chore(deps): Bump jsonpath-plus from 10.4.0 to 11.2.0

[dependabot]

Bumps jsonpath-plus from 10.4.0 to 11.2.0.

Release notes

Sourced from jsonpath-plus's releases.

v10.4.1

What's Changed

• build(deps): bump minimatch from 3.1.2 to 3.1.4 by @​dependabot[bot] in JSONPath-Plus/JSONPath#255
• build(deps): bump markdown-it from 14.1.0 to 14.1.1 by @​dependabot[bot] in JSONPath-Plus/JSONPath#251
• build(deps): bump qs from 6.14.0 to 6.14.2 by @​dependabot[bot] in JSONPath-Plus/JSONPath#252
• build(deps): bump ajv from 6.12.6 to 6.14.0 by @​dependabot[bot] in JSONPath-Plus/JSONPath#253
• build(deps): bump serialize-javascript from 6.0.2 to 7.0.5 (via audit fix) by @​dependabot[bot] in JSONPath-Plus/JSONPath#260
• build(deps): bump minimatch from 9.0.5 to 9.0.9 by @​dependabot[bot] in JSONPath-Plus/JSONPath#262
• build(deps-dev): bump rollup from 4.53.2 to 4.59.0 by @​dependabot[bot] in JSONPath-Plus/JSONPath#257
• fix(slice): explicit zero end no longer returns the whole array by @​spokodev in JSONPath-Plus/JSONPath#265

New Contributors

• @​spokodev made their first contribution in JSONPath-Plus/JSONPath#265

Full Changelog: JSONPath-Plus/JSONPath@v10.4.0...v10.4.1

Changelog

Sourced from jsonpath-plus's changelog.

11.2.0

• feat: allow arg to other type callbacks
• feat: add @​symbol, @​Promise, @​jsonReference other types
• feat: add separate optional imports for structuredCloning and extra javascript types

11.1.1

• fix: avoid treating at sign within regex as current context; fixes #280

11.1.0

• fix: allow bare @ in any position (e.g., $[?(@>1)], $[?(@)], $[?(!@)]) and stop rewriting @ inside quoted string literals (@​spokodev)
• fix: support unions of quoted property names (e.g., $['x','y'], $["a,b",'c.d']) as literal names (fixes #159; see #268)
• fix: support quoted property names containing commas (e.g., $['a,b'])
• fix: support \', \", and \\ escapes within quoted property names and escape ' and \ in toPathString output so paths round-trip

11.0.1

• fix(security) nested filter bypass exploit (@​andrewmacheret)

11.0.0

BREAKING CHANGES

• Require Node >= 22; drops older browser version support

• JSONPath.cache is no longer exposed or mutable. Consumers that used JSONPath.cache to inspect, modify, or clear entries must remove that usage and call JSONPath.clearCache() when cache invalidation is needed.

• chore: bump engines and browserslist and use v flag

• chore: various changes in types, particularly with return values changing from any to unknown to ensure type safety (by forcing type casts of the results on the user).

• fix!: isolate caches and add cache reset API

Other changes:

• feat: add customTypes option for providing own other type callbacks (e.g., @blob()) (@​brettz9)
• fix(slice): explicit zero end no longer returns the whole array (#265) (@​spokodev)
• fix: indicate that the OtherTypeCallback callback type can accept a parentPropName with type number (@​brettz9)
• fix: separate JSONPath path and script caches (@​brettz9)
• fix: restore JSONPath.prototype.evaluate, safeVm, and vm compatibility
• fix(safe-eval): harden operator lookup against prototype inheritance (@​brettz9)
• fix(security): block indirect Function-constructor access in safe eval (reported by @c0rydoras: Arthur Deierlein <info@c0rydoras.dev>)
• refactor: expose JSONPathClass prototype through JSONPath for compatibility
• docs: security notes
• test(safe-eval): guard bind() escape route for constructor access (@​brettz9)

... (truncated)

Commits

• c9fe7b5 chore: update docs
• e857a3c chore: pnpm lock upgrade/dedupe
• 41f4532 chore: update devDeps.
• 72dc3b4 feat: allow arg to other type callbacks
• ed83f1f fix(at signs): tighter regex (with lookbehind)
• e91b6b6 build(deps): bump markdown-it from 14.3.0 to 14.3.2
• 9c3dbc4 build(deps): bump undici from 6.28.0 to 6.29.0
• fc12b59 chore(typedoc): use config file (to specify highlight languages)
• 81abdd8 docs: point to upstream
• 60a521b chore: update docs
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mydevtools-tech	Ready	Preview	Oct 13, 2026 1:25am UTC