chore(deps): bump the npm_and_yarn group across 1 directory with 30 updates #17
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
…pdates Bumps the npm_and_yarn group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [semantic-release](https://github.com/semantic-release/semantic-release) | `15.13.24` | `19.0.3` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.20.13` | `7.24.5` | | [@sideway/formula](https://github.com/sideway/formula) | `3.0.0` | `3.0.1` | | [async](https://github.com/caolan/async) | `2.6.3` | `2.6.4` | | [color-string](https://github.com/Qix-/color-string) | `1.5.3` | `1.9.1` | | [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component) | `0.2.0` | `0.2.2` | | [express](https://github.com/expressjs/express) | `4.17.1` | `4.19.2` | | [hosted-git-info](https://github.com/npm/hosted-git-info) | `2.8.8` | `2.8.9` | | [ini](https://github.com/npm/ini) | `1.3.5` | `1.3.8` | | [ip](https://github.com/indutny/node-ip) | `1.1.5` | `1.1.9` | | [jszip](https://github.com/Stuk/jszip) | `3.5.0` | `3.10.1` | | [moment](https://github.com/moment/moment) | `2.27.0` | `2.30.1` | | [normalize-url](https://github.com/sindresorhus/normalize-url) | `4.5.0` | `4.5.1` | | [qs](https://github.com/ljharb/qs) | `6.5.2` | `6.5.3` | | [react-devtools-core](https://github.com/facebook/react/tree/HEAD/packages/react-devtools-core) | `4.27.1` | `4.28.5` | | [trim-newlines](https://github.com/sindresorhus/trim-newlines) | `3.0.0` | `3.0.1` | | [ua-parser-js](https://github.com/faisalman/ua-parser-js) | `0.7.21` | `0.7.37` | | [word-wrap](https://github.com/jonschlinkert/word-wrap) | `1.2.3` | `1.2.5` | | [ws](https://github.com/websockets/ws) | `5.2.2` | `5.2.3` | Updates `semantic-release` from 15.13.24 to 19.0.3 - [Release notes](https://github.com/semantic-release/semantic-release/releases) - [Commits](semantic-release/semantic-release@v15.13.24...v19.0.3) Updates `@babel/traverse` from 7.20.13 to 7.24.5 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.24.5/packages/babel-traverse) Updates `@sideway/formula` from 3.0.0 to 3.0.1 - [Commits](hapijs/formula@v3.0.0...v3.0.1) Updates `async` from 2.6.3 to 2.6.4 - [Release notes](https://github.com/caolan/async/releases) - [Changelog](https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md) - [Commits](caolan/async@v2.6.3...v2.6.4) Updates `color-string` from 1.5.3 to 1.9.1 - [Release notes](https://github.com/Qix-/color-string/releases) - [Changelog](https://github.com/Qix-/color-string/blob/master/CHANGELOG.md) - [Commits](https://github.com/Qix-/color-string/commits/1.9.1) Updates `decode-uri-component` from 0.2.0 to 0.2.2 - [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases) - [Commits](SamVerschueren/decode-uri-component@v0.2.0...v0.2.2) Updates `express` from 4.17.1 to 4.19.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.17.1...4.19.2) Updates `got` from 6.7.1 to 11.5.2 - [Release notes](https://github.com/sindresorhus/got/releases) - [Commits](sindresorhus/got@v6.7.1...v11.5.2) Updates `handlebars` from 4.7.6 to 4.7.8 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.8/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.6...v4.7.8) Updates `hosted-git-info` from 2.8.8 to 2.8.9 - [Release notes](https://github.com/npm/hosted-git-info/releases) - [Changelog](https://github.com/npm/hosted-git-info/blob/v2.8.9/CHANGELOG.md) - [Commits](npm/hosted-git-info@v2.8.8...v2.8.9) Updates `http-cache-semantics` from 3.8.1 to 4.1.0 - [Commits](kornelski/http-cache-semantics@v3.8.1...v4.1.0) Updates `ini` from 1.3.5 to 1.3.8 - [Release notes](https://github.com/npm/ini/releases) - [Changelog](https://github.com/npm/ini/blob/main/CHANGELOG.md) - [Commits](npm/ini@v1.3.5...v1.3.8) Updates `ip` from 1.1.5 to 1.1.9 - [Commits](indutny/node-ip@v1.1.5...v1.1.9) Updates `jszip` from 3.5.0 to 3.10.1 - [Changelog](https://github.com/Stuk/jszip/blob/main/CHANGES.md) - [Commits](Stuk/jszip@v3.5.0...v3.10.1) Updates `marked` from 0.7.0 to 4.3.0 - [Release notes](https://github.com/markedjs/marked/releases) - [Changelog](https://github.com/markedjs/marked/blob/master/.releaserc.json) - [Commits](markedjs/marked@v0.7.0...v4.3.0) Updates `mem` from 1.1.0 to 4.3.0 - [Release notes](https://github.com/sindresorhus/mem/releases) - [Commits](sindresorhus/memoize@v1.1.0...v4.3.0) Updates `moment` from 2.27.0 to 2.30.1 - [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md) - [Commits](moment/moment@2.27.0...2.30.1) Updates `normalize-url` from 4.5.0 to 4.5.1 - [Release notes](https://github.com/sindresorhus/normalize-url/releases) - [Commits](https://github.com/sindresorhus/normalize-url/commits) Updates `npm-user-validate` from 1.0.0 to 1.0.1 - [Release notes](https://github.com/npm/npm-user-validate/releases) - [Changelog](https://github.com/npm/npm-user-validate/blob/main/CHANGELOG.md) - [Commits](npm/npm-user-validate@v1.0.0...v1.0.1) Updates `qs` from 6.5.2 to 6.5.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.2...v6.5.3) Updates `react-devtools-core` from 4.27.1 to 4.28.5 - [Release notes](https://github.com/facebook/react/releases) - [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/react/commits/HEAD/packages/react-devtools-core) Updates `semver-regex` from 2.0.0 to 3.1.4 - [Release notes](https://github.com/sindresorhus/semver-regex/releases) - [Commits](sindresorhus/semver-regex@v2.0.0...v3.1.4) Updates `ssri` from 6.0.1 to 9.0.1 - [Release notes](https://github.com/npm/ssri/releases) - [Changelog](https://github.com/npm/ssri/blob/main/CHANGELOG.md) - [Commits](npm/ssri@v6.0.1...v9.0.1) Updates `tar` from 4.4.13 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v4.4.13...v6.2.1) Updates `trim-newlines` from 3.0.0 to 3.0.1 - [Release notes](https://github.com/sindresorhus/trim-newlines/releases) - [Commits](https://github.com/sindresorhus/trim-newlines/commits) Updates `ua-parser-js` from 0.7.21 to 0.7.37 - [Release notes](https://github.com/faisalman/ua-parser-js/releases) - [Changelog](https://github.com/faisalman/ua-parser-js/blob/master/CHANGELOG.md) - [Commits](faisalman/ua-parser-js@0.7.21...0.7.37) Updates `word-wrap` from 1.2.3 to 1.2.5 - [Release notes](https://github.com/jonschlinkert/word-wrap/releases) - [Commits](jonschlinkert/word-wrap@1.2.3...1.2.5) Updates `ws` from 5.2.2 to 5.2.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@5.2.2...5.2.3) Updates `y18n` from 3.2.1 to 4.0.0 - [Release notes](https://github.com/yargs/y18n/releases) - [Changelog](https://github.com/yargs/y18n/blob/master/CHANGELOG.md) - [Commits](yargs/y18n@v3.2.1...v4.0.0) Updates `yargs-parser` from 7.0.0 to 11.1.1 - [Release notes](https://github.com/yargs/yargs-parser/releases) - [Changelog](https://github.com/yargs/yargs-parser/blob/v11.1.1/CHANGELOG.md) - [Commits](yargs/yargs-parser@v7.0.0...v11.1.1) --- updated-dependencies: - dependency-name: semantic-release dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@sideway/formula" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: async dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: color-string dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: decode-uri-component dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: got dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: hosted-git-info dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-cache-semantics dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ini dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jszip dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: marked dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: mem dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: moment dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: normalize-url dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: npm-user-validate dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: react-devtools-core dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: semver-regex dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ssri dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: trim-newlines dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ua-parser-js dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: word-wrap dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: y18n dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: yargs-parser dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>
|
👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎ This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. Ignoring: Next stepsTake a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with |
|
@dependabot recreate |
|
@dependabot rebase |
|
@SocketSecurity ignore-all Socket.dev showed no issues with upgrade of package https://socket.dev/npm/package/semantic-release/overview/19.0.3 |
dependabot
bot
deleted the
dependabot/npm_and_yarn/npm_and_yarn-e6408803e0
branch
Bumps the npm_and_yarn group with 19 updates in the / directory:
15.13.2419.0.37.20.137.24.53.0.03.0.12.6.32.6.41.5.31.9.10.2.00.2.24.17.14.19.22.8.82.8.91.3.51.3.81.1.51.1.93.5.03.10.12.27.02.30.14.5.04.5.16.5.26.5.34.27.14.28.53.0.03.0.10.7.210.7.371.2.31.2.55.2.25.2.3Updates
semantic-releasefrom 15.13.24 to 19.0.3Release notes
Sourced from semantic-release's releases.
... (truncated)
Commits
58a226ffix(log-repo): use the original form of the repo url to remove the need to ma...17d60d3build(deps): bump npm from 8.3.1 to 8.12.0 (#2447)ab45ab1chore(lint): disabled rules that dont apply to this project (#2408)ea389c3chore(deps): update dependency yargs-parser to 13.1.2 [security] (#2402)fa994dbbuild(deps): bump node-fetch from 2.6.1 to 2.6.7 (#2399)b79116bbuild(deps): bump trim-off-newlines from 1.0.1 to 1.0.36fd7e56build(deps): bump minimist from 1.2.5 to 1.2.62b94bb4docs: update broken link to CI config recipes (#2378)b4bc191docs: Correct circleci workflow (#2365)2c30e26Merge pull request #2333 from semantic-release/nextUpdates
@babel/traversefrom 7.20.13 to 7.24.5Release notes
Sourced from
@babel/traverse's releases.... (truncated)
Changelog
Sourced from
@babel/traverse's changelog.... (truncated)
Commits
ddbea7dv7.24.5e779cadfix: TypeScript annotation affects output (#16377)ee48754Use multiple TypeScript projects (#16430)4d8b2d0MakeNodePath\<T | U>distributive (#16439)a84ec28Enableeqeqeqrule (#16404)822b025v7.24.1fc0d5adUpdate typescript and lint tools (#16351)69e7928Consider well-known and registered symbols as literals (#16342)40110e9Update source map deps (#16327)ce59160v7.24.0Updates
@sideway/formulafrom 3.0.0 to 3.0.1Commits
5b44c1b3.0.19fbc20achore: better number regex41ae98eCleanupc59f35eMove to SidewayMaintainer changes
This version was pushed to npm by marsup, a new releaser for
@sideway/formulasince your current version.Updates
asyncfrom 2.6.3 to 2.6.4Changelog
Sourced from async's changelog.
Commits
c6bdacaVersion 2.6.48870da9Update built files4df6754update changelog8f7f903Fix prototype pollution vulnerability (#1828)Maintainer changes
This version was pushed to npm by hargasinski, a new releaser for async since your current version.
Updates
color-stringfrom 1.5.3 to 1.9.1Release notes
Sourced from color-string's releases.
... (truncated)
Commits
Updates
decode-uri-componentfrom 0.2.0 to 0.2.2Release notes
Sourced from decode-uri-component's releases.
Commits
a0eea460.2.2980e0bfPrevent overwriting previously decoded tokens3c8a3730.2.176abc93Switch to GitHub workflows746ca5dFix issue where decode throws - fixes #6486d7e2Update license (#1)a650457Tidelift tasks66e1c28Meta tweaksUpdates
expressfrom 4.17.1 to 4.19.2Release notes
Sourced from express's releases.
... (truncated)
Changelog
Sourced from express's changelog.
... (truncated)
Commits
04bc6274.19.2da4d763Improved fix for open redirect allow list bypass4f0f6cc4.19.1a003cfaAllow passing non-strings to res.location with new encoding handling checks f...a1fa90ffixed un-edited version in history.md for 4.19.011f2b1dbuild: fix build due to inconsistent supertest behavior in older versions084e3654.19.00867302Prevent open redirect allow list bypass due to encodeurl567c9c6Add note on how to update docs for new release (#5541)69a4cf2deps: cookie@0.6.0Maintainer changes
This version was pushed to npm by wesleytodd, a new releaser for express since your current version.
Updates
gotfrom 6.7.1 to 11.5.2Release notes
Sourced from got's releases.
... (truncated)
Commits
b86d97111.5.29a309bdFixed deprecationWarning on https options (#1391)a748343Mention header lowercasing inrequestmigration guide (#1387)ddd7930Add got4aws to AWS section (#1380)043c950FixdnsCache: truehaving no effecte02845fFix duplicated hooks when paginatinga3e171cAdd hpagent to proxy section (#1363)b38e39a11.5.11ef053dFollow-up commit2d96679Prevent uncaught errors on HTTP errorsUpdates
handlebarsfrom 4.7.6 to 4.7.8Release notes
Sourced from handlebars's releases.
Changelog
Sourced from handlebars's changelog.
Commits
8dc3d25v4.7.8668c4fbFix browser tests in CI pipelinec65c6ccTest on Node 183d3796cMake library compatible with workers075b354Fix sync issue with npm lock-file30dbf04Fix compiling of each block params in strict modee3a5448Fix bundler issue with webpack 58e23642Fix integration-tests issue with npm >= 788ac068use https instead of git for mustache submodulec68bc08Fix typoMaintainer changes
This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.
Updates
hosted-git-infofrom 2.8.8 to 2.8.9Changelog
Sourced from hosted-git-info's changelog.
Commits
8d4b369chore(release): 2.8.929adfe5fix: backport regex fix from #76Maintainer changes
This version was pushed to npm by nlf, a new releaser for hosted-git-info since your current version.
Updates
http-cache-semanticsfrom 3.8.1 to 4.1.0Commits
ed83aecExplain trust server date1b35980rfc 5861 (stale-if-error, stale-while-revalidate)2c2fac2Drop trustServerDateeb7028fTest names84cc9a8Bumpae5ecd5Add status to tests385b5d3Minor storable bug8ff37cbFix test1988c3fRename var7160146Merge pull request #24 from non-binary/nb/fix-validators-typoUpdates
inifrom 1.3.5 to 1.3.8Commits
a2c5da81.3.8af5c6bbDo not use Object.create(null)8b648a1don't test where our devdeps don't even workc74c8af1.3.7024b8b5update deps, add linting032fbafUse Object.create(null) to avoid default object property hazards2da90391.3.6cfea636better git push script, before publish instead of after56d2805do not allow invalid hazardous string as section nameMaintainer changes
This version was pushed to npm by isaacs, a new releaser for ini since your current version.
Updates
ipfrom 1.1.5 to 1.1.9Commits
1ecbf2f1.1.96a3ada9lib: fixed CVE-2023-42282 and added unit test5dc3b2f1.1.88e6f28blib: even better node 6 support088c9e51.1.71a4ca35lib: add back support for Node.js 6af82ef41.1.6dba19f6package: exclude test folder from publishing7cd7f30ci: use github workflows4de50aelib: node 18 supportUpdates
jszipfrom 3.5.0 to 3.10.1Changelog
Sourced from jszip's changelog.
Commits
0f2f1e43.10.1cae5510Updates for v3.10.1179c9a0Update changelog for 3.10.161e1df5Add Jekyll files to gitignoref299cceMerge pull request #852 from Stuk/metadata-ts852887aConsolidate metadata types and expose OnUpdateCallback5be00dfAdd sponsorship filesdabe864Update package-lock for benchmarkcc554daMerge pull request #841 from stevennyman/patch-2caefbc0Merge pull request #834 from Stuk/benchmarkUpdates
markedfrom 0.7.0 to 4.3.0Release notes
Sourced from marked's releases.