Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump the npm_and_yarn group across 3 directories with 11 updates #3

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Jul 12, 2024

Bumps the npm_and_yarn group with 9 updates in the /code directory:

Package From To
vite 4.5.3 5.0.13
ws 8.16.0 8.17.1
webpack 5.90.3 5.93.0
next 14.1.0 14.1.1
webpack-dev-middleware 6.1.3 7.1.0
@adobe/css-tools 4.3.3 4.4.0
follow-redirects 1.15.5 1.15.6
pug 3.0.2 3.0.3
tar 6.2.0 6.2.1

Bumps the npm_and_yarn group with 1 update in the /code/builders/builder-webpack5 directory: webpack-dev-middleware.
Bumps the npm_and_yarn group with 4 updates in the /scripts directory: vite, @adobe/css-tools, tar and undici.

Updates vite from 4.5.3 to 5.0.13

Release notes

Sourced from vite's releases.

[email protected]

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.0.13 (2024-03-24)

5.0.12 (2024-01-19)

5.0.11 (2024-01-05)

5.0.10 (2023-12-15)

  • fix: omit protocol does not require pre-transform (#15355) (d9ae1b2), closes #15355
  • fix(build): use base64 for inline SVG if it contains both single and double quotes (#15271) (1bbff16), closes #15271

5.0.9 (2023-12-14)

5.0.8 (2023-12-12)

... (truncated)

Commits

Updates ws from 8.16.0 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

  • Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

  1. Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits
  • 3c56601 [dist] 8.17.1
  • e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 6a00029 [test] Increase code coverage
  • ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
  • b73b118 [dist] 8.17.0
  • 29694a5 [test] Use the highWaterMark variable
  • 934c9d6 [ci] Test on node 22
  • 1817bac [ci] Do not test on node 21
  • 96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
  • e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
  • Additional commits viewable in compare view

Updates webpack from 5.90.3 to 5.93.0

Release notes

Sourced from webpack's releases.

v5.93.0

Bug Fixes

  • Generate correct relative path to runtime chunks
  • Makes DefinePlugin quieter under default log level
  • Fixed mangle destructuring default in namespace import
  • Fixed consumption of eager shared modules for module federation
  • Strip slash for pretty regexp
  • Calculate correct contenthash for CSS generator options

New Features

  • Added the binary generator option for asset modules to explicitly keep source maps produced by loaders
  • Added the modern-module library value for tree shakable output
  • Added the overrideStrict option to override strict or non-strict mode for javascript modules

v5.92.1

Bug Fixes

  • Doesn't crash with an error when the css experiment is enabled and contenthash is used

v5.92.0

Bug Fixes

  • Correct tidle range's comutation for module federation
  • Consider runtime for pure expression dependency update hash
  • Return value in the subtractRuntime function for runtime logic
  • Fixed failed to resolve promise when eager import a dynamic cjs
  • Avoid generation extra code for external modules when remapping is not required
  • The css/global type now handles the exports name
  • Avoid hashing for @keyframe and @property at-rules in css/global type
  • Fixed mangle with destructuring for JSON modules
  • The stats.hasWarnings() method now respects the ignoreWarnings option
  • Fixed ArrayQueue iterator
  • Correct behavior of __webpack_exports_info__.a.b.canMangle
  • Changed to the correct plugin name for the CommonJsChunkFormatPlugin plugin
  • Set the chunkLoading option to the import when environment is unknown and output is module
  • Fixed when runtimeChunk has no exports when module chunkFormat used
  • [CSS] Fixed parsing minimized CSS import
  • [CSS] URLs in CSS files now have correct public path
  • [CSS] The css module type should not allow parser to switch mode
  • [Types] Improved context module types

New Features

  • Added platform target properties to compiler
  • Improved multi compiler cache location and validating it
  • Support import attributes spec (with keyword)
  • Support node: prefix for Node.js core modules in runtime code
  • Support prefetch/preload for module chunk format

... (truncated)

Commits
  • 277460b chore(release): 5.93.0
  • 76ab754 fix: relative path to runtime chunks
  • 40b1a77 test: added
  • 080e54f fix: relative path to runtime chunks
  • 7764e38 chore(deps-dev): bump eslint from 9.5.0 to 9.6.0
  • 22738f3 chore(deps-dev): bump eslint from 9.5.0 to 9.6.0
  • 1a27b9e fix: contenthash for css generator options
  • e716d44 chore(deps-dev): bump @​eslint/js from 9.5.0 to 9.6.0
  • 7a34330 chore(deps-dev): bump typescript from 5.5.2 to 5.5.3
  • 974752f chore(deps-dev): bump globals from 15.6.0 to 15.8.0
  • Additional commits viewable in compare view

Updates next from 14.1.0 to 14.1.1

Commits

Updates webpack-dev-middleware from 6.1.3 to 7.1.0

Release notes

Sourced from webpack-dev-middleware's releases.

v7.1.0

7.1.0 (2024-03-19)

Features

  • prefer to use fs.createReadStream over fs.readFileSync to read files (ab533de)

Bug Fixes

v7.0.0

7.0.0 (2023-12-26)

⚠ BREAKING CHANGES

  • minimum supported Node.js version is 18.12.0 (#1694)
  • updated memfs@4 (#1693)
Changelog

Sourced from webpack-dev-middleware's changelog.

7.1.0 (2024-03-19)

Features

  • prefer to use fs.createReadStream over fs.readFileSync to read files (ab533de)

Bug Fixes

7.0.0 (2023-12-26)

⚠ BREAKING CHANGES

  • minimum supported Node.js version is 18.12.0 (#1694)
  • updated memfs@4 (#1693)

Features

6.1.1 (2023-05-16)

Bug Fixes

6.1.0 (2023-05-03)

Features

Bug Fixes

6.0.2 (2023-03-19)

... (truncated)

Commits
  • 3d94e45 chore(release): 7.1.0
  • e10008c fix(security): do not allow to read files above (#1771)
  • ab533de feat: prefer to use fs.createReadStream over fs.readFileSync to read files
  • 1258fdd fix: cleaup stream and handle errors (#1769)
  • 22ec9ad chore(deps-dev): bump @​commitlint/cli from 19.2.0 to 19.2.1 (#1768)
  • 1a104bd chore(deps-dev): bump @​types/node from 20.11.28 to 20.11.29 (#1767)
  • 60ef106 chore(deps-dev): bump @​types/node from 20.11.27 to 20.11.28 (#1766)
  • e42571c chore(deps-dev): bump @​commitlint/cli from 19.1.0 to 19.2.0 (#1765)
  • 1fa9029 chore(deps-dev): bump @​types/node from 20.11.26 to 20.11.27 (#1764)
  • 10df4ad chore(deps-dev): bump @​commitlint/config-conventional (#1763)
  • Additional commits viewable in compare view

Updates @adobe/css-tools from 4.3.3 to 4.4.0

Changelog

Sourced from @​adobe/css-tools's changelog.

4.4.0 / 2024-06-05

Commits

Updates follow-redirects from 1.15.5 to 1.15.6

Commits

Updates pug from 3.0.2 to 3.0.3

Release notes

Sourced from pug's releases.

[email protected]

Bug Fixes

  • Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options (#3438)

[email protected]

Bug Fixes

  • Update pug-code-gen with the following fix: (#3438)

    Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options

Commits

Updates tar from 6.2.0 to 6.2.1

Commits

Updates webpack-dev-middleware from 6.1.3 to 7.2.1

Release notes

Sourced from webpack-dev-middleware's releases.

v7.1.0

7.1.0 (2024-03-19)

Features

  • prefer to use fs.createReadStream over fs.readFileSync to read files (ab533de)

Bug Fixes

v7.0.0

7.0.0 (2023-12-26)

⚠ BREAKING CHANGES

  • minimum supported Node.js version is 18.12.0 (#1694)
  • updated memfs@4 (#1693)
Changelog

Sourced from webpack-dev-middleware's changelog.

7.1.0 (2024-03-19)

Features

  • prefer to use fs.createReadStream over fs.readFileSync to read files (ab533de)

Bug Fixes

7.0.0 (2023-12-26)

⚠ BREAKING CHANGES

  • minimum supported Node.js version is 18.12.0 (#1694)
  • updated memfs@4 (#1693)

Features

6.1.1 (2023-05-16)

Bug Fixes

6.1.0 (2023-05-03)

Features

Bug Fixes

6.0.2 (2023-03-19)

... (truncated)

Commits
  • 3d94e45 chore(release): 7.1.0
  • e10008c fix(security): do not allow to read files above (#1771)
  • ab533de feat: prefer to use fs.createReadStream over fs.readFileSync to read files
  • 1258fdd fix: cleaup stream and handle errors (#1769)
  • 22ec9ad chore(deps-dev): bump @​commitlint/cli from 19.2.0 to 19.2.1 (#1768)
  • 1a104bd chore(deps-dev): bump @​types/node from 20.11.28 to 20.11.29 (#1767)
  • 60ef106 chore(deps-dev): bump @​types/node from 20.11.27 to 20.11.28 (#1766)
  • e42571c chore(deps-dev): bump @​commitlint/cli from 19.1.0 to 19.2.0 (#1765)
  • 1fa9029 chore(deps-dev): bump @​types/node from 20.11.26 to 20.11.27 (#1764)
  • 10df4ad chore(deps-dev): bump @​commitlint/config-conventional (#1763)
  • Additional commits viewable in compare view

Updates vite from 5.1.0 to 5.3.3

Release notes

Sourced from vite's releases.

[email protected]

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.0.13 (2024-03-24)

5.0.12 (2024-01-19)

5.0.11 (2024-01-05)

5.0.10 (2023-12-15)

  • fix: omit protocol does not require pre-transform (#15355) (d9ae1b2), closes #15355
  • fix(build): use base64 for inline SVG if it contains both single and double quotes (#15271) (1bbff16), closes #15271

5.0.9 (2023-12-14)

5.0.8 (2023-12-12)

... (truncated)

Commits

Updates postcss from 8.4.35 to 8.4.39

Release notes

Sourced from postcss's releases.

8.4.39

8.4.38

8.4.37

  • Fixed original.column are not numbers error in another case.

8.4.36

  • Fixed original.column are not numbers error on broken previous source map.
Changelog

Sourced from postcss's changelog.

8.4.39

8.4.38

8.4.37

  • Fixed original.column are not numbers error in another case.

8.4.36

  • Fixed original.column are not numbers error on broken previous source map.
Commits

Updates @adobe/css-tools from 4.3.1 to 4.4.0

Changelog

Sourced from @​adobe/css-tools's changelog.

4.4.0 / 2024-06-05

Commits

Updates tar from 6.2.0 to 6.2.1

Commits

Updates undici from 5.27.2 to 5.28.4

Release notes

Sourced from undici's releases.

v5.28.4

⚠️ Security Release ⚠️

Full Changelog: nodejs/undici@v5.28.3...v5.28.4

v5.28.3

⚠️ Security Release ⚠️

Fixes:

Full Changelog: nodejs/undici@v5.28.2...v5.28.3

v5.28.2

What's Changed

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jul 12, 2024
Copy link

coderabbitai bot commented Jul 12, 2024

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.


Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share
Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai generate interesting stats about this repository and render them as a table.
    • @coderabbitai show all the console.log statements in this repository.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (invoked as PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Additionally, you can add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/code/npm_and_yarn-9831f68fd6 branch 2 times, most recently from a9eae9e to f66359a Compare July 23, 2024 23:49
Bumps the npm_and_yarn group with 9 updates in the /code directory:

| Package | From | To |
| --- | --- | --- |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `4.5.3` | `5.0.13` |
| [ws](https://github.com/websockets/ws) | `8.16.0` | `8.17.1` |
| [webpack](https://github.com/webpack/webpack) | `5.90.3` | `5.93.0` |
| [next](https://github.com/vercel/next.js) | `14.1.0` | `14.1.1` |
| [webpack-dev-middleware](https://github.com/webpack/webpack-dev-middleware) | `6.1.3` | `7.1.0` |
| [@adobe/css-tools](https://github.com/adobe/css-tools) | `4.3.3` | `4.4.0` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.5` | `1.15.6` |
| [pug](https://github.com/pugjs/pug) | `3.0.2` | `3.0.3` |
| [tar](https://github.com/isaacs/node-tar) | `6.2.0` | `6.2.1` |

Bumps the npm_and_yarn group with 1 update in the /code/builders/builder-webpack5 directory: [webpack-dev-middleware](https://github.com/webpack/webpack-dev-middleware).
Bumps the npm_and_yarn group with 4 updates in the /scripts directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [@adobe/css-tools](https://github.com/adobe/css-tools), [tar](https://github.com/isaacs/node-tar) and [undici](https://github.com/nodejs/undici).


Updates `vite` from 4.5.3 to 5.0.13
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.0.13/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.0.13/packages/vite)

Updates `ws` from 8.16.0 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.16.0...8.17.1)

Updates `webpack` from 5.90.3 to 5.93.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Commits](webpack/webpack@v5.90.3...v5.93.0)

Updates `next` from 14.1.0 to 14.1.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v14.1.0...v14.1.1)

Updates `webpack-dev-middleware` from 6.1.3 to 7.1.0
- [Release notes](https://github.com/webpack/webpack-dev-middleware/releases)
- [Changelog](https://github.com/webpack/webpack-dev-middleware/blob/master/CHANGELOG.md)
- [Commits](webpack/webpack-dev-middleware@v6.1.3...v7.1.0)

Updates `@adobe/css-tools` from 4.3.3 to 4.4.0
- [Changelog](https://github.com/adobe/css-tools/blob/main/History.md)
- [Commits](https://github.com/adobe/css-tools/commits)

Updates `follow-redirects` from 1.15.5 to 1.15.6
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.5...v1.15.6)

Updates `pug` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/pugjs/pug/releases)
- [Commits](https://github.com/pugjs/pug/compare/[email protected]@3.0.3)

Updates `tar` from 6.2.0 to 6.2.1
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.2.0...v6.2.1)

Updates `webpack-dev-middleware` from 6.1.3 to 7.2.1
- [Release notes](https://github.com/webpack/webpack-dev-middleware/releases)
- [Changelog](https://github.com/webpack/webpack-dev-middleware/blob/master/CHANGELOG.md)
- [Commits](webpack/webpack-dev-middleware@v6.1.3...v7.1.0)

Updates `vite` from 5.1.0 to 5.3.3
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.0.13/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.0.13/packages/vite)

Updates `postcss` from 8.4.35 to 8.4.39
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.35...8.4.39)

Updates `@adobe/css-tools` from 4.3.1 to 4.4.0
- [Changelog](https://github.com/adobe/css-tools/blob/main/History.md)
- [Commits](https://github.com/adobe/css-tools/commits)

Updates `tar` from 6.2.0 to 6.2.1
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.2.0...v6.2.1)

Updates `undici` from 5.27.2 to 5.28.4
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.27.2...v5.28.4)

---
updated-dependencies:
- dependency-name: vite
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: webpack
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-middleware
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@adobe/css-tools"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: pug
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: webpack-dev-middleware
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@adobe/css-tools"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/code/npm_and_yarn-9831f68fd6 branch from f66359a to 164eb17 Compare July 24, 2024 06:45
Copy link
Author

dependabot bot commented on behalf of github Jul 28, 2024

Superseded by #5.

@dependabot dependabot bot closed this Jul 28, 2024
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/code/npm_and_yarn-9831f68fd6 branch July 28, 2024 01:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants