chore(deps): bump feed from 4.2.2 to 5.2.0

[dependabot]

Bumps feed from 4.2.2 to 5.2.0.

Release notes

Sourced from feed's releases.

5.2.0

What's Changed

• Set copyright as optional for feed by @​lluisemper in jpmonette/feed#217
• feat(rss): relax tag output condition to allow name-only by @​huanjuedadehen in jpmonette/feed#220
• fix: treat description as optional rss2 to avoid "undefined" output by @​Krinkle in jpmonette/feed#223
• perf(rss/atom/json): Use .forEach() instead of .map() when resulting array is unused by @​Greenheart in jpmonette/feed#234
• docs: Show current default value for generator in example by @​Greenheart in jpmonette/feed#232
• fix: make copyright and id optional by @​dword-design in jpmonette/feed#219
• Hotfix for allowing multiple atom:link tags in the RSS2 feed by @​aletorrado in jpmonette/feed#235
• Add stylesheet support to rss and atom by @​kunatastic in jpmonette/feed#216
• release 5.2.0 by @​jpmonette in jpmonette/feed#236

New Contributors

• @​lluisemper made their first contribution in jpmonette/feed#217
• @​huanjuedadehen made their first contribution in jpmonette/feed#220
• @​Krinkle made their first contribution in jpmonette/feed#223
• @​Greenheart made their first contribution in jpmonette/feed#234
• @​dword-design made their first contribution in jpmonette/feed#219
• @​aletorrado made their first contribution in jpmonette/feed#235
• @​kunatastic made their first contribution in jpmonette/feed#216

Full Changelog: jpmonette/feed@5.1.0...5.2.0

5.1.0

What's Changed

• Add Catogory and Enclosure types to Export by @​marcofranssen in jpmonette/feed#214
• For rss2, do not mark guid as permalink, unless only link is given by @​pavellishin in jpmonette/feed#213
• update for release 5.1.0 by @​jpmonette in jpmonette/feed#215

New Contributors

• @​marcofranssen made their first contribution in jpmonette/feed#214
• @​pavellishin made their first contribution in jpmonette/feed#213

Full Changelog: jpmonette/feed@5.0.1...5.1.0

5.0.1

What's Changed

• chore: publish bundled files only by @​KazariEX in jpmonette/feed#209
• chore: use tsdown for bundling by @​KazariEX in jpmonette/feed#210
• Release 5.0.1 by @​jpmonette in jpmonette/feed#211

New Contributors

• @​KazariEX made their first contribution in jpmonette/feed#209

Full Changelog: jpmonette/feed@5.0.0...5.0.1

5.0.0

What's Changed

• Bump tmpl from 1.0.4 to 1.0.5 by @​dependabot in jpmonette/feed#164
• Bump path-parse from 1.0.6 to 1.0.7 by @​dependabot in jpmonette/feed#161

... (truncated)

Commits

• 0dd65a5 release 5.2.0 (#236)
• 4b913e3 Add stylesheet support to rss and atom (#216)
• 6745292 Hotfix for allowing multiple atom:link tags in the RSS2 feed (#235)
• 17d1013 fix: make copyright and id optional (#219)
• 8ba1675 Show current default value for generator in example (#232)
• 0e7456a perf(rss/atom/json): Use .forEach() instead of .map() when resulting arra...
• 14e3fc6 fix: treat description as optional rss2 to avoid "undefined" output (#223)
• fd99f18 feat(rss): relax <author> tag output condition to allow name-only (#220)
• 519d8e9 Set copyright as optional for feed (#217)
• dcf9a89 Update README.md
• Additional commits viewable in compare view

Install script changes

This version modifies prepublish script that runs during installation. Review the package contents before updating.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​dedent@​0.7.2
	@​babel/​plugin-syntax-dynamic-import@​7.8.3
	@​types/​github-slugger@​1.3.0
	@​types/​detect-port@​1.3.5
	@​swc/​html@​1.13.5
	@​types/​update-notifier@​6.0.8
	@​types/​buble@​0.20.5
	@​types/​react-router-dom@​5.3.3
	@​types/​unist@​2.0.11 ⏵ 3.0.3			-29
	@​types/​rtlcss@​3.5.4
	@​types/​js-yaml@​4.0.9
	@​babel/​preset-react@​7.28.5
	@​types/​gtag.js@​0.0.20
	@​types/​webpack-bundle-analyzer@​4.7.0
	@​types/​history@​4.7.11
	@​types/​escape-html@​1.0.4
	@​types/​serve-handler@​6.1.4
	@​types/​file-loader@​5.0.4
	@​babel/​preset-typescript@​7.28.5
	@​types/​webpack-env@​1.18.8
	@​types/​prismjs@​1.26.5
	@​types/​picomatch@​2.3.4
	@​babel/​plugin-transform-runtime@​7.29.0
	@​types/​micromatch@​4.0.9
	@​types/​react-dom@​19.2.3
	@​philpl/​buble@​0.19.7
	babel-plugin-dynamic-import-node@​2.3.3
	@​types/​mdast@​4.0.4
	@​babel/​preset-env@​7.29.2
	@​slorber/​remark-comment@​1.0.0
	@​babel/​generator@​7.29.1
	@​babel/​traverse@​7.29.0
	@​total-typescript/​shoehorn@​0.1.2
See 17 more rows in the dashboard

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Critical CVE: Axios has a NO_PROXY Hostname Normalization Bypass Leads to SSRF CVE: GHSA-3p68-rc4w-qgx5 Axios has a NO_PROXY Hostname Normalization Bypass Leads to SSRF (CRITICAL) Affected versions: < 1.15.0 Patched version: 1.15.0 From: ? → npm/@argos-ci/playwright@2.0.0 → npm/@rsdoctor/webpack-plugin@0.4.7 → npm/@rsdoctor/rspack-plugin@0.4.7 → npm/@crowdin/crowdin-api-client@1.29.5 → npm/axios@1.13.4 ℹ Read more on: This package | This alert | What is a critical CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/axios@1.13.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm svgo is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: ? → npm/@svgr/webpack@8.1.0 → npm/svgo@3.3.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/svgo@3.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report