Skip to content

chore(deps): bump canonicalize from 3.0.0 to 4.0.0 - #277

Merged
Medformatik merged 2 commits into
mainfrom
dependabot/npm_and_yarn/canonicalize-4.0.0
Aug 27, 2026
Merged

chore(deps): bump canonicalize from 3.0.0 to 4.0.0#277
Medformatik merged 2 commits into
mainfrom
dependabot/npm_and_yarn/canonicalize-4.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026

Copy link
Copy Markdown
Contributor

Bumps canonicalize from 3.0.0 to 4.0.0.

Release notes

Sourced from canonicalize's releases.

v4.0.0

Breaking Changes

  • Lone surrogates now throw an error — Strings containing lone Unicode surrogates (unpaired high or low surrogates) now throw a TypeError instead of being serialized. This aligns with RFC 8785 §3.2.2.2 which requires implementations to reject ill-formed strings.

What you need to do

If your code passes strings with lone surrogates to canonicalize(), you will now get an error. Validate or sanitize input strings before calling canonicalize(), or wrap the call in a try/catch.

Commits

@dependabot
dependabot Bot requested a review from Medformatik as a code owner August 24, 2026 04:35
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/canonicalize-4.0.0 branch 3 times, most recently from f9b003a to 04b7f63 Compare August 27, 2026 17:26
@Medformatik
Medformatik force-pushed the dependabot/npm_and_yarn/canonicalize-4.0.0 branch from 04b7f63 to 532d562 Compare August 27, 2026 19:41
dependabot Bot and others added 2 commits August 27, 2026 22:03
Bumps [canonicalize](https://github.com/erdtman/canonicalize) from 3.0.0 to 4.0.0.
- [Release notes](https://github.com/erdtman/canonicalize/releases)
- [Commits](erdtman/canonicalize@v3.0.0...v4.0.0)

---
updated-dependencies:
- dependency-name: canonicalize
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@Medformatik
Medformatik force-pushed the dependabot/npm_and_yarn/canonicalize-4.0.0 branch from 532d562 to 22dd493 Compare August 27, 2026 20:05
@Medformatik

Copy link
Copy Markdown
Collaborator

Validated canonicalize v4’s breaking change: it now rejects lone UTF-16 surrogates. The branch preserves the public TypeError contract and adds a regression test. RFC 8785 byte-parity tests, package type-checking, policy checks, and the full 13,078-test suite pass on the rebased branch.

@Medformatik
Medformatik merged commit 93da818 into main Aug 27, 2026
22 checks passed
@Medformatik
Medformatik deleted the dependabot/npm_and_yarn/canonicalize-4.0.0 branch August 27, 2026 20:36
@github-actions github-actions Bot locked and limited conversation to collaborators Aug 27, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant