Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade: , , , , cosmiconfig, css-functions-list, debug, micromatch, fast-glob, ignore, known-css-properties, picocolors, postcss, postcss-resolve-nested-selector, postcss-selector-parser, supports-hyperlinks, table #61

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

X-oss-byte
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

@csstools/css-parser-algorithms
from 2.3.0 to 2.7.1 | 10 versions ahead of your current version | 2 months ago
on 2024-07-06
@csstools/css-tokenizer
from 2.1.1 to 2.4.1 | 11 versions ahead of your current version | 2 months ago
on 2024-07-05
@csstools/media-query-list-parser
from 2.1.2 to 2.1.13 | 11 versions ahead of your current version | 2 months ago
on 2024-07-06
@csstools/selector-specificity
from 3.0.0 to 3.1.1 | 5 versions ahead of your current version | 4 months ago
on 2024-05-13
cosmiconfig
from 8.2.0 to 8.3.6 | 7 versions ahead of your current version | a year ago
on 2023-09-13
css-functions-list
from 3.1.0 to 3.2.2 | 3 versions ahead of your current version | 5 months ago
on 2024-04-22
debug
from 4.3.4 to 4.3.6 | 2 versions ahead of your current version | 2 months ago
on 2024-07-27
micromatch
from 4.0.5 to 4.0.7 | 2 versions ahead of your current version | 4 months ago
on 2024-05-22
fast-glob
from 3.3.0 to 3.3.2 | 2 versions ahead of your current version | 10 months ago
on 2023-11-06
ignore
from 5.2.4 to 5.3.2 | 3 versions ahead of your current version | a month ago
on 2024-08-12
known-css-properties
from 0.28.0 to 0.34.0 | 6 versions ahead of your current version | 3 months ago
on 2024-06-18
picocolors
from 1.0.0 to 1.0.1 | 1 version ahead of your current version | 4 months ago
on 2024-05-14
postcss
from 8.4.24 to 8.4.41 | 17 versions ahead of your current version | a month ago
on 2024-08-05
postcss-resolve-nested-selector
from 0.1.1 to 0.1.6 | 4 versions ahead of your current version | a month ago
on 2024-08-12
postcss-selector-parser
from 6.0.13 to 6.1.2 | 6 versions ahead of your current version | a month ago
on 2024-08-12
supports-hyperlinks
from 3.0.0 to 3.1.0 | 1 version ahead of your current version | 23 days ago
on 2024-08-20
table
from 6.8.1 to 6.8.2 | 1 version ahead of your current version | 6 months ago
on 2024-03-26

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Uncontrolled resource consumption
SNYK-JS-BRACES-6838727
696 Proof of Concept
high severity Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728
696 No Known Exploit
medium severity Improper Input Validation
SNYK-JS-POSTCSS-5926692
696 No Known Exploit
Release notes
Package name: @csstools/css-parser-algorithms
  • 2.7.1 - 2024-07-06
  • 2.7.0 - 2024-06-29
  • 2.6.3 - 2024-05-04
  • 2.6.2 - 2024-05-04
  • 2.6.1 - 2024-03-13
  • 2.6.0 - 2024-02-19
  • 2.5.0 - 2023-12-31
  • 2.4.0 - 2023-12-15
  • 2.3.2 - 2023-09-24
  • 2.3.1 - 2023-07-24
  • 2.3.0 - 2023-07-03
from @csstools/css-parser-algorithms GitHub release notes
Package name: @csstools/css-tokenizer
  • 2.4.1 - 2024-07-05
  • 2.4.0 - 2024-07-05
  • 2.3.3 - 2024-07-03
  • 2.3.2 - 2024-06-29
  • 2.3.1 - 2024-05-04
  • 2.3.0 - 2024-05-04
  • 2.2.4 - 2024-03-13
  • 2.2.3 - 2023-12-31
  • 2.2.2 - 2023-12-15
  • 2.2.1 - 2023-09-24
  • 2.2.0 - 2023-07-24
  • 2.1.1 - 2023-04-10
from @csstools/css-tokenizer GitHub release notes
Package name: @csstools/media-query-list-parser
  • 2.1.13 - 2024-07-06
  • 2.1.12 - 2024-06-29
  • 2.1.11 - 2024-05-04
  • 2.1.10 - 2024-05-04
  • 2.1.9 - 2024-03-13
  • 2.1.8 - 2024-02-19
  • 2.1.7 - 2023-12-31
  • 2.1.6 - 2023-12-15
  • 2.1.5 - 2023-09-24
  • 2.1.4 - 2023-08-05
  • 2.1.3 - 2023-07-24
  • 2.1.2 - 2023-07-03
from @csstools/media-query-list-parser GitHub release notes
Package name: @csstools/selector-specificity
  • 3.1.1 - 2024-05-13
  • 3.1.0 - 2024-05-11
  • 3.0.3 - 2024-03-31
  • 3.0.2 - 2024-02-19
  • 3.0.1 - 2023-12-15
  • 3.0.0 - 2023-07-03
from @csstools/selector-specificity GitHub release notes
Package name: cosmiconfig from cosmiconfig GitHub release notes
Package name: css-functions-list
  • 3.2.2 - 2024-04-22
    • Add additional function references
  • 3.2.1 - 2023-10-15

    Changed

    • Add additional function references
  • 3.2.0 - 2023-07-10

    Changed

    • Update with latest function definitions
    • Keep functions that end with X|Y|Z, like rotatex or rotatey (rotateX
      or rotateY) (#4)
  • 3.1.0 - 2022-06-03

    Added

    • Add OKLCH and OKLab functions
      (#4)
from css-functions-list GitHub release notes
Package name: debug from debug GitHub release notes
Package name: micromatch from micromatch GitHub release notes
Package name: fast-glob
  • 3.3.2 - 2023-11-06

    Full Changelog: 3.3.1...3.3.2

    🐛 Bug fixes

    • Handle square brackets as a special character on Windows in escape functions (#425)
    • Keep escaping after brace expansion (#422)
  • 3.3.1 - 2023-07-22

    Full Changelog: 3.3.0...3.3.1

    This release fixes a regression for cases where the ignore option is used with a string (#403, #404).

    The public interface of this package does not support a string as the value for the ignore option since 2018 year (release).

    So, in the next major release, we will reintroduce method implementations that do not involve strings in the ignore option.

  • 3.3.0 - 2023-06-30

    Full Changelog: 3.2.12...3.3.0

    🚀 Improvements

    Method aliases

    New methods (glob, globSync, globStream) have been added in addition to the current methods (default import, sync, stream), which eliminate the need to rename the method when importing. In addition, an async alias has been added for the default import, which makes it possible to use this packet with ESM.

    Method to convert paths to globs

    A new method (convertPathToPattern) has been added in this release to convert a path to a pattern. The primary goal is to enable users to avoid processing Windows paths in each location where this package is used by utilities from third-party packages.

    See more details in the pull request.

    🐛 Bug fixes

    • In the past, we mishandled patterns that contained slashes when the baseNameMatch option was enabled, which went against the documented behavior. (#312)
    • Several problems with matching patterns that contain brace expansion have been resolved. The primary issue solved is when the pattern has duplicate slashes after it is expanded (#394), or the micromatch package does not correctly generate a regular expression (#365).
    • All negative patterns will now have the dot option enabled when matching paths. Previously, the !**/* patterns did not exclude hidden files (start with a dot). (#343)
    • The issue that led to duplicates in the results when overlapping or duplicate patterns were present among the patterns has been fixed. At the moment, we are only talking about leading dot. Other cases are not included. For example, running with the patterns ['./file.md', 'file.md', '*'] will now only include file.md once in the results. (#190)

    📖 Documentation

    A clarifying note has been added for the concurrency option, which provides more detailed information about the Thread Pool utilization.

    ⚙️ Infrastructure

    • The benchmark in CI is now running on Node.js 20.
    • The benchmark now uses the public package bencho instead of an in-house implementation. You may want to try this solution for your packages and provide feedback.

    🥇 New Contributors

from fast-glob GitHub release notes
Package name: ignore
  • 5.3.2 - 2024-08-12

    5.3.2: fixes #130, fixes consequent escaped backslashes

  • 5.3.1 - 2024-02-01

    5.3.1: #108: remove BOM before processing .gitignore rules

  • 5.3.0 - 2023-11-16

    5.3.0

    • MINOR export Options interface (#105)

    An upgrade is safe for all dependents


    It allows typing external methods which expect Options as a param, by importing the Options interface.

    import {Options} from 'ignore'
  • 5.2.4 - 2022-12-19
    • PATCH fixes normal single asterisk and normal consecutive asterisks defined in gitignore spec (#57)
    • PATCH invalid trailing backslash will not throw unexpectedly

    An upgrade is recommended for all dependents


    The following rules could be not properly parsed with previous ignore versions

    **foo
    *bar
    qu*ux
    abc\   # `ignore` would throw if no whitespace after `\`
from ignore GitHub release notes
Package name: known-css-properties
  • 0.34.0 - 2024-06-18

    What's Changed

    New Contributors

    Full Changelog: v0.33.0...v0.34.0

  • 0.33.0 - 2024-06-17

    What's Changed

    • Safari 17.3
    • Chrome 126
    • Chrome 126 android
    • Firefox 127
    • Firefox 120 android

    Full Changelog: v0.32.0...v0.33.0

  • 0.32.0 - 2024-06-13

    What's Changed

    • Chrome 125
    • Chrome 125 android
    • Firefox 126
    • Firefox 126 android
    • ios safari 17.5
    • w3c 2024/06/13

    Full Changelog: v0.31.0...v0.32.0

  • 0.31.0 - 2024-05-09

    What's Changed

    • Chrome 123
    • Chrome 124
    • Chrome android 124
    • Firefox 123
    • Firefox 124
    • Firefox 125
    • Firefox android 125
    • Samsung internet 25.0
    • ios safari 17.4
    • w3c 2024/05/09

    Full Changelog: v0.30.0...v0.31.0

  • 0.30.0 - 2024-03-07

    Update properties

    • Chrome 119
    • Firefox 119
    • Chrome 120
    • Firefox 120
    • Chrome 121
    • Firefox 121
    • Chrome 122
    • Firefox 122
    • Samsung internet 23.0
    • ios safari 17.3
    • Safari 17.1
    • w3c 2024/02/07
  • 0.29.0 - 2023-10-15

    Update properties

    • Safari 16.5
    • Safari 17.0
    • ios safari 17.0
    • Chrome 116
    • Chrome 117
    • Chrome android 117
    • Chrome 118
    • Firefox 114
    • Firefox 116
    • Firefox 117
    • Firefox 118
    • Firefox android 118
    • W3C data 2023/10/15

    Update dependencies

    Full Changelog: v0.28.0...v0.29.0

  • 0.28.0 - 2023-07-20
    • Chrome 111
    • Chrome 112
    • Chrome 113
    • Chrome 114
    • Chrome 114
    • Chrome 115
    • Firefox 111
    • Firefox 112
    • Firefox 113
    • Firefox 115
    • Chrome android 113
    • Chrome android 114
    • Firefox mobile 115
    • Safari 16.4
    • Samsung internet 22.0
    • W3C data 2023/07/20
from known-css-properties GitHub release notes
Package name: picocolors
  • 1.0.1 - 2024-05-14

    What's new?

    • Updated color detection mechanism to work properly on Vercel Edge Runtime #64
    • Remove use of recursion to avoid possible stack overflow for very long inputs #56
  • 1.0.0 - 2021-10-13

    What's new?

    • Removed several code elements to reduce the package size #31
    • Fixed optional flag for createColors() in TypeScript typings #34
from picocolors GitHub release notes
Package name: postcss
  • 8.4.41 - 2024-08-05
  • 8.4.40 - 2024-07-24
    • Moved to getter/setter in nodes types to help Sass team (by @ nex3).
  • 8.4.39 - 2024-06-29
  • 8.4.38 - 2024-03-20
  • 8.4.37 - 2024-03-19
    • Fixed original.column are not numbers error in another case.
  • 8.4.36 - 2024-03-17
    • Fixed original.column are not numbers error on broken previous source map.
  • 8.4.35 - 2024-02-07
  • 8.4.34 - 2024-02-05
  • 8.4.33 - 2024-01-04
  • 8.4.32 - 2023-12-02
  • 8.4.31 - 2023-09-28
  • 8.4.30 - 2023-09-18
  • 8.4.29 - 2023-08-29
  • 8.4.28 - 2023-08-15
  • 8.4.27 - 2023-07-21
  • 8.4.26 - 2023-07-13
  • 8.4.25 - 2023-07-06
  • 8.4.24 - 2023-05-28
from postcss GitHub release notes
Package name: postcss-resolve-nested-selector
  • 0.1.6 - 2024-08-12
  • 0.1.5 - 2024-08-08
  • 0.1.4 - 2024-07-23
  • 0.1.3 - 2024-07-23
  • 0.1.1 - 2016-02-19
from postcss-resolve-nested-selector GitHub release notes
Package name: postcss-selector-parser
  • 6.1.2 - 2024-08-12

    6.1.2

    • Fixed: erroneous trailing combinators in pseudos
  • 6.1.1 - 2024-07-11

    6.1.1

    • Fixed: improve typings of constructor helpers (#292)
  • 6.1.0 - 2024-05-22

    6.1.0

    • Feature: add sourceIndex to Selector nodes (#290)
  • 6.0.16 - 2024-03-13

    6.0.16

    • Fixed: add missing index argument to each/walk callback types (#289)
  • 6.0.15 - 2023-12-29

    6.0.15

    • Fixed: Node#prev and Node#next type for the first/last node
  • 6.0.14 - 2023-12-25

    6.0.14

    • Fixed: type definitions
  • 6.0.13 - 2023-05-15

    6.0.13

    • Fixed: throw on unexpected pipe symbols
from postcss-selector-parser GitHub release notes
Package name: supports-hyperlinks from supports-hyperlinks GitHub release notes
Package name: table from table GitHub release notes

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

Snyk has created this PR to upgrade:
  - @csstools/css-parser-algorithms from 2.3.0 to 2.7.1.
    See this package in npm: https://www.npmjs.com/package/@csstools/css-parser-algorithms
  - @csstools/css-tokenizer from 2.1.1 to 2.4.1.
    See this package in npm: https://www.npmjs.com/package/@csstools/css-tokenizer
  - @csstools/media-query-list-parser from 2.1.2 to 2.1.13.
    See this package in npm: https://www.npmjs.com/package/@csstools/media-query-list-parser
  - @csstools/selector-specificity from 3.0.0 to 3.1.1.
    See this package in npm: https://www.npmjs.com/package/@csstools/selector-specificity
  - cosmiconfig from 8.2.0 to 8.3.6.
    See this package in npm: https://www.npmjs.com/package/cosmiconfig
  - css-functions-list from 3.1.0 to 3.2.2.
    See this package in npm: https://www.npmjs.com/package/css-functions-list
  - debug from 4.3.4 to 4.3.6.
    See this package in npm: https://www.npmjs.com/package/debug
  - micromatch from 4.0.5 to 4.0.7.
    See this package in npm: https://www.npmjs.com/package/micromatch
  - fast-glob from 3.3.0 to 3.3.2.
    See this package in npm: https://www.npmjs.com/package/fast-glob
  - ignore from 5.2.4 to 5.3.2.
    See this package in npm: https://www.npmjs.com/package/ignore
  - known-css-properties from 0.28.0 to 0.34.0.
    See this package in npm: https://www.npmjs.com/package/known-css-properties
  - picocolors from 1.0.0 to 1.0.1.
    See this package in npm: https://www.npmjs.com/package/picocolors
  - postcss from 8.4.24 to 8.4.41.
    See this package in npm: https://www.npmjs.com/package/postcss
  - postcss-resolve-nested-selector from 0.1.1 to 0.1.6.
    See this package in npm: https://www.npmjs.com/package/postcss-resolve-nested-selector
  - postcss-selector-parser from 6.0.13 to 6.1.2.
    See this package in npm: https://www.npmjs.com/package/postcss-selector-parser
  - supports-hyperlinks from 3.0.0 to 3.1.0.
    See this package in npm: https://www.npmjs.com/package/supports-hyperlinks
  - table from 6.8.1 to 6.8.2.
    See this package in npm: https://www.npmjs.com/package/table

See this project in Snyk:
https://app.snyk.io/org/sammytezzy/project/9284e6a0-b96f-4b6e-aa5e-7dd75043c61b?utm_source=github&utm_medium=referral&page=upgrade-pr
Copy link

stackblitz bot commented Sep 12, 2024

Review PR in StackBlitz Codeflow Run & review this pull request in StackBlitz Codeflow.

Copy link

changeset-bot bot commented Sep 12, 2024

⚠️ No Changeset found

Latest commit: 175a034

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Copy link

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have skipped reviewing this pull request. Here's why:

  • It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
  • We don't review packaging changes - Let us know if you'd like us to change this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants