Bump the npm_and_yarn group across 2 directories with 24 updates #979
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps the npm_and_yarn group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.10.6` | `1.10.9` | | [axios](https://github.com/axios/axios) | `1.6.8` | `1.7.0` | | [quill](https://github.com/quilljs/quill/tree/HEAD/packages/quill) | `1.3.7` | `2.0.0` | | [socket.io](https://github.com/socketio/socket.io) | `4.5.1` | `4.6.2` | | [postcss](https://github.com/postcss/postcss) | `8.4.38` | `8.4.39` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.1.4` | `5.1.7` | | [@adobe/css-tools](https://github.com/adobe/css-tools) | `4.2.0` | `4.4.0` | | [@sideway/formula](https://github.com/sideway/formula) | `3.0.0` | `3.0.1` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [ejs](https://github.com/mde/ejs) | `3.1.8` | `3.1.10` | | [get-func-name](https://github.com/chaijs/get-func-name) | `2.0.0` | `2.0.2` | | [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.1.0` | `4.1.1` | | [loader-utils](https://github.com/webpack/loader-utils) | `1.4.0` | `1.4.2` | | [semver](https://github.com/npm/node-semver) | `5.7.1` | `5.7.2` | | [tar](https://github.com/isaacs/node-tar) | `6.1.15` | `6.2.1` | | [terser](https://github.com/terser/terser) | `5.14.1` | `5.31.2` | | [webpack-dev-middleware](https://github.com/webpack/webpack-dev-middleware) | `5.3.3` | `5.3.4` | | [word-wrap](https://github.com/jonschlinkert/word-wrap) | `1.2.3` | `1.2.5` | | [ws](https://github.com/websockets/ws) | `6.2.2` | `6.2.3` | Bumps the npm_and_yarn group with 8 updates in the /apps/docs directory: | Package | From | To | | --- | --- | --- | | [express](https://github.com/expressjs/express) | `4.18.2` | `4.19.2` | | [postcss](https://github.com/postcss/postcss) | `8.4.27` | `8.4.39` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.22.8` | `7.24.8` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.2` | `1.15.6` | | [terser](https://github.com/terser/terser) | `5.19.2` | `5.31.2` | | [webpack-dev-middleware](https://github.com/webpack/webpack-dev-middleware) | `5.3.3` | `5.3.4` | | [ws](https://github.com/websockets/ws) | `7.5.9` | `7.5.10` | Updates `@grpc/grpc-js` from 1.10.6 to 1.10.9 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/[email protected]...@grpc/[email protected]) Updates `axios` from 1.6.8 to 1.7.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.6.8...v1.7.0) Updates `quill` from 1.3.7 to 2.0.0 - [Release notes](https://github.com/quilljs/quill/releases) - [Changelog](https://github.com/slab/quill/blob/main/CHANGELOG.md) - [Commits](https://github.com/quilljs/quill/commits/v2.0.0/packages/quill) Updates `socket.io` from 4.5.1 to 4.6.2 - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/4.6.2/CHANGELOG.md) - [Commits](socketio/socket.io@4.5.1...4.6.2) Updates `postcss` from 8.4.38 to 8.4.39 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.38...8.4.39) Updates `vite` from 5.1.4 to 5.1.7 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.1.7/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.1.7/packages/vite) Updates `@adobe/css-tools` from 4.2.0 to 4.4.0 - [Changelog](https://github.com/adobe/css-tools/blob/main/History.md) - [Commits](https://github.com/adobe/css-tools/commits) Updates `@sideway/formula` from 3.0.0 to 3.0.1 - [Commits](hapijs/formula@v3.0.0...v3.0.1) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `ejs` from 3.1.8 to 3.1.10 - [Release notes](https://github.com/mde/ejs/releases) - [Commits](mde/ejs@v3.1.8...v3.1.10) Updates `engine.io` from 6.2.1 to 6.4.2 - [Release notes](https://github.com/socketio/engine.io/releases) - [Changelog](https://github.com/socketio/engine.io/blob/6.4.2/CHANGELOG.md) - [Commits](socketio/engine.io@6.2.1...6.4.2) Updates `follow-redirects` from 1.15.1 to 1.15.6 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.2...v1.15.6) Updates `get-func-name` from 2.0.0 to 2.0.2 - [Release notes](https://github.com/chaijs/get-func-name/releases) - [Commits](https://github.com/chaijs/get-func-name/commits/v2.0.2) Updates `http-cache-semantics` from 4.1.0 to 4.1.1 - [Commits](kornelski/http-cache-semantics@v4.1.0...v4.1.1) Updates `loader-utils` from 1.4.0 to 1.4.2 - [Release notes](https://github.com/webpack/loader-utils/releases) - [Changelog](https://github.com/webpack/loader-utils/blob/v1.4.2/CHANGELOG.md) - [Commits](webpack/loader-utils@v1.4.0...v1.4.2) Updates `semver` from 5.7.1 to 5.7.2 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md) - [Commits](npm/node-semver@v5.7.1...v5.7.2) Updates `socket.io-parser` from 4.0.4 to 4.2.4 - [Release notes](https://github.com/socketio/socket.io-parser/releases) - [Changelog](https://github.com/socketio/socket.io-parser/blob/4.2.4/CHANGELOG.md) - [Commits](socketio/socket.io-parser@4.0.4...4.2.4) Updates `tar` from 6.1.15 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.1.15...v6.2.1) Updates `terser` from 5.14.1 to 5.31.2 - [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md) - [Commits](terser/terser@v5.14.1...v5.31.2) Updates `webpack-dev-middleware` from 5.3.3 to 5.3.4 - [Release notes](https://github.com/webpack/webpack-dev-middleware/releases) - [Changelog](https://github.com/webpack/webpack-dev-middleware/blob/v5.3.4/CHANGELOG.md) - [Commits](webpack/webpack-dev-middleware@v5.3.3...v5.3.4) Updates `word-wrap` from 1.2.3 to 1.2.5 - [Release notes](https://github.com/jonschlinkert/word-wrap/releases) - [Commits](jonschlinkert/word-wrap@1.2.3...1.2.5) Updates `ws` from 6.2.2 to 6.2.3 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@6.2.2...6.2.3) Updates `express` from 4.18.2 to 4.19.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.18.2...4.19.2) Updates `postcss` from 8.4.27 to 8.4.39 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.38...8.4.39) Updates `@babel/traverse` from 7.22.8 to 7.24.8 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.24.8/packages/babel-traverse) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `follow-redirects` from 1.15.2 to 1.15.6 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.2...v1.15.6) Updates `terser` from 5.19.2 to 5.31.2 - [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md) - [Commits](terser/terser@v5.14.1...v5.31.2) Updates `webpack-dev-middleware` from 5.3.3 to 5.3.4 - [Release notes](https://github.com/webpack/webpack-dev-middleware/releases) - [Changelog](https://github.com/webpack/webpack-dev-middleware/blob/v5.3.4/CHANGELOG.md) - [Commits](webpack/webpack-dev-middleware@v5.3.3...v5.3.4) Updates `ws` from 7.5.9 to 7.5.10 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@6.2.2...6.2.3) --- updated-dependencies: - dependency-name: "@grpc/grpc-js" dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: quill dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: socket.io dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@adobe/css-tools" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@sideway/formula" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ejs dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: engine.io dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: get-func-name dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-cache-semantics dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: loader-utils dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: semver dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: socket.io-parser dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: terser dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-middleware dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: word-wrap dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: terser dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: webpack-dev-middleware dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
added
the
dependencies
|
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎ To accept the risk, merge this PR and you will not be notified again.
Next stepsWhat is an install script?Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts. Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Take a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with
|
|
@dependabot rebase |
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
bot
deleted the
dependabot/npm_and_yarn/npm_and_yarn-8ae125fa86
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bumps the npm_and_yarn group with 19 updates in the / directory:
1.10.61.10.91.6.81.7.01.3.72.0.04.5.14.6.28.4.388.4.395.1.45.1.74.2.04.4.03.0.03.0.13.0.23.0.33.1.83.1.102.0.02.0.24.1.04.1.11.4.01.4.25.7.15.7.26.1.156.2.15.14.15.31.25.3.35.3.41.2.31.2.56.2.26.2.3Bumps the npm_and_yarn group with 8 updates in the /apps/docs directory:
4.18.24.19.28.4.278.4.397.22.87.24.83.0.23.0.31.15.21.15.65.19.25.31.25.3.35.3.47.5.97.5.10Updates
@grpc/grpc-jsfrom 1.10.6 to 1.10.9Release notes
Sourced from
@grpc/grpc-js's releases.Commits
674f4e3Merge pull request from GHSA-7v5v-9h63-cj867ecaa2dgrpc-js: Bump to 1.10.9e64d816grpc-js: Avoid buffering significantly more than max_receive_message_size per...45e5fe5Merge pull request #2750 from murgatroid99/grpc-js_idle_uds_fix87a3541grpc-js: Fix UDS channels not reconnecting after going idle3105791Merge pull request #2740 from sergiitk/backport-1.10-psm-interop-common-prod-...fec135aMerge pull request #2729 from sergiitk/psm-interop-common-prod-tests76fe802Merge pull request #2739 from murgatroid99/backport-1.10-grpc-js_linkify-it_fixd5edf49Merge pull request #2735 from murgatroid99/grpc-js_linkify-it_fix23c05fcMerge pull request #2732 from murgatroid99/grpc-js_proto-loader_updateUpdates
axiosfrom 1.6.8 to 1.7.0Release notes
Sourced from axios's releases.
... (truncated)
Changelog
Sourced from axios's changelog.
... (truncated)
Commits
3041c61[Release] v1.7.0 (#6408)18b13cbchore(docs): add fetch adapter docs; (#6407)e62099bfix(fetch): fixed a possible memory leak in the AbortController for the strea...b49aa8echore(release): v1.7.0-beta.2 (#6403)d57f03achore(ci): bump create-pull-request version to fix a bug; (#6405)097b0d1chore(ci): add tag resolution for npm releases based on package version; (#6404)870e0a7fix(fetch): fix headers getting from a stream response; (#6401)95a3e8efix(fetch): fix & optimize progress capturing for cases when the request data...ad3174afix(fetch): capitalize HTTP method names; (#6395)b9f4848chore(release): v1.7.0-beta.1 (#6383)Updates
quillfrom 1.3.7 to 2.0.0Release notes
Sourced from quill's releases.
... (truncated)
Changelog
Sourced from quill's changelog.
... (truncated)
Commits
a6638e92.0.0828d177Use stable version of Parchment0b383a42.0.0-rc.520f02f5Allow ref for insertBefore to be null1021587Expose Range type91a7346Expose Bounds type for getBounds()d5ac335Add support for v1 list attributes (#4082)aa26ff3Fix function overloads for formatText (#4086)bbbae912.0.0-rc.441bd1fcRemove empty .css.js files generated by bundlers (#4076)Maintainer changes
This version was pushed to npm by luin, a new releaser for quill since your current version.
Updates
socket.iofrom 4.5.1 to 4.6.2Release notes
Sourced from socket.io's releases.
... (truncated)
Changelog
Sourced from socket.io's changelog.
... (truncated)
Commits
faf914cchore(release): 4.6.215af22frefactor: add a noop handler for the error eventd365894chore: bump socket.io-parser to version 4.2.312b0de4chore: bump engine.io to version 6.4.23d44aaefix(exports): movetypescondition to the top (#4698)cbf0362docs(examples): bump dependencies for the private messaging example59280dadocs(examples): update examples to docker compose v250a4d37docs(changelog): add version of transitive dependencies6458b2bdocs(example): basic WebSocket-only clientb56da8adocs(examples): upgrade to React 18Updates
postcssfrom 8.4.38 to 8.4.39Release notes
Sourced from postcss's releases.
Changelog
Sourced from postcss's changelog.
Commits
e0efb16Release 8.4.39 version48304c5Update dependencies155ac57Merge pull request #1947 from romainmenke/fix-css-syntax-error-type--reliable...1b9b466fix CssSyntaxError type declaration3f4d96eUpdate dependenciesb952be7Update CI actionsb512b29Typof9a9868Move to pnpm 9 and Node.js 2279052c2Merge pull request #1940 from Xvezda/patch-10eedad4Update changed urlsUpdates
vitefrom 5.1.4 to 5.1.7Changelog
Sourced from vite's changelog.
Commits
e710c2frelease: v5.1.75a056ddfix:fs.denywith globs with directories (#16250)6f7466erelease: v5.1.6a862ecbchore(deps): update all non-major dependencies (#16131)8403546fix: server middleware mode resolve (#16122)b6fb323fix: check for publicDir before checking if it is a parent directory (#16046)fd9de04fix(esbuild): update tsconfck to fix bug that could cause a deadlock (#16124)f699194fix: handle function property extension in namespace import (#16113)0d2df52style(utils): remove null check (#16112)eef9da1fix(worker): throw error when circular worker import is detected and support ...Updates
@adobe/css-toolsfrom 4.2.0 to 4.4.0Changelog
Sourced from
@adobe/css-tools's changelog.Commits
Updates
@sideway/formulafrom 3.0.0 to 3.0.1Commits
5b44c1b3.0.19fbc20achore: better number regex41ae98eCleanupc59f35eMove to SidewayMaintainer changes
This version was pushed to npm by marsup, a new releaser for
@sideway/formulasince your current version.Updates
bracesfrom 3.0.2 to 3.0.3Commits
74b2db23.0.388f1429update eslint. lint, fix unit tests.415d660Snyk js braces 6838727 (#40)190510ffix tests, skip 1 test in test/braces.expand716eb9freadme bumpa5851e5Merge pull request #37 from coderaiser/fix/vulnerability2092bd1feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...9f5b4cffix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)98414f9remove funding file665ab5dupdate keepEscaping doc (#27)Updates
ejsfrom 3.1.8 to 3.1.10Release notes
Sourced from ejs's releases.
Commits
d3f807dVersion 3.1.109ee26ddMocha TDDe469741Basic pollution protection715e950Merge pull request #756 from Jeffrey-mu/maincabe314Include advanced usage examples29b076cAdded header11503c7Merge branch 'main' of github.com:mde/ejs into main7690404Added security banner to READMEf47d7aeUpdate SECURITY.md828cea1Update SECURITY.mdUpdates
engine.iofrom 6.2.1 to 6.4.2Release notes
Sourced from engine.io's releases.
... (truncated)
Changelog
Sourced from engine.io's changelog.
... (truncated)
Commits
95e2153chore(release): 6.4.2fc480b4fix: prevent crash when provided with an invalid query param0141951refactor(types): ensure compatibility with Express middlewares8b22162fix(uws): prevent crash when using with middlewares9395782fix: include error handling for Express middlewares (#674)911d0e3refactor: return HTTP 400 upon invalid request overlapbd6d471fix(typings): make clientsCount public (#675)7033c0echore(release): 6.4.16e78489refactor: export BaseServer class (#669)535b068docs: add upgrade event in the documentationUpdates
follow-redirectsfrom 1.15.1 to 1.15.6Commits
35a517cRelease version 1.15.6 of the npm package.c4f847fDrop Proxy-Authorization across hosts.8526b4aUse GitHub for disclosure.b1677ceRelease version 1.15.5 of the npm package.d8914f7Preserve fragment in responseUrl.6585820Release version 1.15.4 of the npm package.7a6567eDisallow bracketed hostnames.05629afPrefer native URL instead of deprecated url.parse.