
\n- An Uncontrolled Recursion (CWE-674) vulnerability in node-forge\nversions\n1.3.1 and below enables remote, unauthenticated attackers to craft deep\nASN.1 structures that trigger unbounded recursive parsing. This leads to\na\nDenial-of-Service (DoS) via stack exhaustion when parsing untrusted DER\ninputs.
\n- Reported by Hunter Wodzenski.
\n- CVE ID: CVE-2025-66031
\n- GHSA ID: GHSA-554w-wpv2-vw27
\n- MODERATE: ASN.1 OID Integer Truncation\n
\n\n
\n- An Integer Overflow (CWE-190) vulnerability in node-forge versions\n1.3.1\nand below enables remote, unauthenticated attackers to craft ASN.1\nstructures containing OIDs with oversized arcs. These arcs may be\ndecoded\nas smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the\nbypass of downstream OID-based security decisions.
\n- Reported by Hunter Wodzenski.
\n- CVE ID: CVE-2025-66030
\n- GHSA ID: GHSA-65ch-62r8-g69g
\nFixed
\n\n
\n\n- [asn1] Fix for vulnerability identified by CVE-2025-12816 PKCS#12\nMAC\nverification bypass due to missing macData enforcement and improper\nasn1.validate routine.
\n- [asn1] Add
\nfromDer()max recursion depth check.\n\n
\n- Add a
\nasn1.maxDepthglobal configurable maximum depth\nof 256.- Add a
\nasn1.fromDer()per-callmaxDepth\noption.- NOTE: The default maximum is assumed to be higher\nthan needed for valid\ndata. If this assumption is false then this could be a breaking change.\nPlease file an issue if there are use cases that need a higher\nmaximum.
\n- NOTE: The per-call
\nmaxDepthparameter\nhas not been exposed up through\nall of the API stack due to the complexities involved. Please file an\nissue\nif there are use cases that require this instead of changing the\ndefault
... (truncated)
\n1cea0af\nRelease 1.3.3.5265989\nUpdate changelog.e4f3961\nFix changelog for release.503979b\nUpdate changelog.c3b3b32\nMake digestAlgorithm parameters optional6f70043\nUpdate CVE details.f547b0d\nStart 1.3.3-0.235ad3e\nRelease 1.3.2.2598244\nUpdate changelog.0032dd0\nFix typos.Sourced from qs's\nchangelog.
\n\n\n6.14.1
\n\n
\n- [Fix] ensure arrayLength applies to
\n[]notation as\nwell- [Fix]
\nparse: when a custom decoder returns\nnullfor a key, ignore that key- [Refactor]
\nparse: extract key segment splitting\nhelper- [meta] add threat model
\n- [actions] add workflow permissions
\n- [Tests]
\nstringify: increase coverage- [Dev Deps] update
\neslint,\n@ljharb/eslint-config,npmignore,\nes-value-fixtures,for-each,\nobject-inspect6.14.0
\n\n
\n- [New]
\nparse: add\nthrowOnParameterLimitExceededoption (#517)- [Refactor]
\nparse: useutils.combine\nmore- [patch]
\nparse: add explicit\nthrowOnLimitExceededdefault- [actions] use shared action; re-add finishers
\n- [meta] Fix changelog formatting bug
\n- [Deps] update
\nside-channel- [Dev Deps] update
\nes-value-fixtures,\nhas-bigints,has-proto,\nhas-symbols- [Tests] increase coverage
\n6.13.1
\n\n
\n- [Fix]
\nstringify: avoid a crash when a\nfilterkey isnull- [Fix]
\nutils.merge: functions should not be stringified\ninto keys- [Fix]
\nparse: avoid a crash with\ninterpretNumericEntities: true, comma: true, and iso charset- [Fix]
\nstringify: ensure a non-string\nfilterdoes not crash- [Refactor] use
\n__proto__syntax instead of\nObject.createfor null objects- [Refactor] misc cleanup
\n- [Tests]
\nutils.merge: add some coverage- [Tests] fix a test case
\n- [actions] split out node 10-20, and 20+
\n- [Dev Deps] update
\nes-value-fixtures,\nmock-property,object-inspect,\ntape
3fa11a5\nv6.14.1a626704\n[Dev Deps] update npmignore3086902\n[Fix] ensure arrayLength applies to [] notation as\nwellfc7930e\n[Dev Deps] update eslint,\n@ljharb/eslint-config0b06aac\n[Dev Deps] update @ljharb/eslint-config64951f6\n[Refactor] parse: extract key segment splitting helpere1bd259\n[Dev Deps] update @ljharb/eslint-configf4b3d39\n[eslint] add eslint 9 optional peer dep6e94d95\n[Dev Deps] update eslint,\n@ljharb/eslint-config, npmignore973dc3c\n[actions] add workflow permissionsSourced from react-router's\nreleases.
\n\n\nv7.13.0
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7130
\nv7.12.0
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7120
\nv7.11.0
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7110
\nv7.10.1
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7101
\nv7.10.0
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v7100
\nv7.9.6
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v796
\nv7.9.5
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v795
\nv7.9.4
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v794
\nv7.9.3
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v793
\nv7.9.2
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v792
\nv7.9.1
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v791
\nv7.9.0
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v790
\nv7.8.2
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v782
\nv7.8.1
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v781
\nv7.8.0
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v780
\nv7.7.1
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v771
\nv7.7.0
\nSee the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v770
\n\n
... (truncated)
\nSourced from react-router's\nchangelog.
\n\n\n7.13.0
\nMinor Changes
\n\n
\n- Add
\ncrossOriginprop toLinkscomponent\n(#14687)Patch Changes
\n\n
\n- Fix double slash normalization for useNavigate colon urls (#14718)
\n- Update failed origin checks to return a 400 status instead of a 500\n(#14737)
\n- Bugfix #14666:\nInline criticalCss is missing nonce (#14691)
\n- Loosen
\nallowedActionOriginsglob check so\n**matches all domains (#14722)7.12.0
\nMinor Changes
\n\n
\n- Add additional layer of CSRF protection by rejecting submissions to\nUI routes from external origins. If you need to permit access to\nspecific external origins, you can specify them in the\n
\nreact-router.config.tsconfig\nallowedActionOriginsfield. (#14708)Patch Changes
\n\n
\n\n- \n
\nFix
\ngeneratePathwhen used with suffixed params (i.e.,\n"/books/:id.json") (#14269)- \n
\nExport
\nUNSAFE_createMemoryHistoryand\nUNSAFE_createHashHistoryalongside\nUNSAFE_createBrowserHistoryfor consistency. These are not\nintended to be used for new apps but intended to help apps usiong\nunstable_HistoryRoutermigrate from v6->v7 so they can\nadopt the newer APIs. (#14663)- \n
\nEscape HTML in scroll restoration keys (#14705)
\n- \n
\nValidate redirect locations (#14706)
\n- \n
\n[UNSTABLE] Pass
\n<Scripts nonce>value through to\nthe underlyingimportmapscripttag when using\nfuture.unstable_subResourceIntegrity(#14675)- \n
\n[UNSTABLE] Add a new\n
\nfuture.unstable_trailingSlashAwareDataRequestsflag to\nprovide consistent behavior ofrequest.pathnameinside\nmiddleware,loader, andaction\nfunctions on document and data requests when a trailing slash is present\nin the browser URL. (#14644)Currently, your HTTP and
\nrequestpathnames would be as\nfollows for/a/b/cand/a/b/c/\n\n
\n\n \n\n\nURL \n/a/b/cHTTP pathname \n\n requestpathname`\n \nDocument \n\n /a/b/c\n /a/b/c✅\n \n\nData \n\n /a/b/c.data\n /a/b/c✅\n\n
\n\n \n\n\nURL \n/a/b/c/HTTP pathname \n\n requestpathname`\n \nDocument \n\n /a/b/c/\n /a/b/c/✅\n \n\nData \n\n /a/b/c.data\n /a/b/c⚠️With this flag enabled, these pathnames will be made consistent\nthough a new
\n_.dataformat for client-side\n.datarequests:\n\n
\n\n \n\n\nURL \n/a/b/cHTTP pathname \n\n requestpathname`\n \n\nDocument \n\n /a/b/c\n /a/b/c✅
... (truncated)
\n5557ba3\nchore: Update version for release (#14749)62c6e0e\nchore: Update version for release (pre) (#14738)3126264\nReturn 400 response on failed origin checks (#14737)3a5b5ad\nFix double slash normalization for useNavigate paths with\ncolons (#14718)f29c6c9\nAdd docs and loosen origins wildcard check (#14722)0bb972b\nfix(react-router/dom/ssr): add nonce to inline critical css\n(#14691)dd08f8d\nfix(react-router): add crossOrigin prop to Links component (#14687)c38d76c\nchore: format26653a6\nchore: Update version for release (#14712)7ac2346\nchore: Update version for release (pre) (#14709)This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub\nActions), a new releaser for react-router since your current\nversion.
\n