build(deps): bump jsonpath-plus from 10.4.0 to 11.1.1

[dependabot]

Bumps jsonpath-plus from 10.4.0 to 11.1.1.

Release notes

Sourced from jsonpath-plus's releases.

v10.4.1

What's Changed

• build(deps): bump minimatch from 3.1.2 to 3.1.4 by @​dependabot[bot] in JSONPath-Plus/JSONPath#255
• build(deps): bump markdown-it from 14.1.0 to 14.1.1 by @​dependabot[bot] in JSONPath-Plus/JSONPath#251
• build(deps): bump qs from 6.14.0 to 6.14.2 by @​dependabot[bot] in JSONPath-Plus/JSONPath#252
• build(deps): bump ajv from 6.12.6 to 6.14.0 by @​dependabot[bot] in JSONPath-Plus/JSONPath#253
• build(deps): bump serialize-javascript from 6.0.2 to 7.0.5 (via audit fix) by @​dependabot[bot] in JSONPath-Plus/JSONPath#260
• build(deps): bump minimatch from 9.0.5 to 9.0.9 by @​dependabot[bot] in JSONPath-Plus/JSONPath#262
• build(deps-dev): bump rollup from 4.53.2 to 4.59.0 by @​dependabot[bot] in JSONPath-Plus/JSONPath#257
• fix(slice): explicit zero end no longer returns the whole array by @​spokodev in JSONPath-Plus/JSONPath#265

New Contributors

• @​spokodev made their first contribution in JSONPath-Plus/JSONPath#265

Full Changelog: JSONPath-Plus/JSONPath@v10.4.0...v10.4.1

Changelog

Sourced from jsonpath-plus's changelog.

11.1.1

• fix: avoid treating at sign within regex as current context; fixes #280

11.1.0

• fix: allow bare @ in any position (e.g., $[?(@>1)], $[?(@)], $[?(!@)]) and stop rewriting @ inside quoted string literals (@​spokodev)
• fix: support unions of quoted property names (e.g., $['x','y'], $["a,b",'c.d']) as literal names (fixes #159; see #268)
• fix: support quoted property names containing commas (e.g., $['a,b'])
• fix: support \', \", and \\ escapes within quoted property names and escape ' and \ in toPathString output so paths round-trip

11.0.1

• fix(security) nested filter bypass exploit (@​andrewmacheret)

11.0.0

BREAKING CHANGES

• Require Node >= 22; drops older browser version support

• JSONPath.cache is no longer exposed or mutable. Consumers that used JSONPath.cache to inspect, modify, or clear entries must remove that usage and call JSONPath.clearCache() when cache invalidation is needed.

• chore: bump engines and browserslist and use v flag

• chore: various changes in types, particularly with return values changing from any to unknown to ensure type safety (by forcing type casts of the results on the user).

• fix!: isolate caches and add cache reset API

Other changes:

• feat: add customTypes option for providing own other type callbacks (e.g., @blob()) (@​brettz9)
• fix(slice): explicit zero end no longer returns the whole array (#265) (@​spokodev)
• fix: indicate that the OtherTypeCallback callback type can accept a parentPropName with type number (@​brettz9)
• fix: separate JSONPath path and script caches (@​brettz9)
• fix: restore JSONPath.prototype.evaluate, safeVm, and vm compatibility
• fix(safe-eval): harden operator lookup against prototype inheritance (@​brettz9)
• fix(security): block indirect Function-constructor access in safe eval (reported by @c0rydoras: Arthur Deierlein <info@c0rydoras.dev>)
• refactor: expose JSONPathClass prototype through JSONPath for compatibility
• docs: security notes
• test(safe-eval): guard bind() escape route for constructor access (@​brettz9)
• test: restore full test coverage (@​brettz9)
• chore: pnpm update (@​brettz9)
• refactor: implement TypeScript-as-JSDoc and auto-build declaration files from this (avoiding need for maintaining declaration file manually)
• chore: update devDeps
• chore: lint
• build(deps-dev): bump rollup from 4.53.2 to 4.59.0 (@​dependabot[bot])

... (truncated)

Commits

• 81abdd8 docs: point to upstream
• 60a521b chore: update docs
• a320fae chore: bump version (11.1.1)
• 035a2aa chore: update docs
• 030e954 fix: avoid treating at sign within regex as current context; fixes #280
• 6451f7e chore: update build and docs
• ceb861d fix: support unions of quoted property names (e.g., $['x','y'],
• a54beff fix: allow bare @ in any position (e.g., $[?(@)], $[?(!@)],
• 935c782 fix(filter): allow bare @ adjacent to an operator without whitespace
• 3e146f7 chore: update types
• Additional commits viewable in compare view

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: dependabot[bot]
Once this PR has been reviewed and has the lgtm label, please assign cjihrig for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[brendandburns]

@copilot please fix CI/CD

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: dependabot[bot] / name: dependabot[bot] (dcb31d3)

[Copilot]

@copilot please fix CI/CD

Fixed the CI TypeScript errors caused by jsonpath-plus 11.1.0 returning unknown; build, lint, and unit tests pass locally. Commit: 19b4d54. This commit should trigger CI again.

[dependabot]

A newer version of jsonpath-plus exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

[brendandburns]

@dependabot recreate

[dependabot]

Superseded by #3102.