pkg: Update path-to-regexp to v8

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
path-to-regexp	^6.3.0 → ^8.0.0

---

Release Notes

pillarjs/path-to-regexp (path-to-regexp)

v8.3.0: 8.3.0

Compare Source

Changed

• Add custom error class (#​398) 2a7f2a4
• Allow plain objects for TokenData (#​391) 687a9bb
• Escape text should escape backslash (#​390) a4a8552
• Improved error messages and stack size (#​363) a6bdf40

Other

• Minifying the parser
  • PR (#​401) 9df2448
  • PR (#​395) 4a91505
  • Shaving some bytes d63f44b
  • Remove optional operator 973d15c

v8.2.0: 8.2.0

Compare Source

Fixed

• Allowing path-to-regexp to run on older browsers by targeting ES2015
  • Target ES2015 5969033
    • Also saved 0.22kb (10%!) by removing the private class field down level
  • Remove s flag from regexp 51dbd45

v8.1.0

Compare Source

Added

• Adds pathToRegexp method back for generating a regex
• Adds stringify method for converting TokenData into a path string

v8.0.0: Simpler API

Compare Source

Heads up! This is a fairly large change (again) and I need to apologize in advance. If I foresaw what this version would have ended up being I would not have released version 7. A longer blog post and explanation will be incoming this week, but the pivot has been due to work on Express.js v5 and this will the finalized syntax used in Express moving forward.

Edit: The post is out - https://blakeembrey.com/posts/2024-09-web-redos/

Added

• Adds key names to wildcards using *name syntax, aligns with : behavior but using an asterisk instead

Changed

• Removes group suffixes of ?, +, and * - only optional exists moving forward (use wildcards for +, {*foo} for *)
• Parameter names follow JS identifier rules and allow unicode characters

Added

• Parameter names can now be quoted, e.g. :"foo-bar"
• Match accepts an array of values, so the signature is now string | TokenData | Array<string | TokenData>

Removed

• Removes loose mode
• Removes regular expression overrides of parameters

v7.2.0: Support array inputs (again)

Compare Source

Added

• Support array inputs for match and pathToRegexp 3fdd88f

v7.1.0: Strict mode

Compare Source

Added

• Adds a strict option to detect potential ReDOS issues

Fixed

• Fixes separator to default to suffix + prefix when not specified
• Allows separator to be undefined in TokenData
  • This is only relevant if you are building TokenData manually, previously parse filled it in automatically

Comments

• I highly recommend enabling strict: true and I'm probably releasing a V8 with it enabled by default ASAP as a necessary security mitigation

v7.0.0: Wildcard, unicode, and modifier changes

Compare Source

Hi all! There's a few major breaking changes in this release so read carefully.

Breaking changes:

• The function returned by compile only accepts strings as values (i.e. no numbers, use String(value) before compiling a path)
  • For repeated values, when encode !== false, it must be an array of strings
• Parameter names can contain all unicode identifier characters (defined as regex \p{XID_Continue}).
• Modifiers (?, *, +) must be used after a param explicitly wrapped in {}
  • No more implied prefix of / or .
• No support for arrays or regexes as inputs
• The wildcard (standalone *) has been added back and matches Express.js expected behavior
• Removed endsWith option
• Renamed strict: true to trailing: false
• Reserved ;, ,, !, and @ for future use-cases
• Removed tokensToRegexp, tokensToFunction and regexpToFunction in favor of simplifying exports
• Enable a "loose" mode by default, so / can be repeated multiple times in a matched path (i.e. /foo works like //foo, etc)
• encode and decode no longer receive the token as the second parameter
• Removed the ESM + CommonJS dual package in favor of only one CommonJS supported export
• Minimum JS support for ES2020 (previous ES2015)
• Encode defaults to encodeURIComponent and decode defaults to decodeURIComponent

Added:

• Adds encodePath to fix an issue around encode being used for both path and parameters (the path and parameter should be encoded slightly differently)
• Adds loose as an option to support arbitrarily matching the delimiter in paths, e.g. foo/bar and foo///bar should work the same
• Allow encode and decode to be set to false which skips all processing of the parameters input/output
• All remaining methods support TokenData (exported, returned by parse) as input
  • This should be useful if you are programmatically building paths to match or want to avoid parsing multiple times

Requests for feedback:

• Requiring {} is an obvious drawback but I'm seeking feedback on whether it helps make path behavior clearer
  • Related: Removing / and . as implicit prefixes
• Removing array and regex support is to reduce the overall package size for things many users don't need
• Unicode IDs are added to align more closely with browser URLPattern behavior, which uses JS identifiers

---

Motivation

path-to-regexp v6 is vulnerable to ReDoS when routes use two or more parameters between slashes. v8 removes regex features entirely to eliminate this class of vulnerability. Additionally, the v8 syntax is simpler and will be the finalized syntax used in Express.js v5 going forward.

Solution

Upgrade path-to-regexp from v6 to v8 in @data-client/rest, updating both runtime code and TypeScript path-inference types.

Runtime (RestHelpers.ts):

• Updated compile() and parse() calls for the new v8 API
• Added recursive tokenMap() to handle v8's structured token tree (including group tokens for {...} optional syntax)

Types (pathTypes.ts):

• PathKeys / PathSplits: Updated to handle *name wildcards alongside :name params, with v8-appropriate delimiter and escape sets
• Added CleanKey type to strip quotes from quoted parameter names (:"with-dash" → with-dash)
• Removed v6 ? suffix handling from OnlyOptional / OnlyRequired; optionality is now detected via trailing } from {...} groups

Tests:

• New pathTypes.test.ts with 50+ direct type-level assertions covering all v8 patterns (basic params, wildcards, optional groups, quoted names, escapes, combined patterns, ShortenPath, PathArgsAndSearch)
• Migrated all v6 syntax in types.test.ts to v8

Docs & blog:

• Updated RestEndpoint.md path examples and escape character documentation
• Updated resource.md GitHub search example
• Added path-to-regexp v8 migration table to draft v0.16 blog post

[changeset-bot]

🦋 Changeset detected

Latest commit: 2abf408

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@data-client/rest	Minor
test-bundlesize	Patch
coinbase-lite	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Size Change: -242 B (-0.3%)

Total Size: 79.6 kB

Filename	Size	Change
examples/test-bundlesize/dist/App.js	3.18 kB	-242 B (-7.08%)	✅

ℹ️ View Unchanged

Filename	Size
examples/test-bundlesize/dist/polyfill.js	308 B
examples/test-bundlesize/dist/rdcClient.js	10.2 kB
examples/test-bundlesize/dist/rdcEndpoint.js	5.84 kB
examples/test-bundlesize/dist/react.js	59.4 kB
examples/test-bundlesize/dist/webpack-runtime.js	726 B

_{compressed-size-action}

[github-actions]

Size Change: -186 B (-0.23%)

Total Size: 80.4 kB

Filename	Size	Change
examples/test-bundlesize/dist/App.js	3.18 kB	-242 B (-7.08%)	✅
examples/test-bundlesize/dist/rdcEndpoint.js	6.3 kB	+56 B (+0.9%)

ℹ️ View Unchanged

Filename	Size
examples/test-bundlesize/dist/polyfill.js	307 B
examples/test-bundlesize/dist/rdcClient.js	10.2 kB
examples/test-bundlesize/dist/react.js	59.7 kB
examples/test-bundlesize/dist/webpack-runtime.js	726 B

_{compressed-size-action}

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[ntucker]

@cursor review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.05%. Comparing base (5783267) to head (2abf408).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3239   +/-   ##
=======================================
  Coverage   98.05%   98.05%           
=======================================
  Files         151      151           
  Lines        2821     2831   +10     
  Branches      553      554    +1     
=======================================
+ Hits         2766     2776   +10     
  Misses         11       11           
  Partials       44       44           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 8.x releases. But if you manually upgrade to 8.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.