Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump the npm_and_yarn group with 9 updates #96

Closed
wants to merge 1 commit into from
Closed

Bump the npm_and_yarn group with 9 updates #96

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 14, 2024 •
edited
Loading

Bumps the npm_and_yarn group with 9 updates:

Package From To
webpack 5.88.2 5.96.1
axios 1.6.1 1.7.7
body-parser 1.20.1 1.20.3
braces 3.0.2 3.0.3
cookie 0.4.2 0.7.2
socket.io 4.7.2 4.8.1
ws 8.5.0 8.18.0
socket.io-adapter 2.5.2 2.5.5
puppeteer 13.7.0 23.8.0

Updates webpack from 5.88.2 to 5.96.1

Release notes

Sourced from webpack's releases.

v5.96.1

Bug Fixes

  • [Types] Add @types/eslint-scope to dependencieS
  • [Types] Fixed regression in validate

v5.96.0

Bug Fixes

  • Fixed Module Federation should track all referenced chunks
  • Handle Data URI without base64 word
  • HotUpdateChunk have correct runtime when modified with new runtime
  • Order of chunks ids in generated chunk code
  • No extra Javascript chunks when using asset module as an entrypoint
  • Use optimistically logic for output.environment.dynamicImport to determine chunk format when no browserslist or target
  • Collision with global variables for optimization.avoidEntryIife
  • Avoid through variables in inlined module
  • Allow chunk template strings in output.devtoolNamespace
  • No extra runtime for get javascript/css chunk filename
  • No extra runtime for prefetch and preload in JS runtime when it was unsed in CSS
  • Avoid cache invalidation using ProgressPlugin
  • Increase parallelism when using importModule on the execution stage
  • Correctly parsing string in export and import
  • Typescript types
  • [CSS] css/auto considers a module depending on its filename as css (pure CSS) or css/local, before it was css/global and css/local
  • [CSS] Always interpolate classes even if they are not involved in export
  • [CSS] No extra runtime in Javascript runtime chunks for asset modules used in CSS
  • [CSS] No extra runtime in Javascript runtime chunks for external asset modules used in CSS
  • [CSS] No extra runtime for the node target
  • [CSS] Fixed url()s and @import parsing
  • [CSS] Fixed - emit a warning on broken :local and :global

New Features

  • Export CSS and ESM runtime modules
  • Single Runtime Chunk and Federation eager module hoisting
  • [CSS] Support /* webpackIgnore: true */ for CSS files
  • [CSS] Support src() support
  • [CSS] CSS nesting in CSS modules

v5.95.0

Bug Fixes

  • Fixed hanging when attempting to read a symlink-like file that it can't read
  • Handle default for import context element dependency
  • Merge duplicate chunks call after split chunks
  • Generate correctly code for dynamically importing the same file twice and destructuring
  • Use content hash as [base] and [name] for extracted DataURI's
  • Distinguish module and import in module-import for externals import's

... (truncated)

Commits
  • d4ced73 chore(release): 5.96.1
  • 7d6dbea fix: types regression in validate
  • 5c556e3 fix: types regression in validate
  • 2420eae fix: add @types/eslint-scope to dependencies due types regression
  • ec45d2d fix: add @types/eslint-scope to dependencies
  • aff0c3e chore(release): 5.96.0
  • 6f11ec1 refactor: module source types code
  • b07142f refactor: module source types code
  • 7d98b3c fix: Module Federation should track all referenced chunks
  • 6d09769 chore: linting
  • Additional commits viewable in compare view

Updates axios from 1.6.1 to 1.7.7

Release notes

Sourced from axios's releases.

Release v1.7.7

Release notes:

Bug Fixes

  • fetch: fix stream handling in Safari by fallback to using a stream reader instead of an async iterator; (#6584) (d198085)
  • http: fixed support for IPv6 literal strings in url (#5731) (364993f)

Contributors to this release

Release v1.7.6

Release notes:

Bug Fixes

  • fetch: fix content length calculation for FormData payload; (#6524) (085f568)
  • fetch: optimize signals composing logic; (#6582) (df9889b)

Contributors to this release

Release v1.7.5

Release notes:

Bug Fixes

  • adapter: fix undefined reference to hasBrowserEnv (#6572) (7004707)
  • core: add the missed implementation of AxiosError#status property; (#6573) (6700a8a)
  • core: fix ReferenceError: navigator is not defined for custom environments; (#6567) (fed1a4b)
  • fetch: fix credentials handling in Cloudflare workers (#6533) (550d885)

Contributors to this release

Release v1.7.4

Release notes:

Bug Fixes

Contributors to this release

... (truncated)

Changelog

Sourced from axios's changelog.

1.7.7 (2024-08-31)

Bug Fixes

  • fetch: fix stream handling in Safari by fallback to using a stream reader instead of an async iterator; (#6584) (d198085)
  • http: fixed support for IPv6 literal strings in url (#5731) (364993f)

Contributors to this release

1.7.6 (2024-08-30)

Bug Fixes

  • fetch: fix content length calculation for FormData payload; (#6524) (085f568)
  • fetch: optimize signals composing logic; (#6582) (df9889b)

Contributors to this release

1.7.5 (2024-08-23)

Bug Fixes

  • adapter: fix undefined reference to hasBrowserEnv (#6572) (7004707)
  • core: add the missed implementation of AxiosError#status property; (#6573) (6700a8a)
  • core: fix ReferenceError: navigator is not defined for custom environments; (#6567) (fed1a4b)
  • fetch: fix credentials handling in Cloudflare workers (#6533) (550d885)

Contributors to this release

1.7.4 (2024-08-13)

Bug Fixes

... (truncated)

Commits
  • 5b8a826 chore(release): v1.7.7 (#6585)
  • 364993f fix(http): fixed support for IPv6 literal strings in url (#5731)
  • d198085 fix(fetch): fix stream handling in Safari by fallback to using a stream reade...
  • d584fcf chore(release): v1.7.6 (#6583)
  • bc03c6c chore(examples): fix module import (#6575)
  • df9889b fix(fetch): optimize signals composing logic; (#6582)
  • ee208cf chore(sponsor): update sponsor block (#6576)
  • 085f568 fix(fetch): fix content length calculation for FormData payload; (#6524)
  • 59cd6b0 chore(release): v1.7.5 (#6574)
  • 6700a8a fix(core): add the missed implementation of AxiosError#status property; (#6573)
  • Additional commits viewable in compare view

Updates body-parser from 1.20.1 to 1.20.3

Release notes

Sourced from body-parser's releases.

1.20.3

What's Changed

Important

  • deps: [email protected]
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

New Contributors

Full Changelog: expressjs/body-parser@1.20.2...1.20.3

1.20.2

  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
    • perf: skip value escaping when unnecessary
  • deps: [email protected]
Changelog

Sourced from body-parser's changelog.

1.20.3 / 2024-09-10

  • deps: [email protected]
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

1.20.2 / 2023-02-21

  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
    • perf: skip value escaping when unnecessary
  • deps: [email protected]
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.


Updates braces from 3.0.2 to 3.0.3

Commits

Updates cookie from 0.4.2 to 0.7.2

Release notes

Sourced from cookie's releases.

v0.7.2

Fixed

  • Fix object assignment of hasOwnProperty (#177) bc38ffd

jshttp/cookie@v0.7.1...v0.7.2

0.7.1

Fixed

  • Allow leading dot for domain (#174)
    • Although not permitted in the spec, some users expect this to work and user agents ignore the leading dot according to spec
  • Add fast path for serialize without options, use obj.hasOwnProperty when parsing (#172)

jshttp/cookie@v0.7.0...v0.7.1

0.7.0

jshttp/cookie@v0.6.0...v0.7.0

0.6.0

  • Add partitioned option

0.5.0

  • Add priority option
  • Fix expires option to reject invalid dates
  • pref: improve default decode speed
  • pref: remove slow string split in parse
Commits
Maintainer changes

This version was pushed to npm by blakeembrey, a new releaser for cookie since your current version.


Updates socket.io from 4.7.2 to 4.8.1

Release notes

Sourced from socket.io's releases.

[email protected]

Due to a change in the bundler configuration, the production bundle (socket.io.min.js) did not support sending and receiving binary data in version 4.8.0. This is now fixed.

Dependencies

[email protected]

Bug Fixes

  • bundle: do not mangle the "_placeholder" attribute (ca9e994)

Dependencies

[email protected]

Features

Custom transport implementations

The transports option now accepts an array of transport implementations:

import { io } from "socket.io-client";
import { XHR, WebSocket } from "engine.io-client";
const socket = io({
transports: [XHR, WebSocket]
});

Here is the list of provided implementations:

Transport Description
Fetch HTTP long-polling based on the built-in fetch() method.
NodeXHR HTTP long-polling based on the XMLHttpRequest object provided by the xmlhttprequest-ssl package.
XHR HTTP long-polling based on the built-in XMLHttpRequest object.
NodeWebSocket WebSocket transport based on the WebSocket object provided by the ws package.
WebSocket WebSocket transport based on the built-in WebSocket object.
WebTransport WebTransport transport based on the built-in WebTransport object.

Usage:

Transport browser Node.js Deno Bun

... (truncated)

Commits

Updates ws from 8.5.0 to 8.18.0

Release notes

Sourced from ws's releases.

8.18.0

Features

  • Added support for Blob (#2229).

8.17.1

Bug fixes

  • Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

... (truncated)

Commits
  • 976c53c [dist] 8.18.0
  • 59b9629 [feature] Add support for Blob (#2229)
  • 0d1b5e6 [security] Use more descriptive text for 2017 vulnerability link
  • 15f11a0 [security] Add new DoS vulnerability to SECURITY.md
  • 3c56601 [dist] 8.17.1
  • e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 6a00029 [test] Increase code coverage
  • ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
  • b73b118 [dist] 8.17.0
  • 29694a5 [test] Use the highWaterMark variable
  • Additional commits viewable in compare view

Updates socket.io-adapter from 2.5.2 to 2.5.5

Release notes

Sourced from socket.io-adapter's releases.

2.5.4

Bug Fixes

  • ensure the order of the commands (a13f35f)
  • types: ensure compatibility with TypeScript < 4.5 (ca397f3)

Links

2.5.3

Two abstract classes were imported from the Redis adapter repository:

  • the ClusterAdapter class, which manages the messages sent between the server instances of the cluster
  • the ClusterAdapterWithHeartbeat class, which extends the ClusterAdapter and adds a heartbeat mechanism in order to check the healthiness of the other instances

Other adapters can then just extend those classes and only have to implement the pub/sub mechanism (and not the internal chit-chat protocol):

class MyAdapter extends ClusterAdapterWithHeartbeat {
  constructor(nsp, pubSub, opts) {
    super(nsp, opts);
    this.pubSub = pubSub;
    pubSub.subscribe("main-channel", (message) => this.onMessage(message));
    pubSub.subscribe("specific-channel#" + this.uid, (response) => this.onResponse(response));
  }
doPublish(message) {
return this.pubSub.publish("main-channel", message);
}
doPublishResponse(requesterUid, response) {
return this.pubSub.publish("specific-channel#" + requesterUid, response);
}
}

Besides, the number of "timeout reached: only x responses received out of y" errors (which can happen when a server instance leaves the cluster) should be greatly reduced by this commit.

Bug Fixes

  • cluster: fix count in fetchSockets() method (80af4e9)
  • cluster: notify the other nodes when closing (0e23ff0)

Performance Improvements

  • cluster: use timer.refresh() (d99a71b)

... (truncated)

Changelog

Sourced from socket.io-adapter's changelog.

2.5.5 (2024-06-18)

This release contains a bump of the ws dependency, which includes an important security fix.

Advisory: GHSA-3h5v-q93c-6h6q

2.5.4 (2024-02-22)

Bug Fixes

  • ensure the order of the commands (a13f35f)
  • types: ensure compatibility with TypeScript < 4.5 (ca397f3)

2.5.3 (2024-02-21)

Two abstract classes were imported from the Redis adapter repository:

  • the ClusterAdapter class, which manages the messages sent between the server instances of the cluster
  • the ClusterAdapterWithHeartbeat class, which extends the ClusterAdapter and adds a heartbeat mechanism in order to check the healthiness of the other instances

Other adapters can then just extend those classes and only have to implement the pub/sub mechanism (and not the internal chit-chat protocol):

class MyAdapter extends ClusterAdapterWithHeartbeat {
  constructor(nsp, pubSub, opts) {
    super(nsp, opts);
    this.pubSub = pubSub;
    pubSub.subscribe("main-channel", (message) => this.onMessage(message));
    pubSub.subscribe("specific-channel#" + this.uid, (response) => this.onResponse(response));
  }
doPublish(message) {
return this.pubSub.publish("main-channel", message);
}
doPublishResponse(requesterUid, response) {
return this.pubSub.publish("specific-channel#" + requesterUid, response);
}
}

Besides, the number of "timeout reached: only x responses received out of y" errors (which can happen when a server instance leaves the cluster) should be greatly reduced by this commit.

Bug Fixes

... (truncated)

Commits
  • 05a190a chore(release): 6.5.5
  • 93fe190 chore(deps): bump ws from 8.11.0 to 8.17.1 (#93)
  • 5eae5a0 chore(release): 2.5.4
  • 005d546 ci: test with older TypeScript version
  • a13f35f fix: ensure the order of the commands
  • 207c0db refactor: break circular dependency (2)
  • abc93a9 refactor: break circular dependency (1)
  • 9d4c4a7 refactor(cluster): export ClusterAdapterOptions and MessageType types
  • ca397f3 fix(types): ensure compatibility with TypeScript < 4.5
  • 549156c chore(release): 2.5.3
  • Additional commits viewable in compare view

Updates puppeteer from 13.7.0 to 23.8.0

Release notes

Sourced from puppeteer's releases.

puppeteer-core: v23.8.0

23.8.0 (2024-11-13)

Features

Bug Fixes

puppeteer: v23.8.0

23.8.0 (2024-11-13)

Features

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 23.7.1 to 23.8.0

puppeteer-core: v23.7.1

23.7.1 (2024-11-07)

Bug Fixes

puppeteer: v23.7.1

23.7.1 (2024-11-07)

Miscellaneous Chores

  • puppeteer: Synchronize puppeteer versions

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for puppeteer since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group with 9 updates
5e29b7b 
Bumps the npm_and_yarn group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [webpack](https://github.com/webpack/webpack) | `5.88.2` | `5.96.1` |
| [axios](https://github.com/axios/axios) | `1.6.1` | `1.7.7` |
| [body-parser](https://github.com/expressjs/body-parser) | `1.20.1` | `1.20.3` |
| [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` |
| [cookie](https://github.com/jshttp/cookie) | `0.4.2` | `0.7.2` |
| [socket.io](https://github.com/socketio/socket.io) | `4.7.2` | `4.8.1` |
| [ws](https://github.com/websockets/ws) | `8.5.0` | `8.18.0` |
| [socket.io-adapter](https://github.com/socketio/socket.io-adapter) | `2.5.2` | `2.5.5` |
| [puppeteer](https://github.com/puppeteer/puppeteer) | `13.7.0` | `23.8.0` |


Updates `webpack` from 5.88.2 to 5.96.1
- [Release notes](https://github.com/webpack/webpack/releases)
- [Commits](webpack/webpack@v5.88.2...v5.96.1)

Updates `axios` from 1.6.1 to 1.7.7
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.6.1...v1.7.7)

Updates `body-parser` from 1.20.1 to 1.20.3
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.1...1.20.3)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `cookie` from 0.4.2 to 0.7.2
- [Release notes](https://github.com/jshttp/cookie/releases)
- [Commits](jshttp/cookie@v0.4.2...v0.7.2)

Updates `socket.io` from 4.7.2 to 4.8.1
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/[email protected])

Updates `ws` from 8.5.0 to 8.18.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.5.0...8.18.0)

Updates `socket.io-adapter` from 2.5.2 to 2.5.5
- [Release notes](https://github.com/socketio/socket.io-adapter/releases)
- [Changelog](https://github.com/socketio/socket.io-adapter/blob/2.5.5/CHANGELOG.md)
- [Commits](socketio/socket.io-adapter@2.5.2...2.5.5)

Updates `puppeteer` from 13.7.0 to 23.8.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/release-please-config.json)
- [Commits](puppeteer/puppeteer@v13.7.0...puppeteer-v23.8.0)

---
updated-dependencies:
- dependency-name: webpack
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: axios
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: cookie
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: socket.io
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: socket.io-adapter
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: puppeteer
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from a team as a code owner November 14, 2024 21:49
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 14, 2024
@dependabot Dependabot
Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 2, 2024

Superseded by #102.

@dependabot dependabot bot closed this Dec 2, 2024
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-c42798ccce branch December 2, 2024 06:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Davidhanson90 Davidhanson90 Davidhanson90 approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@Davidhanson90