[dependabot]

Bumps the npm_and_yarn group with 5 updates in the /code4z/example-com-extension directory:

Package	From	To
brace-expansion	5.0.7	5.0.12
fast-uri	3.1.5	3.1.8
js-yaml	4.3.1	4.3.2
markdown-it	14.2.0	14.3.2
undici	6.28.0	6.29.0

Updates brace-expansion from 5.0.7 to 5.0.12

Commits

• f341015 5.0.12
• 33a5ef1 Merge commit from fork
• 8247927 5.0.11
• 935d78f Merge commit from fork
• df7682f 5.0.10
• 1ade9de npm run format
• 6735c94 Merge commit from fork
• 4e70465 chore: ensure prettier formatting (#154)
• fd7a5e3 Bump ip-address from 10.2.0 to 10.4.0 (#152)
• 1790143 Bump uuid and @​tapjs/processinfo (#120)
• Additional commits viewable in compare view

Updates fast-uri from 3.1.5 to 3.1.8

Release notes

Sourced from fast-uri's releases.

v3.1.8

⚠️ Security Warning

This security release fixes the following medium-severity security advisory:

• GHSA-hrr3-gc8f-f4qj — inconsistent host case normalization via percent-encoded octets

Users of the v3.x release line should upgrade to v3.1.8.

Full Changelog: fastify/fast-uri@v3.1.7...v3.1.8

v3.1.7

⚠️ Security Warning

This is a security release that fixes the following high-severity security advisories:

• GHSA-qw65-cvwx-89v3 — authority injection via an unvalidated port in serialize()
• GHSA-58mr-gqgx-xq4g — host confusion via unbalanced or misplaced IP-literal brackets

Users of the v3.x release line should upgrade to v3.1.7.

Full Changelog: fastify/fast-uri@v3.1.6...v3.1.7

v3.1.6

⚠️ Security Warning

This release addresses the following high-severity security advisories:

• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalization on scheme-relative references
• GHSA-fph4-wmhf-6fwf — server-side request forgery via repeated hostname percent-decoding
• GHSA-f65p-4m7j-42xc — server-side request forgery via malformed IPv6 normalization
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme normalization

Users of the v3.x release line should upgrade to v3.1.6.

Full Changelog: fastify/fast-uri@v3.1.5...v3.1.6

Commits

• ead3ab7 Bumped v3.1.8
• c88b59e fix: normalize decoded reg-name case
• 412e40a Bumped v3.1.7
• 9f4c943 fix: backport port and IP-literal validation to v3.x (#216)
• 1eb3ce4 fix: treat unterminated bracket hosts as reg-names again (#214)
• 6f970b2 Bumped v3.1.6
• d941579 fix: never run IDN canonicalization on bracketed IP literals
• c0f0279 test: adapt decoded-scheme handler assertion to 3.x (no mailto scheme)
• 37f3417 Merge commit from fork
• 607bfbe Merge commit from fork
• Additional commits viewable in compare view

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

• 79ca68d 4.3.2 released
• d90b661 Backport merge limits from v5.4.1
• See full diff in compare view

Updates markdown-it from 14.2.0 to 14.3.2

Changelog

Sourced from markdown-it's changelog.

[14.3.2] - 2026-09-12

Security

• Backported 15.0.2 fixes.

[14.3.1] - 2026-08-27

Security

• Backported 15.0.1 fixes.

[14.3.0] - 2026-07-02

Changed

• Reworked build pipeline & tools.
• Added source maps.
• Bumped linkify-it to 5.0.2.

Fixed

• Preserve backslash-space hard line breaks, matching CommonMark 6.7, #1185.

Commits

• efb9993 14.3.2 released
• daf5a3c Backported 15.0.2 fixes
• a855f10 14.3.1 released
• ad70f6b Backported 15.0.1 fixes
• b407f3b Ignore generated API docs in lint
• bf025ad Prepare package.json for v14 backports
• 2d9bbea fix: recognize lowercase declarations as HTML blocks (CommonMark 4.6) (#1189)
• a311cfb fix: keep literal backslash before space in link destination (CommonMark 6.3)...
• ff0ee08 14.3.0 released
• 52e2749 Bump linkify-it / vite deps
• Additional commits viewable in compare view

Updates undici from 6.28.0 to 6.29.0

Release notes

Sourced from undici's releases.

v6.29.0

What's Changed

• [v6.x] fix(retry): settle exposed body on terminal failure by @​mcollina in nodejs/undici#5778
• Backport upgrade diagnostics lifecycle fixes to v6.x by @​BridgeAR in nodejs/undici#5833
• test: synchronize the issue-3356 body timeout by @​BridgeAR in nodejs/undici#5834

Full Changelog: nodejs/undici@v6.28.1...v6.29.0

v6.28.1

⚠️ Security fixes

High severity

• GHSA-rfgv-xxqx-mfg5: a WebSocket server could select a subprotocol when none was requested, causing an uncaught TypeError that could terminate the process. Undici now rejects the handshake with protocol error 1002. Fixed by 2af0faf8.

Medium severity

• GHSA-3wwx-pv8p-q78v: a malformed permessage-deflate payload exceeding the configured decompression limit could emit an unhandled zlib error and terminate the process. Undici now destroys the inflater after reaching the limit. Fixed by 07c60d9c.

Low severity

• GHSA-r53p-7pc4-xj5r: the retry interceptor could concatenate a resumed response with inconsistent framing into downstream output, enabling response splitting or corruption. Undici now validates Content-Range against the original response framing before resuming. Fixed by ce31bc82.

What's Changed

• perf: reduce EventSourceStream parser allocations (#5032) by @​mcollina in nodejs/undici#5647
• [v6.x] perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) by @​mcollina in nodejs/undici#5770

Full Changelog: nodejs/undici@v6.28.0...v6.28.1

Commits

• e1d0501 Bumped v6.29.0 (#5888)
• 57ac4de test: synchronize the issue-3356 body timeout (#5834)
• 6d44174 Backport upgrade diagnostics lifecycle fixes to v6.x (#5833)
• 2a91fc8 fix(retry): settle exposed body on terminal failure (#5778)
• ffc8aa0 Bumped v6.28.1 (#5773)
• 3866a3b perf(h1): drop idle-socket timer floor with a ref'd setImmediate (#5707) (#5770)
• ce31bc8 fix(retry): validate resumed response framing
• 2af0faf fix(websocket): reject unrequested subprotocols
• 07c60d9 fix(websocket): destroy inflater after decompression limit
• bd90fff perf: reduce EventSourceStream parser allocations (#5032) (#5647)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.