build(deps): bump the npm_security group across 1 directory with 3 updates

[dependabot]

Bumps the npm_security group with 2 updates in the / directory: next and find-my-way.

Updates next from 16.2.10 to 16.2.11

Release notes

Sourced from next's releases.

v16.2.11

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

Commits

• 9beca08 v16.2.11
• 3c48c7a [16.x] Fix Turbopack middleware matcher with i18n single locale
• ac1eff3 [16.x] Improve performance of checking valid MPA form submissions
• 9a4651e [16.x] Enforce serverActions.bodySizeLimit for Server Actions in Edge runtime
• b512063 [16.x] Set correct origin for internal redirects in custom server
• d303326 [16.x] Ensure exotic rewrite param values are properly encoded
• 73b9487 [16.x] fix(fetch-cache): key fetch(Request, init) by the effective request
• bf9d17f [16.x] fix(incremental-cache): byte-exact fetch cache key for binary bodies
• fe28768 [16.x] fix(next/image): improve performance of detectContentType()
• d8afb8d [16.x] Performance improvements when decoding React Server function payloads
• Additional commits viewable in compare view

Updates find-my-way from 9.6.0 to 9.7.0

Release notes

Sourced from find-my-way's releases.

v9.7.0

What's Changed

• fix: backtrack on regex param mismatch by @​mcollina in delvedor/find-my-way#427
• fix: apply root path fallback for optional params in off() by @​aquie00t in delvedor/find-my-way#428
• ci: add node v26 to test matrix by @​aquie00t in delvedor/find-my-way#435
• perf(host): cache regex lookup results in HostStorage by @​aquie00t in delvedor/find-my-way#436
• chore: bump inquirer from 13.4.3 to 14.0.2 in the dev-dependencies group by @​dependabot[bot] in delvedor/find-my-way#437
• chore: bump fastify/github-action-merge-dependabot from 3.12.0 to 3.15.0 by @​dependabot[bot] in delvedor/find-my-way#438
• chore: bump @​types/node from 25.9.4 to 26.1.0 in the dev-dependencies group by @​dependabot[bot] in delvedor/find-my-way#440
• fix: prevent done from being called multiple times on async constraint errors by @​deepview-autofix in delvedor/find-my-way#425
• fix: align isParamSafe state in findRoute with _on by @​deepview-autofix in delvedor/find-my-way#424
• chore: bump actions/checkout from 6 to 7 by @​dependabot[bot] in delvedor/find-my-way#439
• fix: avoid crash on undefined regex capture during route lookup by @​bianyifan in delvedor/find-my-way#441

New Contributors

• @​aquie00t made their first contribution in delvedor/find-my-way#428
• @​deepview-autofix made their first contribution in delvedor/find-my-way#425
• @​bianyifan made their first contribution in delvedor/find-my-way#441

Full Changelog: delvedor/find-my-way@v9.6.0...v9.7.0

Commits

• 827248e Bumped v9.7.0
• b9d7bf1 Merge branch 'main' of github.com:delvedor/find-my-way
• b7b5657 fix: avoid crash on undefined regex capture during route lookup (#441)
• 4263d82 chore: bump actions/checkout from 6 to 7 (#439)
• 66d3015 fix: align isParamSafe state in findRoute with _on (#424)
• 75e4728 fix: prevent done from being called multiple times on async constraint errors...
• 902a02d chore: bump @​types/node in the dev-dependencies group (#440)
• b803e4e chore: bump fastify/github-action-merge-dependabot from 3.12.0 to 3.15.0 (#438)
• e63cb77 chore: bump inquirer from 13.4.3 to 14.0.2 in the dev-dependencies group (#437)
• 992c1df perf(host): cache regex lookup results in HostStorage (#436)
• Additional commits viewable in compare view

Updates valibot from 1.2.0 to 1.4.2

Release notes

Sourced from valibot's releases.

v1.4.2

Many thanks to @​Faze-up and @​chatman-media for contributing to this release.

• Fix word count actions to cache the Intl.Segmenter for non-primitive locales, preventing it from being recreated on every words, minWords, maxWords and notWords validation (pull request #1521)
• Fix flatten method to handle issue path keys that collide with Object.prototype members like toString instead of throwing a TypeError (pull request #1522)
• Fix intersect schema to merge object keys that collide with Object.prototype members like toString instead of failing to merge them (pull request #1522)

v1.4.1

• Fix intersect schema to infer correct input and output types for non-tuple array options instead of never (pull request #1478)

v1.4.0

Many thanks to @​ksaurav24, @​heiwen, @​compulim, @​ysknsid25, @​alaycock-stripe, @​IlyaSemenov, @​wszgrcy, @​LMGO, @​yslpn, @​EltonLobo07 and @​Eronmmer for contributing to this release.

Read the release notes on our website for a quick overview of the most exciting new features in this release.

• Add isoDateTimeSecond validation action to validate ISO date times with seconds (pull request #1418)
• Add toCamelCase, toKebabCase, toPascalCase and toSnakeCase transformation actions to convert strings between common naming conventions (pull request #1457)
• Change internal ReadonlyOutputKeys and OutputWithReadonly types of object schemas and WithReadonly type of record schemas to improve TypeScript type performance (pull request #1442)
• Change hot paths to reduce object allocations and improve runtime performance (pull request #1437)
• Change build target to ES2020 so distributed output stays compatible with environments that lack support for newer syntax (pull request #1455)
• Change internal _LruCache to use a TypeScript private method instead of a #private class field to avoid runtime helpers in the transpiled output (pull request #1455)
• Change internal _isValidObjectKey to use Object.prototype.hasOwnProperty.call instead of Object.hasOwn so the distributed output stays compatible with runtimes that lack the ES2022 Object.hasOwn builtin (pull request #1421)
• Change flatten method to accept readonly issue arrays (pull request #1269)
• Fix potential RangeError caused by spreading large issue arrays (pull request #1437)
• Fix creditCard validation action to reject Mastercard numbers with invalid lengths (pull request #1462)
• Fix intersect schema to no longer mutate input values, allowing frozen objects and arrays to be merged (pull request #1463)

v1.4.0 (to-json-schema)

Many thanks to @​stefanprobst, @​sruenwg and @​cruzdanilo for contributing to this release.

• Add support for examples action
• Add support for integer when used with minValue and maxValue actions (pull request #1367)
• Change Valibot peer dependency to v1.2.0
• Fix conversion of exactOptional object properties (pull request #1220)
• Fix conversion of variant to use oneOf instead of anyOf (pull request #1193)

v1.3.1

• Change MAC48_REGEX, MAC64_REGEX and MAC_REGEX to drop the i flag for better JSON Schema compatibility (pull request #1430)
• Change hash action to use case-expanded character classes instead of the i flag (pull request #1430)

v1.3.0

Many thanks to @​EskiMojo14, @​yslpn, @​alexilyaev, @​idleberg, @​BerkliumBirb and @​frenzzy for contributing to this release.

Read the release notes on our website for a quick overview of the most exciting new features in this release.

• Add guard transformation action to narrow types using type predicates (pull request #1204)
• Add parseBoolean transformation action to parse boolean values from strings and other types (pull request #1251)
• Add isrc validation action to validate ISRC codes (pull request #1373)
• Add cache method for caching schema output by input (pull request #1170)
• Add domain validation action to validate domain names (pull request #1284)

... (truncated)

Commits

• 0dc26ea Bump library version to 1.4.2
• 1bd01c3 fix: handle keys that collide with Object.prototype in flatten and merge (#1522)
• 752c636 docs: clarify string length semantics (#1505)
• a3beff9 fix: cache word-count segmenter for non-primitive locales (#1521)
• 1f9b183 Update FUNDING.yml in fabvor of Open Collective
• 2c63b2a Update logos of partners in README
• 09616b2 Add CodeRabbit as partner and remove Stainless
• 92bcf55 Add Cloudflare to privacy policy page
• 9bb6617 Add Cloudflare as a deploy target to our website (#1508)
• c05bf95 Bump to-json-schema version to 1.7.1
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for valibot since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.