[posit-snyk-bot]

Snyk has created this PR to upgrade fontoxpath from 3.29.1 to 3.34.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 10 versions ahead of your current version.

• The recommended version was released 10 months ago.

Breaking Change Risk

Notice: This assessment is enhanced by AI.

Release notes

Package name: fontoxpath

• 3.34.0 - 2025-12-24
  

  What's Changed

  • Statically compile type test for instance of operator by @ DrRataplan in #680
  • Add addition and substraction of xs:dayTimeDuration() by @ aheissenberger in #677
  • Implement otherwise and combinating tests from XQ4 by @ DrRataplan in #660

  New Contributors

  • @ aheissenberger made their first contribution in #677

  Full Changelog: 3.33.2...3.34.0

• 3.33.2 - 2025-03-24
  

  What's Changed

  • Fix handling of AST expressions in fontoxpath:evaluate error handling by @ bwrrp in #673

  Full Changelog: 3.33.1...3.33.2

• 3.33.1 - 2025-03-11
  

  What's Changed

  • Fix demo page by @ DrRataplan in #659
  • Parse StringConstructors by @ DrRataplan in #658
  • Fix contextItemAsFirstArgument to check type of contextItem by @ DrRataplan in #671

  Full Changelog: 3.33.0...3.33.1

• 3.33.0 - 2024-08-13
  

  New features

  • Implement the fn:generate-id function by @ egh in #641

  Fixed issues

  • Atomize document fragments (fix for #643) by @ egh in #644

  Full Changelog: 3.32.0...3.33.0

• 3.32.0 - 2024-05-28
  

  New features

  • Implement the fn:lang function by @ egh in #639. Thanks!

  Full Changelog: 3.31.0...3.32.0

• 3.31.0 - 2024-05-16
  

  New features

  • Implemented switch expression by @ DrRataplan in #620

  Fixed issues

  • Fixed tokenize with capture groups by @ DrRataplan in #638

  Full Changelog: 3.30.3...3.31.0

• 3.30.3 - 2024-02-07
  

  What's Changed

  • Print and rethrow errors thrown during parsing in registerXQueryModule

  Full Changelog: 3.30.2...3.30.3

• 3.30.2 - 2023-10-11
  

  Fixed issues

  • Errors in functions now show the function name in stack traces, and more small improvements

  Full Changelog: 3.30.1...3.30.2

• 3.30.1 - 2023-09-07
  

  Fixed issues

  Fix intersecting buckets in strange path expressions
  The bucket for the getNextSibling call in DomFacade for following-sibling::node()[1][self::xxx] is
  not the same as the bucket in the following-sibling::node()[self::xxx][1] query

• 3.30.0 - 2023-08-24
  

  New features:

  • We now support more locales for format-integer: Greek, Hebrew and Arab are now supported! Thanks @ drex04 for the work!

  ---

  Fixed issues

  • Do not parse prefixes as reserved function names
  • Set attributes using the localname and namespace instead of nodename when using XQUF
  • Remove recursions from array:flatten function
  • Allow map operator to be evaluated statically, preventing a crash later on
  • Fix text() not selecting CDATA sections

  Full Changelog: 3.29.1...3.30.0

• 3.29.1 - 2023-04-13

from fontoxpath GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[posit-snyk-bot]

This is a minor version upgrade for fontoxpath from 3.29.1 to 3.34.0.

Analysis of the release notes between these versions indicates that the changes primarily consist of new features and bug fixes. For example, version 3.34.0 adds support for xs:dayTimeDuration arithmetic and improves static compilation. No breaking changes, API deprecations, or mandatory migrations were identified in the release notes for the versions within this range.

Source: GitHub Releases

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cderv]

Closing in favor of #15151. This package.json belongs to the Node-runtime spike in dev-docs/runtime-migration/ — frozen, throwaway evidence tooling whose pinned versions don't flow into shipped quarto code (the real sources get these deps via src/import_map.json / packages/ojs). Merging all 8 spike PRs individually would leave 7 of them conflicted; one representative merge records the "we don't take Snyk bumps here" signal. A request has been filed to disable upgrade PRs for this Project in the Snyk UI.