chore(deps): bump the minor-versions group across 5 directories with 48 updates

[dependabot]

Bumps the minor-versions group with 27 updates in the / directory:

Package	From	To
react	19.2.3	19.2.4
@types/react	19.2.7	19.2.13
react-test-renderer	19.2.3	19.2.4
@bloom-housing/ui-seeds	3.1.4	3.3.1
@mapbox/mapbox-sdk	0.13.7	0.16.2
autoprefixer	10.4.20	10.4.24
axios	1.8.3	1.13.5
dayjs	1.11.8	1.11.19
dotenv	17.2.3	17.2.4
mapbox-gl	3.16.0	3.18.1
qs	6.11.2	6.14.1
react-dom	19.2.3	19.2.4
react-google-recaptcha-v3	1.10.1	1.11.0
@babel/core	7.21.4	7.29.0
@babel/preset-env	7.25.7	7.29.0
@cypress/code-coverage	3.14.4	3.14.7
@testing-library/dom	10.4.0	10.4.1
@testing-library/jest-dom	6.6.3	6.9.1
@testing-library/react	16.2.0	16.3.2
postcss	8.5.3	8.5.6
sass	1.93.3	1.97.3
sass-loader	16.0.6	16.0.7
ts-loader	9.5.2	9.5.4
webpack	5.98.0	5.105.0
swr	2.2.5	2.4.0
@types/mapbox__mapbox-sdk	0.13.11	0.16.3
@google-cloud/translate	9.2.0	9.3.0

Bumps the minor-versions group with 26 updates in the /api directory:

Package	From	To
ts-jest	29.1.1	29.4.6
ts-node	10.9.1	10.9.2
typescript	5.1.6	5.9.3
axios	1.8.3	1.13.5
dayjs	1.11.9	1.11.19
dotenv	17.2.3	17.2.4
qs	6.11.2	6.14.1
ts-loader	9.5.2	9.5.4
webpack	5.98.0	5.105.0
@google-cloud/translate	9.2.0	9.3.0
@aws-sdk/client-s3	3.758.0	3.985.0
@aws-sdk/lib-storage	3.758.0	3.985.0
@aws-sdk/s3-request-presigner	3.750.0	3.985.0
@google-cloud/recaptcha-enterprise	6.3.0	6.4.0
casbin	5.27.1	5.48.0
class-validator	0.14.0	0.14.3
compression	1.7.4	1.8.1
@types/compression	1.7.5	1.8.1
cookie-parser	1.4.6	1.4.7
jsonwebtoken	9.0.2	9.0.3
lodash	4.17.21	4.17.23
passport	0.6.0	0.7.0
reflect-metadata	0.1.13	0.2.2
rxjs	7.8.1	7.8.2
swagger-axios-codegen	0.15.12	0.18.0
@types/exceljs	1.3.0	1.3.2

Bumps the minor-versions group with 5 updates in the /shared-helpers directory:

Package	From	To
react	19.2.3	19.2.4
react-test-renderer	19.2.3	19.2.4
@bloom-housing/ui-seeds	3.1.4	3.3.1
react-dom	19.2.3	19.2.4
@testing-library/react	16.3.0	16.3.2

Bumps the minor-versions group with 5 updates in the /sites/partners directory:

Package	From	To
react	19.2.3	19.2.4
@bloom-housing/ui-seeds	3.1.4	3.3.1
@mapbox/mapbox-sdk	0.13.7	0.16.2
react-dom	19.2.3	19.2.4
@types/mapbox__mapbox-sdk	0.13.11	0.16.3

Bumps the minor-versions group with 4 updates in the /sites/public directory: react, @bloom-housing/ui-seeds, @mapbox/mapbox-sdk and react-dom.

Updates react from 19.2.3 to 19.2.4

Release notes

Sourced from react's releases.

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

Commits

• 90ab3f8 Version 19.2.4
• See full diff in compare view

Updates @types/react from 19.2.7 to 19.2.13

Commits

• See full diff in compare view

Updates react-test-renderer from 19.2.3 to 19.2.4

Release notes

Sourced from react-test-renderer's releases.

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, @​lubieowoce, @​sebmarkbage, @​unstubbable)

Commits

• 90ab3f8 Version 19.2.4
• See full diff in compare view

Updates @bloom-housing/ui-seeds from 3.1.4 to 3.3.1

Release notes

Sourced from @​bloom-housing/ui-seeds's releases.

v3.3.1

3.3.1 (2026-02-04)

Bug Fixes

• rtl loading spinner (#147) (8278002)

v3.3.0

3.3.0 (2026-01-22)

Features

• spacer classes for zero release (#146) (57ba198)

Commits

• 8278002 fix: rtl loading spinner (#147)
• 57ba198 feat: spacer classes for zero release (#146)
• da5a17d feat: spacer classes for zero (#145)
• 868accd fix: FieldValue children typing (#137)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by emilyjablonski, a new releaser for @​bloom-housing/ui-seeds since your current version.

Updates @heroicons/react from 2.1.1 to 2.2.0

Release notes

Sourced from @​heroicons/react's releases.

v2.2.0

Added

• Add React 19 support (#1247)

Fixed

• Removed unnecessary clipping path from solid/arrow-left-circle (#1211)

v2.1.5

Added

• Add new icons (arrow-turn-*, bold, calendar-date-range, divide, document-currency-*, equals, h1, h2, h3, italic, link-slash, numbered-list, percent-badge, slash, strikethrough, underline)

v2.1.4

Fixed

• Improve tree-shakability of React package (#1192)

v2.1.3

• Improve project READMEs (#1152)

v2.1.2

• Include license file with published packages (#1151)

Changelog

Sourced from @​heroicons/react's changelog.

[2.2.0] - 2024-11-18

Added

• Add React 19 support (#1247)

Fixed

• Removed unnecessary clipping path from solid/arrow-left-circle (#1211)

[2.1.5] - 2024-07-10

Added

• Add new icons (arrow-turn-*, bold, calendar-date-range, divide, document-currency-*, equals, h1, h2, h3, italic, link-slash, numbered-list, percent-badge, slash, strikethrough, underline)

[2.1.4] - 2024-06-17

Fixed

• Improve tree-shakability of React package (#1192)

[2.1.3] - 2024-03-22

• Improve project READMEs (#1152)

[2.1.2] - 2024-03-22

• Include license file with published packages (#1151)

Commits

• 0435d4c 2.2.0
• f327cbe Add React 19 support (#1247)
• 56c073c Update changelog
• 64e2368 Remove clip-path from 20/arrow-left-circle (#1211)
• ad0ad1f 2.1.5
• 58d511e Add new icons (#1204)
• c1b192b 2.1.4
• e2e487f Make sure calls to forwardRef are marked as pure (#1192)
• cafc7d6 use size-* instead of w-* h-* (#1182)
• 9a17872 Update README.md (#1167)
• Additional commits viewable in compare view

Updates @mapbox/mapbox-sdk from 0.13.7 to 0.16.2

Release notes

Sourced from @​mapbox/mapbox-sdk's releases.

v0.16.2

0.16.2

• Addressed security issues CVE-2025-7783 and CVE-2022-25881

v0.16.1

0.16.1

• Add: Add session_token as optional parameter in the geocoding services

v0.15.16

0.15.6

• Add: Add secondary_address to list of accepted types for Geocoding v6

v0.15.4

No release notes provided.

Changelog

Sourced from @​mapbox/mapbox-sdk's changelog.

Changelog

0.16.1

• Add: Add session_token as optional parameter in the geocoding services

0.16.0

• Add: Add depart_at as optional parameter in the isochrone service

0.15.6

• Fix: Add secondary_address to list of accepted types for Geocoding v6

0.15.5

• Fix: Rename directions api annotation option max_speed to maxspeed #480

0.15.4

• Fix: Set body = '' for POST, PUT, PATCH, and DELETE requests that do not have a body #479

0.15.3

• Fix: Maximum Optimization V1 request size limits should not be enforced client-side

0.15.2

• Add: Add depart_at and arrive_by as optional parameters in the directions service

0.15.1

• Add: Add driving-traffic as a profile option in the isochrone service

0.15.0

• Add: Geocoding v6 service

0.14.0

• Add: Config for Tokens#createToken and Tokens#updateToken can now include the allowedApplications property.

Commits

• 8b8dc60 Merge pull request #502 from mapbox/max/CVE-2025-7783
• f897e42 [CVE-2025-7783] Upgrade form-data
• 12f5a42 Merge pull request #493 from mapbox/geocoding-sessionid
• 0e19cc9 docs, bump package version
• ae00cc5 change to token
• 19b012d add sessionId param to geocoding services
• 41c7da5 0.16.0
• d5a34be prepare v0.16.0
• eb8e804 Merge pull request #473 from mapbox/add-depart-at
• 1b5c24b Merge pull request #483 from mapbox/geocoding-v6-secondary-address
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by mbx-npm-07-production, a new releaser for @​mapbox/mapbox-sdk since your current version.

Updates autoprefixer from 10.4.20 to 10.4.24

Release notes

Sourced from autoprefixer's releases.

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

10.4.23

• Reduced dependencies (by @​hyperz111).

10.4.22

• Fixed stretch prefixes on new Can I Use database.
• Updated fraction.js.

10.4.21

• Fixed old -moz- prefix for :placeholder-shown (by @​Marukome0743).

Changelog

Sourced from autoprefixer's changelog.

10.4.24

• Made Autoprefixer a little faster (by @​Cherry).

10.4.23

• Reduced dependencies (by @​hyperz111).

10.4.22

• Fixed stretch prefixes on new Can I Use database.
• Updated fraction.js.

10.4.21

• Fixed old -moz- prefix for :placeholder-shown (by @​Marukome0743).

Commits

• 36692c2 Release 10.4.24 version
• 67df014 Update dependencies
• 032440e perf: reduce array allocations (#1542)
• 212ba3c Release 10.4.23 version
• 7f62fb6 Update dependencies
• c455bb1 chore: inline and simplify normalize-range (#1539)
• 73dc62c Release 10.4.22 version
• 9973c59 Lock CI action versions
• 4b4feca Fix Node.js 10 on CI
• 15c21d3 Fix old Node.js CI
• Additional commits viewable in compare view

Updates axios from 1.8.3 to 1.13.5

Release notes

Sourced from axios's releases.

v1.13.5

Release 1.13.5

Highlights

• Security: Fixed a potential Denial of Service issue involving the __proto__ key in mergeConfig. (PR #7369)
• Bug fix: Resolved an issue where AxiosError could be missing the status field on and after v1.13.3. (PR #7368)

Changes

Security

• Fix Denial of Service via __proto__ key in mergeConfig. (PR #7369)

Fixes

• Fix/5657. (PR #7313)
• Ensure status is present in AxiosError on and after v1.13.3. (PR #7368)

Features / Improvements

• Add input validation to isAbsoluteURL. (PR #7326)
• Refactor: bump minor package versions. (PR #7356)

Documentation

• Clarify object-check comment. (PR #7323)
• Fix deprecated Buffer constructor usage and README formatting. (PR #7371)

CI / Maintenance

• Chore: fix issues with YAML. (PR #7355)
• CI: update workflow YAMLs. (PR #7372)
• CI: fix run condition. (PR #7373)
• Dev deps: bump karma-sourcemap-loader from 0.3.8 to 0.4.0. (PR #7360)
• Chore(release): prepare release 1.13.5. (PR #7379)

New Contributors

• @​sachin11063 (first contribution — PR #7323)
• @​asmitha-16 (first contribution — PR #7326)

Full Changelog: axios/axios@v1.13.4...v1.13.5

v1.13.4

Overview

The release addresses issues discovered in v1.13.3 and includes significant CI/CD improvements.

Full Changelog: v1.13.3...v1.13.4

What's New in v1.13.4

Bug Fixes

• fix: issues with version 1.13.3 (#7352) (ee90dfc)
  • Fixed issues discovered in v1.13.3 release

... (truncated)

Changelog

Sourced from axios's changelog.

Changelog

1.13.3 (2026-01-20)

Bug Fixes

• http2: Use port 443 for HTTPS connections by default. (#7256) (d7e6065)
• interceptor: handle the error in the same interceptor (#6269) (5945e40)
• main field in package.json should correspond to cjs artifacts (#5756) (7373fbf)
• package.json: add 'bun' package.json 'exports' condition. Load the Node.js build in Bun instead of the browser build (#5754) (b89217e)
• silentJSONParsing=false should throw on invalid JSON (#7253) (#7257) (7d19335)
• turn AxiosError into a native error (#5394) (#5558) (1c6a86d)
• types: add handlers to AxiosInterceptorManager interface (#5551) (8d1271b)
• types: restore AxiosError.cause type from unknown to Error (#7327) (d8233d9)
• unclear error message is thrown when specifying an empty proxy authorization (#6314) (6ef867e)

Features

• add undefined as a value in AxiosRequestConfig (#5560) (095033c)
• add automatic minor and patch upgrades to dependabot (#6053) (65a7584)
• add Node.js coverage script using c8 (closes #7289) (#7294) (ec9d94e)
• added copilot instructions (3f83143)
• compatibility with frozen prototypes (#6265) (860e033)
• enhance pipeFileToResponse with error handling (#7169) (88d7884)
• types: Intellisense for string literals in a widened union (#6134) (f73474d), closes microsoft/TypeScript#33471

