Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build(deps): bump the npm_and_yarn group across 1 directory with 20 updates #1

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

build(deps): bump the npm_and_yarn group across 1 directory with 20 updates #1

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Feb 14, 2025

Bumps the npm_and_yarn group with 17 updates in the / directory:

Package From To
body-parser 1.20.0 1.20.3
express 4.17.3 4.20.0
@babel/traverse 7.15.4 7.26.9
@sideway/formula 3.0.0 3.0.1
braces 3.0.2 3.0.3
cookiejar 2.1.3 2.1.4
follow-redirects 1.14.9 1.15.9
http-cache-semantics 4.1.0 4.1.1
jpeg-js 0.4.3 0.4.4
json5 2.2.0 2.2.3
micromatch 4.0.4 4.0.8
npm 8.6.0 8.19.4
semantic-release 19.0.2 19.0.5
semver-regex 3.1.3 3.1.4
tar 6.1.11 6.2.1
tough-cookie 4.0.0 4.1.4
word-wrap 1.2.3 1.2.5

Updates body-parser from 1.20.0 to 1.20.3

Release notes

Sourced from body-parser's releases.

1.20.3

What's Changed

Important

  • deps: [email protected]
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

New Contributors

Full Changelog: expressjs/body-parser@1.20.2...1.20.3

1.20.2

  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
    • perf: skip value escaping when unnecessary
  • deps: [email protected]

1.20.1

Changelog

Sourced from body-parser's changelog.

1.20.3 / 2024-09-10

  • deps: [email protected]
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

1.20.2 / 2023-02-21

  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
    • perf: skip value escaping when unnecessary
  • deps: [email protected]

1.20.1 / 2022-10-06

Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.


Updates express from 4.17.3 to 4.20.0

Release notes

Sourced from express's releases.

4.20.0

What's Changed

Important

  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect

Other Changes

New Contributors

Full Changelog: expressjs/express@4.19.1...4.20.0

... (truncated)

Changelog

Sourced from express's changelog.

4.20.0 / 2024-09-10

  • deps: [email protected]
    • Remove link renderization in html while redirecting
  • deps: [email protected]
    • Remove link renderization in html while redirecting
  • deps: [email protected]
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: [email protected]
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

  • Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

  • Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

4.18.3 / 2024-02-29

4.18.2 / 2022-10-08

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express since your current version.


Updates @babel/traverse from 7.15.4 to 7.26.9

Release notes

Sourced from @​babel/traverse's releases.

v7.26.9 (2025-02-14)

🐛 Bug Fix

🏠 Internal

Committers: 5

v7.26.8 (2025-02-08)

🏠 Internal

  • babel-preset-env
    • #17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

v7.26.7 (2025-01-24)

Thanks @​branchseer and @​tquetano-netflix for your first PRs!

🐛 Bug Fix

  • babel-helpers, babel-preset-env, babel-runtime-corejs3
  • babel-plugin-transform-typeof-symbol
  • babel-parser
  • babel-core
  • babel-plugin-transform-typescript
  • babel-plugin-transform-typescript, babel-traverse, babel-types

Committers: 6

... (truncated)

Changelog

Sourced from @​babel/traverse's changelog.

v7.26.9 (2025-02-14)

🐛 Bug Fix

🏠 Internal

v7.26.7 (2025-01-24)

🐛 Bug Fix

  • babel-helpers, babel-preset-env, babel-runtime-corejs3
  • babel-plugin-transform-typeof-symbol
  • babel-parser
  • babel-core
  • babel-plugin-transform-typescript
  • babel-plugin-transform-typescript, babel-traverse, babel-types

v7.26.6 (2025-01-13)

🐛 Bug Fix

  • babel-plugin-transform-nullish-coalescing-operator

v7.26.5 (2025-01-10)

👓 Spec Compliance

🐛 Bug Fix

  • babel-plugin-transform-block-scoped-functions
  • babel-plugin-transform-typescript
  • babel-parser
  • babel-generator, babel-parser, babel-plugin-transform-flow-strip-types, babel-types

... (truncated)

Commits

Updates @sideway/formula from 3.0.0 to 3.0.1

Commits
Maintainer changes

This version was pushed to npm by marsup, a new releaser for @​sideway/formula since your current version.


Updates braces from 3.0.2 to 3.0.3

Commits

Updates cookiejar from 2.1.3 to 2.1.4

Commits

Updates follow-redirects from 1.14.9 to 1.15.9

Commits
  • e4e55c7 Release version 1.15.9 of the npm package.
  • 31a1abf Attempt much more gentle detection.
  • d2aaa97 Fix url field.
  • 62558f0 Release version 1.15.8 of the npm package.
  • a8d1cee Return subtlety.
  • 458ca8e Fix native URL test for Node 20.
  • ca49e44 Handle KeepAlive connections in tests.
  • f3711d7 Test on Node 20 and 22.
  • fda0faf Fix typo.
  • 760757f Release version 1.15.7 of the npm package.
  • Additional commits viewable in compare view

Updates http-cache-semantics from 4.1.0 to 4.1.1

Commits

Updates jpeg-js from 0.4.3 to 0.4.4

Release notes

Sourced from jpeg-js's releases.

v0.4.4

v0.4.4 (2022-06-07)

  • feat: add comment tag encoding (#87) (13e1ffa), closes #87
  • fix: validate sampling factors (#106) (9ccd35f), closes #106
  • fix(decoder): rethrow a more helpful error if Buffer is undefined (#93) (b58cc11), closes #93
  • chore(ci): migrate to github actions (#86) (417e8e2), closes #86
  • chore(deps): bump y18n from 4.0.0 to 4.0.3 (#98) (2c90858), closes #98
  • chore(deps): bump ws from 7.2.3 to 7.4.6 (#91) (fd73289), closes #91
  • chore(deps): bump hosted-git-info from 2.8.8 to 2.8.9 (#90) (9449a8b), closes #90
  • chore(deps): bump lodash from 4.17.15 to 4.17.21 (#89) (ffdc4a4), closes #89
Commits
  • 9ccd35f fix: validate sampling factors (#106)
  • b58cc11 fix(decoder): rethrow a more helpful error if Buffer is undefined (#93)
  • 2c90858 chore(deps): bump y18n from 4.0.0 to 4.0.3 (#98)
  • fd73289 chore(deps): bump ws from 7.2.3 to 7.4.6 (#91)
  • 9449a8b chore(deps): bump hosted-git-info from 2.8.8 to 2.8.9 (#90)
  • ffdc4a4 chore(deps): bump lodash from 4.17.15 to 4.17.21 (#89)
  • 13e1ffa feat: add comment tag encoding (#87)
  • 417e8e2 chore(ci): migrate to github actions (#86)
  • See full diff in compare view

Updates json5 from 2.2.0 to 2.2.3

Release notes

Sourced from json5's releases.

v2.2.3

v2.2.2

  • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1

Changelog

Sourced from json5's changelog.

v2.2.3 [code, diff]

v2.2.2 [code, diff]

  • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

Commits
  • c3a7524 2.2.3
  • 94fd06d docs: update CHANGELOG for v2.2.3
  • 3b8cebf docs(security): use GitHub security advisories
  • f0fd9e1 docs: publish a security policy
  • 6a91a05 docs(template): bug -> bug report
  • 14f8cb1 2.2.2
  • 10cc7ca docs: update CHANGELOG for v2.2.2
  • 7774c10 fix: add proto to objects and arrays
  • edde30a Readme: slight tweak to intro
  • 97286f8 Improve example in readme
  • Additional commits viewable in compare view

Updates micromatch from 4.0.4 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

  • this is basically v4.0.5, with some README updates
  • it is vulnerable to CVE-2024-4067
  • Updated braces to v3.0.3 to avoid CVE-2024-4068
  • does NOT break API compatibility

[4.0.6] - 2024-05-21

  • Added hasBraces to check if a pattern contains braces.
  • Fixes CVE-2024-4067
  • BREAKS API COMPATIBILITY
  • Should be labeled as a major release, but it's not.

