[posit-snyk-bot]

Snyk has created this PR to upgrade slimdom from 4.2.0 to 4.3.5.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 6 versions ahead of your current version.

• The recommended version was released 3 years ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: slimdom

• 4.3.5 - 2024-04-01
  
  • Add location info to the error that's thrown when an end tag is missing

  Full Changelog: 4.3.4...4.3.5

• 4.3.4 - 2024-03-15
  
  • Add "types" to the "exports" section of package.json by @ jkonowitch in #150 (thanks!)
  • Update (most) devDependencies to their latest versions

  Full Changelog: 4.3.3...4.3.4

• 4.3.3 - 2023-12-21
  
  • Also guard against entity expansion attacks in attribute values

  Full Changelog: 4.3.2...4.3.3

• 4.3.2 - 2023-10-19
  
  • Fix a few serialization issues introduced in 4.3.1.

  Full Changelog: 4.3.1...4.3.2

• 4.3.1 - 2023-10-19
  
  • This release reworks the way namespace prefixes are determined during serialization. Previous releases used the algorithm from the DOM parsing & serialization spec, which unfortunately contains a number of bugs that produce incorrect or invalid serializations in some edge cases.

  Full Changelog: 4.3.0...4.3.1

• 4.3.0 - 2023-08-03
  
  • Added option to parse CDATA as normal text

  Full Changelog: 4.2.0...4.3.0

• 4.2.0 - 2023-06-01
  
  • Added heuristics to block entity expansion attacks. Parsing is aborted if the output size exceeds a certain limit and the size increase due to entity expansion exceeds a set factor. Both this approach and the default limits are based on how libexpat guards against such attacks. Please file an issue if you have to increase these limits for any real-world document.

  Full Changelog: 4.1.1...4.2.0

from slimdom GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[posit-snyk-bot]

This is a minor version upgrade. A changelog or release notes for the version range 4.2.0 to 4.3.5 could not be found, which prevents a definitive analysis of breaking changes.

Given the lack of documentation, the risk is assessed as medium due to uncertainty.

Recommendation: Review the package's behavior after the upgrade, focusing on any areas where it is used, to ensure it has not impacted your application.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cderv]

Closing in favor of #15151. This package.json belongs to the Node-runtime spike in dev-docs/runtime-migration/ — frozen, throwaway evidence tooling whose pinned versions don't flow into shipped quarto code (the real sources get these deps via src/import_map.json / packages/ojs). Merging all 8 spike PRs individually would leave 7 of them conflicted; one representative merge records the "we don't take Snyk bumps here" signal. A request has been filed to disable upgrade PRs for this Project in the Snyk UI.