Reverts

• Revert "fix: silentJSONParsing=false should throw on invalid JSON (#7253) (#7…" (#7298) (a4230f5), closes #7253 #7 #7298
• deps: bump peter-evans/create-pull-request from 7 to 8 in the github-actions group (#7334) (2d6ad5e)

Contributors to this release

• Ashvin Tiwari
• Nikunj Mochi
• Anchal Singh
• jasonsaayman
• Julian Dax
• Akash Dhar Dubey
• Madhumita
• Tackoil
• Justin Dhillon
• Rudransh
• WuMingDao
• codenomnom
• Nandan Acharya
• Eric Dubé
• Tibor Pilz
• Gabriel Quaresma
• Turadg Aleahmad

... (truncated)

Commits

• 29f7542 chore(release): prepare release 1.13.5 (#7379)
• 431c3a3 ci: fix run condition (#7373)
• 9ff3a78 ci: update ymls (#7372)
• 265b712 docs: fix deprecated Buffer constructor and formatting issues in README (#7371)
• 475e75a feat: add input validation to isAbsoluteURL (#7326)
• 28c7215 fix: Denial of Service via proto Key in mergeConfig (#7369)
• 04cf019 docs: clarify object check comment (#7323)
• 696fa75 fix: status is missing in AxiosError on and after v1.13.3 (#7368)
• 569f028 fix: added a option to choose between legacy and the new request/response int...
• 44b7c9f chore(deps-dev): bump karma-sourcemap-loader (#7360)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for axios since your current version.

Updates dayjs from 1.11.8 to 1.11.19

Release notes

Sourced from dayjs's releases.

v1.11.19

1.11.19 (2025-10-31)

Bug Fixes

• added usage warnings for diff + updated unit tests (#2948) (269a7a9)
• dont instantiate regexes within ar locale functions to avoid performance overhead (#2898) (af5e9f0)
• replace italian locale "un' ora fa" with "un'ora fa", add tests for it (#2930) (9e9f76c)
• Updated Belarusian locale with relative time (#2656) (1d8746c)

v1.11.18

1.11.18 (2025-08-30)

Bug Fixes

• error semantic-release dependency (8cfb313)

v1.11.17

1.11.17 (2025-08-29)

Bug Fixes

• [en-AU] locale use the same ordinal as moment (#2878) (1b95ecd)

v1.11.16

1.11.16 (2025-08-29)

Bug Fixes

• test release workflow (no code changes) (c38c428)

v1.11.15

1.11.15 (2025-08-28)

Bug Fixes

• Fix misspellings in Irish or Irish Gaelic [ga] (#2861) (9c14a42)

v1.11.14

1.11.14 (2025-08-27)

Bug Fixes

• .utcOffset(0, true) result and its clone are different bug (#2505) (fefdcd4)

... (truncated)

Changelog

Sourced from dayjs's changelog.

1.11.19 (2025-10-31)

Bug Fixes

• added usage warnings for diff + updated unit tests (#2948) (269a7a9)
• dont instantiate regexes within ar locale functions to avoid performance overhead (#2898) (af5e9f0)
• replace italian locale "un' ora fa" with "un'ora fa", add tests for it (#2930) (9e9f76c)
• Updated Belarusian locale with relative time (#2656) (1d8746c)

1.11.18 (2025-08-30)

Bug Fixes

• error semantic-release dependency (8cfb313)

1.11.17 (2025-08-29)

Bug Fixes

• [en-AU] locale use the same ordinal as moment (#2878) (1b95ecd)

1.11.16 (2025-08-29)

Bug Fixes

• test release workflow (no code changes) (c38c428)

1.11.15 (2025-08-28)

Bug Fixes

• Fix misspellings in Irish or Irish Gaelic [ga] (#2861) (9c14a42)

1.11.14 (2025-08-27)

Bug Fixes

• .utcOffset(0, true) result and its clone are different bug (#2505) (fefdcd4)

1.11.13 (2024-08-20)

Bug Fixes

... (truncated)

Commits

• 02b7a5c chore(release): 1.11.19 [skip ci]
• 37193be Merge pull request #2950 from iamkun/dev
• 2db920b chore: update doc
• 4f72974 chore: update doc
• 0b36a07 chore: update doc
• 269a7a9 fix: added usage warnings for diff + updated unit tests (#2948)
• 9e3132e chore: update doc
• 84201e6 chore: update doc
• 80401e3 chore: update readme
• 88ad3fd test: Add unit test for Belarusian locale (#2934)
• Additional commits viewable in compare view

Updates dotenv from 17.2.3 to 17.2.4

Changelog

Sourced from dotenv's changelog.

17.2.4 (2026-02-05)

Changed

• Make DotenvPopulateInput accept NodeJS.ProcessEnv type (#915)

• Give back to dotenv by checking out my newest project vestauth. It is auth for agents. Thank you for using my software.

Commits

• See full diff in compare view

Updates mapbox-gl from 3.16.0 to 3.18.1

Release notes

Sourced from mapbox-gl's releases.

v3.18.1

Features and improvements ✨

• Add support for visibility property in clip layers.
• Improve raster-color precision for fine-grained value ranges.

Bug fixes 🐞

• Fix color interpolation throwing errors in edge cases.
• Fix appearances with no icon-size.
• Fix disappearing symbols when used with elevated raster layers.

v3.18.0

Features and improvements ✨

• Add scaleFactor support for images within text-field.
• Add showButton option to GeolocateControl that allows hiding the control button.
• Add followUserLocation option and setFollowUserLocation method to GeolocateControl to control whether the map follows the user's location.
• Improve GeolocateControl timeout handling.
• Add support for text-rotate, text-size, and text-offset properties in appearances.
• Add shadow-draw-before-layer property to directional light, allowing control over shadow draw order in the layer stack.
• Add model-allow-density-reduction property to model layers. (h/t @​JoshuaJMoore)

Bug fixes 🐞

• Fix interaction handlers not working on model layers.
• Fix stretchable icons without icon-text-fit rendering with an incorrect size.
• Fix icon-size not working correctly with coalesce expressions.
• Fix raster-color interpolation when using nearest raster-resampling.
• Fix render cut off for elevated raster-layer rendering in ortho projection range.
• Fix symbol placement with optional and missing parts.
• Expose all error properties for GeolocateControl error event (h/t @​lucavb).
• Fix an error when querying multipolygons in dynamic: true mode.
• Fix AttributionControl links sanitization.
• Fix appearances with no icon-size using the default value instead of the layout-defined one.
• Fix updates to model source via ModelSource.setModels while models are still loading.
• Fix polygon clipping precision errors causing rendering artifacts in elevated structures.
• Preserve featuresets in map.getStyle() output.
• Expose TypeScript types from @mapbox/mapbox-gl-style-spec for direct imports.

v3.18.0-beta.2

Features and improvements ✨

• Add showButton option to GeolocateControl that allows hiding the control button.
• Add followUserLocation option and setFollowUserLocation method to GeolocateControl to control whether the map follows the user's location.
• Improve GeolocateControl timeout handling.

Bug fixes 🐞

• Fix stretchable icons without icon-text-fit rendering with an incorrect size.

... (truncated)

Changelog

Sourced from mapbox-gl's changelog.

3.18.1

Features and improvements ✨

• Add support for visibility property in clip layers.
• Improve raster-color precision for fine-grained value ranges.

Bug fixes 🐞

• Fix color interpolation throwing errors in edge cases.
• Fix appearances with no icon-size.
• Fix disappearing symbols when used with elevated raster layers.

3.18.0

Features and improvements ✨

• Add scaleFactor support for images within text-field.
• Add showButton option to GeolocateControl that allows hiding the control button.
• Add followUserLocation option and setFollowUserLocation method to GeolocateControl to control whether the map follows the user's location.
• Improve GeolocateControl timeout handling.
• Add support for text-rotate, text-size, and text-offset properties in appearances.
• Add shadow-draw-before-layer property to directional light, allowing control over shadow draw order in the layer stack.
• Add model-allow-density-reduction property to model layers. (h/t @​JoshuaJMoore)

Bug fixes 🐞

• Fix interaction handlers not working on model layers.
• Fix stretchable icons without icon-text-fit rendering with an incorrect size.
• Fix icon-size not working correctly with coalesce expressions.
• Fix raster-color interpolation when using nearest raster-resampling.
• Fix render cut off for elevated raster-layer rendering in ortho projection range.
• Fix symbol placement with optional and missing parts.
• Expose all error properties for GeolocateControl error event (h/t @​lucavb).
• Fix an error when querying multipolygons in dynamic: true mode.
• Fix AttributionControl links sanitization.
• Fix appearances with no icon-size using the default value instead of the layout-defined one.
• Fix updates to model source via ModelSource.setModels while models are still loading.
• Fix polygon clipping precision errors causing rendering artifacts in elevated structures.
• Preserve featuresets in map.getStyle() output.
• Expose TypeScript types from @mapbox/mapbox-gl-style-spec for direct imports.

3.17.0

Features and improvements ✨

• Add experimental ESM support.
• Make line-emissive-strength data-driven.
• Remove experimental flag from the extra_bounds property of raster and vector sources.
• Remove experimental flag from model layer.

... (truncated)

Commits

• e512955 v3.18.1
• 1e8b843 Remove mapbox_enable_fog_dithering from render tests
• f91f98e Remove unused FOG_DITHERING define
• e1138f7 Clamp RenderColor interpolation to avoid throwing
• 92b5d1f Increase raster color ramp texture resolution
• 77db1fe Properly position 3D models in roads underpass areas (internal-9229)
• 16d8482 Bump @​babel/core from 7.28.5 to 7.28.6 (internal-9319)
• f8ee268 Bump ejs from 3.1.10 to 4.0.1 (internal-9324)
• b1d987d Bump @​types/node from 25.0.6 to 25.0.9 (internal-9323)
• e6eecc2 Bump diff from 8.0.2 to 8.0.3 (internal-9321)
• Additional commits viewable in compare view

Updates qs from 6.11.2 to 6.14.1

Changelog

Sourced from qs's changelog.

6.14.1

• [Fix] ensure arrayLength applies to [] notation as well
• [Fix] parse: when a custom decoder returns null for a key, ignore that key
• [Refactor] parse: extract key segment splitting helper
• [meta] add threat model
• [actions] add workflow permissions
• [Tests] stringify: increase coverage
• [Dev Deps] update eslint, @ljharb/eslint-config, npmignore, es-value-fixtures, for-each, object-inspect

6.14.0

• [New] parse: add throwOnParameterLimitExceeded option (#517)
• [Refactor] parse: use utils.combine more
• [patch] parse: add explicit throwOnLimitExceeded default
• [actions] use shared action; re-add finishers
• [meta] Fix changelog formatting bug
• [Deps] update side-channel
• [Dev Deps] update es-value-fixtures, has-bigints, has-proto, has-symbols
• [Tests] increase coverage

6.13.1

• [Fix] stringify: avoid a crash when a filter key is null
• [Fix] utils.merge: functions should not be stringified into keys
• [Fix] parse: avoid a crash with interpretNumericEntities: true, comma: true, and iso charset
• [Fix] stringify: ensure a non-string filter does not crash
• [Refactor] use __proto__ syntax instead of Object.create for null objects
• [Refactor] misc cleanup
• [Tests] utils.merge: add some coverage
• [Tests] fix a test case
• [actions] split out node 10-20, and 20+
• [Dev Deps] update es-value-fixtures, mock-property, object-inspect, tape

6.13.0

• [New] parse: add strictDepth option (#511)
• [Tests] use npm audit instead of aud

6.12.3

• [Fix] parse: properly account for strictNullHandling when allowEmptyArrays
• [meta] fix changelog indentation

6.12.2

• [Fix] parse: parse encoded square brackets (#506)
• [readme] add CII best practices badge

6.12.1

• [Fix] parse: Disable decodeDotInKeys by default to restore previous behavior (#501)
• [Performance] utils: Optimize performance under large data volumes, reduce memory usage, and speed up processing (#502)
• [Refactor] utils: use +=
• [Tests] increase coverage

6.12.0

... (truncated)

Commits

• 3fa11a5 v6.14.1
• a626704 [Dev Deps] update npmignore
• 3086902 [Fix] ensure arrayLength applies to [] notation as well
• fc7930e [Dev Deps] update eslint, @ljharb/eslint-config
• 0b06aac [Dev Deps] update @ljharb/eslint-config
• 64951f6 [Refactor] parse: extract key segment splitting helper
• e1bd259 [Dev Deps] update @ljharb/eslint-config
• f4b3d39 [eslint] add eslint 9 optional peer dep
• 6e94d95 [Dev Deps] update eslint, @ljharb/eslint-config, npmignore
• 973dc3c [actions] add workflow permissions
• Additional commits viewable in compare view

Updates react-dom from 19.2.3 to 19.2.4

Release notes

Sourced from react-dom's releases.

19.2.4 (January 26th, 2026)

React Server Components

• Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @​gnoff, Description has been truncated