[Snyk] Upgrade jira-changelog from 1.5.0 to 1.6.3 #3

opedge · 2023-09-23T09:19:57Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade jira-changelog from 1.5.0 to 1.6.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 6 versions ahead of your current version.
The recommended version was released 3 years ago, on 2020-09-02.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Information Exposure SNYK-JS-NODEFETCH-2342118	104/1000 Why? Confidentiality impact: High, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.0011, Social Trends: No, Days since published: 613, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.73, Score Version: V4	No Known Exploit
	Denial of Service SNYK-JS-NODEFETCH-674311	104/1000 Why? Confidentiality impact: High, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.0011, Social Trends: No, Days since published: 613, Transitive dependency: Yes, Is Malicious: No, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.73, Score Version: V4	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: jira-changelog

1.6.3 - 2020-09-02
1.6.2 - 2020-04-13
For some reason, the 1.2.1 version of html-entities was suddenly failing. This version does an upgrade to that and other libraries and fixed a couple failing tests.
1.6.1 - 2020-03-12
More info: #14
1.6.0 - 2020-02-20
The goal of this release was to remove a lot of unneeded noise from the changelogs. These involve some changes in functionality, please read.

Changes
- Upgrade core libraries to remove security warnings (core-js, lodash, babel, etc)
- Rollup merge commits into a single entry.
- Detect revert commits
- Add unit test coverage.
- Cleaned up a lot of code.
Detect Reverts

Previously, if you reverted a commit tagged with a Jira ticket, that ticket will still show up in the changelog even though it's no longer there. This is because the git commit would be something like: "Revert [ENG-123] lorem ipsum".

Now, as long as you use the default git revert commit message, jira-changelog will remove those reverted commits from the changelog. It will also intelligently detect a revert of a revert, which reincludes the ticket in the changelog as well as a revert, of a revert, of a revert, and so on.

Rollup Merge Commits

When merging a branch without squashing the commits first, all the commits from that branch will also be added to the git logs; which can cause a lot of noise in the changelog.

Now jira-changelog will attempt to rollup all those commits into the single merge commit. NOTE: This will still use the commit messages for all those commits to detect which tickets were included, but only a single commit will be presented in the changelog.

How it works

Every git log has a "parents" value, which is a list of git commit shas. The first value is the commit which came before this one. If there is more than one parent, it signals a merge and each git commit sha is one of the revisions merged into this. We can use that and then walk backward, to determine all the commits included with a merge.
1.6.0-beta.1 - 2020-02-10
v1.6.0-beta.1
1.6.0-beta.0 - 2020-02-06
v1.6.0-beta.0
1.5.0 - 2019-06-13
Jira has deprecated authenticating APIs with username and password. Now API requests need to be authenticated with the user's email address and Auth token.

How to upgrade
- Login to Jira with the user used by the jira-changelog script.
- Follow these instructions to get an auth token.
- Update your configuration file:
  - Change username to email and replace the value with the user's login email address.
  - Change password to token and the auth token to it.
Before
```
module.exports = {
  jira: {
    api: {
      host: 'myapp.atlassian.net',
      username: 'jirauser',
      password: 'pa55word'
    },
  }
}
```
After
```
module.exports = {
  jira: {
    api: {
      host: 'myapp.atlassian.net',
      email: '[email protected]',
      token: 'qWoJBdlEp6pJy15fc9tGpsOOR2L5i35v'
    },
  }
}
```