fix(deps): update dependency jsonpath-plus to v10.3.0 [security] - autoclosed

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
jsonpath-plus	10.2.0 -> 10.3.0

GitHub Vulnerability Alerts

CVE-2025-1302

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode.

Note:

This is caused by an incomplete fix for CVE-2024-21534.

---

Release Notes

s3u/JSONPath (jsonpath-plus)

v10.3.0

Compare Source

• fix(eval): rce using non-string prop names (#​237)
• feat(demo): make demo link shareable (#​238)
• chore: update deps. and devDeps.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.