Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates #192

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates #192

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Jul 22, 2024 •
edited
Loading

Bumps the npm_and_yarn group with 4 updates in the / directory: copy-webpack-plugin, jsdoc, json and webpack-dev-server.

Updates copy-webpack-plugin from 4.6.0 to 12.0.2

Release notes

Sourced from copy-webpack-plugin's releases.

v12.0.2

12.0.2 (2024-01-17)

Bug Fixes

v12.0.1

12.0.1 (2024-01-11)

Bug Fixes

v12.0.0

12.0.0 (2024-01-10)

⚠ BREAKING CHANGES

  • update globby to 14.0.0
  • minimum supported Node.js version is 18.12.0 (#759) (a5b7d06)

v11.0.0

11.0.0 (2022-05-17)

⚠ BREAKING CHANGES

  • minimum supported Node.js version is 14.15.0

v10.2.4

10.2.4 (2022-01-31)

Bug Fixes

v10.2.3

10.2.3 (2022-01-29)

Bug Fixes

v10.2.2

... (truncated)

Changelog

Sourced from copy-webpack-plugin's changelog.

12.0.2 (2024-01-17)

Bug Fixes

12.0.1 (2024-01-11)

Bug Fixes

12.0.0 (2024-01-10)

⚠ BREAKING CHANGES

  • update globby to 14.0.0
  • minimum supported Node.js version is 18.12.0 (#759) (a5b7d06)

11.0.0 (2022-05-17)

⚠ BREAKING CHANGES

  • minimum supported Node.js version is 14.15.0

build

10.2.4 (2022-01-31)

Bug Fixes

10.2.3 (2022-01-29)

Bug Fixes

10.2.2 (2022-01-28)

... (truncated)

Commits

Updates jsdoc from 3.6.11 to 4.0.3

Changelog

Sourced from jsdoc's changelog.

4.0.3 (May 2024)

Updates dependencies.

4.0.2 (February 2023)

Updates the Babel parser, and enables additional Babel plugins for ECMAScript proposals.

4.0.1 (February 2023)

If an inline link tag uses a pipe delimiter, and there are spaces around the pipe delimiter, then the HTML link no longer contains %20 at the end; also, the link text no longer contains extra spaces. For example, {@link https://example.com | link text} is now rendered as <a href="https://example.com/">link text</a> rather than <a href="https://example.com/%20"> link text</a>.

4.0.0 (November 2022)

Commits
  • 49b6fc2 4.0.3
  • 39061bb fix(deps): update @types/markdown-it and related packages
  • 1a31e64 chore(deps): update deps
  • 0b6193f 4.0.2
  • 9d88548 deps: update Babel; enable current Babel plugins in parser
  • c2dd210 4.0.1
  • 3d90c8a fix: in inline links, strip spaces around pipe character
  • 37fc8cd chore: tell Prettier not to format files
  • a5e4688 chore(deps): update deps
  • 0842185 4.0.0
  • Additional commits viewable in compare view

Updates json from 9.0.6 to 10.0.0

Changelog

Sourced from json's changelog.

10.0.0

  • Backward incompatible and security-related change to parsing "lookup" strings.

    This version restricts the supported syntax for bracketed "lookup" strings to fix a possible vulnerability (CVE-2020-7712). With a carefully crafted lookup string, command injection was possible. See #144 for a repro. If you use json (the CLI or as a node.js module) and run arbitrary user-provided strings as a "lookup", then you should upgrade.

    For the json CLI, a "lookup" string is the 'foo' in:

      echo ...some json... | json foo

    which allows you to lookup fields on the given JSON, e.g.:

      $ echo '{"foo": {"bar": "baz"}}' | json foo.bar
  baz

    If one of the lookup fields isn't a valid JS identifier, then the JS array notation is supported:

      $ echo '{"https://example.com": "my-value"}' | json '["https://example.com"]'
  my-value

    Before this change, json would effectively exec the string between the brackets as JS code such that things like the following were possible:

      $ echo '{"foo3": "bar"}' | json '["foo" + 3]'
  bar

    This change limits supported bracket syntax in lookups to a simple quoted string:

      ["..."]
  ['...']
  [`...`]      # no variable interpolation

    Otherwise generating an error of the form:

      json: error: invalid bracketed lookup string: "[\"foo\" + 3]" (must be of the form ['...'], ["..."], or [`...`])
Commits

Updates webpack-dev-server from 3.11.3 to 5.0.4

Release notes

Sourced from webpack-dev-server's releases.

v5.0.4

5.0.4 (2024-03-19)

Bug Fixes

v5.0.3

5.0.3 (2024-03-12)

Bug Fixes

v5.0.2

5.0.2 (2024-02-16)

Bug Fixes

v5.0.1

5.0.1 (2024-02-13)

Bug Fixes

v5.0.0

5.0.0 (2024-02-12)

Migration Guide and Changes.

v4.15.2

4.15.2 (2024-03-20)

Bug Fixes

  • security: bump webpack-dev-middleware (4116209)

v4.15.1

4.15.1 (2023-06-09)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

5.0.4 (2024-03-19)

Bug Fixes

5.0.3 (2024-03-12)

Bug Fixes

5.0.2 (2024-02-16)

Bug Fixes

5.0.1 (2024-02-13)

Bug Fixes

5.0.0 (2024-02-12)

Migration Guide and Changes.

4.15.1 (2023-06-09)

Bug Fixes

  • replace :: with localhost before openBrowser() (#4856) (874c44b)
  • types: compatibility with @types/ws (#4899) (34bcec2)

4.15.0 (2023-05-07)

Features

  • overlay displays unhandled promise rejection (#4849) (d1dd430)

4.14.0 (2023-05-06)

... (truncated)

Commits

Updates ip from 1.1.9 to 2.0.0

Commits

Updates node-forge from 0.10.0 to 1.3.1

Changelog

Sourced from node-forge's changelog.

1.3.1 - 2022-03-29

Fixes

  • RFC 3447 and RFC 8017 allow for optional DigestAlgorithm NULL parameters for sha* algorithms and require NULL paramters for md2 and md5 algorithms.

1.3.0 - 2022-03-17

Security

  • Three RSA PKCS#1 v1.5 signature verification issues were reported by Moosa Yahyazadeh ([email protected]).
  • HIGH: Leniency in checking digestAlgorithm structure can lead to signature forgery.
  • HIGH: Failing to check tailing garbage bytes can lead to signature forgery.
  • MEDIUM: Leniency in checking type octet.
    • DigestInfo is not properly checked for proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.
    • CVE ID: CVE-2022-24773
    • GHSA ID: GHSA-2r2c-g63r-vccr

Fixed

  • [asn1] Add fallback to pretty print invalid UTF8 data.
  • [asn1] fromDer is now more strict and will default to ensuring all input bytes are parsed or throw an error. A new option parseAllBytes can disable this behavior.
    • NOTE: The previous behavior is being changed since it can lead to security issues with crafted inputs. It is possible that code doing custom DER parsing may need to adapt to this new behavior and optional flag.
  • [rsa] Add and use a validator to check for proper structure of parsed ASN.1

... (truncated)

Commits

Updates serialize-javascript from 1.9.1 to 4.0.0

Release notes

Sourced from serialize-javascript's releases.

v4.0.0

Changelog

  • Bump nyc from 15.0.1 to 15.1.0 (#85)
  • support for bigint (#80)

Behavior changes for BigInt

It serializes BigInt values as follows since this version. The result of serialization may be changed if you are passing BigInt values into the serialize-javascript.

v4.x:

const serialize = require('serialize-javascript');
serialize({big: BigInt('10')}); // '{"big":BigInt("10")}'

v3.x:

const serialize = require('serialize-javascript');
serialize({big: BigInt('10')}); // throws error

Thank you @​mum-never-proud for this release.

v3.1.0

  • Bump mocha from 7.1.2 to 7.2.0 (#83)
  • Bump mocha from 7.1.1 to 7.1.2 (#82)
  • Bump nyc from 15.0.0 to 15.0.1 (#81)
  • Don't replace regex / function placeholders within string literals (#79)
  • [Security] Bump minimist from 1.2.0 to 1.2.5 (#78)
  • Bump mocha from 7.1.0 to 7.1.1 (#77)
  • Bump mocha from 7.0.1 to 7.1.0 (#74)
  • Update example in README (#73)

Note: the randombytes has been added to the dependency package to improve the generation of UIDs. Check the #22 for more information. Thanks to @​JordanMilne and @​Siebes for this change.

v3.0.0

  • Introduce support for Infinity (@​vthibault, #72)
  • Bump mocha from 7.0.0 to 7.0.1 (#71)
  • Test on Node.js v12 (@​okuryu, #70)
  • Bump mocha from 6.2.2 to 7.0.0 (#69)
  • Bump nyc from 14.1.1 to 15.0.0 (#68)

Behavior changes for Infinity

It serializes Infinity values as follows since this version. The result of serialization may be changed if you are passing Infinity values into the serialize-javascript.

... (truncated)

Commits

Updates ws from 6.2.3 to 7.5.9

Release notes

Sourced from ws's releases.

7.5.9

Bug fixes

  • Backported bc8bd34e to the 7.x release line (0435e6e1).

7.5.8

Bug fixes

  • Backported 0fdcc0af to the 7.x release line (2758ed35).
  • Backported d68ba9e1 to the 7.x release line (dc1781bc).

7.5.7

Bug fixes

  • Backported 6946f5fe to the 7.x release line (1f72e2e1).

7.5.6

Bug fixes

  • Backported b8186dd1 to the 7.x release line (73dec34b).
  • Backported ed2b8039 to the 7.x release line (22a26afb).

7.5.5

Bug fixes

  • Backported ec9377ca to the 7.x release line (0e274acd).

7.5.4

Bug fixes

  • Backported 6a72da3e to the 7.x release line (76087fbf).
  • Backported 869c9892 to the 7.x release line (27997933).

7.5.3

Bug fixes

  • The WebSocketServer constructor now throws an error if more than one of the noServer, server, and port options are specefied (66e58d27).
  • Fixed a bug where a 'close' event was emitted by a WebSocketServer before the internal HTTP/S server was actually closed (5a587304).
  • Fixed a bug that allowed WebSocket connections to be established after WebSocketServer.prototype.close() was called (772236a1).

7.5.2

Bug fixes

  • The opening handshake is now aborted if the client receives a Sec-WebSocket-Extensions header but no extension was requested or if the server indicates an extension not requested by the client (aca94c86).

... (truncated)

Commits
  • 8a78f87 [dist] 7.5.9
  • 0435e6e [security] Fix same host check for ws+unix: redirects
  • 4271f07 [dist] 7.5.8
  • dc1781b [security] Drop sensitive headers when following insecure redirects
  • 2758ed3 [fix] Abort the handshake if the Upgrade header is invalid
  • a370613 [dist] 7.5.7
  • 1f72e2e [security] Drop sensitive headers when following redirects (#2013)
  • 8ecd890 [dist] 7.5.6
  • 22a26af [fix] Resume the socket in the CLOSING state
  • 73dec34 [fix] Do not throw if the redirect URL is invalid
  • Additional commits viewable in compare view

Updates webpack-dev-middleware from 3.7.3 to 7.3.0

Release notes

Sourced from webpack-dev-middleware's releases.

v7.3.0

7.3.0 (2024-07-18)

Features

v7.2.1

7.2.1 (2024-04-02)

Bug Fixes

  • avoid extra log

v7.2.0

7.2.0 (2024-03-29)

Features

v7.1.1

7.1.1 (2024-03-21)

Bug Fixes

v7.1.0

7.1.0 (2024-03-19)

Features

  • prefer to use fs.createReadStream over fs.readFileSync to read files (ab533de)

Bug Fixes

... (truncated)

Changelog

Sourced from webpack-dev-middleware's changelog.

7.3.0 (2024-07-18)

Features

7.2.1 (2024-04-02)

Bug Fixes

  • avoid extra log

7.2.0 (2024-03-29)

Features

7.1.1 (2024-03-21)

Bug Fixes

7.1.0 (2024-03-19)

Features

  • prefer to use fs.createReadStream over fs.readFileSync to read files (ab533de)

Bug Fixes

7.0.0 (2023-12-26)

⚠ BREAKING CHANGES

... (truncated)

Commits
  • 1b92c73 chore(release): 7.3.0
  • ccd00bb refactor: types (#1895)
  • 0f9f398 feat: support hono (#1890)
  • fd06983 chore(deps-dev): bump @​types/node from 20.14.10 to 20.14.11 (#1894)
  • 594e453 chore(deps-dev): bump cspell from 8.10.4 to 8.11.0 (#1893)
  • f2d4e21 chore(deps-dev): bump prettier from 3.3.2 to 3.3.3 (#1891)
  • 5b1a915 chore(deps-dev): bump @​babel/core from 7.24.8 to 7.24.9 (#1892)
  • aad0e1d chore(deps-dev): bump @​babel/core from 7.24.7 to 7.24.8 (#1888)
  • f1accfe chore(deps-dev): bump @​babel/preset-env from 7.24.7 to 7.24.8 (#1889)
  • aa66133 chore(deps-dev): bump @​babel/cli from 7.24.7 to 7.24.8 (#1887)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jul 22, 2024
@dependabot dependabot bot mentioned this pull request Jul 22, 2024
Closed
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-b97adca4cd branch 5 times, most recently from 643938e to 13c88c3 Compare July 27, 2024 12:39
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-b97adca4cd branch 2 times, most recently from 021443e to dbfdea6 Compare August 1, 2024 11:45
@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 9 up…
b262398 
…dates

Bumps the npm_and_yarn group with 4 updates in the / directory: [copy-webpack-plugin](https://github.com/webpack-contrib/copy-webpack-plugin), [jsdoc](https://github.com/jsdoc/jsdoc), [json](https://github.com/trentm/json) and [webpack-dev-server](https://github.com/webpack/webpack-dev-server).


Updates `copy-webpack-plugin` from 4.6.0 to 12.0.2
- [Release notes](https://github.com/webpack-contrib/copy-webpack-plugin/releases)
- [Changelog](https://github.com/webpack-contrib/copy-webpack-plugin/blob/master/CHANGELOG.md)
- [Commits](webpack-contrib/copy-webpack-plugin@v4.6.0...v12.0.2)

Updates `jsdoc` from 3.6.11 to 4.0.3
- [Release notes](https://github.com/jsdoc/jsdoc/releases)
- [Changelog](https://github.com/jsdoc/jsdoc/blob/4.0.3/CHANGES.md)
- [Commits](jsdoc/jsdoc@3.6.11...4.0.3)

Updates `json` from 9.0.6 to 10.0.0
- [Changelog](https://github.com/trentm/json/blob/master/CHANGES.md)
- [Commits](trentm/json@9.0.6...10.0.0)

Updates `webpack-dev-server` from 3.11.3 to 5.0.4
- [Release notes](https://github.com/webpack/webpack-dev-server/releases)
- [Changelog](https://github.com/webpack/webpack-dev-server/blob/master/CHANGELOG.md)
- [Commits](webpack/webpack-dev-server@v3.11.3...v5.0.4)

Updates `ip` from 1.1.9 to 2.0.0
- [Commits](indutny/node-ip@v1.1.9...v2.0.0)

Updates `node-forge` from 0.10.0 to 1.3.1
- [Changelog](https://github.com/digitalbazaar/forge/blob/main/CHANGELOG.md)
- [Commits](digitalbazaar/forge@0.10.0...v1.3.1)

Updates `serialize-javascript` from 1.9.1 to 4.0.0
- [Release notes](https://github.com/yahoo/serialize-javascript/releases)
- [Commits](yahoo/serialize-javascript@v1.9.1...v4.0.0)

Updates `ws` from 6.2.3 to 7.5.9
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@6.2.3...7.5.9)

Updates `webpack-dev-middleware` from 3.7.3 to 7.3.0
- [Release notes](https://github.com/webpack/webpack-dev-middleware/releases)
- [Changelog](https://github.com/webpack/webpack-dev-middleware/blob/master/CHANGELOG.md)
- [Commits](webpack/webpack-dev-middleware@v3.7.3...v7.3.0)

---
updated-dependencies:
- dependency-name: copy-webpack-plugin
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: jsdoc
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: json
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-server
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: ip
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-forge
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serialize-javascript
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-middleware
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-b97adca4cd branch from dbfdea6 to b262398 Compare August 6, 2024 21:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants