build(deps): bump the npm-minor-patch group across 1 directory with 21 updates

[dependabot]

Bumps the npm-minor-patch group with 21 updates in the / directory:

Package	From	To
knip	6.32.1	6.32.3
@amplitude/analytics-browser	2.45.5	2.45.7
@next/third-parties	16.3.0	16.3.3
@tanstack/react-query	5.101.4	5.102.5
@uswds/uswds	3.13.0	3.14.0
i18next	26.3.6	26.4.0
jose	6.2.8	6.2.10
react-i18next	17.0.11	17.0.12
@axe-core/react	4.12.1	4.13.0
@next/bundle-analyzer	16.3.0	16.3.3
@testing-library/user-event	14.6.3	14.6.6
@types/react-dom	19.2.4	19.2.5
@vitest/coverage-v8	4.1.10	4.1.11
baseline-browser-mapping	2.11.13	2.11.19
puppeteer	25.5.0	25.9.0
sass	1.102.0	1.103.1
sass-embedded	1.100.0	1.103.1
vite	8.2.1	8.2.2
vitest	4.1.10	4.1.11
uuid	14.0.1	14.0.2
@vitejs/plugin-react	6.0.5	6.1.0

Updates knip from 6.32.1 to 6.32.3

Release notes

Sourced from knip's releases.

Release 6.32.3

• Update sentry production snapshot (9f18cba93c91de8554636b13692d6e7a937b7697)
• Pin TypeScript ecosystem test (de5162952d223050f3135afb02d4e8de6d46f381)
• Update query snapshot (f6964dd577d8f7967f9be6778f5c3953632e3c96)
• fix(tsup): match config files with .cts and .mts extensions (#1938) (68d6f52f7913cfa1e36618e6b03f90734da34149) - thanks @​codeAnqiang-ma!
• fix(lefthook): match all config file names and extensions (#1940) (4015ae0330c78e97360a2c8f697d17f82c5c24ae) - thanks @​codeAnqiang-ma!
• fix(binaries): resolve missing pnpm subcommands (#1945) (deedbf69dcbd6a59d6705a72cadb4e40ad9c8029) - thanks @​marcalexiei!
• Fix nested gitignore negation inside ignored dot-directories (#1913) (#1942) (0201641af48f52edfbe72076118944ee6273718e) - thanks @​DSeaStar!
• fix(webdriver-io): match all supported config file extensions (#1948) (dc7aca5a865d1762a41dd97493b73398ec3abc19) - thanks @​solomonaustin!
• Resolve vitest include patterns relative to test.dir (#1929) (ee555d227208dd6a34e002318bd6710dedb4d5ca) - thanks @​kirthi-b!
• Change GitHub stars badge style to flat (#1967) (ff0d791e8130430524dc88c4df73ad87f82879f7) - thanks @​DreamLongYT!
• Ignore printf as global binary (#1972) (a0c0b0805a8a26a6efdedfe2561b168da2a22b68) - thanks @​taracutie!
• fix: add bun 1.4 dedupe subcommand (#1969) (d1d5d4276ece6daf2215f5ff3f4224b5b50dcac3) - thanks @​NimmLor!
• Resolve Vitest mocks from test root (e655b0ba0192546a2688d702323c8e7c58fecde1)
• Resolve local Vitest reporters from test root (resolve #1953) (f4ff31ad0385c5955627ec1b3bed2bc0000b14fe)

Release 6.32.2

• Support oxfmt.config.mts (#1933) (795900191dc75eec8d1e717b866bf57e1e2912cc) - thanks @​joealden!
• Support oxlint.config.mts (#1934) (531e2dc7c1d8bf31babea0068c34391182ec2d50) - thanks @​joealden!
• Fix Supported lint-staged Configs (#1935) (f9c755e414ed10baa4d01af8ddac6d04cb8d5617) - thanks @​joealden!
• Update dependencies (95f7c529f918dd9e1a84f92c68d064738977b825)
• Update sentry snapshot (ea7929fcbd6b323c8bdd9252ac57017feeb29ecf)

Commits

• fc2733d Release knip@6.32.3
• f4ff31a Resolve local Vitest reporters from test root (resolve #1953)
• e655b0b Resolve Vitest mocks from test root
• d1d5d42 fix: add bun 1.4 dedupe subcommand (#1969)
• a0c0b08 Ignore printf as global binary (#1972)
• ff0d791 Change GitHub stars badge style to flat (#1967)
• ee555d2 Resolve vitest include patterns relative to test.dir (#1929)
• dc7aca5 fix(webdriver-io): match all supported config file extensions (#1948)
• 0201641 Fix nested gitignore negation inside ignored dot-directories (#1913) (#1942)
• deedbf6 fix(binaries): resolve missing pnpm subcommands (#1945)
• Additional commits viewable in compare view

Updates @amplitude/analytics-browser from 2.45.5 to 2.45.7

Release notes

Sourced from @​amplitude/analytics-browser's releases.

@​amplitude/analytics-browser@​2.45.7

2.45.7 (2026-08-24)

Bug Fixes

• analytics-browser: tolerate nullish querySelectorAll in mutation observers (#1919) (1b7b929)

@​amplitude/analytics-browser@​2.45.6

2.45.6 (2026-08-12)

Bug Fixes

• deps: remediate Semgrep supply chain findings (#1921) (e131df0)

Commits

• 8dbd5b1 chore(release): publish
• 0807d88 fix(autocapture): prevent scroll gestures from triggering dead clicks (#1941)
• 6deb062 feat(session-replay-react-native): remove deprecated APIs (#1950)
• ab11585 test: Rn diagnostics client harness test (#1942)
• 8d150ce feat(analytics-react-native): add diagnostics client (#1939)
• ea730d4 refactor: remove and replace analytics-client-common (#1905)
• 8fa69bb chore: upgrade expo-app to work iOS 13 (#1940)
• 1b7b929 fix(analytics-browser): tolerate nullish querySelectorAll in mutation observe...
• 744a2fa chore(release): publish
• f82e521 fix(build): use @​babel/preset-env in snippet build scripts (#1933)
• Additional commits viewable in compare view

Updates @next/third-parties from 16.3.0 to 16.3.3

Release notes

Sourced from @​next/third-parties's releases.

v16.3.3

This release contains security fixes for the following advisories:

Critical:

• Unauthenticated Remote Code Execution on windows-hosted servers
• Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used

v16.3.2

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• [backport] Scope app-entry export validation to files inside the app directory (#97357)
• [backport] Fix catch-all index page being served for every other slug (#97416)
• [16.3] Turbopack: don't trace embedded WASM loader helpers (#97353) (#97463)
• [16.3] Turbopack: retain conditions when replacing resolve request keys (#97453)
• [16.3.x] Fix Turbopack worker chunk loading with asset prefix (#97419)
• [16.3.x] Authenticate Turborepo remote caching with OIDC instead of a static PAT (#97603)

Credits

Huge thanks to @​lubieowoce, @​unstubbable, @​timneutkens, @​mischnic, and @​eps1lon for helping!

v16.3.1

What's Changed

• [16.x] Turbopack: don't strip async-module runtime from shared runtime chunks by @​lukesandberg in vercel/next.js#96653
• [16.x] [turbopack] Add turbopack_ecmascript and turbopack_wasm's embeded FS to internal_assets_conditions by @​lukesandberg in vercel/next.js#96655
• [16.x] [turbopack] Collapse nested promises in the analyzer by @​sampoder in vercel/next.js#96675
• [16.x] fix(next/image): preserve image response after optimization by @​styfle in vercel/next.js#96733
• [16.3.x] Default deploy e2e tests to the repo next version by @​eps1lon in vercel/next.js#96900
• [backport] Bump @​swc/helpers by @​mischnic in vercel/next.js#96885
• [backport] [turbopack] Raise registration calls in hoisted modules to the top by @​lukesandberg in vercel/next.js#97308
• [backport] Fix missing styled-jsx styles in Pages Router SSR on adapter builds by @​lukesandberg in vercel/next.js#97302
• [backport] [turbopack] Fix HMR for dynamic imports evaluated from layouts by @​lukesandberg in vercel/next.js#97317
• [backport] Restore the live headers() view of the incoming request by @​unstubbable in vercel/next.js#97311
• [backport] Allow literal exports in 'use cache' files by @​unstubbable in vercel/next.js#97312
• [backport] Keep the dev validation worker alive across HMR updates by @​unstubbable in vercel/next.js#97315
• [backport] Discard only cache entries that predate a tag revalidation, and reuse completed entries by @​unstubbable in vercel/next.js#97314
• [backport] Encode the cache item name built by unstable_cache by @​unstubbable in vercel/next.js#97313
• [16.3] [ci] Use OIDC tokens to read private preview builds by @​eps1lon in vercel/next.js#97258
• [backport] [test] Compile the middleware redirect routes up front in dev by @​lukesandberg in vercel/next.js#97328
• [backport] Fix Nav Inspector request loop on repeat captures by @​acdlite in vercel/next.js#97326
• [backport] Fix: Optimistic routing bugs leading to repeated prefetch loops by @​acdlite in vercel/next.js#97325
• [backport] Retain fewer stale cache versions and use a TTL, plus the mtime fallback by @​lukesandberg in vercel/next.js#97304
• [backport] Revert i18n localization change for dynamic Pages API routes (#94905) by @​gaojude in vercel/next.js#97330

Full Changelog: vercel/next.js@v16.3.0...v16.3.1

... (truncated)

Commits

• a9a1cb7 v16.3.3
• d0ac882 v16.3.2
• 3d32eb8 v16.3.1
• See full diff in compare view

Updates @tanstack/react-query from 5.101.4 to 5.102.5

Release notes

Sourced from @​tanstack/react-query's releases.

@​tanstack/react-query-devtools@​5.102.5

Patch Changes

• Updated dependencies [ef1eff1]:
  • @​tanstack/query-devtools@​5.102.5
  • @​tanstack/react-query@​5.102.5

@​tanstack/react-query-next-experimental@​5.102.5

Patch Changes

• Updated dependencies []:
  • @​tanstack/react-query@​5.102.5

@​tanstack/react-query-persist-client@​5.102.5

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-persist-client-core@​5.102.5
  • @​tanstack/react-query@​5.102.5

@​tanstack/react-query@​5.102.5

Patch Changes

• Updated dependencies [578e5c2]:
  • @​tanstack/query-core@​5.102.5

Changelog

Sourced from @​tanstack/react-query's changelog.

5.102.5

Patch Changes

• Updated dependencies [578e5c2]:
  • @​tanstack/query-core@​5.102.5

5.102.4

Patch Changes

• Updated dependencies [a05df6a]:
  • @​tanstack/query-core@​5.102.4

5.102.3

Patch Changes

• Updated dependencies []:
  • @​tanstack/query-core@​5.102.3

5.102.2

Patch Changes

• Updated dependencies [80fbf73]:
  • @​tanstack/query-core@​5.102.2

5.102.1

Patch Changes

• Updated dependencies [134890d]:
  • @​tanstack/query-core@​5.102.1

5.102.0

Minor Changes

• #10668 e674826 - react-query: update usePrefetchQuery and usePrefetchInfiniteQuery to use queryClient.query and queryClient.infiniteQuery

Patch Changes

• #11245 37127db - revert: remove NoInfer from useQuery return types

• #10373 6e3d521 - fix(types): propagate generic type parameters to useMutationState select callback

• #11224 294d4e6 - Fix queryOptions and infiniteQueryOptions return types so exported inferred options can be emitted in declaration files without leaking internal data tag symbols.

• #11147 cb6c9d3 - Default TData of UseInfiniteQueryOptions and UseSuspenseInfiniteQueryOptions to InfiniteData<TQueryFnData> so it matches the hook generics.

... (truncated)

Commits

• 1836e61 ci: Version Packages (#11303)
• 51f12db ci: Version Packages (#11294)
• 730b3aa ci: Version Packages (#11276)
• 388bbaf ci: Version Packages (#11265)
• bc423b3 ci: Version Packages (#11261)
• be1352b test(*): add adapter-level type coverage for optional undefinable mutate vari...
• 5743468 ci: Version Packages (#11206)
• 2215bb0 fix(query-core): make MutateFunction optional undefinable-variables (#8737)
• d156adc test: transition tests (#11246)
• 37127db fix/11018 (#11245)
• Additional commits viewable in compare view

Updates @uswds/uswds from 3.13.0 to 3.14.0

Release notes

Sourced from @​uswds/uswds's releases.

USWDS 3.14.0

What's new in USWDS 3.14.0

Features

Package	A11y	Breaking	Markup change	Description
usa-accordion, uswds-core	Yes	Yes	Yes	Added a left-aligned expand/collapse icon option. A new $theme-accordion-icon-position setting (default: "start") lets teams set icon placement globally. The .usa-accordion--icon-start and .usa-accordion--icon-end modifier classes support per-instance placement. This improves discoverability for users viewing content at high magnification or zoom levels. Thanks @​HopeTurnerUSCIS, @​rosamundtgov, and @​jeana-adhoc! (#6789)✏️ Teams should verify layout at common zoom levels for the new default accordion behavior.
usa-breadcrumb	Yes	Yes	-	Breadcrumbs now wrap by default. The previous truncation behavior is now opt-in via the new usa-breadcrumb--truncate modifier class. Thanks @​AKnassa! (#6722) ✏️ Teams should confirm breadcrumbs display as expected and add usa-breadcrumb--truncate if they want the old truncation behavior.
usa-range	Yes	-	Yes	Added a visible hint to the range slider. A new usa-hint element with the text "Move the slider to change the value" is added above the slider so sighted users receive the same guidance that screen reader users already had. Thanks @​ravitejapioneerblaze-code! (#6673, #6811) ✏️ Teams should pull in the updated markup.
usa-range	Yes	-	-	Improved range slider border visibility. The border is now 2px and uses the base-darker theme token. A focus ring is also added to the slider input. Thanks @​manichandra! (#6659)
usa-date-picker	Yes	-	Yes	Added aria-current="date" to today's date button. Assistive technologies can now programmatically identify the current date in the calendar widget. Thanks @​daresTheDevil! (#6593)
usa-file-input	-	-	-	Error border now uses the error-dark token. The file input error state previously used secondary-dark, which could show the wrong color in projects with distinct secondary and error palettes. Thanks @​manichandra! (#6669)

Bug fixes

Package	A11y	Breaking	Markup change	Description
usa-modal	Yes	-	-	Closing a modal now always restores screen reader access to the page. If the element that opened the modal had left the document by the time the modal closed, page content kept aria-hidden="true" and stayed invisible to assistive technology until reload. Thanks @​vssinghh! (#6786)
usa-modal, uswds-core	Yes	-	Yes	Fixed modal content being read twice by screen readers. The default focus target has changed — on open, focus now moves to the first enabled button in the modal footer, or the first enabled button in the modal if no footer button is present. FocusTrap no longer uses autoFocus. (#6703)✏️ Teams should verify modal focus lands where expected after this update.
usa-memorable-date	Yes	-	Yes	Added per-field hints to the memorable date component. The component previously used a single shared hint referenced by all three fields via aria-describedby, causing screen readers to repeat the full instruction block on every field focus. Each field now has its own targeted hint. The visible group hint remains for sighted users with aria-hidden="true". (#6725)✏️ Teams should update to the new per-field hint markup. Teams supporting other languages should update their hint strings.
usa-file-input	Yes	Yes	Yes	Removed the drag instruction on mobile and coarse-pointer devices. The file input previously showed "Drag file here or choose from folder" on all devices, including mobile where drag-and-drop isn't a practical interaction. Coarse-pointer devices now show and announce "Choose from folder" only. Thanks @​manichandra! (#6660)✏️ Teams should check for layout changes and update any accessibility tests that assert the old exact instruction text.
usa-character-count	Yes	-	-	Deferred aria-live to prevent iOS VoiceOver from announcing character count on page load. Live updates continue to fire normally during typing. Thanks @​daresTheDevil! (#6595)
usa-character-count	-	-	-	Fixed the label selector so it correctly finds the associated label. Thanks @​ealexhaywood! (#6385)
usa-footer	-	Yes	-	Restricted data-tag to heading elements. The footer's big link list was vulnerable to XSS through unsanitized data-tag values. Non-heading elements now gracefully fall back to h4. Thanks @​IHIutch! (#6674)✏️ Teams should review any footer data-tag values that aren't heading elements.
usa-banner, uswds-core	-	-	-	Fixed toggle so it resolves aria-controls from the component's root node. This allows banner toggles to work correctly when used inside a shadow root. Thanks @​arpitjain099! (#6714)
uswds-core	-	-	-	Fixed the language selector Escape key handler. Thanks @​arpitjain099! (#6713)
uswds-core	-	-	-	Guarded the keymap against non-keyboard events from datalist selections. This prevents a console error when a user selects an option from a datalist. Thanks @​vijaygovindaraja! (#6594)
usa-table	-	-	-	Restored the row header border in borderless tables. Row-scoped body header cells now keep their top border so row headers don't appear visually disconnected. Thanks @​manichandra! (#6661)
usa-table	-	-	-	Fixed .usa-sr-only table caption causing heading-row border collapse. Thanks @​IHIutch! (#6633)
usa-time-picker	-	-	-	Added missing combobox style dependency to the time picker package. Thanks @​IHIutch! (#6634)
usa-input, usa-textarea, usa-range, usa-combo-box, usa-input-prefix-suffix, usa-select	-	-	-	Set box-sizing: border-box on the %block-input-styles mixin to prevent overflow. Components in host environments that reset global box sizing no longer overflow their containers. Thanks @​VenkateshAddala! (#6736)✏️ Teams should verify these elements display correctly in projects with custom global box-sizing resets (e.g. those who set $theme-global-border-box-sizing: false).
usa-in-page-navigation	-	-	-	Standardized the component's enhancement guard to use data-enhanced in line with other USWDS components. (#6688)
uswds-core	-	-	-	Fixed ink assignment referencing the wrong variable. Custom ink colors in a project's theme were referencing the wrong system token. Thanks @​nektro! (#6651)✏️ Teams should verify that custom ink colors in their theme render as expected.

Guidance changes

Alert

The alert component page now recommends that alert headings start with the alert type to improve clarity and urgency of the message, both for accessibility and general usability, as well as adding extended guidance to help teams use the correct alert type. Thanks @​jeana-adhoc and @​rosamundtgov! (uswds/uswds#3288)

Markup changes

Memorable date

The memorable date component's three fields now each have their own aria-describedby hint instead of sharing a single group hint. Teams who've copied the memorable date markup should update to the per-field pattern:

 <fieldset class="usa-fieldset">
</tr></table> 

... (truncated)

Commits

• 92391c3 Merge pull request #6822 from uswds/release-3.14.0
• fb8177f version bump and add hash file
• bad6161 Merge pull request #6821 from uswds/task/update-notifications
• 9cd57f3 update wording
• dfe087f update notifications to capture extent of changes
• dc23998 Merge pull request #6767 from uswds/bug/5852-audible-cue-character-count-exce...
• 26ff46d Merge branch 'develop' into bug/5852-audible-cue-character-count-exceeded
• 622369b Merge pull request #6817 from uswds/feature/6812-prerelease-verification
• d7863e7 Merge branch 'develop' into feature/6812-prerelease-verification
• 797e3e9 Merge pull request #6820 from uswds/task/fix-viewbox-setting-deprecation
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​uswds/uswds since your current version.

Updates i18next from 26.3.6 to 26.4.0

Release notes

Sourced from i18next's releases.

v26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

Changelog

Sourced from i18next's changelog.

26.4.0

• perf: cache toResolveHierarchy results per (code, fallbackCode) pair. The hierarchy resolver runs on every t() call and calls Intl.getCanonicalLocales multiple times, which showed up prominently when profiling render-heavy UIs (e.g. virtualized data grids); with the cache the per-call cost drops from ~886 ns to ~41 ns. The cache is invalidated automatically when options.fallbackLng changes (reassignment or in-place array mutation); if you mutate other resolution-relevant options at runtime (load, lowerCaseLng, cleanCode, nonExplicitSupportedLngs), call i18next.services.languageUtils.clearCache() afterwards. Function-valued fallbackLng and per-call array/object fallbackLng options are never cached, so dynamic fallbacks keep working as before. Thanks @​equaterina (#2444).
• chore: update all devDependencies (Babel stays on 7.x until @rollup/plugin-babel supports 8, eslint on 9.x for neostandard). Removed the unused coveralls package (CI uses the Coveralls GitHub Action) and replaced sinon with nise + vitest.spyOn in the v1 compatibility tests, which resolves all open npm audit findings (0 vulnerabilities) and should close the dependabot alerts on the lockfile.

Commits

• 652847e 26.4.0
• 6c6025f prettier fix
• 742b9a9 chore: update dependencies and clean up dev tooling
• 06924d9 fix: invalidate toResolveHierarchy cache on in-place fallbackLng mutation
• bb80369 perf: cache toResolveHierarchy (#2444)
• See full diff in compare view

Updates jose from 6.2.8 to 6.2.10

Release notes

Sourced from jose's releases.

v6.2.10

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (cc03be8)

v6.2.9

Fixes

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.10 (2026-08-21)

Fixes

• jose: consume serialization members once (9bee285)
• jose: reject empty protected and JWE AAD members (8da4145)
• jose: validate serialized header values (b711d8f)
• jwe: conceal invalid decrypted CEK lengths (41fafe0)
• jwe: enforce AES-GCM tag boundaries (9a5b744)
• jwe: validate explicit encryption parameters (7a02697)
• jwk: accept empty octet-sequence keys (3f871e7)
• jwk: normalize key resolution inputs (f54ee7b)
• jwks: enforce verification key metadata (f9ba510)
• jwks: order overlapping remote reloads (9a1a913)
• jwks: reject invalid remote duration values (7bdb9e5)
• jwk: validate ext and key_ops parameters (4d91c37)
• jws: reject mixed payload encoding modes (dc69713)
• jws: validate unencoded payload strings (541f282)
• jwt: enforce explicit verification policies (b347182)
• jwt: prevent replacing protected headers (ae07d09)
• jwt: reject invalid duration inputs (282f9aa)
• jwt: validate builder claim values (ea03f83)
• jwt: validate unsecured protected headers (230c14e)
• key: validate generation and import options (15d880e)
• reject mixed b64 modes for empty General JWS payloads (61a2ef7)
• x509: reject DER truncated past its outer length (d8db9f6)

Documentation

• jwks: correct cache timestamp units (01a44d9)

Refactor

• jose: share binary input validation (eedb124)
• jose: share compact token processing internals (85e30ed)
• jwe: consolidate CBC decryption failures (1ee6f61)
• jwe: specialize compact processing (a998927)
• jwe: streamline single-recipient encryption (290aaa6)
• jwks: compact JWK Set shape validation (930c7df), references Array#every
• jwks: compact local key selection (4cb5ae5)
• jwks: compact remote resolver state (ef5eaf4)
• jws: specialize compact processing (021abf4)
• jwt: compact claim validation helpers (f390683)
• jwt: consolidate replicated claim checks (7dd5591)
• jwt: share producer claim state (52ba159)
• key: compact JWK algorithm selection (a6b29da)
• key: compact secret length parsing (

[github-actions]

⚠️ This PR needs a label so we know which states it affects. Add one of:

• co — Colorado only
• dc — DC only
• all states — applies everywhere (use this for infra/platform changes that aren't state-specific)

While you're at it, a type label (feature, bugfix, chore, refactor, …) helps too — most are auto-applied from your branch name, see .github/labeler.yml if yours wasn't.

[datadog-engineering-non-production]

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 2 Pipeline jobs failed

Release IIS Package — DC | Build DC IIS bundle

View in Datadog · View in GitHub Actions

Missing required input 'client-id' for creating GitHub app token.

Require State Label | check-state-label

View in Datadog · View in GitHub Actions

Missing required state label (co, dc, or all states) during execution of check-state-label job.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 319c189 | Docs | View more details | Give us feedback!}

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.