[4.0.1 - 4.0.5]

[4.0.0] - 2019-03-20

Added

  • Adds support for options.onMatch. See the readme for details
  • Adds support for options.onIgnore. See the readme for details
  • Adds support for options.onResult. See the readme for details

Breaking changes

  • Require Node.js >= 8.6
  • Removed support for passing an array of brace patterns to micromatch.braces().
  • To strictly enforce closing brackets (for {, [, and (), you must now use strictBrackets=true instead of strictErrors.
  • cache - caching and all related options and methods have been removed
  • options.unixify was renamed to options.windows
  • options.nodupes Was removed. Duplicates are always removed by default. You can override this with custom behavior by using the onMatch, onResult and onIgnore functions.
  • options.snapdragon was removed, as snapdragon is no longer used.
  • options.sourcemap was removed, as snapdragon is no longer used, which provided sourcemap support.

[3.0.0] - 2017-04-11

Complete overhaul, with 36,000+ new unit tests validated against actual output generated by Bash and minimatch. More specifically, 35,000+ of the tests:

  • micromatch results are directly compared to bash results
  • in rare cases, when micromatch and bash disagree, micromatch's results are compared to minimatch's results
  • micromatch is much more accurate than minimatch, so there were cases where I had to make assumptions. I'll try to document these.

This refactor introduces a parser and compiler that are supersets of more granular parsers and compilers from other sub-modules. Each of these sub-modules has a singular responsibility and focuses on a certain type of matching that aligns with a specific part of the Bash "expansion" API.

These sub-modules work like plugins to seamlessly create the micromatch parser/compiler, so that strings are parsed in one pass, an AST is created, then a new string is generated by the compiler.

... (truncated)

Commits

Updates npm from 8.6.0 to 8.19.4

Changelog

Sourced from npm's changelog.

8.19.4 (2023-02-14)

Documentation

Dependencies

8.19.3 (2022-11-03)

Bug Fixes

Documentation

Dependencies

8.19.2 (2022-09-13)

Dependencies

8.19.1 (2022-09-01)

Bug Fixes

8.19.0 (2022-08-31)

Features

Bug Fixes

... (truncated)

Commits

Updates path-to-regexp from 0.1.7 to 0.1.10

Release notes

Sourced from path-to-regexp's releases.

Backtrack protection

Fixed

  • Add backtrack protection to parameters 29b96b4
    • This will break some edge cases but should improve performance

pillarjs/path-to-regexp@v0.1.9...v0.1.10

Support non-lookahead regex output

Added

  • Allow a non-lookahead regex (#312) c4272e4

component/path-to-regexp@v0.1.8...v0.1.9

Support named matching groups in RegExp

Added

  • Add support for named matching groups (#301) 114f62d

pillarjs/path-to-regexp@v0.1.7...v0.1.8

Commits

Updates semantic-release from 19.0.2 to 19.0.5

Release notes

Sourced from semantic-release's releases.

Description has been truncated

@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 20 u…
3c1bc17 
…pdates

Bumps the npm_and_yarn group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.0` | `1.20.3` |
| [express](https://github.com/expressjs/express) | `4.17.3` | `4.20.0` |
| [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.15.4` | `7.26.9` |
| [@sideway/formula](https://github.com/sideway/formula) | `3.0.0` | `3.0.1` |
| [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` |
| [cookiejar](https://github.com/bmeck/node-cookiejar) | `2.1.3` | `2.1.4` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.14.9` | `1.15.9` |
| [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.1.0` | `4.1.1` |
| [jpeg-js](https://github.com/eugeneware/jpeg-js) | `0.4.3` | `0.4.4` |
| [json5](https://github.com/json5/json5) | `2.2.0` | `2.2.3` |
| [micromatch](https://github.com/micromatch/micromatch) | `4.0.4` | `4.0.8` |
| [npm](https://github.com/npm/cli) | `8.6.0` | `8.19.4` |
| [semantic-release](https://github.com/semantic-release/semantic-release) | `19.0.2` | `19.0.5` |
| [semver-regex](https://github.com/sindresorhus/semver-regex) | `3.1.3` | `3.1.4` |
| [tar](https://github.com/isaacs/node-tar) | `6.1.11` | `6.2.1` |
| [tough-cookie](https://github.com/salesforce/tough-cookie) | `4.0.0` | `4.1.4` |
| [word-wrap](https://github.com/jonschlinkert/word-wrap) | `1.2.3` | `1.2.5` |



Updates `body-parser` from 1.20.0 to 1.20.3
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.0...1.20.3)

Updates `express` from 4.17.3 to 4.20.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@4.17.3...4.20.0)

Updates `@babel/traverse` from 7.15.4 to 7.26.9
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.26.9/packages/babel-traverse)

Updates `@sideway/formula` from 3.0.0 to 3.0.1
- [Commits](hapijs/formula@v3.0.0...v3.0.1)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `cookiejar` from 2.1.3 to 2.1.4
- [Commits](https://github.com/bmeck/node-cookiejar/commits)

Updates `follow-redirects` from 1.14.9 to 1.15.9
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.14.9...v1.15.9)

Updates `http-cache-semantics` from 4.1.0 to 4.1.1
- [Commits](kornelski/http-cache-semantics@v4.1.0...v4.1.1)

Updates `jpeg-js` from 0.4.3 to 0.4.4
- [Release notes](https://github.com/eugeneware/jpeg-js/releases)
- [Commits](jpeg-js/jpeg-js@v0.4.3...v0.4.4)

Updates `json5` from 2.2.0 to 2.2.3
- [Release notes](https://github.com/json5/json5/releases)
- [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md)
- [Commits](json5/json5@v2.2.0...v2.2.3)

Updates `micromatch` from 4.0.4 to 4.0.8
- [Release notes](https://github.com/micromatch/micromatch/releases)
- [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/micromatch@4.0.4...4.0.8)

Updates `npm` from 8.6.0 to 8.19.4
- [Release notes](https://github.com/npm/cli/releases)
- [Changelog](https://github.com/npm/cli/blob/v8.19.4/CHANGELOG.md)
- [Commits](npm/cli@v8.6.0...v8.19.4)

Updates `path-to-regexp` from 0.1.7 to 0.1.10
- [Release notes](https://github.com/pillarjs/path-to-regexp/releases)
- [Changelog](https://github.com/pillarjs/path-to-regexp/blob/master/History.md)
- [Commits](pillarjs/path-to-regexp@v0.1.7...v0.1.10)

Updates `semantic-release` from 19.0.2 to 19.0.5
- [Release notes](https://github.com/semantic-release/semantic-release/releases)
- [Commits](semantic-release/semantic-release@v19.0.2...v19.0.5)

Updates `semver-regex` from 3.1.3 to 3.1.4
- [Release notes](https://github.com/sindresorhus/semver-regex/releases)
- [Commits](https://github.com/sindresorhus/semver-regex/commits/v3.1.4)

Updates `send` from 0.17.2 to 0.18.0
- [Release notes](https://github.com/pillarjs/send/releases)
- [Changelog](https://github.com/pillarjs/send/blob/master/HISTORY.md)
- [Commits](pillarjs/send@0.17.2...0.18.0)

Updates `serve-static` from 1.14.2 to 1.16.0
- [Release notes](https://github.com/expressjs/serve-static/releases)
- [Changelog](https://github.com/expressjs/serve-static/blob/master/HISTORY.md)
- [Commits](expressjs/serve-static@v1.14.2...1.16.0)

Updates `tar` from 6.1.11 to 6.2.1
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.1.11...v6.2.1)

Updates `tough-cookie` from 4.0.0 to 4.1.4
- [Release notes](https://github.com/salesforce/tough-cookie/releases)
- [Changelog](https://github.com/salesforce/tough-cookie/blob/master/CHANGELOG.md)
- [Commits](salesforce/tough-cookie@v4.0.0...v4.1.4)

Updates `word-wrap` from 1.2.3 to 1.2.5
- [Release notes](https://github.com/jonschlinkert/word-wrap/releases)
- [Commits](jonschlinkert/word-wrap@1.2.3...1.2.5)

---
updated-dependencies:
- dependency-name: body-parser
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@babel/traverse"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@sideway/formula"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookiejar
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: http-cache-semantics
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: jpeg-js
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: json5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: micromatch
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: npm
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: path-to-regexp
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: semantic-release
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: semver-regex
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: send
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: serve-static
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tough-cookie
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: word-wrap
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Feb 14, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants