Bump the npm_and_yarn group across 2 directories with 16 updates

[dependabot]

Bumps the npm_and_yarn group with 12 updates in the / directory:

Package	From	To
markdown-it	12.3.2	14.2.0
rollup	2.79.1	2.80.0
koa	2.13.4	3.1.2
playwright	1.28.1	1.61.0
ws	7.5.9	7.5.11
ws	8.14.2	8.21.0
cross-spawn	7.0.3	7.0.6
@tootallnate/once	1.1.2	removed
handlebars	4.7.7	4.7.9
liquidjs	10.7.1	10.27.0
lodash	4.17.21	4.18.1
node-forge	1.3.1	1.4.0
qs	6.11.2	6.15.2

Bumps the npm_and_yarn group with 1 update in the /packages/lit-dev-content directory: markdown-it.

Updates markdown-it from 12.3.2 to 14.2.0

Changelog

Sourced from markdown-it's changelog.

[14.2.0] - 2026-05-24

Added

• isPunctCharCode to utilities.

Fixed

• Don't end HTML comment blocks on a blank line, #1155.
• Properly recognize astral chars (surrogates) in delimiter scans for emphasis-like markers, #1072. Big thanks to @​tats-u for his global efforts with improving CJK support.
• Preserve unicode whitespaces when trimm headings/paragraphs, #1074.
• More strict entities decode to avoid false positives ;, #1096.
• Restore block parser state on fail in lheading rule, #1131.

Security

• Fixed poor smartquotes perfomance on > 70k quotes in single block
• Bumped linkify-it to 5.0.1 with fixed potential perfomance issues.

[14.1.1] - 2026-01-11

Security

• Fixed regression from v13 in linkify inline rule. Specific patterns could cause high CPU use. Thanks to @​ltduc147 for report.

[14.1.0] - 2024-03-19

Changed

• Updated CM spec compatibility to 0.31.2, #1009.

Fixed

• Fixed quadratic complexity when parsing references, #996.
• Fixed quadratic output size with pathological user input in tables, #1000.

[14.0.0] - 2023-12-08

Changed

• Drop ancient browsers support (use .fromCodePoint and other features).
• Rewrite to ESM (including all plugins/deps). CJS fallback still available. No signatures changed, except markdown-it-emoji plugin.
• Dropped dist/ folder from repo, build on package publish.
• Set punicode.js as external dependency.

Fixed

• Html tokens inside img alt are now rendered as their original text, #896.
• Hardbreaks inside img alt are now rendered as newlines.

[13.0.2] - 2023-09-26

Security

• Fixed crash/infinite loop caused by linkify inline rule, #957.

... (truncated)

Commits

• 829797a 14.2.0 released
• 9ce2087 Fix smartquotes perfomance
• 02e73b8 linkify-it bump
• 68cfb8c fix: don't end HTML comment blocks on a blank line (#1155)
• 1083137 Readme cleanup
• 97c7ca2 Update funding info
• c471b55 Changelog update
• 7769621 isPunctChar => isPunctCharCode
• aa2aa70 fix: always reset parentType in lheading rule (#1131)
• 59955f2 Polish PRs #1072, #1074
• Additional commits viewable in compare view

Updates rollup from 2.79.1 to 2.80.0

Changelog

Sourced from rollup's changelog.

2.80.0

2026-02-22

Features

• Throw when the generated bundle contains paths that would leave the output directory (#6277)

Pull Requests

• #6277: Validate bundle stays within output dir (@​lukastaegert)

2.79.2

2024-09-26

Bug Fixes

• Resolve CVE-2024-43788 (#5677)

Pull Requests

• #5677: resolve DOM Clobbering CVE-2024-43788 (backport to v2) (@​fabianszabo)

Commits

• d17ae15 2.80.0
• d6dee5e Validate bundle stays within output dir (#6277)
• c9bd03d 2.79.2
• 48aef33 fix: resolve DOM Clobbering CVE-2024-43788 (backport to v2) (#5677)
• See full diff in compare view

Updates koa from 2.13.4 to 3.1.2

Release notes

Sourced from koa's releases.

v3.1.2

What's Changed

• fix: typo in troubleshooting.md by @​WuMingDao in koajs/koa#1916
• build(deps-dev): bump qs from 6.14.0 to 6.14.1 by @​dependabot[bot] in koajs/koa#1921
• build(deps): bump http-errors from 2.0.0 to 2.0.1 by @​dependabot[bot] in koajs/koa#1919
• build(deps): bump mime-types from 3.0.1 to 3.0.2 by @​dependabot[bot] in koajs/koa#1918
• docs: use correct term "Server-Sent Events" in guide by @​jtr860830 in koajs/koa#1920
• build(deps): bump content-disposition from 0.5.4 to 1.0.1 by @​dependabot[bot] in koajs/koa#1917
• build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 by @​dependabot[bot] in koajs/koa#1922
• fix(security): Host Header Injection via ctx.hostname by @​killagu GHSA-7gcc-r8m5-44qm

New Contributors

• @​WuMingDao made their first contribution in koajs/koa#1916
• @​jtr860830 made their first contribution in koajs/koa#1920

Full Changelog: koajs/koa@v3.1.1...v3.1.2

v3.1.1

What's Changed

• fix: only original value destroy if the new value is not a stream by @​yowainwright in koajs/koa#1914

Full Changelog: koajs/koa@v3.1.0...v3.1.1

v3.1.0

What's Changed

• feat: fixes mem leak relating to issue-1834 by @​yowainwright in koajs/koa#1893
• fix: adds steam clean up by @​yowainwright in koajs/koa#1910

Full Changelog: koajs/koa@v3.0.3...v3.1.0

v3.0.3

What's Changed

• fix: normalize referer before redirect by @​fengmk2 in koajs/koa#1908

Full Changelog: koajs/koa@v3.0.2...v3.0.3

v3.0.2

What's Changed

• fix: fixes response.attachment behaviour leads to Content-Type Sniffing by @​yowainwright in koajs/koa#1904
• chore: use NPM trusted publishing with semver tag triggers by @​Copilot in koajs/koa#1907

New Contributors

• @​Copilot made their first contribution in koajs/koa#1907

Full Changelog: koajs/koa@v3.0.1...v3.0.2

v3.0.1

... (truncated)

Changelog

Sourced from koa's changelog.

[!IMPORTANT] Moving forwards we are using the GitHub releases page at https://github.com/koajs/koa/releases in combination with np for publishing releases and their changelogs.

---

3.0.0-alpha.3 / 2025-02-11

fixes

• Avoid redos on host and protocol getter

3.0.0-alpha.2 / 2024-11-04

breaking changes

• Update http-errors to v2.0.0 #1486
  • ctx.throw now requires a format of ctx.throw(status, error, properties). See: https://www.npmjs.com/package/http-errors
• Remove res.redirect('back'), add back() method to ctx #1115
• Replace node querystring with URLSearchParams #1828
• Remove obsolete createAsyncCtxStorageMiddleware #1817

features

• Add support for web WHATWG #1830

updates

• Update cookies to ~0.9.1 #1846
• Update statuses to ^2.0.1
• Update supertest to ^7.0.0 #1841

fixes

• Fix exports.defaults in package.json #1630
• Fix leaky handles in tests #1838
• Fix body null checks #1814
• Fix reformatting redirect URLs #1805 #1804
• Fix passing ctx in error handler #1758

migrations

• Migrate from jest to the native node test runner #1845

3.0.0-alpha.1 / 2023-04-12

fixes

• [e98b8d1] - fix: can not get currentContext in error handler (#1758) (Gxkl <gxkl203@gmail.com>)

3.0.0-alpha.0 / 2023-01-02

Breaking Changes

... (truncated)

Commits

• c5a52e0 3.1.2
• 55ab9ba Merge commit from fork
• fecd464 build(deps-dev): bump js-yaml from 4.1.0 to 4.1.1 (#1922)
• d2066cf build(deps): bump content-disposition from 0.5.4 to 1.0.1 (#1917)
• 8694a06 docs: use correct term "Server-Sent Events" in guide (#1920)
• 096682b build(deps): bump mime-types from 3.0.1 to 3.0.2 (#1918)
• 8215c2e build(deps): bump http-errors from 2.0.0 to 2.0.1 (#1919)
• cfe5ec6 build(deps-dev): bump qs from 6.14.0 to 6.14.1 (#1921)
• 0a6afa5 fix: typo in troubleshooting.md (#1916)
• 2e52fb5 3.1.1
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for koa since your current version.

Updates playwright from 1.28.1 to 1.61.0

Release notes

Sourced from playwright's releases.

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

• New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
• New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
• The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

• The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
• Supported expect.soft.poll(...).
• New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
• New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
• testInfo.errors now lists each sub-error of an AggregateError as a separate entry.

... (truncated)

Commits

• 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
• a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
• 8133dcf cherry-pick(#41283): docs: add Ubuntu 26.04 and Node.js 26.x to system requir...
• 812432e chore: mark v1.61.0 (#41277)
• ac05145 fix(fetch): report serverAddr and securityDetails for reused sockets (#41267)
• 056efc9 fix(trace-viewer): add keyboard navigation to NetworkFilters component (#41...
• 41f7b9a chore: fixes uncovered by the .NET 1.61 roll (#41266)
• ba50778 fix(mcp): assign caps as array for legacy --vision flag (#41253)
• b8ee5ae docs: release notes for v1.61 (#41261)
• 49c1f69 fix(trace viewer): load trace from a local file (#41263)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for playwright since your current version.

Updates ws from 7.5.9 to 7.5.11

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

• Backported 2b2abd45 to the 7.x release line (e14c4586).

7.5.10

Bug fixes

• Backported e55e5106 to the 7.x release line (22c28763).

Commits

• fd36cd8 [dist] 7.5.11
• e14c458 [security] Limit retained message parts
• d962d70 [dist] 7.5.10
• 22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
• See full diff in compare view

Updates ws from 8.14.2 to 8.21.0

Release notes

Sourced from ws's releases.

7.5.11

Bug fixes

• Backported 2b2abd45 to the 7.x release line (e14c4586).

7.5.10

Bug fixes

• Backported e55e5106 to the 7.x release line (22c28763).

Commits

• fd36cd8 [dist] 7.5.11
• e14c458 [security] Limit retained message parts
• d962d70 [dist] 7.5.10
• 22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
• See full diff in compare view

Updates cross-spawn from 7.0.3 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

• update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

• fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

• disable regexp backtracking (#160) (5ff3a07)

Commits

• 77cd97f chore(release): 7.0.6
• 6717de4 chore: upgrade standard-version
• f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json
• 9a7e3b2 chore: fix build status badge
• 0852683 chore(release): 7.0.5
• 640d391 fix: fix escaping bug introduced by backtracking
• bff0c87 chore: remove codecov
• a7c6abc chore: replace travis with github workflows
• 9b9246e chore(release): 7.0.4
• 5ff3a07 fix: disable regexp backtracking (#160)
• Additional commits viewable in compare view

Updates @octokit/plugin-paginate-rest from 2.18.0 to 14.0.0

Release notes

Sourced from @​octokit/plugin-paginate-rest's releases.

v14.0.0

14.0.0 (2025-10-31)

Features

• add immutable releases, enterprise team membership, enterprise team organization endpoints (413e899)

BREAKING CHANGES

• Remove GET /projects/{project_id}/columns
• Remove GET /enterprises/{enterprise}/secret-scanning/alerts

v13.2.1

13.2.1 (2025-10-20)

Bug Fixes

• deps: update @octokit/types (#698) (ba56fbc)

v13.2.0

13.2.0 (2025-09-29)

Features

• new Projects v2 endpoints, new code scanning dismissal endpoints, many other endpoints (#690) (0e236cb)

v13.1.1

13.1.1 (2025-06-27)

Bug Fixes

• handle url in response when using pagination with compareCommits (#686) (8e5da25)

v13.1.0

13.1.0 (2025-06-16)

Features

• add paginatantion support for compareCommits and compareCommitsWithBasehead (#678) (6d8ea8a)

v13.0.1

13.0.1 (2025-05-25)

... (truncated)

Commits

• 413e899 feat: add immutable releases, enterprise team membership, enterprise team org...
• 3d311d6 chore(deps): update dependency @​types/node to v24 (#701)
• ba56fbc fix(deps): update @octokit/types (#698)
• 80745be ci(action): update actions/checkout action to v5 (#687)
• 0e236cb feat: new Projects v2 endpoints, new code scanning dismissal endpoints, many ...
• bf19e3e chore(deps): update dependency prettier to v3.6.2 (#685)
• 4f9fc56 ci(action): update actions/setup-node action to v5 (#688)
• 8e5da25 fix: handle url in response when using pagination with compareCommits (#686)
• 6d8ea8a feat: add paginatantion support for compareCommits and `compareCommitsWith...
• 8ec2713 fix(deps): update @octokit/types - no new paginated endpoints (#680)
• Additional commits viewable in compare view

Updates @octokit/request from 5.6.3 to 10.0.10

Release notes

Sourced from @​octokit/request's releases.

v10.0.10

10.0.10 (2026-05-26)

Bug Fixes

• remove unused fast-content-type-parse dependency (#808) (25b0838)

v10.0.9

10.0.9 (2026-05-12)

Bug Fixes

• deps: switch to using the "content-type" package for content type parsing (#807) (a9f64a0)

v10.0.8

10.0.8 (2026-02-20)

Bug Fixes

• use json-with-bigint instead of built-in JSON methods in order to properly support int64's (#798) (f13f5d9)

v10.0.7

10.0.7 (2025-11-13)

Bug Fixes

• readme: properly structure the options for custom agent (#786) (f17c1c1), closes #785

v10.0.6

10.0.6 (2025-10-30)

Bug Fixes

• deps: update dependency @​octokit/types to v16 (#783) (1aeac56)

v10.0.5

10.0.5 (2025-09-29)

Bug Fixes

• deps: update octokit deps (#772) (30f83b6)

v10.0.4

10.0.4 (2025-09-29)

... (truncated)

Commits

• 25b0838 fix: remove unused fast-content-type-parse dependency (#808)
• b3d6b0b chore(deps): update dependency esbuild to ^0.28.0 (#804)
• 7fdf739 ci(action): update actions/create-github-app-token action to v3 (#801)
• 58b1f87 ci(action): update actions/add-to-project action to v2 (#806)
• a9f64a0 fix(deps): switch to using the "content-type" package for content type parsin...
• 4abc280 chore(deps): update dependency undici to v7.24.0 [security] (#800)
• f13f5d9 fix: use json-with-bigint instead of built-in JSON methods in order to prop...
• 9ba6ae0 Document that unsuccessful HTTP status code result in an exception (#795)
• 7160b82 chore(deps): replace glob with tinyglobby (#791)
• ab8018b ci(action): update peter-evans/create-or-update-comment action to v5 (#776)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​octokit/request since your current version.

Updates @octokit/request-error from 2.1.0 to 7.1.0

Release notes

Sourced from @​octokit/request-error's releases.

v7.1.0

7.1.0 (2025-11-13)

Features

• inherit options from base Error class to add support for the cause property (#535/#536) (2ea2780)

v7.0.2

7.0.2 (2025-10-30)

Bug Fixes

• deps: update dependency @​octokit/types to v16 (#533) (e5a75ef)

v7.0.1

7.0.1 (2025-09-29)

Bug Fixes

• deps: update dependency @​octokit/types to v15 (#522) (4a453f2)

v7.0.0

7.0.0 (2025-05-20)

Continuous Integration

• stop testing against NodeJS v18 (#512) (8eee0c1)

BREAKING CHANGES

• Drop support for NodeJS v18

• build: set minimal node version in build script to v20

• ci: stop testing against NodeJS v18

v6.1.8

6.1.8 (2025-04-10)

Bug Fixes

• deps: update dependency @​octokit/types to v14 (#505) (ab4ea7b)

v6.1.7

... (truncated)

Commits

• 2ea2780 feat: inherit options from base Error class to add support for the cause ...
• ac7b309 chore(deps): update vitest monorepo to v4 (major) (#531)
• dadc76d ci(action): update peter-evans/create-or-update-comment action to v5 (#525)
• f57f2e6 build(deps): lock file maintenance (#534)
• e5a75ef fix(deps): update dependency @​octokit/types to v16 (#533)
• e5d5de2 chore(deps): update dependency @​types/node to v24 (#532)
• 8cc127b ci(action): update actions/setup-node action to v6 (#529)
• b3a876b build(deps): lock file maintenance (#527)
• cf1817b ci(action): update github/codeql-action action to v4 (#528)
• 61f1e87 chore(deps): update dependency tinybench to v5 (#519)
• Additional commits viewable in compare view

Removes @tootallnate/once

Updates handlebars from 4.7.7 to 4.7.9

Release notes

Sourced from handlebars's releases.

v4.7.9

• fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
• fix type "RuntimeOptions" also accepting string partials - eab1d14
• feat(types): set hash to be a Record<string, any> - de4414d
• fix non-contiguous program indices - 4512766
• refactor: rename i to startPartIndex - e497a35
• security: fix security issues - 68d8df5
  • GHSA-2w6w-674q-4c4q
  • GHSA-3mfm-83xf-c92r
  • GHSA-xhpv-hc6g-r9c6
  • GHSA-xjpj-3mr7-gcpf
  • GHSA-9cx6-37pm-9jff
  • GHSA-2qvq-rjwj-gvw9
  • GHSA-7rx3-28cr-v5wh
  • GHSA-442j-39wm-28r2

Commits

v4.7.8

• Make library compatible with workers (#1894) - 3d3796c
• Don't rely on Node.js global object (#1776) - 2954e7e
• Fix compiling of each block params in strict mode (#1855) - 30dbf04
• Fix rollup warning when importing Handlebars as ESM - 03d387b
• Fix bundler issue with webpack 5 (#1862) - c6c6bbb
• Use https instead of git for mustache submodule - 88ac068

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.9 - March 26th, 2026

• fix: enable shell mode for spawn to resolve Windows EINVAL issue - e0137c2
• fix type "RuntimeOptions" also accepting string partials - eab1d14
• feat(types): set hash to be a Record<string, any> - de4414d
• fix non-contiguous program indices - 4512766
• refactor: rename i to startPartIndex - e497a35
• security: fix security issues - 68d8df5

Commits

v4.7.8 - July 27th, 2023

• Make library compatible with workers (#1894) - 3d3796c
• Don't rely on Node.js global object (#1776) - 2954e7e
• Fix compiling of each block params in strict mode (#1855) - 30dbf04
• Fix rollup warning when importing Handlebars as ESM - 03d387b
• Fix bundler issue with webpack 5 (#1862) - c6c6bbb
• Use https instead of git for mustache submodule - 88ac068

Commits

Commits

• dce542c v4.7.9
• 8a41389 Update release notes
• 68d8df5 Fix security issues
• b2a0831 Fix browser tests
• 9f98c16 Fix release script
• 45443b4 Revert "Improve partial indenting performance"
• 8841a5f Fix CI errors with linting
• e0137c2 fix: enable shell mode for spawn to resolve Windows EINVAL issue
• e914d60 Improve rendering performance
• 7de4b41 Upgrade GitHub Actions checkout and setup-node on 4.x branch
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.

Updates jws from 3.2.2 to 4.0.0

Release notes

Sourced from jws's releases.

v4.0.0

No release notes provided.

v3.2.3

Changed

• Fix advisory GHSA-869p-cjfg-cm3x: createSign and createVerify now require that a non empty secret is provided (via opts.secret, opts.privateKey or opts.key) when using HMAC algorithms.
• Upgrading JWA version to 1.4.2, addressing a compatibility issue for Node >= 25.

Commits

• 1389f6d v4.0.0
• e4593f1 jwa@^2.0.0
• 9deb311 README: Use SVG build badge (#87)
• See full diff in compare view

Updates liquidjs from 10.7.1 to 10.27.0

Release notes

Sourced from liquidjs's releases.

v10.27.0

10.27.0 (2026-05-15)

Features

• context: null-prototype scope frames via createScope (#899) (47d3f1b)

v10.26.0

10.26.0 (2026-05-14)

Bug Fixes

• date: cap strftime widths and account padding in memoryLimit (#895) (3129d46)
• enforce renderLimit for empty renderTemplates calls (#894) (5b9c346)
• propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) (dbbf628)
• security: block Object.prototype filter/tag lookups (RCE) (#897) (457fae0)
• strip html newline tags (#892) (26ea285)
• strip_html: rewrite as linear single-pass scan to avoid ReDoS (#896) (3616a74)

Features

• add sha256 and hmac_sha256 filters for cryptographic operations (#889) (1c816d4)

v10.25.7

10.25.7 (2026-04-23)

Bug Fixes

• filters: support Buffer input in base64_encode to prevent binary data corruption (#881) (0ee6dbb)

v10.25.6

10.25.6 (2026-04-19)

Bug Fixes

• nested block for layout (#883) (e2311df)

v10.25.5

10.25.5 (2026-04-07)

Bug Fixes

• enforce root containment for renderFile/parseFile lookups (#870) (f41c1fc)
• null date should return empty (#868) (#872) (4f9a499)

... (truncated)

Changelog

Sourced from liquidjs's changelog.

10.27.0 (2026-05-15)

Features

• context: null-prototype scope frames via createScope (#899) (47d3f1b)

10.26.0 (2026-05-14)

Bug Fixes

• date: cap strftime widths and account padding in memoryLimit (#895) (3129d46)
• enforce renderLimit for empty renderTemplates calls (#894) (5b9c346)
• propagate ownPropertyOnly into Context.spawn() for {% render %} (#893) (dbbf628)
• security: block Object.prototype filter/tag lookups (RCE) (#897Description has been truncated

[dependabot]

Superseded by #10.