fix(deps): update minor and patch dependencies for gatsby-source-drupal

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
agentkeepalive	^4.2.1 → ^4.6.0
body-parser	^1.20.0 → ^1.20.6
fastq	^1.13.0 → ^1.20.1
got	^11.8.5 → ^11.8.6
http2-wrapper	^2.1.11 → ^2.2.1
lodash (source)	^4.17.21 → ^4.18.1
probe-image-size	^7.2.3 → ^7.3.0

---

Release Notes

node-modules/agentkeepalive (agentkeepalive)

v4.6.0

Compare Source

==================

features

• [7d79ddd] - feat: export HttpAgent as standalone class to avoid namespace clutter and support ESM style imports (#​119) (Radoslav Kirilov <smoke@users.noreply.github.com>)

v4.5.0

Compare Source

==================

others

• [1e5e312] - deps: remove debug and depd (#​114) (fengmk2 <<fengmk2@​gmail.com>>)

v4.4.0

Compare Source

==================

features

• [c7c1e93] - feat: return socket from createConnection (#​113) (Nabeel Bukhari <nabeel.bukhari@hotmail.com>)

v4.3.0

Compare Source

==================

others

• [6f9852b] - deps: depd@​2.0.0 (#​109) (Brian DeHamer <bdehamer@github.com>)
• [fd4bd9b] - test: use npm install (#​110) (fengmk2 <<fengmk2@​gmail.com>>)
• [d52822c] - chore: update contributors (fengmk2 <<fengmk2@​gmail.com>>)

expressjs/body-parser (body-parser)

v1.20.6

Compare Source

What's Changed

• fix: improve limit option validation by @​Phillip9587 in #​741

Full Changelog: expressjs/body-parser@1.20.5...1.20.6

v1.20.5

Compare Source

What's Changed

The reason for this release is a fix to the extended urlencoded parser returning objects instead of arrays for large array inputs (> 100) on qs@​6.14.2+. (#​716)

• refactor(json): simplify strict mode error string construction by @​jonchurch in #​692
• fix: correct off-by-one error in parameterCount by @​abhu85 in #​716
• deps(qs): bump qs to 6.15.1 by @​jonchurch in #​722
• Release: 1.20.5 by @​jonchurch in #​721

New Contributors

• @​abhu85 made their first contribution in #​716

Special thanks to triager @​krzysdz for keeping this on our radar and effectively triaging the specific issue!

Full Changelog: expressjs/body-parser@1.20.4...1.20.5

v1.20.4

Compare Source

===================

• deps: qs@~6.14.0
• deps: use tilde notation for dependencies
• deps: http-errors@~2.0.1
• deps: raw-body@~2.5.3

v1.20.3

Compare Source

===================

• deps: qs@​6.13.0
• add depth option to customize the depth level in the parser
• IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

v1.20.2

Compare Source

===================

• Fix strict json error message on Node.js 19+
• deps: content-type@~1.0.5
  • perf: skip value escaping when unnecessary
• deps: raw-body@​2.5.2

v1.20.1

Compare Source

===================

• deps: qs@​6.11.0
• perf: remove unnecessary object clone

mcollina/fastq (fastq)

v1.20.1

Compare Source

What's Changed

• chore(package): explicitly declare js module type by @​Fdawgs in #​95
• feat: migrate from StandardJS to ESLint with neostandard by @​mcollina in #​98
• feat: add abort() method to settle pending tasks by @​mcollina in #​101

New Contributors

• @​Fdawgs made their first contribution in #​95

Full Changelog: mcollina/fastq@v1.19.1...v1.20.1

v1.20.0

Compare Source

v1.19.1

Compare Source

What's Changed

• Bump nyc from 15.1.0 to 17.0.0 by @​dependabot in #​84
• add comments to type declarations by @​qpwo in #​92
• Do not run coverage on older nodes by @​mcollina in #​93

New Contributors

• @​qpwo made their first contribution in #​92

Full Changelog: mcollina/fastq@v1.19.0...v1.19.1

v1.19.0

Compare Source

What's Changed

• Expose paused status flag by @​greguz in #​91

New Contributors

• @​greguz made their first contribution in #​91

Full Changelog: mcollina/fastq@v1.18.0...v1.19.0

v1.18.0

Compare Source

What's Changed

• fix: ensure drained() resolves after async tasks complete by @​todoroff in #​89

New Contributors

• @​todoroff made their first contribution in #​89

Full Changelog: mcollina/fastq@v1.17.1...v1.18.0

v1.17.1

Compare Source

What's Changed

• Emit drain event after pause/resume combo by @​mcollina in #​82

Full Changelog: mcollina/fastq@v1.17.0...v1.17.1

v1.17.0

Compare Source

What's Changed

• Bump typescript from 4.9.5 to 5.0.4 by @​dependabot in #​68
• fix ci by @​Uzlopak in #​72
• add running to typescript definition by @​Uzlopak in #​71
• fix: unshift with worker throwing error (#​77) by @​aguegu in #​78
• Consistently respect the configured concurrency by @​mart-jansink in #​81

New Contributors

• @​dependabot made their first contribution in #​68
• @​Uzlopak made their first contribution in #​72
• @​aguegu made their first contribution in #​78
• @​mart-jansink made their first contribution in #​81

Full Changelog: mcollina/fastq@v1.15.0...v1.17.0

v1.16.0

Compare Source

What's Changed

• Bump typescript from 4.9.5 to 5.0.4 by @​dependabot in #​68
• fix ci by @​Uzlopak in #​72
• add running to typescript definition by @​Uzlopak in #​71
• fix: unshift with worker throwing error (#​77) by @​aguegu in #​78

New Contributors

• @​dependabot made their first contribution in #​68
• @​Uzlopak made their first contribution in #​72
• @​aguegu made their first contribution in #​78

Full Changelog: mcollina/fastq@v1.15.0...v1.16.0

v1.15.0

Compare Source

What's Changed

• fix: queueAsPromised.drained() resolves while queue is idle by @​0xOlias in #​64

New Contributors

• @​0xOlias made their first contribution in #​64

Full Changelog: mcollina/fastq@v1.14.0...v1.15.0

v1.14.0

Compare Source

What's Changed

• Update README on error callback expected behaviour by @​giovanni-bertoncelli in #​59
• fix(typings): pass generic type to error handler by @​AVVS in #​62

New Contributors

• @​giovanni-bertoncelli made their first contribution in #​59
• @​AVVS made their first contribution in #​62

Full Changelog: mcollina/fastq@v1.13.0...v1.14.0

sindresorhus/got (got)

v11.8.6

Compare Source

• Destroy request object after successful response

szmarczak/http2-wrapper (http2-wrapper)

v2.2.1

Compare Source

• Skip HTTP/2 headers when making a HTTP/1 request (#​100) 1bec004

v2.2.0

Compare Source

• Fix buffer queue memory leak 51eeaf5
• Print status message when proxy server rejects 7a9a46a

lodash/lodash (lodash)

v4.18.1

Compare Source

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See #​6167 (comment)

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

• lodash: lodash/lodash@4.18.0-npm...4.18.1-npm
• lodash-es: lodash/lodash@4.18.0-es...4.18.1-es
• lodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amd
• lodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packages

v4.18.0

Compare Source

v4.18.0

Full Changelog: lodash/lodash@4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

• Add security notice for _.template in threat model and API docs (#​6099)
• Document lower > upper behavior in _.random (#​6115)
• Fix quotes in _.compact jsdoc (#​6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

• lodash.orderby
• lodash.tonumber
• lodash.trim
• lodash.trimend
• lodash.sortedindexby
• lodash.zipobjectdeep
• lodash.unset
• lodash.omit
• lodash.template

v4.17.23

Compare Source

nodeca/probe-image-size (probe-image-size)

v7.3.0

Compare Source

Fixed

• Fixed .readXXX() helpers in sync parsers.
• Improved BMP format handling, #​77.
• Ensure width/height are positive.
• Fixed max redirects handling, #​81.
• Fixed webp sync parser (adjust to streamed version).
• Add bounds check to sync ICO parser.

---

Configuration

📅 Schedule: (in timezone GMT)

• Branch creation
  • "before 7am on the first day of the month"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.