From f7c32799428da50b93cbaf5f36c2385854d7ea28 Mon Sep 17 00:00:00 2001
From: Tom Fotherby <tom+github@peopleperhour.com>
Date: Sun, 17 May 2026 14:24:02 +0100
Subject: [PATCH] keep package inputs ES5-compatible

---
 framework/web/js/source/jquery.ba-bbq.js     | 4 ++--
 framework/web/js/source/jquery.ba-bbq.min.js | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/framework/web/js/source/jquery.ba-bbq.js b/framework/web/js/source/jquery.ba-bbq.js
index f7b5da63db..08a62b291e 100644
--- a/framework/web/js/source/jquery.ba-bbq.js
+++ b/framework/web/js/source/jquery.ba-bbq.js
@@ -490,7 +490,7 @@
         keys = key.split( '][' ),
         keys_last = keys.length - 1;
 
-      if ( prohibited_keys.includes( key ) ) {
+      if ( $.inArray( key, prohibited_keys ) !== -1 ) {
         return;
       }
       
@@ -535,7 +535,7 @@
           for ( ; i <= keys_last; i++ ) {
             key = keys[i] === '' ? cur.length : keys[i];
             
-            if ( prohibited_keys.includes( key ) ) {
+            if ( $.inArray( key, prohibited_keys ) !== -1 ) {
               return;
             }
 
diff --git a/framework/web/js/source/jquery.ba-bbq.min.js b/framework/web/js/source/jquery.ba-bbq.min.js
index 33e995595f..b50f50507e 100644
--- a/framework/web/js/source/jquery.ba-bbq.min.js
+++ b/framework/web/js/source/jquery.ba-bbq.min.js
@@ -20,4 +20,4 @@
  * - Fixed prototype pollution (CVE-2021-20086)
  * - Minified with `uglifyjs jquery.ba-bbq.js --compress -o jquery.ba-bbq.min.js`
  */
-($=>{var jq_param_sorted,jq_param_fragment,jq_deparam,jq_deparam_fragment,jq_bbq_pushState,jq_bbq_getState,jq_elemUrlAttr,re_params_fragment,re_fragment,re_no_escape,ajax_crawlable,fragment_prefix,aps=Array.prototype.slice,decode=decodeURIComponent,jq_param=$.param,jq_bbq=$.bbq=$.bbq||{},special=$.event.special,re_params_querystring=/^.*\?|#.*$/g,elemUrlAttr_cache={};function is_string(arg){return"string"==typeof arg}function curry(func){var args=aps.call(arguments,1);return function(){return func.apply(this,args.concat(aps.call(arguments)))}}function jq_param_sub(is_fragment,get_func,url,params,merge_mode){var qs,matches,url_params,hash,merge_mode=void 0!==params?(hash=(matches=url.match(is_fragment?re_fragment:/^([^#?]*)\??([^#]*)(#?.*)/))[3]||"",2===merge_mode&&is_string(params)?qs=params.replace(is_fragment?re_params_fragment:re_params_querystring,""):(url_params=jq_deparam(matches[2]),params=is_string(params)?jq_deparam[is_fragment?"fragment":"querystring"](params):params,qs=2===merge_mode?params:1===merge_mode?$.extend({},params,url_params):$.extend({},url_params,params),qs=jq_param_sorted(qs),is_fragment&&(qs=qs.replace(re_no_escape,decode))),matches[1]+(is_fragment?fragment_prefix:qs||!matches[1]?"?":"")+qs+hash):get_func(void 0!==url?url:location.href);return merge_mode}function jq_deparam_sub(is_fragment,url_or_params,coerce){return url_or_params=void 0===url_or_params||"boolean"==typeof url_or_params?(coerce=url_or_params,jq_param[is_fragment?"fragment":"querystring"]()):is_string(url_or_params)?url_or_params.replace(is_fragment?re_params_fragment:re_params_querystring,""):url_or_params,jq_deparam(url_or_params,coerce)}function jq_fn_sub(mode,force_attr,params,merge_mode){return is_string(params)||"object"==typeof params||(merge_mode=params,params=force_attr,force_attr=void 0),this.each(function(){var that=$(this),attr=force_attr||jq_elemUrlAttr()[(this.nodeName||"").toLowerCase()]||"",url=attr&&that.attr(attr)||"";that.attr(attr,jq_param[mode](url,params,merge_mode))})}jq_param.querystring=curry(jq_param_sub,0,function(url){return url.replace(/(?:^[^?#]*\?([^#]*).*$)?.*/,"$1")}),jq_param.fragment=jq_param_fragment=curry(jq_param_sub,1,function(url){return url.replace(re_fragment,"$2")}),jq_param.sorted=jq_param_sorted=function(a,traditional){var arr=[],obj={};return $.each(jq_param(a,traditional).split("&"),function(i,v){var key=v.replace(/(?:%5B|=).*$/,""),key_obj=obj[key];key_obj||(key_obj=obj[key]=[],arr.push(key)),key_obj.push(v)}),$.map(arr.sort(),function(v){return obj[v]}).join("&")},jq_param_fragment.noEscape=function(chars){chars=$.map((chars=chars||"").split(""),encodeURIComponent);re_no_escape=new RegExp(chars.join("|"),"g")},jq_param_fragment.noEscape(",/"),jq_param_fragment.ajaxCrawlable=function(state){return void 0!==state&&(fragment_prefix=state?(re_params_fragment=/^.*(?:#!|#)/,re_fragment=/^([^#]*)(?:#!|#)?(.*)$/,"#!"):(re_params_fragment=/^.*#/,re_fragment=/^([^#]*)#?(.*)$/,"#"),ajax_crawlable=!!state),ajax_crawlable},jq_param_fragment.ajaxCrawlable(0),$.deparam=jq_deparam=function(params,coerce){var prohibited_keys=["__proto__"],obj={},coerce_types={true:!0,false:!1,null:null};return $.each(params.replace(/\+/g," ").split("&"),function(j,v){var val,v=v.split("="),key=decode(v[0]),cur=obj,i=0,keys=key.split("]["),keys_last=keys.length-1;if(!prohibited_keys.includes(key))if(keys_last=/\[/.test(keys[0])&&/\]$/.test(keys[keys_last])?(keys[keys_last]=keys[keys_last].replace(/\]$/,""),(keys=keys.shift().split("[").concat(keys)).length-1):0,2===v.length)if(val=decode(v[1]),coerce&&(val=val&&!isNaN(val)?+val:"undefined"===val?void 0:void 0!==coerce_types[val]?coerce_types[val]:val),keys_last)for(;i<=keys_last;i++){if(key=""===keys[i]?cur.length:keys[i],prohibited_keys.includes(key))return;cur=cur[key]=i<keys_last?cur[key]||(keys[i+1]&&isNaN(keys[i+1])?{}:[]):val}else $.isArray(obj[key])?obj[key].push(val):void 0!==obj[key]?obj[key]=[obj[key],val]:obj[key]=val;else key&&(obj[key]=coerce?void 0:"")}),obj},jq_deparam.querystring=curry(jq_deparam_sub,0),jq_deparam.fragment=jq_deparam_fragment=curry(jq_deparam_sub,1),$.elemUrlAttr||($.elemUrlAttr=function(obj){return $.extend(elemUrlAttr_cache,obj)})({a:"href",base:"href",iframe:"src",img:"src",input:"src",form:"action",link:"href",script:"src"}),jq_elemUrlAttr=$.elemUrlAttr,$.fn.querystring=curry(jq_fn_sub,"querystring"),$.fn.fragment=curry(jq_fn_sub,"fragment"),jq_bbq.pushState=jq_bbq_pushState=function(params,merge_mode){is_string(params)&&/^#/.test(params)&&void 0===merge_mode&&(merge_mode=2);var has_args=void 0!==params,params=jq_param_fragment(location.href,has_args?params:{},has_args?merge_mode:2);location.href=params},jq_bbq.getState=jq_bbq_getState=function(key,coerce){return void 0===key||"boolean"==typeof key?jq_deparam_fragment(key):jq_deparam_fragment(coerce)[key]},jq_bbq.removeState=function(arr){var state={};void 0!==arr&&(state=jq_bbq_getState(),$.each($.isArray(arr)?arr:arguments,function(i,v){delete state[v]})),jq_bbq_pushState(state,2)},special.hashchange=$.extend(special.hashchange,{add:function(handleObj){var old_handler;function new_handler(e){var hash=e.fragment=jq_param_fragment();e.getState=function(key,coerce){return void 0===key||"boolean"==typeof key?jq_deparam(hash,key):jq_deparam(hash,coerce)[key]},old_handler.apply(this,arguments)}if($.isFunction(handleObj))return old_handler=handleObj,new_handler;old_handler=handleObj.handler,handleObj.handler=new_handler}})})(jQuery),(($,window)=>{var fake_onhashchange,timeout_id,last_hash,history_set,history_get,doc=document,special=$.event.special,doc=doc.documentMode,supports_onhashchange="onhashchange"in window&&(void 0===doc||7<doc);function get_fragment(url){return"#"+(url=url||location.href).replace(/^[^#]*#?(.*)$/,"$1")}function fn_retval(val){return val}function poll(){var hash=get_fragment(),history_hash=history_get(last_hash);hash!==last_hash?(history_set(last_hash=hash,history_hash),$(window).trigger("hashchange")):history_hash!==last_hash&&(location.href=location.href.replace(/#.*/,"")+history_hash),timeout_id=setTimeout(poll,$.fn.hashchange.delay)}$.fn.hashchange=function(fn){return fn?this.bind("hashchange",fn):this.trigger("hashchange")},$.fn.hashchange.delay=50,special.hashchange=$.extend(special.hashchange,{setup:function(){if(supports_onhashchange)return!1;$(fake_onhashchange.start)},teardown:function(){if(supports_onhashchange)return!1;$(fake_onhashchange.stop)}}),doc={},last_hash=get_fragment(),history_get=history_set=fn_retval,doc.start=function(){timeout_id||poll()},doc.stop=function(){timeout_id&&clearTimeout(timeout_id),timeout_id=void 0},fake_onhashchange=doc})(jQuery,this);
\ No newline at end of file
+(function($){var jq_param_sorted,jq_param_fragment,jq_deparam,jq_deparam_fragment,jq_bbq_pushState,jq_bbq_getState,jq_elemUrlAttr,re_params_fragment,re_fragment,re_no_escape,ajax_crawlable,fragment_prefix,aps=Array.prototype.slice,decode=decodeURIComponent,jq_param=$.param,jq_bbq=$.bbq=$.bbq||{},special=$.event.special,re_params_querystring=/^.*\?|#.*$/g,elemUrlAttr_cache={};function is_string(arg){return"string"==typeof arg}function curry(func){var args=aps.call(arguments,1);return function(){return func.apply(this,args.concat(aps.call(arguments)))}}function jq_param_sub(is_fragment,get_func,url,params,merge_mode){var qs,matches,url_params,hash,merge_mode=void 0!==params?(hash=(matches=url.match(is_fragment?re_fragment:/^([^#?]*)\??([^#]*)(#?.*)/))[3]||"",2===merge_mode&&is_string(params)?qs=params.replace(is_fragment?re_params_fragment:re_params_querystring,""):(url_params=jq_deparam(matches[2]),params=is_string(params)?jq_deparam[is_fragment?"fragment":"querystring"](params):params,qs=2===merge_mode?params:1===merge_mode?$.extend({},params,url_params):$.extend({},url_params,params),qs=jq_param_sorted(qs),is_fragment&&(qs=qs.replace(re_no_escape,decode))),matches[1]+(is_fragment?fragment_prefix:qs||!matches[1]?"?":"")+qs+hash):get_func(void 0!==url?url:location.href);return merge_mode}function jq_deparam_sub(is_fragment,url_or_params,coerce){return url_or_params=void 0===url_or_params||"boolean"==typeof url_or_params?(coerce=url_or_params,jq_param[is_fragment?"fragment":"querystring"]()):is_string(url_or_params)?url_or_params.replace(is_fragment?re_params_fragment:re_params_querystring,""):url_or_params,jq_deparam(url_or_params,coerce)}function jq_fn_sub(mode,force_attr,params,merge_mode){return is_string(params)||"object"==typeof params||(merge_mode=params,params=force_attr,force_attr=void 0),this.each(function(){var that=$(this),attr=force_attr||jq_elemUrlAttr()[(this.nodeName||"").toLowerCase()]||"",url=attr&&that.attr(attr)||"";that.attr(attr,jq_param[mode](url,params,merge_mode))})}jq_param.querystring=curry(jq_param_sub,0,function(url){return url.replace(/(?:^[^?#]*\?([^#]*).*$)?.*/,"$1")}),jq_param.fragment=jq_param_fragment=curry(jq_param_sub,1,function(url){return url.replace(re_fragment,"$2")}),jq_param.sorted=jq_param_sorted=function(a,traditional){var arr=[],obj={};return $.each(jq_param(a,traditional).split("&"),function(i,v){var key=v.replace(/(?:%5B|=).*$/,""),key_obj=obj[key];key_obj||(key_obj=obj[key]=[],arr.push(key)),key_obj.push(v)}),$.map(arr.sort(),function(v){return obj[v]}).join("&")},jq_param_fragment.noEscape=function(chars){chars=$.map((chars=chars||"").split(""),encodeURIComponent);re_no_escape=new RegExp(chars.join("|"),"g")},jq_param_fragment.noEscape(",/"),jq_param_fragment.ajaxCrawlable=function(state){return void 0!==state&&(fragment_prefix=state?(re_params_fragment=/^.*(?:#!|#)/,re_fragment=/^([^#]*)(?:#!|#)?(.*)$/,"#!"):(re_params_fragment=/^.*#/,re_fragment=/^([^#]*)#?(.*)$/,"#"),ajax_crawlable=!!state),ajax_crawlable},jq_param_fragment.ajaxCrawlable(0),$.deparam=jq_deparam=function(params,coerce){var prohibited_keys=["__proto__"],obj={},coerce_types={"true":!0,"false":!1,"null":null};return $.each(params.replace(/\+/g," ").split("&"),function(j,v){var val,v=v.split("="),key=decode(v[0]),cur=obj,i=0,keys=key.split("]["),keys_last=keys.length-1;if($.inArray(key,prohibited_keys)===-1)if(keys_last=/\[/.test(keys[0])&&/\]$/.test(keys[keys_last])?(keys[keys_last]=keys[keys_last].replace(/\]$/,""),(keys=keys.shift().split("[").concat(keys)).length-1):0,2===v.length)if(val=decode(v[1]),coerce&&(val=val&&!isNaN(val)?+val:"undefined"===val?void 0:void 0!==coerce_types[val]?coerce_types[val]:val),keys_last)for(;i<=keys_last;i++){if(key=""===keys[i]?cur.length:keys[i],$.inArray(key,prohibited_keys)!==-1)return;cur=cur[key]=i<keys_last?cur[key]||(keys[i+1]&&isNaN(keys[i+1])?{}:[]):val}else $.isArray(obj[key])?obj[key].push(val):void 0!==obj[key]?obj[key]=[obj[key],val]:obj[key]=val;else key&&(obj[key]=coerce?void 0:"")}),obj},jq_deparam.querystring=curry(jq_deparam_sub,0),jq_deparam.fragment=jq_deparam_fragment=curry(jq_deparam_sub,1),$.elemUrlAttr||($.elemUrlAttr=function(obj){return $.extend(elemUrlAttr_cache,obj)})({a:"href",base:"href",iframe:"src",img:"src",input:"src",form:"action",link:"href",script:"src"}),jq_elemUrlAttr=$.elemUrlAttr,$.fn.querystring=curry(jq_fn_sub,"querystring"),$.fn.fragment=curry(jq_fn_sub,"fragment"),jq_bbq.pushState=jq_bbq_pushState=function(params,merge_mode){is_string(params)&&/^#/.test(params)&&void 0===merge_mode&&(merge_mode=2);var has_args=void 0!==params,params=jq_param_fragment(location.href,has_args?params:{},has_args?merge_mode:2);location.href=params},jq_bbq.getState=jq_bbq_getState=function(key,coerce){return void 0===key||"boolean"==typeof key?jq_deparam_fragment(key):jq_deparam_fragment(coerce)[key]},jq_bbq.removeState=function(arr){var state={};void 0!==arr&&(state=jq_bbq_getState(),$.each($.isArray(arr)?arr:arguments,function(i,v){delete state[v]})),jq_bbq_pushState(state,2)},special.hashchange=$.extend(special.hashchange,{add:function(handleObj){var old_handler;function new_handler(e){var hash=e.fragment=jq_param_fragment();e.getState=function(key,coerce){return void 0===key||"boolean"==typeof key?jq_deparam(hash,key):jq_deparam(hash,coerce)[key]},old_handler.apply(this,arguments)}if($.isFunction(handleObj))return old_handler=handleObj,new_handler;old_handler=handleObj.handler,handleObj.handler=new_handler}})})(jQuery),(function($,window){var fake_onhashchange,timeout_id,last_hash,history_set,history_get,doc=document,special=$.event.special,doc=doc.documentMode,supports_onhashchange="onhashchange"in window&&(void 0===doc||7<doc);function get_fragment(url){return"#"+(url=url||location.href).replace(/^[^#]*#?(.*)$/,"$1")}function fn_retval(val){return val}function poll(){var hash=get_fragment(),history_hash=history_get(last_hash);hash!==last_hash?(history_set(last_hash=hash,history_hash),$(window).trigger("hashchange")):history_hash!==last_hash&&(location.href=location.href.replace(/#.*/,"")+history_hash),timeout_id=setTimeout(poll,$.fn.hashchange.delay)}$.fn.hashchange=function(fn){return fn?this.bind("hashchange",fn):this.trigger("hashchange")},$.fn.hashchange.delay=50,special.hashchange=$.extend(special.hashchange,{setup:function(){if(supports_onhashchange)return!1;$(fake_onhashchange.start)},teardown:function(){if(supports_onhashchange)return!1;$(fake_onhashchange.stop)}}),doc={},last_hash=get_fragment(),history_get=history_set=fn_retval,doc.start=function(){timeout_id||poll()},doc.stop=function(){timeout_id&&clearTimeout(timeout_id),timeout_id=void 0},fake_onhashchange=doc})(jQuery,this);
\ No newline at end of file