Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump the npm_and_yarn group across 1 directory with 17 updates #1

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github May 22, 2024

Bumps the npm_and_yarn group with 17 updates in the / directory:

Package From To
@angular/core 4.4.4 10.2.5
bootstrap 3.3.7 3.4.1
jquery 3.2.1 3.5.0
css-what 2.1.0 2.1.3
diff 3.3.0 3.5.0
dot 1.1.2 1.1.3
extend 3.0.1 3.0.2
fsevents 1.1.2 1.2.13
handlebars 4.0.11 4.7.8
lodash 4.17.4 4.17.21
minimatch 3.0.4 3.1.2
minimist 1.2.0 1.2.8
mkdirp 0.5.1 0.5.6
morgan 1.9.0 1.10.0
path-parse 1.0.5 1.0.7
semver 5.4.1 5.7.2
websocket-extensions 0.1.2 0.1.4

Updates @angular/core from 4.4.4 to 10.2.5

Changelog

Sourced from @​angular/core's changelog.

10.2.5 (2021-04-14)

Bug Fixes

  • compiler-cli: show a more specific error for Ivy NgModules (#41534) (#41598) (f630f33)
  • core: fix possible XSS attack in development through SSR (#40525) (ba8da74)

10.2.4 (2020-12-17)

Bug Fixes

  • core: fix possible XSS attack in development through SSR. (#40152) (0b8e3d5)
  • core: set ngDevMode to false when calling enableProdMode() (#40160) (90570c0)

10.2.3 (2020-11-09)

Bug Fixes

  • compiler: ensure that i18n message-parts have the correct source-span (#39589) (e67a331)
  • compiler: skipping leading whitespace should not break placeholder source-spans (#39589) (2b684b7), closes #39195
  • compiler-cli: avoid duplicate diagnostics about unknown pipes (#39517) (861e4fa)
  • compiler-cli: do not drop non-Angular decorators when downleveling (#39577) (1c6cf8a), closes #39574

10.2.2 (2020-11-04)

Bug Fixes

  • compiler-cli: report missing pipes when fullTemplateTypeCheck is disabled (#39320) (71d0063), closes #38195
  • core: markDirty() should only mark flags when really scheduling tick. (#39316) (8c82106), closes #39296
  • router: Ensure all outlets are used when commands have a prefix (#39456) (85d5242)

Performance Improvements

  • core: do not recurse into modules that have already been registered (#39514) (812355c), closes #39487

... (truncated)

Commits
  • ba8da74 fix(core): fix possible XSS attack in development through SSR (#40525)
  • 90570c0 fix(core): set ngDevMode to false when calling enableProdMode() (#40160)
  • 0b8e3d5 fix(core): fix possible XSS attack in development through SSR. (#40152)
  • 1aee8b3 refactor(compiler): store the fullStart location on ParseSourceSpans (#39...
  • 812355c perf(core): do not recurse into modules that have already been registered (#3...
  • 8f36c21 refactor(router): Small refactor of createUrlTree and extra tests (#39456)
  • 90acb91 docs: tView.preOrderHooks and tView.preOrderCheckHooks docs update (#39497)
  • 8c82106 fix(core): markDirty() should only mark flags when really scheduling tick. (#...
  • 0b37249 docs(core): update a typo in the comment of ngZoneEventCoalescing (#39423)
  • 3b779a1 docs: fix typo in initializeInputAndOutputAliases docstring (#39438)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​angular/core since your current version.


