chore(deps): bump the npm_and_yarn group across 4 directories with 16 updates #1

dependabot · 2024-12-18T13:34:26Z

Bumps the npm_and_yarn group with 14 updates in the / directory:

Package	From	To
@discordjs/opus	`0.8.0`	`0.9.0`
axios	`0.27.2`	`0.28.0`
nanoid	`3.3.4`	`3.3.8`
ws	`8.10.0`	`8.17.1`
cookie	`0.5.0`	`0.7.0`
jsonwebtoken	`8.5.1`	`9.0.0`
next	`12.1.6`	`14.2.15`
rollup	`2.75.7`	`2.79.2`
zod	`3.19.1`	`3.22.3`
@babel/traverse	`7.17.3`	`7.26.4`
braces	`3.0.2`	`3.0.3`
micromatch	`4.0.5`	`4.0.8`
tar	`6.1.11`	`6.2.1`
word-wrap	`1.2.3`	`1.2.5`

Bumps the npm_and_yarn group with 3 updates in the /apps/bot directory: @discordjs/opus, axios and nanoid.
Bumps the npm_and_yarn group with 3 updates in the /apps/dashboard directory: cookie, jsonwebtoken and next.
Bumps the npm_and_yarn group with 1 update in the /apps/tasks directory: axios.

Updates @discordjs/opus from 0.8.0 to 0.9.0

Release notes

Sourced from @discordjs/opus's releases.

0.9.0

Features

feat: support node 19 (discordjs/opus@814e500)

Commits

814e500 feat: support node 19
See full diff in compare view

Updates axios from 0.27.2 to 0.28.0

Release notes

Sourced from axios's releases.

Release v0.28.0

Release notes:

Bug Fixes

fix(security): fixed CVE-2023-45857 by backporting withXSRFToken option to v0.x (#6091)

Backports from v1.x:

Allow null indexes on formSerializer and paramsSerializer v0.x (#4961)

Fixing content-type header repeated #4745

Fixed timeout error message for HTTP 4738

Added axios.formToJSON method (#4735)

URL params serializer (#4734)

Fixed toFormData Blob issue on node>v17 #4728

Adding types for progress event callbacks #4675

Fixed max body length defaults #4731

Added data URL support for node.js (#4725)

Added isCancel type assert (#4293)

Added the ability for the url-encoded-form serializer to respect the formSerializer config (#4721)

Add string[] to AxiosRequestHeaders type (#4322)

Allow type definition for axios instance methods (#4224)

Fixed AxiosError stack capturing; (#4718)

Fixed AxiosError status code type; (#4717)

Adding Canceler parameters config and request (#4711)

fix(types): allow to specify partial default headers for instance creation (#4185)

Added blob to the list of protocols supported by the browser (#4678)

Fixing Z_BUF_ERROR when no content (#4701)

Fixed race condition on immediate requests cancellation (#4261)

Added a clear() function to the request and response interceptors object so a user can ensure that all interceptors have been removed from an Axios instance axios/axios#4248

Added generic AxiosAbortSignal TS interface to avoid importing AbortController polyfill (#4229)

Fix TS definition for AxiosRequestTransformer (#4201)

Use type alias instead of interface for AxiosPromise (#4505)

Include request and config when creating a CanceledError instance (#4659)

Added generic TS types for the exposed toFormData helper (#4668)

Optimized the code that checks cancellation (#4587)

Replaced webpack with rollup (#4596)

Added stack trace to AxiosError (#4624)

Updated AxiosError.config to be optional in the type definition (#4665)

Removed incorrect argument for NetworkError constructor (#4656)

Changelog

Sourced from axios's changelog.

0.28.0 (2024-02-12)

Release notes:

Bug Fixes

fix(security): fixed CVE-2023-45857 by backporting withXSRFToken option to v0.x (#6091)

Backports from v1.x:

Allow null indexes on formSerializer and paramsSerializer v0.x (#4961)

Fixing content-type header repeated #4745

Fixed timeout error message for HTTP 4738

Added axios.formToJSON method (#4735)

URL params serializer (#4734)

Fixed toFormData Blob issue on node>v17 #4728

Adding types for progress event callbacks #4675

Fixed max body length defaults #4731

Added data URL support for node.js (#4725)

Added isCancel type assert (#4293)

Added the ability for the url-encoded-form serializer to respect the formSerializer config (#4721)

Add string[] to AxiosRequestHeaders type (#4322)

Allow type definition for axios instance methods (#4224)

Fixed AxiosError stack capturing; (#4718)

Fixed AxiosError status code type; (#4717)

Adding Canceler parameters config and request (#4711)

fix(types): allow to specify partial default headers for instance creation (#4185)

Added blob to the list of protocols supported by the browser (#4678)

Fixing Z_BUF_ERROR when no content (#4701)

Fixed race condition on immediate requests cancellation (#4261)

Added a clear() function to the request and response interceptors object so a user can ensure that all interceptors have been removed from an Axios instance axios/axios#4248

Added generic AxiosAbortSignal TS interface to avoid importing AbortController polyfill (#4229)

Fix TS definition for AxiosRequestTransformer (#4201)

Use type alias instead of interface for AxiosPromise (#4505)

Include request and config when creating a CanceledError instance (#4659)

Added generic TS types for the exposed toFormData helper (#4668)

Optimized the code that checks cancellation (#4587)

Replaced webpack with rollup (#4596)

Added stack trace to AxiosError (#4624)

Updated AxiosError.config to be optional in the type definition (#4665)

Removed incorrect argument for NetworkError constructor (#4656)

Commits

3b7635a [Release] v0.28.0 (#6211)
27c0076 feat(backport): added ability for paramsSerializer to handle function; (#6227)
80c3d74 chore(ci): backported publish action; (#6224)
2755df5 fix(security): fixed CVE-2023-45857 by backporting withXSRFToken option to ...
880b42e docs: Fix a typo in README
c4bf0a4 Allow null indexes on formSerializer and paramsSerializer v0.x (#4961)
1e2679f fix: [Types] Type of header in AxiosRequestConfig / for Axios.create is incor...
80b546c fix: loosing request header (#4858) (#4871)
6acb5ef feat: brower platform add data protocol. (#4814)
bbb2264 fix(typing): axios response headers can be undefined (#4813)
Additional commits viewable in compare view

Updates nanoid from 3.3.4 to 3.3.8

Changelog

Sourced from nanoid's changelog.

3.3.8

Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

3.3.7

Fixed node16 TypeScript support (by Saadi Myftija).

3.3.6

Fixed package.

3.3.5

Backport funding information.

Commits

3044cd5 Release 3.3.8 version
4fe3495 Update size limit
d643045 Fix pool pollution, infinite loop (#510)
89d82d2 Release 3.3.7 version
5022c35 Update dual-publish
3e7a8e5 Remove benchmark from CI for v3
d356144 Fix CI for v3
37b25df Move to pnpm 8
d96f392 Release 3.3.6 version
8210dfb Release 3.3.5 version
Additional commits viewable in compare view

Updates ws from 8.10.0 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.
const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits

3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
934c9d6 [ci] Test on node 22
1817bac [ci] Do not test on node 21
96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
Additional commits viewable in compare view

Updates cookie from 0.5.0 to 0.7.0

Release notes

Sourced from cookie's releases.

0.7.0

perf: parse cookies ~10% faster (#144 by @kurtextrem and #170)

fix: narrow the validation of cookies to match RFC6265 (#167 by @bewinsnw)

fix: add main to package.json for rspack (#166 by @proudparrot2)

jshttp/cookie@v0.6.0...v0.7.0

0.6.0

Add partitioned option

Commits

ab057d6 0.7.0
5f02ca8 Migrate history to GitHub releases
a5d591c Migrate history to GitHub releases
51968f9 Skip isNaN
9e7ca51 perf(parse): cache length, return early (#144)
d6f39b0 Fix tests for old node
6bb701f Remove failing scorecard
ca70da4 test(serialize): additional tests for name, domain and path RFC validations (...
47917c9 Iterate whitespace for perf (#170)
927d48a Add main to package.json (#166)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.

Updates jsonwebtoken from 8.5.1 to 9.0.0

Changelog

Sourced from jsonwebtoken's changelog.

9.0.0 - 2022-12-21

Breaking changes: See Migration from v8 to v9

Breaking changes

Removed support for Node versions 11 and below.

The verify() function no longer accepts unsigned tokens by default. ([834503079514b72264fd13023a3b8d648afd6a16]auth0/node-jsonwebtoken@8345030)

RSA key size must be 2048 bits or greater. ([ecdf6cc6073ea13a7e71df5fad043550f08d0fa6]auth0/node-jsonwebtoken@ecdf6cc)

Key types must be valid for the signing / verification algorithm

Security fixes

security: fixes Arbitrary File Write via verify function - CVE-2022-23529

security: fixes Insecure default algorithm in jwt.verify() could lead to signature validation bypass - CVE-2022-23540

security: fixes Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - CVE-2022-23541

security: fixes Unrestricted key type could lead to legacy keys usage - CVE-2022-23539

Commits

e1fa9dc Merge pull request from GHSA-8cf7-32gw-wr33
5eaedbf chore(ci): remove github test actions job (#861)
cd4163e chore(ci): configure Github Actions jobs for Tests & Security Scanning (#856)
ecdf6cc fix!: Prevent accidental use of insecure key sizes & misconfiguration of secr...
8345030 fix(sign&verify)!: Remove default none support from sign and verify met...
7e6a86b Upload OpsLevel YAML (#849)
74d5719 docs: update references vercel/ms references (#770)
d71e383 docs: document "invalid token" error
3765003 docs: fix spelling in README.md: Peak -> Peek (#754)
a46097e docs: make decode impossible to discover before verify
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by julien.wollscheid, a new releaser for jsonwebtoken since your current version.

Updates next from 12.1.6 to 14.2.15

Commits

737c29e v14.2.15
1c8234e backport: [i18n] Routing fix #70761 (#70976)
bb3f580 fix: Do not omit alt on getImgProps return type, ImgProps (#70818)
cb8113b fix(next/image): handle undefined images.localPatterns config in `images-ma...
9c1191a fix missing helpers in next-test-utils.ts
0de4183 fix lint
e03c4ff feat(next/image): add images.localPatterns config (#70802)
540ea2d backport: support breadcrumb style catch-all parallel routes (#65063) (#70794)
0d0448b Fix client reference access causing metadata missing (#70732) (#70788)
381d1f9 feat(next/image): add support for decoding prop (#70678)
Additional commits viewable in compare view

Updates postcss from 8.4.19 to 8.4.31

Release notes

Sourced from postcss's releases.

8.4.31

Fixed \r parsing to fix CVE-2023-44270.

8.4.30

Improved source map performance (by @romainmenke).

8.4.29

Fixed Node#source.offset (by @idoros).

Fixed docs (by @coliff).

8.4.28

Fixed Root.source.end for better source map (by @romainmenke).

Fixed Result.root types when process() has no parser.

8.4.27

Fixed Container clone methods types.

8.4.26

Fixed clone methods types.

8.4.25

Improve stringify performance (by @romainmenke).

Fixed docs (by @vikaskaliramna07).

8.4.24

Fixed Plugin types.

8.4.23

Fixed warnings in TypeDoc.

8.4.22

Fixed TypeScript support with node16 (by @remcohaszing).

8.4.21

Fixed Input#error types (by @hudochenkov).

8.4.20

Fixed source map generation for childless at-rules like @layer.

Changelog

Sourced from postcss's changelog.

8.4.31

Fixed \r parsing to fix CVE-2023-44270.

8.4.30

Improved source map performance (by Romain Menke).

8.4.29

Fixed Node#source.offset (by Ido Rosenthal).

Fixed docs (by Christian Oliff).

8.4.28

Fixed Root.source.end for better source map (by Romain Menke).

Fixed Result.root types when process() has no parser.

8.4.27

Fixed Container clone methods types.

8.4.26

Fixed clone methods types.

8.4.25

Improve stringify performance (by Romain Menke).

Fixed docs (by @vikaskaliramna07).

8.4.24

Fixed Plugin types.

8.4.23

Fixed warnings in TypeDoc.

8.4.22

Fixed TypeScript support with node16 (by Remco Haszing).

8.4.21

Fixed Input#error types (by Aleks Hudochenkov).

8.4.20

Fixed source map generation for childless at-rules like @layer.

Commits

90208de Release 8.4.31 version
58cc860 Fix carrier return parsing
4fff8e4 Improve pnpm test output
cd43ed1 Update dependencies
caa916b Update dependencies
8972f76 Typo
11a5286 Typo
45c5501 Release 8.4.30 version
bc3c341 Update linter
b2be58a Merge pull request #1881 from romainmenke/improve-sourcemap-performance--phil...
Additional commits viewable in compare view

Updates rollup from 2.75.7 to 2.79.2

Release notes

Sourced from rollup's releases.

v.2.79.2

2.79.2

2024-09-26

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

Changelog

Sourced from rollup's changelog.

2.79.2

2024-09-26

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

3.29.5

2024-09-21

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

4.22.4

2024-09-21

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5670: refactor: Use object.prototype to check for reserved properties (@YuHyeonWook)

#5671: Fix DOM Clobbering CVE (@lukastaegert)

4.22.3

2024-09-21

Bug Fixes

Ensure that mutations in modules without side effects are observed while properly handling transitive dependencies (#5669)

Pull Requests

#5669: Ensure impure dependencies of pure modules are added (@lukastaegert)

4.22.2

... (truncated)

Commits

c9bd03d 2.79.2
48aef33 fix: resolve DOM Clobbering CVE-2024-43788 (backport to v2) (#5677)
69ff418 2.79.1
04dce1b Update changelog
159137e fix: typo docs and contributors link in CONTRIBUTING.md (#4639)
e1392b3 Update type definition of resolveId (#4641)
7836357 Improve performance of chunk naming collision check (#4643)
71d20c9 Reduce permissions for repl-artefacts.yml workflow (#4630)
8193ea5 Adapt workflow to use Node 14 sub-version to work with branch protection
8477f8f 2.79.0
Additional commits viewable in compare view

Updates zod from 3.19.1 to 3.22.3

Release notes

Sourced from zod's releases.

v3.22.3

Commits:

1e23990bcdd33d1e81b31e40e77a031fcfd87ce1 Commit

9bd3879b482f139fd03d5025813ee66a04195cdd docs: remove obsolete text about readonly types (#2676)

f59be093ec21430d9f32bbcb628d7e39116adf34 clarify datetime ISO 8601 (#2673)

64dcc8e2b16febe48fa8e3c82c47c92643e6c9e3 Update sponsors

18115a8f128680b4526df58ce96deab7dce93b93 Formatting

28c19273658b164c53c149785fa7a8187c428ad4 Update sponsors

ad2ee9ccf723c4388158ff6b8669c2a6cdc85643 2718 Updated Custom Schemas documentation example to use type narrowing (#2778)

ae0f7a2c15e7741ee1b23c03a3bfb9acebd86551 docs: update ref to discriminated-unions docs (#2485)

2ba00fe2377f4d53947a84b8cdb314a63bbd6dd4 [2609] fix ReDoS vulnerability in email regex (#2824)

1e61d76cdec05de9271fc0df58798ddf9ce94923 3.22.3

v3.22.2

Commits:

13d9e6bda286cbd4c1b177171273695d8309e5de Fix lint

0d49f10b3c25a8e4cbb6534cc0773b195c56d06d docs: add typeschema to ecosystem (#2626)

8e4af7b56df6f2e3daf0dd825b986f1d963025ce X to Zod: add app.quicktype.io (#2668)

792b3ef0d41c144cd10641c6966b98dae1222d82 Fix superrefine types

v3.22.1

Commits:

Fix handing of this in ZodFunction schemas. The parse logic for function schemas now requires the Reflect API.
const methodObject = z.object({
  property: z.number(),
  method: z.function().args(z.string()).returns(z.number()),
});
const methodInstance = {
  property: 3,
  method: function (s: string) {
    return s.length + this.property;
  },
};
const parsed = methodObject.parse(methodInstance);
parsed.method("length=8"); // => 11 (8 length + 3 property)
932cc472d2e66430d368a409b8d251909d7d8d21 Initial prototype fix for issue #2651 (#2652)

0a055e726ac210ef6efc69aa70cd2491767f6060 3.22.1

v3.22.0

ZodReadonly

This release introduces ZodReadonly and the .readonly() method on ZodType.

... (truncated)

Commits

1e61d76 3.22.3
2ba00fe [2609] fix ReDoS vulnerability in email regex (#2824)
ae0f7a2 docs: update ref to discriminated-unions docs (#2485)
ad2ee9c 2718 Updated Custom Schemas documentation example to use type narrowing (#2778)
28c1927 Update sponsors
18115a8 Formatting
64dcc8e Update sponsors
f59be09 clarify datetime ISO 8601 (#2673)
9bd3879 docs: remove obsolete text about readonly types (#2676)
1e23990 Commit
Additional commits viewable in compare view

Updates @babel/traverse from 7.17.3 to 7.26.4

Release notes

Sourced from @babel/traverse's releases.

v7.26.4 (2024-12-05)

↩️ Revert

babel-traverse

#17005 Revert "perf: Improve scope information collection performance" (@JLHwung)

Committers: 2

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.26.3 (2024-12-04)

🐛 Bug Fix

babel-generator

#16958 [preserveFormat] force semicolons when invalidating ASI (@nicolo-ribaudo)

🏠 Internal

babel-helper-builder-binary-assignment-operator-visitor, babel-plugin-transform-exponentiation-operator

#16895 Remove helper-builder-binary-assignment-operator-visitor (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-generator

#16959 perf: Reduce the use of temporary objects (@liuxingbaoyu)

babel-traverse

#16923 perf: Improve scope information collection performance (@liuxingbaoyu)

#16964 perf: Avoid repeated traversal when creating scope (@liuxingbaoyu)

babel-plugin-transform-modules-commonjs

#16954 perf: Remove use of simplifyAccess (@liuxingbaoyu)

Committers: 4

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

v7.26.2 (2024-10-30)

🐛 Bug Fix

babel-parser

#16903 fix: Parse placeholder for TS namespace (@liuxingbaoyu)

#16937 fix: Account for offsets when creating new Position instances (@DylanPiercey)

babel-generator

#16948 Fix mapping of tokens with generated nodes in between (@nicolo-ribaudo)

Committers: 6

Babel Bot (@babel-bot)

Dylan Piercey (@DylanPiercey)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

@liuxingbaoyu

... (truncated)

Changelog

Sourced from @babel/traverse's changelog.

v7.26.4 (2024-12-05)

↩️ Revert

babel-traverse

#17005 Revert "perf: Improve scope information collection performance" (@JLHwung)

v7.26.3 (2024-12-04)

🐛 Bug Fix

babel-generator

#16958 [preserveFormat] force semicolons when invalidating ASI (@nicolo-ribaudo)

🏠 Internal

babel-helper-builder-binary-assignment-operator-visitor, babel-plugin-transform-exponentiation-operator

#16895 Remove helper-builder-binary-assignment-operator-visitor (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-generator

#16959 perf: Reduce the use of temporary objects (@liuxingbaoyu)

babel-traverse

#16923 perf: Improve scope information collection performance (@liuxingbaoyu)

#16964 perf: Avoid repeated traversal when creating scope (@liuxingbaoyu)

babel-plugin-transform-modules-commonjs

#16954 perf: Remove use of simplifyAccess (@liuxingbaoyu)

v7.26.2 (2024-10-30)

🐛 Bug Fix

babel-parser

#16903 fix: Parse placeholder for TS namespace (@liuxingbaoyu)

#16937 fix: Account for offsets when creating new Position instances (@DylanPiercey)

babel-generator

#16948 Fix mapping of tokens with generated nodes in between (@nicolo-ribaudo)

v7.26.1 (2024-10-25)

🐛 Bug Fix

babel-parser

#16936 fix(parser): offset internal index locations by startIndex (@DylanPiercey)

v7.26.0 (2024-10-25)

🚀 New Feature

babel-core, babel-generator, babel-parser, babel-plugin-syntax-import-assertions, babel-plugin-syntax-import-attributes, babel-preset-env, babel-standalone, babel-types

#16850 Enable import attributes parsing by default (@nicolo-ribaudo)

babel-core

#16862 feat: support async plugin's pre/post (@timofei-iatsenko)

babel-compat-data, babel-plugin-proposal-regexp-modifiers, babel-plugin-transform-regexp-modifiers, babel-preset-env, babel-standalone

#16692 Add transform-regexp-modifiers to preset-env (@JLHwung)

babel-parser

#16849 feat: add startIndex parser option (@DylanPiercey)

babel-generator, babel-parser, babel-plugin-syntax-flow

#16841 Always enable parsing of Flow enums (@nicolo-ribaudo)

babel-helpers, babel-preset-typescript, babel-runtime-corejs3

... (truncated)

Commits

cf7b9cd v7.26.4
f33704a Revert "perf: Improve scope information collection performance" (#17005)
36ca8fa v7.26.3
ded1571 perf: Improve scope information collection performance (#16923)
943bdfe perf: Avoid repeated traversal when creating scope (#16964)
b07957e v7.25.9
af91759 fix: Accidentally publishing useless files (#16917)
2533cfb v7.25.7
611d958 [babel 8] Create TSClassImplements|TSInterfaceHeritage nodes (#16731)
506bf91 Remove BABEL_TYPES_8_BREAKING flag and enable it by default (#16817)
Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates follow-redirects from 1.14.9 to 1.15.9

Commits

e4e55c7 Release version 1.15.9 of the npm package.
31a1abf Attempt much more gentle detection.
d2aaa97 Fix url field.
62558f0 Release version 1.15.8 of the npm package.
a8d1cee Return subtlety.
458ca8e Fix native URL test for Node 20.
ca49e44 Handle KeepAlive connections in tests.
f3711d7 Test on Node 20 and 22.
fda0faf Fix typo.
760757f Release version 1.15.7 of the npm package.
Additional commits viewable in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

this is basically v4.0.5, with some README updates

it is vulnerable to CVE-2024-4067

Updated braces to v3.0.3 to avoid CVE-2024-4068

does NOT break API compatibility

[4.0.6] - 2024-05-21

Added hasBraces to check if a pattern contains braces.

Fixes CVE-2024-4067

BREAKS API COMPATIBILITY

Should be labeled as a major release, but it's not.

Commits

8bd704e 4.0.8
a0e6841 run verb to generate README documentation
4ec2884 Merge branch 'v4' into ha...
Description has been truncated

… updates Bumps the npm_and_yarn group with 14 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@discordjs/opus](https://github.com/discordjs/opus) | `0.8.0` | `0.9.0` | | [axios](https://github.com/axios/axios) | `0.27.2` | `0.28.0` | | [nanoid](https://github.com/ai/nanoid) | `3.3.4` | `3.3.8` | | [ws](https://github.com/websockets/ws) | `8.10.0` | `8.17.1` | | [cookie](https://github.com/jshttp/cookie) | `0.5.0` | `0.7.0` | | [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken) | `8.5.1` | `9.0.0` | | [next](https://github.com/vercel/next.js) | `12.1.6` | `14.2.15` | | [rollup](https://github.com/rollup/rollup) | `2.75.7` | `2.79.2` | | [zod](https://github.com/colinhacks/zod) | `3.19.1` | `3.22.3` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.17.3` | `7.26.4` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [micromatch](https://github.com/micromatch/micromatch) | `4.0.5` | `4.0.8` | | [tar](https://github.com/isaacs/node-tar) | `6.1.11` | `6.2.1` | | [word-wrap](https://github.com/jonschlinkert/word-wrap) | `1.2.3` | `1.2.5` | Bumps the npm_and_yarn group with 3 updates in the /apps/bot directory: [@discordjs/opus](https://github.com/discordjs/opus), [axios](https://github.com/axios/axios) and [nanoid](https://github.com/ai/nanoid). Bumps the npm_and_yarn group with 3 updates in the /apps/dashboard directory: [cookie](https://github.com/jshttp/cookie), [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken) and [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /apps/tasks directory: [axios](https://github.com/axios/axios). Updates `@discordjs/opus` from 0.8.0 to 0.9.0 - [Release notes](https://github.com/discordjs/opus/releases) - [Commits](discordjs/opus@v0.8.0...v0.9.0) Updates `axios` from 0.27.2 to 0.28.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v0.28.0/CHANGELOG.md) - [Commits](axios/axios@v0.27.2...v0.28.0) Updates `nanoid` from 3.3.4 to 3.3.8 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.4...3.3.8) Updates `ws` from 8.10.0 to 8.17.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.10.0...8.17.1) Updates `cookie` from 0.5.0 to 0.7.0 - [Release notes](https://github.com/jshttp/cookie/releases) - [Commits](jshttp/cookie@v0.5.0...v0.7.0) Updates `jsonwebtoken` from 8.5.1 to 9.0.0 - [Changelog](https://github.com/auth0/node-jsonwebtoken/blob/master/CHANGELOG.md) - [Commits](auth0/node-jsonwebtoken@v8.5.1...v9.0.0) Updates `next` from 12.1.6 to 14.2.15 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v12.1.6...v14.2.15) Updates `postcss` from 8.4.19 to 8.4.31 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.19...8.4.31) Updates `rollup` from 2.75.7 to 2.79.2 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v2.75.7...v2.79.2) Updates `zod` from 3.19.1 to 3.22.3 - [Release notes](https://github.com/colinhacks/zod/releases) - [Changelog](https://github.com/colinhacks/zod/blob/main/CHANGELOG.md) - [Commits](colinhacks/zod@v3.19.1...v3.22.3) Updates `@babel/traverse` from 7.17.3 to 7.26.4 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.26.4/packages/babel-traverse) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `follow-redirects` from 1.14.9 to 1.15.9 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.14.9...v1.15.9) Updates `micromatch` from 4.0.5 to 4.0.8 - [Release notes](https://github.com/micromatch/micromatch/releases) - [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md) - [Commits](micromatch/micromatch@4.0.5...4.0.8) Updates `tar` from 6.1.11 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.1.11...v6.2.1) Updates `word-wrap` from 1.2.3 to 1.2.5 - [Release notes](https://github.com/jonschlinkert/word-wrap/releases) - [Commits](jonschlinkert/word-wrap@1.2.3...1.2.5) Updates `@discordjs/opus` from 0.8.0 to 0.9.0 - [Release notes](https://github.com/discordjs/opus/releases) - [Commits](discordjs/opus@v0.8.0...v0.9.0) Updates `axios` from 0.27.2 to 1.7.9 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v0.28.0/CHANGELOG.md) - [Commits](axios/axios@v0.27.2...v0.28.0) Updates `nanoid` from 3.3.8 to 5.0.9 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.4...3.3.8) Updates `cookie` from 0.5.0 to 1.0.2 - [Release notes](https://github.com/jshttp/cookie/releases) - [Commits](jshttp/cookie@v0.5.0...v0.7.0) Updates `jsonwebtoken` from 8.5.1 to 9.0.2 - [Changelog](https://github.com/auth0/node-jsonwebtoken/blob/master/CHANGELOG.md) - [Commits](auth0/node-jsonwebtoken@v8.5.1...v9.0.0) Updates `next` from 12.1.6 to 14.2.15 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v12.1.6...v14.2.15) Updates `axios` from 0.27.2 to 1.7.9 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v0.28.0/CHANGELOG.md) - [Commits](axios/axios@v0.27.2...v0.28.0) --- updated-dependencies: - dependency-name: "@discordjs/opus" dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nanoid dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ws dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: cookie dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: jsonwebtoken dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: rollup dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: zod dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: micromatch dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: word-wrap dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@discordjs/opus" dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: nanoid dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: cookie dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: jsonwebtoken dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: next dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added the dependencies Pull requests that update a dependency file label Dec 18, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 4 directories with 16 updates #1

chore(deps): bump the npm_and_yarn group across 4 directories with 16 updates #1

dependabot bot commented on behalf of github Dec 18, 2024

chore(deps): bump the npm_and_yarn group across 4 directories with 16 updates #1

Are you sure you want to change the base?

chore(deps): bump the npm_and_yarn group across 4 directories with 16 updates #1

Conversation

dependabot bot commented on behalf of github Dec 18, 2024

0.9.0

Features

Release v0.28.0

Release notes:

Bug Fixes

Backports from v1.x:

0.28.0 (2024-02-12)

Release notes:

Bug Fixes

Backports from v1.x:

3.3.8

3.3.7

3.3.6

3.3.5

8.17.1

Bug fixes

0.7.0

0.6.0

9.0.0 - 2022-12-21

Breaking changes

Security fixes

8.4.31

8.4.30

8.4.29

8.4.28

8.4.27

8.4.26

8.4.25

8.4.24

8.4.23

8.4.22

8.4.21

8.4.20

8.4.31

8.4.30

8.4.29

8.4.28

8.4.27

8.4.26

8.4.25

8.4.24

8.4.23

8.4.22

8.4.21

8.4.20

v.2.79.2

2.79.2

Bug Fixes

Pull Requests

2.79.2

Bug Fixes

Pull Requests

3.29.5

Bug Fixes

Pull Requests

4.22.4

Bug Fixes

Pull Requests

4.22.3

Bug Fixes

Pull Requests

4.22.2

v3.22.3

Commits:

v3.22.2

Commits:

v3.22.1

Commits:

v3.22.0

ZodReadonly

v7.26.4 (2024-12-05)

↩️ Revert

Committers: 2

v7.26.3 (2024-12-04)

🐛 Bug Fix

`ZodReadonly`