Skip to content

deps: bump canonicalize from 3.0.0 to 4.0.0 - #6602

Merged
bokelley merged 1 commit into
mainfrom
dependabot/npm_and_yarn/main/canonicalize-4.0.0
Aug 17, 2026
Merged

deps: bump canonicalize from 3.0.0 to 4.0.0#6602
bokelley merged 1 commit into
mainfrom
dependabot/npm_and_yarn/main/canonicalize-4.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 16, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps canonicalize from 3.0.0 to 4.0.0.

Release notes

Sourced from canonicalize's releases.

v4.0.0

Breaking Changes

  • Lone surrogates now throw an error — Strings containing lone Unicode surrogates (unpaired high or low surrogates) now throw a TypeError instead of being serialized. This aligns with RFC 8785 §3.2.2.2 which requires implementations to reject ill-formed strings.

What you need to do

If your code passes strings with lone surrogates to canonicalize(), you will now get an error. Validate or sanitize input strings before calling canonicalize(), or wrap the call in a try/catch.

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 16, 2026
bokelley
bokelley approved these changes Aug 17, 2026
View reviewed changes

@bokelley bokelley left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed the v4 breaking change and repository usage. The new lone-surrogate rejection aligns canonicalization with RFC 8785, and this repository's direct use is limited to controlled governance-vector generation. CI is green.

@bokelley

bokelley commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@bokelley
bokelley enabled auto-merge (squash) August 17, 2026 18:46
@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@aao-secretariat

aao-secretariat Bot commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

Ladon does not review bot-authored PRs.

@bokelley
bokelley disabled auto-merge August 17, 2026 18:50
@bokelley
bokelley enabled auto-merge (squash) August 17, 2026 18:50
bokelley
bokelley approved these changes Aug 17, 2026
View reviewed changes

@bokelley bokelley left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-approved after updating onto the merged KMS lockfile changes.

@bokelley

bokelley commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@bokelley

bokelley commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/main/canonicalize-4.0.0 branch from bcb77b6 to 1ea5587 Compare August 17, 2026 18:58
bokelley
bokelley approved these changes Aug 17, 2026
View reviewed changes

@bokelley bokelley left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-approved after Dependabot recreated the branch on current main and the merged KMS lockfile. The verified diff remains scoped to canonicalize v4.

@bokelley

bokelley commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

@bokelley bokelley closed this Aug 17, 2026
auto-merge was automatically disabled August 17, 2026 19:04

Pull request was closed

@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@bokelley bokelley reopened this Aug 17, 2026
@bokelley

bokelley commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

@dependabot recreate

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/main/canonicalize-4.0.0 branch from 1ea5587 to 7a9fb49 Compare August 17, 2026 19:05
bokelley
bokelley approved these changes Aug 17, 2026
View reviewed changes

@bokelley bokelley left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-approved on the final Dependabot-recreated head. The verified diff remains scoped to canonicalize v4 on current main.

@bokelley
bokelley enabled auto-merge (squash) August 17, 2026 19:05
@dependabot
deps: bump canonicalize from 3.0.0 to 4.0.0
46fee73 
Bumps [canonicalize](https://github.com/erdtman/canonicalize) from 3.0.0 to 4.0.0.
- [Release notes](https://github.com/erdtman/canonicalize/releases)
- [Commits](erdtman/canonicalize@v3.0.0...v4.0.0)

---
updated-dependencies:
- dependency-name: canonicalize
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/main/canonicalize-4.0.0 branch from 7a9fb49 to 46fee73 Compare August 17, 2026 19:06
bokelley
bokelley approved these changes Aug 17, 2026
View reviewed changes

@bokelley bokelley left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-approved on the final queued Dependabot recreation. Verified signature; diff remains limited to canonicalize v4 and its lockfile.

@bokelley
bokelley merged commit 6d0453b into main Aug 17, 2026
43 checks passed
@bokelley
bokelley deleted the dependabot/npm_and_yarn/main/canonicalize-4.0.0 branch August 17, 2026 19:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bokelley bokelley bokelley approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@bokelley