Updates bootstrap from 3.3.7 to 3.4.1

Release notes

Sourced from bootstrap's releases.

v3.4.1

  • Security: Fixed an XSS vulnerability (CVE-2019-8331) in our tooltip and popover plugins by implementing a new HTML sanitizer
  • Handle bad selectors (#) in data-target for Dropdowns
  • Clarified tooltip selector documentation
  • Added support for NuGet contentFiles

v3.4.0

  • New: Added a .row-no-gutters class.
  • New: Added docs searching via Algolia.
  • Fixed: Resolved an XSS issue in Alert, Carousel, Collapse, Dropdown, Modal, and Tab components. See https://snyk.io/vuln/npm:bootstrap:20160627 for details.
  • Fixed: Added padding to .navbar-fixed-* on modal open
  • Fixed: Removed the double border on <abbr> elements.
  • Removed Gist creation in web-based Customizer since anonymous gists were disabled long ago by GitHub.
  • Removed drag and drop support from Customizer since it didn't work anymore.
  • Added a dropdown to the docs nav for newer and previous versions.
  • Update the docs to use a new baseurl, /docs/3.4/, to version the v3.x documentation like we do with v4.
  • Reorganized the v3 docs CSS to use Less.
  • Switched to BrowserStack for tests.
  • Updated links to always use https and fix broken URLs.
  • Replaced ZeroClipboard with clipboard.js
Commits
Maintainer changes

This version was pushed to npm by xhmikosr, a new releaser for bootstrap since your current version.


Updates jquery from 3.2.1 to 3.5.0

Release notes

Sourced from jquery's releases.

jQuery 3.5.0 Released!

See the blog post: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ and the upgrade guide: https://jquery.com/upgrade-guide/3.5/

NOTE: Despite being a minor release, this update includes a breaking change that we had to make to fix a security issue ( CVE-2020-11022). Please follow the blog post & the upgrade guide for more details.

Commits
  • 7a0a850 3.5.0
  • 8570a08 Release: Update AUTHORS.txt
  • da3dd85 Ajax: Do not execute scripts for unsuccessful HTTP responses
  • 065143c Ajax: Overwrite s.contentType with content-type header value, if any
  • 1a4f10d Tests: Blacklist one focusin test in IE
  • 9e15d6b Event: Use only one focusin/out handler per matching window & document
  • 966a709 Manipulation: Skip the select wrapper for <option> outside of IE 9
  • 1d61fd9 Manipulation: Make jQuery.htmlPrefilter an identity function
  • 04bf577 Selector: Update Sizzle from 2.3.4 to 2.3.5
  • 7506c9c Build: Resolve Travis config warnings
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by mgol, a new releaser for jquery since your current version.


Updates css-what from 2.1.0 to 2.1.3

Commits

Updates diff from 3.3.0 to 3.5.0

Changelog

Sourced from diff's changelog.

v3.5.0 - March 4th, 2018

  • Omit redundant slice in join method of diffArrays - 1023590
  • Support patches with empty lines - fb0f208
  • Accept a custom JSON replacer function for JSON diffing - 69c7f0a
  • Optimize parch header parser - 2aec429
  • Fix typos - e89c832

Commits

v3.4.0 - October 7th, 2017

  • #183 - Feature request: ability to specify a custom equality checker for diffArrays
  • #173 - Bug: diffArrays gives wrong result on array of booleans
  • #158 - diffArrays will not compare the empty string in array?
  • comparator for custom equality checks - 30e141e
  • count oldLines and newLines when there are conflicts - 53bf384
  • Fix: diffArrays can compare falsey items - 9e24284
  • Docs: Replace grunt with npm test - 00e2f94

Commits

v3.3.1 - September 3rd, 2017

  • #141 - Cannot apply patch because my file delimiter is "/r/n" instead of "/n"
  • #192 - Fix: Bad merge when adding new files (#189)
  • correct spelling mistake - 21fa478

Commits

Commits
  • e9ab948 v3.5.0
  • b73884c Update release notes
  • 8953021 Update release notes
  • 1023590 Omit redundant slice in join method of diffArrays
  • c72ef4a Add missing test coverage
  • b9ef24f Support patches with empty lines
  • 10aaabb Support patches with empty lines
  • 196d3aa Support patches with empty lines
  • e24d789 Support patches with empty lines
  • 8616a02 Support patches with empty lines
  • Additional commits viewable in compare view

Updates dot from 1.1.2 to 1.1.3

Release notes

Sourced from dot's releases.

v1.1.3

Tests for doT.process Patch code injection via prototype pollution (#291)

Commits
  • d00300e 1.1.3
  • 87ccef3 test: update travis versions
  • 4cc3253 chore: update dependencies
  • 320e847 test: missing test files
  • ef5f353 docs: security considerations
  • c531369 test: exclude unused code from coverage
  • b4fd211 test: doT.process
  • fa3890d test: use doT required via the main module
  • 2cf2226 fix: prevent possibility of execution of the code injected via prototype poll...
  • 299b4da Merge pull request #237 from EdwardBetts/spelling
  • Additional commits viewable in compare view

Updates extend from 3.0.1 to 3.0.2

Changelog

Sourced from extend's changelog.

3.0.2 / 2018-07-19

  • [Fix] Prevent merging __proto__ property (#48)
  • [Dev Deps] update eslint, @ljharb/eslint-config, tape
  • [Tests] up to node v10.7, v9.11, v8.11, v7.10, v6.14, v4.9; use nvm install-latest-npm
Commits
  • 8d106d2 v3.0.2
  • e97091f [Dev Deps] update tape
  • e841aac [Tests] up to node v10.7
  • 0e68e71 [Fix] Prevent merging proto property
  • a689700 Only apps should have lockfiles
  • f13c1c4 [Dev Deps] update eslint, @ljharb/eslint-config, tape
  • f3570fe [Tests] up to node v10.0, v9.11, v8.11, v7.10, v6.14, v4.9; use...
  • See full diff in compare view

Updates fsevents from 1.1.2 to 1.2.13

Release notes

Sourced from fsevents's releases.

Release v1.2.13

Only build on Mac-OSX

Release v1.2.11

Removing node-pre-gyp so that building fsevents becomes easier and enabled without the download of binaries.

The credentials to the AWS store have been lost. Releasing to AWS is both insecure and no longer possible due to the lost credentials.

Intermediate Release

No release notes provided.

Release v1.2.9 - Node v12 compatibility

No release notes provided.

Release Pre-NAPI v1.2.8

No release notes provided.

Version Bump (bundle node-pre-gyp)

No release notes provided.

Prebuilt v11.x

No release notes provided.

v1.2.3

  • Added node v10 for pre-built binaries
  • C++ tuning to fix potential SIGILL and cyclic dependency (#204)

v1.2.2

Fixed node-pre-gyp bundling issue

v1.2.1

[unpublished because of errors during publish process]

v1.2.0

  • BREAKING: End support for Node v0.12. If you are using Node v0.12 please pin your fsevents dependencies to v1.1.3. Not bumping semver major for this release was a compromise solution discussed in #199 and #201.
    • Node v0.10 should continue to work with local compilation for now, but hosted pre-built binaries will no longer be provided. If this is a constraint for you, please pin to an earlier version.
  • Fixed security vulnerability warnings by updating node-pre-gyp to ^0.9.0
  • Compatibility updates for nan v2.9.0

v1.1.3

  • Added node v9 for pre-built binaries
  • Fixed bug related to using --no-bin-links option on install
  • Updated node-pre-gyp to latest version (0.6.39)
Commits

Updates handlebars from 4.0.11 to 4.7.8

Release notes

Sourced from handlebars's releases.

v4.7.8

  • Make library compatible with workers (#1894) - 3d3796c
  • Don't rely on Node.js global object (#1776) - 2954e7e
  • Fix compiling of each block params in strict mode (#1855) - 30dbf04
  • Fix rollup warning when importing Handlebars as ESM - 03d387b
  • Fix bundler issue with webpack 5 (#1862) - c6c6bbb
  • Use https instead of git for mustache submodule - 88ac068

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.8 - July 27th, 2023

  • Make library compatible with workers (#1894) - 3d3796c
  • Don't rely on Node.js global object (#1776) - 2954e7e
  • Fix compiling of each block params in strict mode (#1855) - 30dbf04
  • Fix rollup warning when importing Handlebars as ESM - 03d387b
  • Fix bundler issue with webpack 5 (#1862) - c6c6bbb
  • Use https instead of git for mustache submodule - 88ac068

Commits

v4.7.7 - February 15th, 2021

  • fix weird error in integration tests - eb860c0
  • fix: check prototype property access in strict-mode (#1736) - b6d3de7
  • fix: escape property names in compat mode (#1736) - f058970
  • refactor: In spec tests, use expectTemplate over equals and shouldThrow (#1683) - 77825f8
  • chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

  • the changes from version 4.6.0 now also apply in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

v4.7.6 - April 3rd, 2020

Chore/Housekeeping:

Compatibility notes:

  • Restored Node.js compatibility

Commits

v4.7.5 - April 2nd, 2020

Chore/Housekeeping:

  • Node.js version support has been changed to v6+ Reverted in 4.7.6

Compatibility notes:

... (truncated)

Commits
  • 8dc3d25 v4.7.8
  • 668c4fb Fix browser tests in CI pipeline
  • c65c6cc Test on Node 18
  • 3d3796c Make library compatible with workers
  • 075b354 Fix sync issue with npm lock-file
  • 30dbf04 Fix compiling of each block params in strict mode
  • e3a5448 Fix bundler issue with webpack 5
  • 8e23642 Fix integration-tests issue with npm >= 7
  • 88ac068 use https instead of git for mustache submodule
  • c68bc08 Fix typo
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.


Updates lodash from 4.17.4 to 4.17.21

Commits
  • f299b52 Bump to v4.17.21
  • c4847eb Improve performance of toNumber, trim and trimEnd on large input strings
  • 3469357 Prevent command injection through _.template's variable option
  • ded9bc6 Bump to v4.17.20.
  • 63150ef Documentation fixes.
  • 00f0f62 test.js: Remove trailing comma.
  • 846e434 Temporarily use a custom fork of lodash-cli.
  • 5d046f3 Re-enable Travis tests on 4.17 branch.
  • aa816b3 Remove /npm-package.
  • d7fbc52 Bump to v4.17.19
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by bnjmnt4n, a new releaser for lodash since your current version.


Updates minimatch from 3.0.4 to 3.1.2

Commits

Updates minimist from 1.2.0 to 1.2.8

Changelog

Sourced from minimist's changelog.

v1.2.8 - 2023-02-09

Merged

Fixed

Commits

  • Merge tag 'v0.2.3' a026794
  • [eslint] fix indentation and whitespace 5368ca4
  • [eslint] fix indentation and whitespace e5f5067
  • [eslint] more cleanup 62fde7d
  • [eslint] more cleanup 36ac5d0
  • [meta] add auto-changelog 73923d2
  • [actions] add reusable workflows d80727d
  • [eslint] add eslint; rules to enable later are warnings 48bc06a
  • [eslint] fix indentation 34b0f1c
  • [readme] rename and add badges 5df0fe4
  • [Dev Deps] switch from covert to nyc a48b128
  • [Dev Deps] update covert, tape; remove unnecessary tap f0fb958
  • [meta] create FUNDING.yml; add funding in package.json 3639e0c
  • [meta] use npmignore to autogenerate an npmignore file be2e038
  • Only apps should have lockfiles 282b570
  • isConstructorOrProto adapted from PR ef9153f
  • [Dev Deps] update @ljharb/eslint-config, aud 098873c
  • [Dev Deps] update @ljharb/eslint-config, aud 3124ed3
  • [meta] add safe-publish-latest 4b927de
  • [Tests] add aud in posttest b32d9bd
  • [meta] update repo URLs f9fdfc0
  • [actions] Avoid 0.6 tests due to build failures ba92fe6
  • [Dev Deps] update tape 950eaa7
  • [Dev Deps] add missing npmignore dev dep 3226afa
  • Merge tag 'v0.2.2' 980d7ac

v1.2.7 - 2022-10-10

Commits

... (truncated)

Commits
  • 6901ee2 v1.2.8
  • a026794 Merge tag 'v0.2.3'
  • c0b2661 v0.2.3
  • 63b8fee [Fix] Fix long option followed by single dash (#17)
  • 72239e6 [Tests] Remove duplicate test (#12)
  • 34b0f1c [eslint] fix indentation
  • 3226afa [Dev Deps] add missing npmignore dev dep
  • 098873c [Dev Deps] update @ljharb/eslint-config, aud
  • 9ec4d27 [Fix] Fix long option followed by single dash
  • ba92fe6 [actions] Avoid 0.6 tests due to build failures
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for minimist since your current version.


Updates mkdirp from 0.5.1 to 0.5.6

Commits
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for mkdirp since your current version.


Updates morgan from 1.9.0 to 1.10.0

Release notes

Sourced from morgan's releases.

1.10.0

  • Add :total-time token
  • Fix trailing space in colored status code for dev format
  • deps: basic-auth@~2.0.1
  • deps: depd@~2.0.0
    • Replace internal eval usage with Function constructor
    • Use instance methods on process to check for listeners
  • deps: on-headers@~1.0.2
    • Fix res.writeHead patch missing return value

1.9.1

  • Fix using special characters in format
  • deps: depd@~1.1.2
    • perf: remove argument reassignment
Changelog

Sourced from morgan's changelog.

1.10.0 / 2020-03-20

  • Add :total-time token
  • Fix trailing space in colored status code for dev format
  • deps: basic-auth@~2.0.1
  • deps: depd@~2.0.0
    • Replace internal eval usage with Function constructor
    • Use instance methods on process to check for listeners
  • deps: on-headers@~1.0.2
    • Fix res.writeHead patch missing return value

1.9.1 / 2018-09-10

  • Fix using special characters in format
  • deps: depd@~1.1.2
    • perf: remove argument reassignment
Commits

Updates path-parse from 1.0.5 to 1.0.7

Commits

Updates semver from 5.4.1 to 5.7.2

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

5.7

  • Add minVersion method

5.6

  • Move boolean loose param to an options object, with backwards-compatibility protection.
  • Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

  • Add version coercion capabilities

5.4

  • Add intersection checking

5.3

  • Add minSatisfying method

5.2

  • Add prerelease(v) that returns prerelease components

5.1

  • Add Backus-Naur for ranges
  • Remove excessively cute inspection methods

5.0

  • Remove AMD/Browserified build artifacts
  • Fix ltr and gtr when using the * range
  • Fix for range * with a prerelease identifier
Commits
Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.


Updates websocket-extensions from 0.1.2 to 0.1.4

Changelog

Sourced from websocket-extensions's changelog.

0.1.4 / 2020-06-02

  • Remove a ReDoS vulnerability in the header parser (CVE-2020-7662, reported by Robert McLaughlin)
  • Change license from MIT to Apache 2.0

0.1.3 / 2017-11-11

  • Accept extension names and parameters including uppercase letters
  • Handle extension names that clash with Object.prototype properties
Commits
  • 5ea0b42 Bump version to 0.1.4
  • 29496f6 Remove ReDoS vulnerability in the Sec-WebSocket-Extensions header parser
  • 4a76c75 Add Node versions 13 and 14 on Travis
  • 44a677a Formatting change: {...} should have spaces inside the braces
  • f6c50ab Let npm reformat package.json
  • 2d211f3 Change markdown formatting of docs.
  • 0b62083 Update Travis target versions.
  • 729a465 Switch license to Apache 2.0.
  • 2af2c18 Bump version to 0.1.3.
  • 50bcedd Test on Node v9.
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

updated-dependencies:
- dependency-name: "@angular/core"
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: bootstrap
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: jquery
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: css-what
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: diff
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dot
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: extend
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fsevents
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: lodash
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimist
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: mkdirp
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: morgan
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-parse
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: semver
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: websocket-extensions
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label May 22, 2024
Copy link

⚠️ Este repositório ainda não está catalogado no Backstage. ⚠️

Por favor, catalogue-o seguindo as instruções nesta documentação. [Via VPN].

💁 Qualquer problema ou dúvida, estamos no Slack, basta abrir um ticket no canal #help-foundation-platform.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants