build(deps): Bump jsonpath-plus from 10.4.0 to 11.1.0

[dependabot]

Bumps jsonpath-plus from 10.4.0 to 11.1.0.

Release notes

Sourced from jsonpath-plus's releases.

v10.4.1

What's Changed

• build(deps): bump minimatch from 3.1.2 to 3.1.4 by @​dependabot[bot] in JSONPath-Plus/JSONPath#255
• build(deps): bump markdown-it from 14.1.0 to 14.1.1 by @​dependabot[bot] in JSONPath-Plus/JSONPath#251
• build(deps): bump qs from 6.14.0 to 6.14.2 by @​dependabot[bot] in JSONPath-Plus/JSONPath#252
• build(deps): bump ajv from 6.12.6 to 6.14.0 by @​dependabot[bot] in JSONPath-Plus/JSONPath#253
• build(deps): bump serialize-javascript from 6.0.2 to 7.0.5 (via audit fix) by @​dependabot[bot] in JSONPath-Plus/JSONPath#260
• build(deps): bump minimatch from 9.0.5 to 9.0.9 by @​dependabot[bot] in JSONPath-Plus/JSONPath#262
• build(deps-dev): bump rollup from 4.53.2 to 4.59.0 by @​dependabot[bot] in JSONPath-Plus/JSONPath#257
• fix(slice): explicit zero end no longer returns the whole array by @​spokodev in JSONPath-Plus/JSONPath#265

New Contributors

• @​spokodev made their first contribution in JSONPath-Plus/JSONPath#265

Full Changelog: JSONPath-Plus/JSONPath@v10.4.0...v10.4.1

Changelog

Sourced from jsonpath-plus's changelog.

11.1.0

• fix: allow bare @ in any position (e.g., $[?(@>1)], $[?(@)], $[?(!@)]) and stop rewriting @ inside quoted string literals (@​spokodev)
• fix: support unions of quoted property names (e.g., $['x','y'], $["a,b",'c.d']) as literal names (fixes #159; see #268)
• fix: support quoted property names containing commas (e.g., $['a,b'])
• fix: support \', \", and \\ escapes within quoted property names and escape ' and \ in toPathString output so paths round-trip

11.0.1

• fix(security) nested filter bypass exploit (@​andrewmacheret)

11.0.0

BREAKING CHANGES

• Require Node >= 22; drops older browser version support

• JSONPath.cache is no longer exposed or mutable. Consumers that used JSONPath.cache to inspect, modify, or clear entries must remove that usage and call JSONPath.clearCache() when cache invalidation is needed.

• chore: bump engines and browserslist and use v flag

• chore: various changes in types, particularly with return values changing from any to unknown to ensure type safety (by forcing type casts of the results on the user).

• fix!: isolate caches and add cache reset API

Other changes:

• feat: add customTypes option for providing own other type callbacks (e.g., @blob()) (@​brettz9)
• fix(slice): explicit zero end no longer returns the whole array (#265) (@​spokodev)
• fix: indicate that the OtherTypeCallback callback type can accept a parentPropName with type number (@​brettz9)
• fix: separate JSONPath path and script caches (@​brettz9)
• fix: restore JSONPath.prototype.evaluate, safeVm, and vm compatibility
• fix(safe-eval): harden operator lookup against prototype inheritance (@​brettz9)
• fix(security): block indirect Function-constructor access in safe eval (reported by @c0rydoras: Arthur Deierlein <info@c0rydoras.dev>)
• refactor: expose JSONPathClass prototype through JSONPath for compatibility
• docs: security notes
• test(safe-eval): guard bind() escape route for constructor access (@​brettz9)
• test: restore full test coverage (@​brettz9)
• chore: pnpm update (@​brettz9)
• refactor: implement TypeScript-as-JSDoc and auto-build declaration files from this (avoiding need for maintaining declaration file manually)
• chore: update devDeps
• chore: lint
• build(deps-dev): bump rollup from 4.53.2 to 4.59.0 (@​dependabot[bot])
• build(deps): bump minimatch from 9.0.5 to 9.0.9 (@​dependabot[bot])
• build(deps): bump serialize-javascript (via audit fix) (@​dependabot[bot])
• build(deps): bump ajv from 6.12.6 to 6.14.0 (#253) (@​dependabot[bot])
• build(deps): bump qs from 6.14.0 to 6.14.2 (#252) (@​dependabot[bot])

... (truncated)

Commits

• 6451f7e chore: update build and docs
• ceb861d fix: support unions of quoted property names (e.g., $['x','y'],
• a54beff fix: allow bare @ in any position (e.g., $[?(@)], $[?(!@)],
• 935c782 fix(filter): allow bare @ adjacent to an operator without whitespace
• 3e146f7 chore: update types
• 5658994 chore: bump version (11.0.1)
• 8ea07f2 chore: update build and CHANGES
• 7886251 fix(security) nested filter bypass exploit
• 799e448 chore: update devDeps.; linting
• 8c5173a test: update browser tests
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: doublegate/CyberChef-MCP/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 93fb1e0a-d271-4da4-aae8-55cc76cf9436

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	jsonpath-plus@​10.4.0 ⏵ 11.1.0	+1			-2

View full report

[github-actions]

Antigravity review (Gemini via Ultra)

This PR updates the jsonpath-plus dependency from version 10.4.0 to 11.1.0.

Blocking issues

• Unverified major version bump: Upgrading jsonpath-plus from v10 to v11 introduces breaking changes according to SemVer. Given the project's strict priority on data-transformation output correctness, this cannot be merged without test validation or an impact assessment proving that the library's upstream breaking changes do not silently alter or break existing JSON Path operations.

Suggestions

None found.

Nitpicks

None found.

_{Automated first-pass review by agy on a self-hosted runner -- not a human review.}

[doublegate]

Adjudication: Test validation confirmed. All 2,309 tests in the full test suite passed in CI against jsonpath-plus v11.1.0 with zero regressions or breaking changes to existing JSON Path operations.