trails-cool/trails
Watch
1
1
Fork
You've already forked trails
 0
Code Issues 2 Pull requests Projects Releases Packages Activity Actions 10

chore(deps): Update dependency path-to-regexp@<0.1.13 to v8 #44

Closed
renovate wants to merge 1 commit from renovate/path-to-regexp-0.1.13-8.x into main
pull from: renovate/path-to-regexp-0.1.13-8.x
merge into: trails-cool:main
Conversation 2 Commits 1 Files changed 2 +8 -6
renovate commented 2026-07-28 07:25:55 +00:00
Collaborator
Copy link

This PR contains the following updates:

Package Change Age Confidence
path-to-regexp@<0.1.13 0.2.5 → 8.4.2 age confidence

Release Notes

pillarjs/path-to-regexp (path-to-regexp@<0.1.13)

v8.4.2

Compare Source

Fixed

Performance

  • Minimize array allocations (#​437) 937c02d
  • Improve compile performance (#​436) 57247e6
    • Should improve compilation performance by ~25%
  • Remove internal tokenization during parse (#​435) 5844988
    • Should improve parse performance by ~20%

Bundle size to 1.93 kB, from 1.97 kB.

v8.4.1

Compare Source

Fixed

  • Remove trie deduplication (#​431) 6bc8e84
    • Using a trie required non-greedy matching, which regressed wildcards in non-ending mode by matching them up until the first match. For example:
      • /*foo with /a/b = /a
      • /*foo.htmlwith /a/b.html/c.html = /a/b.html
  • Allow backtrack handling to match itself (#​427) 5bcd30b
    • When backtracking was introduced, it rejected matching things like /:"a"_:"b" against /foo__. This makes intuitive sense because the second parameter is not going to backtrack on _ anymore, but it's somewhat unexpected since there's no reason it shouldn't match the second _.

v8.4.0

Compare Source

Important

Fixed

  • Restricts wildcard backtracking when using more than 1 in a path (#​421)

Changed

  • Dedupes regex prefixes (#​422)
    • This will result in shorter regular expressions for some cases using optional groups
  • Rejects large optional route combinations (#​424)
    • When using groups such as /users{/delete} it will restrict the number of generated combinations to < 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes

v8.3.0

Compare Source

Changed

Other

v8.2.0

Compare Source

Fixed

  • Allowing path-to-regexp to run on older browsers by targeting ES2015
    • Target ES2015 5969033
      • Also saved 0.22kb (10%!) by removing the private class field down level
    • Remove s flag from regexp 51dbd45

v8.1.0

Compare Source

Added

  • Adds pathToRegexp method back for generating a regex
  • Adds stringify method for converting TokenData into a path string

v8.0.0: Simpler API

Compare Source

Heads up! This is a fairly large change (again) and I need to apologize in advance. If I foresaw what this version would have ended up being I would not have released version 7. A longer blog post and explanation will be incoming this week, but the pivot has been due to work on Express.js v5 and this will the finalized syntax used in Express moving forward.

Edit: The post is out - https://blakeembrey.com/posts/2024-09-web-redos/

Added

  • Adds key names to wildcards using *name syntax, aligns with : behavior but using an asterisk instead

Changed

  • Removes group suffixes of ?, +, and * - only optional exists moving forward (use wildcards for +, {*foo} for *)
  • Parameter names follow JS identifier rules and allow unicode characters

Added

  • Parameter names can now be quoted, e.g. :"foo-bar"
  • Match accepts an array of values, so the signature is now string | TokenData | Array<string | TokenData>

Removed

  • Removes loose mode
  • Removes regular expression overrides of parameters

v7.2.0: Support array inputs (again)

Compare Source

Added

  • Support array inputs for match and pathToRegexp 3fdd88f

v7.1.0: Strict mode

Compare Source

Added

  • Adds a strict option to detect potential ReDOS issues

Fixed

  • Fixes separator to default to suffix + prefix when not specified
  • Allows separator to be undefined in TokenData
    • This is only relevant if you are building TokenData manually, previously parse filled it in automatically

Comments

  • I highly recommend enabling strict: true and I'm probably releasing a V8 with it enabled by default ASAP as a necessary security mitigation

v7.0.0: Wildcard, unicode, and modifier changes

Compare Source

Hi all! There's a few major breaking changes in this release so read carefully.

Breaking changes:

  • The function returned by compile only accepts strings as values (i.e. no numbers, use String(value) before compiling a path)
    • For repeated values, when encode !== false, it must be an array of strings
  • Parameter names can contain all unicode identifier characters (defined as regex \p{XID_Continue}).
  • Modifiers (?, *, +) must be used after a param explicitly wrapped in {}
    • No more implied prefix of / or .
  • No support for arrays or regexes as inputs
  • The wildcard (standalone *) has been added back and matches Express.js expected behavior
  • Removed endsWith option
  • Renamed strict: true to trailing: false
  • Reserved ;, ,, !, and @ for future use-cases
  • Removed tokensToRegexp, tokensToFunction and regexpToFunction in favor of simplifying exports
  • Enable a "loose" mode by default, so / can be repeated multiple times in a matched path (i.e. /foo works like //foo, etc)
  • encode and decode no longer receive the token as the second parameter
  • Removed the ESM + CommonJS dual package in favor of only one CommonJS supported export
  • Minimum JS support for ES2020 (previous ES2015)
  • Encode defaults to encodeURIComponent and decode defaults to decodeURIComponent

Added:

  • Adds encodePath to fix an issue around encode being used for both path and parameters (the path and parameter should be encoded slightly differently)
  • Adds loose as an option to support arbitrarily matching the delimiter in paths, e.g. foo/bar and foo///bar should work the same
  • Allow encode and decode to be set to false which skips all processing of the parameters input/output
  • All remaining methods support TokenData (exported, returned by parse) as input
    • This should be useful if you are programmatically building paths to match or want to avoid parsing multiple times

Requests for feedback:

  • Requiring {} is an obvious drawback but I'm seeking feedback on whether it helps make path behavior clearer
    • Related: Removing / and . as implicit prefixes
  • Removing array and regex support is to reduce the overall package size for things many users don't need
  • Unicode IDs are added to align more closely with browser URLPattern behavior, which uses JS identifiers

v6.3.0: Fix backtracking in 6.x

Compare Source

Fixed

v6.2.2: Updated README

Compare Source

No API changes. Documentation only release.

Changed

v6.2.1: Fix matching :name* parameter

Compare Source

Fixed

  • Fix invalid matching of :name* parameter (#​261) 762bc6b
  • Compare delimiter string over regexp 86baef8

Added

v6.2.0: Named Capturing Groups

Compare Source

Added

  • Support named capturing groups for RegExps (#​225)

Fixed

  • Update strict flag documentation (#​227)
  • Ignore test files when bundling (#​220)

v6.1.0: Use /#? as Default Delimiter

Compare Source

Fixed

  • Use /#? as default delimiter to avoid matching on query or fragment parameters
    • If you are matching non-paths (e.g. hostnames), you can adjust delimiter: '.'

v6.0.0: Custom Prefix and Suffix Groups

Compare Source

This release reverts the prefix behavior added in v3 back to the behavior seen in v2. For the most part, path matching is backward compatible with v2 with these enhancements:

  1. Support for nested non-capturing groups in regexp, e.g. /(abc(?=d))
  2. Support for custom prefix and suffix groups using /{abc(.*)def}
  3. Tokens in an unexpected position will throw an error
    • Paths like /test(foo previously worked treating ( as a literal character, now it expects ( to be closed and is treated as a group
    • You can escape the character for the previous behavior, e.g. /test\(foo

Changed

  • Revert using any character as prefix, support prefixes option to configure this (starts as /. which acts like every version since 0.x again)
  • Add support for {} to capture prefix/suffix explicitly, enables custom use-cases like /:attr1{-:attr2}?

v5.0.0: Remove Default Encode URI Component

Compare Source

No changes to path rules since 3.x, except support for nested RegEx parts in 4.x.

Changed

  • Rename RegexpOptions interface to TokensToRegexpOptions
  • Remove normalizePathname from library, document solution in README
  • Encode using identity function as default, not encodeURIComponent

v4.0.5: Decode URI

Compare Source

Removed

  • Remove whitelist in favor of decodeURI (advanced behavior can happen outside path-to-regexp)

v4.0.4: Remove String#normalize

Compare Source

Fixed

  • Remove usage of String.prototype.normalize to continue supporting IE

v4.0.3: Normalize Path Whitelist

Compare Source

Added

  • Add normalize whitelist of characters (defaults to /%.-)

v4.0.2: Allow RegexpOptions in match

Compare Source

Fixed

  • Allow RegexpOptions in match(...) function

v4.0.1: Fix Spelling of Regexp

Compare Source

Fixed

  • Normalize regexp spelling across 4.x

v4.0.0: ES2015 Package for Bundlers

Compare Source

All path rules are backward compatible with 3.x, except for nested () and other RegEx special characters that were previously ignored.

Changed

  • Export names have changed to support ES2015 modules in bundlers
  • match does not default to decodeURIComponent

Added

  • New normalizePathname utility for supporting unicode paths in libraries
  • Support nested non-capturing groups within parameters
  • Add tree-shaking (via ES2015 modules) for webpack and other bundlers

v3.3.0: Add backtracking protection

Compare Source

Fixed

v3.2.0: Match Function

Compare Source

Added

  • Add native match function to library

v3.1.0: Validate and sensitive options

Compare Source

  • Add sensitive option for tokensToFunction (#​191)
  • Add validate option to path functions (#​178)

v3.0.0

Compare Source

  • Always use prefix character as delimiter token, allowing any character to be a delimiter (e.g. /:att1-:att2-:att3-:att4-:att5)
  • Remove partial support, prefer escaping the prefix delimiter explicitly (e.g. \\/(apple-)?icon-:res(\\d+).png)

v2.4.0

Compare Source

  • Support start option to disable anchoring from beginning of the string

v2.3.0

Compare Source

  • Use delimiter when processing repeated matching groups (e.g. foo/bar has no prefix, but has a delimiter)

v2.2.1

Compare Source

  • Allow empty string with end: false to match both relative and absolute paths

v2.2.0

Compare Source

  • Pass token as second argument to encode option (e.g. encode(value, token))

v2.1.0

Compare Source

  • Handle non-ending paths where the final character is a delimiter
    • E.g. /foo/ before required either /foo/ or /foo// to match in non-ending mode

v2.0.0

Compare Source

  • New option! Ability to set endsWith to match paths like /test?query=string up to the query string
  • New option! Set delimiters for specific characters to be treated as parameter prefixes (e.g. /:test)
  • Remove isarray dependency
  • Explicitly handle trailing delimiters instead of trimming them (e.g. /test/ is now treated as /test/ instead of /test when matching)
  • Remove overloaded keys argument that accepted options
  • Remove keys list attached to the RegExp output
  • Remove asterisk functionality (it's a real pain to properly encode)
  • Change tokensToFunction (e.g. compile) to accept an encode function for pretty encoding (e.g. pass your own implementation)

v1.9.0: Fix backtracking in 1.x

Compare Source

Fixed

v1.8.0: Backport token to function options

Compare Source

Added

  • Backport TokensToFunctionOptions

v1.7.0

Compare Source

  • Allow a delimiter option to be passed in with tokensToRegExp which will be used for "non-ending" token match situations

v1.6.0

Compare Source

  • Populate RegExp.keys when using the tokensToRegExp method (making it consistent with the main export)
  • Allow a delimiter option to be passed in with parse
  • Updated TypeScript definition with Keys and Options updated

v1.5.3

Compare Source

  • Add \\ to the ignore character group to avoid backtracking on mismatched parens

v1.5.2

Compare Source

  • Escape \\ in string segments of regexp

v1.5.1

Compare Source

  • Add index.d.ts to NPM package

v1.5.0

Compare Source

  • Handle partial token segments (better)
  • Allow compile to handle asterisk token segments

v1.4.0

Compare Source

  • Handle RegExp unions in path matching groups

v1.3.0

Compare Source

  • Clarify README language and named parameter token support
  • Support advanced Closure Compiler with type annotations
  • Add pretty paths options to compiled function output
  • Add TypeScript definition to project
  • Improved prefix handling with non-complete segment parameters (E.g. /:foo?-bar)

v1.2.1

Compare Source

  • Encode values before validation with path compilation function
  • More examples of using compilation in README

v1.2.0

Compare Source

  • Add support for matching an asterisk (*) as an unnamed match everything group ((.*))

v1.1.1

Compare Source

  • Expose methods for working with path tokens

v1.1.0

Compare Source

  • Expose the parser implementation to consumers
  • Implement a compiler function to generate valid strings
  • Huge refactor of tests to be more DRY and cover new parse and compile functions
  • Use chai in tests
  • Add .editorconfig

v1.0.3

Compare Source

  • Optimised function runtime
  • Added files to package.json

v1.0.2

Compare Source

  • Use Array.isArray shim
  • Remove ES5 incompatible code
  • Fixed repository path
  • Added new readme badges

v1.0.1

Compare Source

  • Ensure installation works correctly on 0.8

v1.0.0

Compare Source

  • No more API changes

Configuration

📅 Schedule: (in timezone Europe/Copenhagen)

  • Branch creation
    • "before 6am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [path-to-regexp@<0.1.13](https://github.com/pillarjs/path-to-regexp) | [`0.2.5` → `8.4.2`](https://renovatebot.com/diffs/npm/path-to-regexp@<0.1.13/0.2.5/8.4.2) | ![age](https://developer.mend.io/api/mc/badges/age/npm/path-to-regexp/8.4.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/path-to-regexp/0.2.5/8.4.2?slim=true) | --- ### Release Notes <details> <summary>pillarjs/path-to-regexp (path-to-regexp@<0.1.13)</summary> ### [`v8.4.2`](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.2) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v8.4.1...v8.4.2) **Fixed** - Error on trailing backslash ([#&#8203;434](https://github.com/pillarjs/path-to-regexp/issues/434)) [`9a78879`](https://github.com/pillarjs/path-to-regexp/commit/9a78879) **Performance** - Minimize array allocations ([#&#8203;437](https://github.com/pillarjs/path-to-regexp/issues/437)) [`937c02d`](https://github.com/pillarjs/path-to-regexp/commit/937c02d) - Improve compile performance ([#&#8203;436](https://github.com/pillarjs/path-to-regexp/issues/436)) [`57247e6`](https://github.com/pillarjs/path-to-regexp/commit/57247e6) - Should improve compilation performance by \~25% - Remove internal tokenization during parse ([#&#8203;435](https://github.com/pillarjs/path-to-regexp/issues/435)) [`5844988`](https://github.com/pillarjs/path-to-regexp/commit/5844988) - Should improve parse performance by \~20% **Bundle size** to 1.93 kB, from 1.97 kB. *** ### [`v8.4.1`](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.1) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v8.4.0...v8.4.1) **Fixed** - Remove trie deduplication ([#&#8203;431](https://github.com/pillarjs/path-to-regexp/issues/431)) [`6bc8e84`](https://github.com/pillarjs/path-to-regexp/commit/6bc8e84) - Using a trie required non-greedy matching, which regressed wildcards in non-ending mode by matching them up until the first match. For example: - `/*foo` with `/a/b` = `/a` - `/*foo.html`with `/a/b.html/c.html` = `/a/b.html` - Allow backtrack handling to match itself ([#&#8203;427](https://github.com/pillarjs/path-to-regexp/issues/427)) [`5bcd30b`](https://github.com/pillarjs/path-to-regexp/commit/5bcd30b) - When backtracking was introduced, it rejected matching things like `/:"a"_:"b"` against `/foo__`. This makes intuitive sense because the second parameter is not going to backtrack on `_` anymore, but it's somewhat unexpected since there's no reason it shouldn't match the second `_`. *** ### [`v8.4.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.4.0) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v8.3.0...v8.4.0) **Important** - Fix [CVE-2026-4926](https://www.cve.org/CVERecord?id=CVE-2026-4926) ([GHSA-j3q9-mxjg-w52f](https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-j3q9-mxjg-w52f)) - Fix [CVE-2026-4923](https://www.cve.org/CVERecord?id=CVE-2026-4923) ([GHSA-27v5-c462-wpq7](https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-27v5-c462-wpq7)) **Fixed** - Restricts wildcard backtracking when using more than 1 in a path ([#&#8203;421](https://github.com/pillarjs/path-to-regexp/pull/421)) **Changed** - Dedupes regex prefixes ([#&#8203;422](https://github.com/pillarjs/path-to-regexp/pull/422)) - This will result in shorter regular expressions for some cases using optional groups - Rejects large optional route combinations ([#&#8203;424](https://github.com/pillarjs/path-to-regexp/pull/424)) - When using groups such as `/users{/delete}` it will restrict the number of generated combinations to < 256, equivalent to 8 top-level optional groups and unlikely to occur in a real world application, but avoids exploding the regex size for applications that accept user created routes ### [`v8.3.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.3.0) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v8.2.0...v8.3.0) **Changed** - Add custom error class ([#&#8203;398](https://github.com/pillarjs/path-to-regexp/issues/398)) [`2a7f2a4`](https://github.com/pillarjs/path-to-regexp/commit/2a7f2a4) - Allow plain objects for `TokenData` ([#&#8203;391](https://github.com/pillarjs/path-to-regexp/issues/391)) [`687a9bb`](https://github.com/pillarjs/path-to-regexp/commit/687a9bb) - Escape text should escape backslash ([#&#8203;390](https://github.com/pillarjs/path-to-regexp/issues/390)) [`a4a8552`](https://github.com/pillarjs/path-to-regexp/commit/a4a8552) - Improved error messages and stack size ([#&#8203;363](https://github.com/pillarjs/path-to-regexp/issues/363)) [`a6bdf40`](https://github.com/pillarjs/path-to-regexp/commit/a6bdf40) **Other** - Minifying the parser - PR ([#&#8203;401](https://github.com/pillarjs/path-to-regexp/issues/401)) [`9df2448`](https://github.com/pillarjs/path-to-regexp/commit/9df2448) - PR ([#&#8203;395](https://github.com/pillarjs/path-to-regexp/issues/395)) [`4a91505`](https://github.com/pillarjs/path-to-regexp/commit/4a91505) - Shaving some bytes [`d63f44b`](https://github.com/pillarjs/path-to-regexp/commit/d63f44b) - Remove optional operator [`973d15c`](https://github.com/pillarjs/path-to-regexp/commit/973d15c) ### [`v8.2.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.2.0) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v8.1.0...v8.2.0) **Fixed** - Allowing `path-to-regexp` to run on older browsers by targeting ES2015 - Target ES2015 [`5969033`](https://github.com/pillarjs/path-to-regexp/commit/5969033) - Also saved *0.22kb* (10%!) by removing the private class field down level - Remove `s` flag from regexp [`51dbd45`](https://github.com/pillarjs/path-to-regexp/commit/51dbd45) ### [`v8.1.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.1.0) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v8.0.0...v8.1.0) **Added** - Adds `pathToRegexp` method back for generating a regex - Adds `stringify` method for converting `TokenData` into a path string ### [`v8.0.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0): Simpler API [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v7.2.0...v8.0.0) Heads up! This is a fairly large change (again) and I need to apologize in advance. If I foresaw what this version would have ended up being I would not have released version 7. A longer blog post and explanation will be incoming this week, but the pivot has been due to work on Express.js v5 and this will the finalized syntax used in Express moving forward. Edit: The post is out - <https://blakeembrey.com/posts/2024-09-web-redos/> **Added** - Adds key names to wildcards using `*name` syntax, aligns with `:` behavior but using an asterisk instead **Changed** - Removes group suffixes of `?`, `+`, and `*` - only optional exists moving forward (use wildcards for `+`, `{*foo}` for `*`) - Parameter names follow JS identifier rules and allow unicode characters **Added** - Parameter names can now be quoted, e.g. `:"foo-bar"` - Match accepts an array of values, so the signature is now `string | TokenData | Array<string | TokenData>` **Removed** - Removes `loose` mode - Removes regular expression overrides of parameters ### [`v7.2.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v7.2.0): Support array inputs (again) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v7.1.0...v7.2.0) **Added** - Support array inputs for `match` and `pathToRegexp` [`3fdd88f`](https://github.com/pillarjs/path-to-regexp/commit/3fdd88f) ### [`v7.1.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0): Strict mode [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v7.0.0...v7.1.0) **Added** - Adds a `strict` option to detect potential ReDOS issues **Fixed** - Fixes separator to default to `suffix + prefix` when not specified - Allows separator to be undefined in `TokenData` - This is only relevant if you are building `TokenData` manually, previously `parse` filled it in automatically **Comments** - I highly recommend enabling `strict: true` and I'm *probably* releasing a V8 with it enabled by default ASAP as a necessary security mitigation ### [`v7.0.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v7.0.0): Wildcard, unicode, and modifier changes [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v6.3.0...v7.0.0) Hi all! There's a few major breaking changes in this release so read carefully. **Breaking changes:** - The function returned by `compile` only accepts strings as values (i.e. no numbers, use `String(value)` before compiling a path) - For repeated values, when `encode !== false`, it must be an array of strings - Parameter names can contain all unicode identifier characters (defined as regex `\p{XID_Continue}`). - Modifiers (`?`, `*`, `+`) must be used after a param explicitly wrapped in `{}` - No more implied prefix of `/` or `.` - No support for arrays or regexes as inputs - The wildcard (standalone `*`) has been added back and matches Express.js expected behavior - Removed `endsWith` option - Renamed `strict: true` to `trailing: false` - Reserved `;`, `,`, `!`, and `@` for future use-cases - Removed `tokensToRegexp`, `tokensToFunction` and `regexpToFunction` in favor of simplifying exports - Enable a "loose" mode by default, so `/` can be repeated multiple times in a matched path (i.e. `/foo` works like `//foo`, etc) - `encode` and `decode` no longer receive the token as the second parameter - Removed the ESM + CommonJS dual package in favor of only one CommonJS supported export - Minimum JS support for ES2020 (previous ES2015) - Encode defaults to `encodeURIComponent` and decode defaults to `decodeURIComponent` **Added:** - Adds `encodePath` to fix an issue around `encode` being used for both path and parameters (the path and parameter should be encoded slightly differently) - Adds `loose` as an option to support arbitrarily matching the delimiter in paths, e.g. `foo/bar` and `foo///bar` should work the same - Allow `encode` and `decode` to be set to `false` which skips all processing of the parameters input/output - All remaining methods support `TokenData` (exported, returned by `parse`) as input - This should be useful if you are programmatically building paths to match or want to avoid parsing multiple times **Requests for feedback:** - Requiring `{}` is an obvious drawback but I'm seeking feedback on whether it helps make path behavior clearer - Related: Removing `/` and `.` as implicit prefixes - Removing array and regex support is to reduce the overall package size for things many users don't need - Unicode IDs are added to align more closely with browser URLPattern behavior, which uses JS identifiers ### [`v6.3.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0): Fix backtracking in 6.x [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v6.2.2...v6.3.0) **Fixed** - Add backtrack protection to 6.x ([#&#8203;324](https://github.com/pillarjs/path-to-regexp/issues/324)) [`f1253b4`](https://github.com/pillarjs/path-to-regexp/commit/f1253b4) ### [`v6.2.2`](https://github.com/pillarjs/path-to-regexp/releases/tag/v6.2.2): Updated README [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v6.2.1...v6.2.2) No API changes. Documentation only release. **Changed** - Fix readme example [`c7ec332`](https://github.com/pillarjs/path-to-regexp/commit/c7ec332) - Update shield URL [`e828000`](https://github.com/pillarjs/path-to-regexp/commit/e828000) ### [`v6.2.1`](https://github.com/pillarjs/path-to-regexp/releases/tag/v6.2.1): Fix matching `:name*` parameter [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v6.2.0...v6.2.1) **Fixed** - Fix invalid matching of `:name*` parameter ([#&#8203;261](https://github.com/pillarjs/path-to-regexp/issues/261)) [`762bc6b`](https://github.com/pillarjs/path-to-regexp/commit/762bc6b) - Compare delimiter string over regexp [`86baef8`](https://github.com/pillarjs/path-to-regexp/commit/86baef8) **Added** - New example in documentation ([#&#8203;256](https://github.com/pillarjs/path-to-regexp/issues/256)) [`ae9e576`](https://github.com/pillarjs/path-to-regexp/commit/ae9e576) - Update demo link ([#&#8203;250](https://github.com/pillarjs/path-to-regexp/issues/250)) [`77df638`](https://github.com/pillarjs/path-to-regexp/commit/77df638) - Update README encode example [`b39edd4`](https://github.com/pillarjs/path-to-regexp/commit/b39edd4) ### [`v6.2.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v6.2.0): Named Capturing Groups [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v6.1.0...v6.2.0) **Added** - Support named capturing groups for RegExps ([#&#8203;225](https://github.com/pillarjs/path-to-regexp/issues/225)) **Fixed** - Update `strict` flag documentation ([#&#8203;227](https://github.com/pillarjs/path-to-regexp/issues/227)) - Ignore test files when bundling ([#&#8203;220](https://github.com/pillarjs/path-to-regexp/issues/220)) ### [`v6.1.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v6.1.0): Use `/#?` as Default Delimiter [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v6.0.0...v6.1.0) **Fixed** - Use `/#?` as default delimiter to avoid matching on query or fragment parameters - If you are matching non-paths (e.g. hostnames), you can adjust `delimiter: '.'` ### [`v6.0.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v6.0.0): Custom Prefix and Suffix Groups [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v5.0.0...v6.0.0) This release reverts the prefix behavior added in v3 back to the behavior seen in v2. For the most part, path matching is backward compatible with v2 with these enhancements: 1. Support for nested non-capturing groups in regexp, e.g. `/(abc(?=d))` 2. Support for custom prefix and suffix groups using `/{abc(.*)def}` 3. Tokens in an unexpected position will throw an error - Paths like `/test(foo` previously worked treating `(` as a literal character, now it expects `(` to be closed and is treated as a group - You can escape the character for the previous behavior, e.g. `/test\(foo` **Changed** - Revert using any character as prefix, support `prefixes` option to configure this (starts as `/.` which acts like every version since 0.x again) - Add support for `{}` to capture prefix/suffix explicitly, enables custom use-cases like `/:attr1{-:attr2}?` ### [`v5.0.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v5.0.0): Remove Default Encode URI Component [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v4.0.5...v5.0.0) No changes to path rules since 3.x, except support for nested RegEx parts in 4.x. **Changed** - Rename `RegexpOptions` interface to `TokensToRegexpOptions` - Remove `normalizePathname` from library, document solution in README - Encode using identity function as default, not `encodeURIComponent` ### [`v4.0.5`](https://github.com/pillarjs/path-to-regexp/releases/tag/v4.0.5): Decode URI [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v4.0.4...v4.0.5) **Removed** - Remove `whitelist` in favor of `decodeURI` (advanced behavior can happen outside `path-to-regexp`) ### [`v4.0.4`](https://github.com/pillarjs/path-to-regexp/releases/tag/v4.0.4): Remove `String#normalize` [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v4.0.3...v4.0.4) **Fixed** - Remove usage of `String.prototype.normalize` to continue supporting IE ### [`v4.0.3`](https://github.com/pillarjs/path-to-regexp/releases/tag/v4.0.3): Normalize Path Whitelist [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v4.0.2...v4.0.3) **Added** - Add normalize whitelist of characters (defaults to `/%.-`) ### [`v4.0.2`](https://github.com/pillarjs/path-to-regexp/releases/tag/v4.0.2): Allow `RegexpOptions` in `match` [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v4.0.1...v4.0.2) **Fixed** - Allow `RegexpOptions` in `match(...)` function ### [`v4.0.1`](https://github.com/pillarjs/path-to-regexp/releases/tag/v4.0.1): Fix Spelling of Regexp [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v4.0.0...v4.0.1) **Fixed** - Normalize `regexp` spelling across 4.x ### [`v4.0.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v4.0.0): ES2015 Package for Bundlers [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v3.3.0...v4.0.0) All path rules are backward compatible with 3.x, except for nested `()` and other RegEx special characters that were previously ignored. **Changed** - Export names have changed to support ES2015 modules in bundlers - `match` does not default to `decodeURIComponent` **Added** - New `normalizePathname` utility for supporting unicode paths in libraries - Support nested non-capturing groups within parameters - Add tree-shaking (via ES2015 modules) for webpack and other bundlers ### [`v3.3.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0): Add backtracking protection [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v3.2.0...v3.3.0) **Fixed** - Add backtrack protection to 3.x release ([#&#8203;321](https://github.com/pillarjs/path-to-regexp/issues/321)) [`d31670a`](https://github.com/pillarjs/path-to-regexp/commit/d31670a) ### [`v3.2.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v3.2.0): Match Function [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v3.1.0...v3.2.0) **Added** - Add native `match` function to library ### [`v3.1.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v3.1.0): Validate and sensitive options [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v3.0.0...v3.1.0) - Add `sensitive` option for `tokensToFunction` ([#&#8203;191](https://github.com/pillarjs/path-to-regexp/issues/191)) - Add `validate` option to path functions ([#&#8203;178](https://github.com/pillarjs/path-to-regexp/issues/178)) ### [`v3.0.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#300--2019-01-13) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v2.4.0...v3.0.0) - Always use prefix character as delimiter token, allowing any character to be a delimiter (e.g. `/:att1-:att2-:att3-:att4-:att5`) - Remove `partial` support, prefer escaping the prefix delimiter explicitly (e.g. `\\/(apple-)?icon-:res(\\d+).png`) ### [`v2.4.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#240--2018-08-26) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v2.3.0...v2.4.0) - Support `start` option to disable anchoring from beginning of the string ### [`v2.3.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#230--2018-08-20) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v2.2.1...v2.3.0) - Use `delimiter` when processing repeated matching groups (e.g. `foo/bar` has no prefix, but has a delimiter) ### [`v2.2.1`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#221--2018-04-24) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v2.2.0...v2.2.1) - Allow empty string with `end: false` to match both relative and absolute paths ### [`v2.2.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#220--2018-03-06) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v2.1.0...v2.2.0) - Pass `token` as second argument to `encode` option (e.g. `encode(value, token)`) ### [`v2.1.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#210--2017-10-20) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v2.0.0...v2.1.0) - Handle non-ending paths where the final character is a delimiter - E.g. `/foo/` before required either `/foo/` or `/foo//` to match in non-ending mode ### [`v2.0.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#200--2017-08-23) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.9.0...v2.0.0) - New option! Ability to set `endsWith` to match paths like `/test?query=string` up to the query string - New option! Set `delimiters` for specific characters to be treated as parameter prefixes (e.g. `/:test`) - Remove `isarray` dependency - Explicitly handle trailing delimiters instead of trimming them (e.g. `/test/` is now treated as `/test/` instead of `/test` when matching) - Remove overloaded `keys` argument that accepted `options` - Remove `keys` list attached to the `RegExp` output - Remove asterisk functionality (it's a real pain to properly encode) - Change `tokensToFunction` (e.g. `compile`) to accept an `encode` function for pretty encoding (e.g. pass your own implementation) ### [`v1.9.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0): Fix backtracking in 1.x [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.8.0...v1.9.0) **Fixed** - Add backtrack protection to 1.x release ([#&#8203;320](https://github.com/pillarjs/path-to-regexp/issues/320)) [`925ac8e`](https://github.com/pillarjs/path-to-regexp/commit/925ac8e) - Fix `re.exec(&#&#8203;39;/test/route&#&#8203;39;)` result ([#&#8203;267](https://github.com/pillarjs/path-to-regexp/issues/267)) [`32a14b0`](https://github.com/pillarjs/path-to-regexp/commit/32a14b0) ### [`v1.8.0`](https://github.com/pillarjs/path-to-regexp/releases/tag/v1.8.0): Backport token to function options [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.7.0...v1.8.0) **Added** - Backport `TokensToFunctionOptions` ### [`v1.7.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#170--2016-11-08) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.6.0...v1.7.0) - Allow a `delimiter` option to be passed in with `tokensToRegExp` which will be used for "non-ending" token match situations ### [`v1.6.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#160--2016-10-03) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.5.3...v1.6.0) - Populate `RegExp.keys` when using the `tokensToRegExp` method (making it consistent with the main export) - Allow a `delimiter` option to be passed in with `parse` - Updated TypeScript definition with `Keys` and `Options` updated ### [`v1.5.3`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#153--2016-06-15) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.5.2...v1.5.3) - Add `\\` to the ignore character group to avoid backtracking on mismatched parens ### [`v1.5.2`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#152--2016-06-15) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.5.1...v1.5.2) - Escape `\\` in string segments of regexp ### [`v1.5.1`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#151--2016-06-08) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.5.0...v1.5.1) - Add `index.d.ts` to NPM package ### [`v1.5.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#150--2016-05-20) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.4.0...v1.5.0) - Handle partial token segments (better) - Allow compile to handle asterisk token segments ### [`v1.4.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#140--2016-05-18) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.3.0...v1.4.0) - Handle RegExp unions in path matching groups ### [`v1.3.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#130--2016-05-08) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.2.1...v1.3.0) - Clarify README language and named parameter token support - Support advanced Closure Compiler with type annotations - Add pretty paths options to compiled function output - Add TypeScript definition to project - Improved prefix handling with non-complete segment parameters (E.g. `/:foo?-bar`) ### [`v1.2.1`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#121--2015-08-17) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.2.0...v1.2.1) - Encode values before validation with path compilation function - More examples of using compilation in README ### [`v1.2.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#120--2015-05-20) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.1.1...v1.2.0) - Add support for matching an asterisk (`*`) as an unnamed match everything group (`(.*)`) ### [`v1.1.1`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#111--2015-05-11) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.1.0...v1.1.1) - Expose methods for working with path tokens ### [`v1.1.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#110--2015-05-09) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.0.3...v1.1.0) - Expose the parser implementation to consumers - Implement a compiler function to generate valid strings - Huge refactor of tests to be more DRY and cover new parse and compile functions - Use chai in tests - Add .editorconfig ### [`v1.0.3`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#103--2015-01-17) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.0.2...v1.0.3) - Optimised function runtime - Added `files` to `package.json` ### [`v1.0.2`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#102--2014-12-17) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.0.1...v1.0.2) - Use `Array.isArray` shim - Remove ES5 incompatible code - Fixed repository path - Added new readme badges ### [`v1.0.1`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#101--2014-08-27) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v1.0.0...v1.0.1) - Ensure installation works correctly on 0.8 ### [`v1.0.0`](https://github.com/pillarjs/path-to-regexp/blob/HEAD/History.md#100--2014-08-17) [Compare Source](https://github.com/pillarjs/path-to-regexp/compare/v0.2.5...v1.0.0) - No more API changes </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Copenhagen) - Branch creation - "before 6am on monday" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yODEuMCIsInVwZGF0ZWRJblZlciI6IjQzLjI4NS4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJtYWpvciIsInNlY3VyaXR5LXBpbiJdfQ==-->
chore(deps): Update dependency path-to-regexp@<0.1.13 to v8
Some checks failed
CD Staging / Build & Push Docker Images (pull_request) Has been skipped
Details
CD Staging / Build & Push Docker Images-1 (pull_request) Has been skipped
Details
CD Staging / Deploy Staging (pull_request) Has been skipped
Details
CD Staging / Deploy PR Preview (pull_request) Has been skipped
Details
CD Staging / Tear Down PR Preview (pull_request) Has been skipped
Details
CI / Security Scan (pull_request) Successful in 56s
Details
CI / Dockerfile Package Check (pull_request) Successful in 1m13s
Details
CI / Checks (pull_request) Successful in 11m5s
Details
CI / Visual Tests (pull_request) Successful in 4m51s
Details
CI / Journal Image Smoke Test (pull_request) Successful in 19m20s
Details
CI / E2E Tests (pull_request) Failing after 6m41s
Details
c38b1379b9
renovate force-pushed renovate/path-to-regexp-0.1.13-8.x from c38b1379b9
Some checks failed
CD Staging / Build & Push Docker Images (pull_request) Has been skipped
Details
CD Staging / Build & Push Docker Images-1 (pull_request) Has been skipped
Details
CD Staging / Deploy Staging (pull_request) Has been skipped
Details
CD Staging / Deploy PR Preview (pull_request) Has been skipped
Details
CD Staging / Tear Down PR Preview (pull_request) Has been skipped
Details
CI / Security Scan (pull_request) Successful in 56s
Details
CI / Dockerfile Package Check (pull_request) Successful in 1m13s
Details
CI / Checks (pull_request) Successful in 11m5s
Details
CI / Visual Tests (pull_request) Successful in 4m51s
Details
CI / Journal Image Smoke Test (pull_request) Successful in 19m20s
Details
CI / E2E Tests (pull_request) Failing after 6m41s
Details
to 02d1bf944d
Some checks failed
CD Staging / Build & Push Docker Images (pull_request) Has been skipped
Details
CD Staging / Build & Push Docker Images-1 (pull_request) Has been skipped
Details
CD Staging / Deploy Staging (pull_request) Has been skipped
Details
CD Staging / Deploy PR Preview (pull_request) Has been skipped
Details
CI / Security Scan (pull_request) Successful in 1m18s
Details
CI / Dockerfile Package Check (pull_request) Successful in 46s
Details
CI / Checks (pull_request) Successful in 7m7s
Details
CI / Visual Tests (pull_request) Successful in 4m1s
Details
CI / Journal Image Smoke Test (pull_request) Successful in 15m30s
Details
CD Staging / Tear Down PR Preview (pull_request) Successful in 37s
Details
CI / E2E Tests (pull_request) Failing after 10m0s
Details
2026-07-30 10:53:19 +00:00 Compare
ullrich commented 2026-07-30 11:32:45 +00:00
Owner
Copy link

Closing: superseded by #56, which freezes the version line of `pnpm.overrides` security pins (minor and major disabled, patch still flows).

This entry is a CVE floor, not a dependency — the correct value is the minimum patched version inside the range its consumers expect, not the newest release. No current advisory requires leaving the pinned line, so this change is risk without benefit. Renovate will no longer raise it.

If a future advisory can only be satisfied by crossing a minor or major, that becomes a deliberate manual change (ideally driven by osvVulnerabilityAlerts once configured).

Closing: superseded by #56, which freezes the version line of \`pnpm.overrides\` security pins (minor and major disabled, patch still flows). This entry is a CVE floor, not a dependency — the correct value is the minimum patched version inside the range its consumers expect, not the newest release. No current advisory requires leaving the pinned line, so this change is risk without benefit. Renovate will no longer raise it. If a future advisory can only be satisfied by crossing a minor or major, that becomes a deliberate manual change (ideally driven by `osvVulnerabilityAlerts` once configured).
ullrich closed this pull request 2026-07-30 11:32:45 +00:00
renovate commented 2026-07-31 07:44:39 +00:00
Author
Collaborator
Copy link

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 8.x releases. But if you manually upgrade to 8.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

### Renovate Ignore Notification Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for *any* future `8.x` releases. But if you manually upgrade to `8.x` then Renovate will re-enable `minor` and `patch` updates automatically. If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.
Some checks failed
CD Staging / Build & Push Docker Images (pull_request) Has been skipped
Details
CD Staging / Build & Push Docker Images-1 (pull_request) Has been skipped
Details
CD Staging / Deploy Staging (pull_request) Has been skipped
Details
CD Staging / Deploy PR Preview (pull_request) Has been skipped
Details
CI / Security Scan (pull_request) Successful in 1m18s
Required
Details
CI / Dockerfile Package Check (pull_request) Successful in 46s
Required
Details
CI / Checks (pull_request) Successful in 7m7s
Required
Details
CI / Visual Tests (pull_request) Successful in 4m1s
Required
Details
CI / Journal Image Smoke Test (pull_request) Successful in 15m30s
Required
Details
CD Staging / Tear Down PR Preview (pull_request) Successful in 37s
Details
CI / E2E Tests (pull_request) Failing after 10m0s
Required
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
dependencies
Dependency updates raised by Renovate (renovate.json5 labels)

  
major
Major version bump — always needs human review, never auto-merged

  
security-pin
Touches a pnpm.overrides CVE remediation pin, not an ordinary dependency

No labels
dependencies
major
security-pin
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
trails-cool/trails!44
No description provided.