[Snyk] Fix for 3 vulnerabilities

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json

⚠️ Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	526/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.1	Arbitrary Code Injection SNYK-JS-EJS-1049328	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MARKDOWNIT-2331914	Yes	No Known Exploit
	611/1000 Why? Recently disclosed, Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @11ty/eleventy

The new version differs by 250 commits.

• c8741c0 v1.0.0
• 2c606a9 Update deps
• 7b8b43b Adds support for `serverlessFilter` as a more straightforward way to fetch the chunk of paginated data in a serverless call
• 2d5be6c Fixed: benchmark was misreporting too many init calls
• fca0104 Require key for cacheable custom template extensions
• ef494a9 v1.0.0-beta.10
• 32730c4 v1.0.0-canary.50
• 730252a Minor tweak for local test stability
• 223f9ab Updates to ava 4 https://github.com/avajs/ava/releases/tag/v4.0.0
• 1d08541 Update deps
• e343879 Comment tweak [skip ci]
• a218607 Run executeBuild twice, in parallel
• 9514da2 .write, .toJSON, and .toNDJSON will now call .init() for you transparently.
• 34ace73 Test for #1555 #1865 #1956
• c314fc8 Merge pull request #1956 from monochromer/bugfix/pagiation-computed-permalink
• d860374 Tests for `defaultRenderer`
• 4e2ad5e A few tweaks and tests for custom file extensions getData
• 97570cf Custom extensions improvement: Make `getData: false` and `getData: []` work without error.
• 3cb2d71 Change cache default for custom extensions to true, but only if `read: true`
• a510189 Fixes #2155
• 5bc24ca Checks when .compile returns undefined
• fb1a7d8 Add outputFileExtension to default page variable
• ed661f4 Fix debug output for Eleventy:cmd
• 1ea3a90 * Allow render function to return undefined to skip the file write.

See the full diff

Package name: node-fetch

The new version differs by 19 commits.

• 1ef4b56 backport of #1449 (#1453)
• 8fe5c4e 2.x: Specify encoding as an optional peer dependency in package.json (#1310)
• f56b0c6 fix(URL): prefer built in URL version when available and fallback to whatwg (#1352)
• b5417ae fix: import whatwg-url in a way compatible with ESM Node (#1303)
• 18193c5 fix v2.6.3 that did not sending query params (#1301)
• ace7536 fix: properly encode url with unicode characters (#1291)
• 152214c Fix(package.json): Corrected main file path in package.json (#1274)
• b5e2e41 update version number
• 2358a6c Honor the `size` option after following a redirect and revert data uri support
• 8c197f8 docs: Fix typos and grammatical errors in README.md (no-param-reassign: arguments object is mutated anyhow eslint/archive-website#686)
• 1e99050 fix: Change error message thrown with redirect mode set to error (Demo: add ability to configure rules eslint/archive-website#653)
• 244e6f6 docs: Show backers in README
• 6a5d192 fix: Properly parse meta tag when parameters are reversed (Docs: Update 7.0.0-alpha.0 release notes eslint/archive-website#682)
• 47a24a0 chore: Add opencollective badge
• 7b13662 chore: Add funding link
• 5535c2e fix: Check for global.fetch before binding it (Add v6.8.0 release highlights eslint/archive-website#674)
• 1d5778a docs: Add Discord badge
• eb3a572 feat: Data URI support (Docs : Fix broken link to eslint collective logo eslint/archive-website#659)
• 086be6f Remove --save option as it isn't required anymore (Update blogpost for v6.0.0 eslint/archive-website#581)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic