Bump the npm_and_yarn group with 9 updates #70

dependabot · 2024-08-11T08:24:38Z

Bumps the npm_and_yarn group with 9 updates:

Package	From	To
ansi-regex	`4.1.0`	`5.0.1`
async	`2.6.3`	`3.2.4`
braces	`3.0.2`	`3.0.3`
handlebars	`4.7.6`	`4.7.8`
moment	`2.29.1`	`2.30.1`
nunjucks	`3.2.3`	`3.2.4`
object-path	`0.11.5`	`0.11.8`
qs	`6.5.2`	`6.13.0`
urijs	`1.19.6`	`1.19.11`

Updates ansi-regex from 4.1.0 to 5.0.1

Release notes

Sourced from ansi-regex's releases.

v5.0.1

Fixes (backport of 6.0.1 to v5)

This is a backport of the minor ReDos vulnerability in ansi-regex@<6.0.1, as requested in #38.

Fix ReDoS in certain cases (#37) You are only really affected if you run the regex on untrusted user input in a server context, which it's very unlikely anyone is doing, since this regex is mainly used in command-line tools.

CVE-2021-3807

https://github.com/chalk/ansi-regex/compare/v5.0.0..v5.0.1

Thank you @yetingli for the patch and reproduction case!

v5.0.0

Breaking

Require Node.js 8 166a0d5

Enhancements

Add TypeScript definition (#32) e77ea17

chalk/ansi-regex@v4.1.0...v5.0.0

Commits

a9babce 5.0.1
4657833 fix incorrect format
c3c0b3f Fix potential ReDoS (#37)
178363b Move to GitHub Actions (#35)
0755e66 Add @Qix- to funding.yml
2b56fb0 5.0.0
f26f7fe Meta tweaks
e77ea17 Add TypeScript definition (#32)
166a0d5 Require Node.js 8
f115fca Tidelift tasks
See full diff in compare view

Updates async from 2.6.3 to 3.2.4

Changelog

Sourced from async's changelog.

v3.2.4

Fix a bug in priorityQueue where it didn't wait for the result. (#1725)

Fix a bug where unshiftAsync was included in priorityQueue. (#1790)

v3.2.3

Fix bugs in comment parsing in autoInject. (#1767, #1780)

v3.2.2

Fix potential prototype pollution exploit

v3.2.1

Use queueMicrotask if available to the environment (#1761)

Minor perf improvement in priorityQueue (#1727)

More examples in documentation (#1726)

Various doc fixes (#1708, #1712, #1717, #1740, #1739, #1749, #1756)

Improved test coverage (#1754)

v3.2.0

Fix a bug in Safari related to overwriting func.name

Remove built-in browserify configuration (#1653)

Varios doc fixes (#1688, #1703, #1704)

v3.1.1

Allow redefining name property on wrapped functions.

v3.1.0

Added q.pushAsync and q.unshiftAsync, analagous to q.push and q.unshift, except they always do not accept a callback, and reject if processing the task errors. (#1659)

Promises returned from q.push and q.unshift when a callback is not passed now resolve even if an error ocurred. (#1659)

Fixed a parsing bug in autoInject with complicated function bodies (#1663)

Added ES6+ configuration for Browserify bundlers (#1653)

Various doc fixes (#1664, #1658, #1665, #1652)

v3.0.1

Bug fixes

Fixed a regression where arrays passed to queue and cargo would be completely flattened. (#1645)

Clarified Async's browser support (#1643)

v3.0.0

The async/await release!

There are a lot of new features and subtle breaking changes in this major version, but the biggest feature is that most Async methods return a Promise if you omit the callback, meaning you can await them from within an async function.
const results = await async.mapLimit(urls, 5, async url => {
    const resp = await fetch(url)
    return resp.body
</tr></table> 

... (truncated)

Commits

f3ab51a Version 3.2.4
7ea2cec Update built files
bef7bef update changelog
03eeab3 Bump yargs from 17.4.1 to 17.5.1 (#1843)
387efcf Bump eslint from 8.14.0 to 8.17.0 (#1849)
131225a Bump karma from 6.3.19 to 6.3.20 (#1844)
4cfa89c Bump eslint from 8.14.0 to 8.16.0 (#1845)
90e940c Bump rollup from 2.71.1 to 2.75.5 (#1846)
dd72cf5 Bump @babel/eslint-parser from 7.17.0 to 7.18.2 (#1847)
4ae026e Bump babel-minify from 0.5.1 to 0.5.2 (#1848)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by hargasinski, a new releaser for async since your current version.

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates handlebars from 4.7.6 to 4.7.8

Release notes

Sourced from handlebars's releases.

v4.7.8

Make library compatible with workers (#1894) - 3d3796c

Don't rely on Node.js global object (#1776) - 2954e7e

Fix compiling of each block params in strict mode (#1855) - 30dbf04

Fix rollup warning when importing Handlebars as ESM - 03d387b

Fix bundler issue with webpack 5 (#1862) - c6c6bbb

Use https instead of git for mustache submodule - 88ac068

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.8 - July 27th, 2023

Make library compatible with workers (#1894) - 3d3796c

Don't rely on Node.js global object (#1776) - 2954e7e

Fix compiling of each block params in strict mode (#1855) - 30dbf04

Fix rollup warning when importing Handlebars as ESM - 03d387b

Fix bundler issue with webpack 5 (#1862) - c6c6bbb

Use https instead of git for mustache submodule - 88ac068

Commits

v4.7.7 - February 15th, 2021

fix weird error in integration tests - eb860c0

fix: check prototype property access in strict-mode (#1736) - b6d3de7

fix: escape property names in compat mode (#1736) - f058970

refactor: In spec tests, use expectTemplate over equals and shouldThrow (#1683) - 77825f8

chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

the changes from version 4.6.0 now also apply in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

Commits

8dc3d25 v4.7.8
668c4fb Fix browser tests in CI pipeline
c65c6cc Test on Node 18
3d3796c Make library compatible with workers
075b354 Fix sync issue with npm lock-file
30dbf04 Fix compiling of each block params in strict mode
e3a5448 Fix bundler issue with webpack 5
8e23642 Fix integration-tests issue with npm >= 7
88ac068 use https instead of git for mustache submodule
c68bc08 Fix typo
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.

Updates moment from 2.29.1 to 2.30.1

Changelog

Sourced from moment's changelog.

2.30.1

Release Dec 27, 2023

Revert moment/moment#5827, because it's breaking a lot of TS code.

2.30.0 Full changelog

Release Dec 26, 2023

2.29.4

Release Jul 6, 2022

#6015 [bugfix] Fix ReDoS in preprocessRFC2822 regex

2.29.3 Full changelog

Release Apr 17, 2022

#5995 [bugfix] Remove const usage

#5990 misc: fix advisory link

2.29.2 See full changelog

Release Apr 3 2022

Address GHSA-8hfj-j24r-96c4

Commits

485d9a7 Build 2.30.1
e048b09 Bump version to 2.30.1
f9f2d58 Update changelog for 2.30.1
a52ffb2 Revert "Merge pull request #5827 from BobZombie:feature/fix_d.ts"
ddd6809 Build 2.30.0
be64d00 Bump version to 2.30.0
ad41179 Update changelog for 2.30.0
63fe479 [misc] Make code ES6 compatible
0f0195f Revert "Merge pull request #5599 from Alanscut:issue_4985"
15b82f5 Revert "Merge pull request #5597 from Alanscut:issue-5596"
Additional commits viewable in compare view

Updates nunjucks from 3.2.3 to 3.2.4

Release notes

Sourced from nunjucks's releases.

v3.2.4

What's Changed

fix: html encode backslashes if used with escape filter or autoescape by @fdintino in mozilla/nunjucks#1437. Fixes CVE-2023-2142 ([bugzilla #1825980](https://bugzilla.mozilla.org/show_bug.cgi?id=1825980))

Full Changelog: mozilla/nunjucks@v3.2.3...v3.2.4

Changelog

Sourced from nunjucks's changelog.

3.2.4 (Apr 13 2023)

HTML encode backslashes when expressions are passed through the escape filter (including when this is done automatically with autoescape). Merge of #1437.

Commits

86a77f4 Release v3.2.4
ec16d21 fix: html encode backslashes if used with escape filter or autoescape (#1437)
See full diff in compare view

Updates object-path from 0.11.5 to 0.11.8

Commits

See full diff in compare view

Updates qs from 6.5.2 to 6.13.0

Changelog

Sourced from qs's changelog.

6.13.0

[New] parse: add strictDepth option (#511)

[Tests] use npm audit instead of aud

6.12.3

[Fix] parse: properly account for strictNullHandling when allowEmptyArrays

[meta] fix changelog indentation

6.12.2

[Fix] parse: parse encoded square brackets (#506)

[readme] add CII best practices badge

6.12.1

[Fix] parse: Disable decodeDotInKeys by default to restore previous behavior (#501)

[Performance] utils: Optimize performance under large data volumes, reduce memory usage, and speed up processing (#502)

[Refactor] utils: use +=

[Tests] increase coverage

6.12.0

[New] parse/stringify: add decodeDotInKeys/encodeDotKeys options (#488)

[New] parse: add duplicates option

[New] parse/stringify: add allowEmptyArrays option to allow [] in object values (#487)

[Refactor] parse/stringify: move allowDots config logic to its own variable

[Refactor] stringify: move option-handling code into normalizeStringifyOptions

[readme] update readme, add logos (#484)

[readme] stringify: clarify default arrayFormat behavior

[readme] fix line wrapping

[readme] remove dead badges

[Deps] update side-channel

[meta] make the dist build 50% smaller

[meta] add sideEffects flag

[meta] run build in prepack, not prepublish

[Tests] parse: remove useless tests; add coverage

[Tests] stringify: increase coverage

[Tests] use mock-property

[Tests] stringify: improve coverage

[Dev Deps] update @ljharb/eslint-config , aud, has-override-mistake, has-property-descriptors, mock-property, npmignore, object-inspect, tape

[Dev Deps] pin glob, since v10.3.8+ requires a broken jackspeak

[Dev Deps] pin jackspeak since 2.1.2+ depends on npm aliases, which kill the install process in npm < 6

6.11.2

[Fix] parse: Fix parsing when the global Object prototype is frozen (#473)

[Tests] add passing test cases with empty keys (#473)

6.11.1

[Fix] stringify: encode comma values more consistently (#463)

[readme] add usage of filter option for injecting custom serialization, i.e. of custom types (#447)

[meta] remove extraneous code backticks (#457)

[meta] fix changelog markdown

... (truncated)

Commits

5cf516c v6.13.0
8d56df2 [New] parse: add strictDepth option
c9a6694 [Tests] use npm audit instead of aud
f90cc35 v6.12.3
1bf9f7a [Fix] parse: properly account for strictNullHandling when allowEmptyArrays
7ebf48b [meta] fix changelog indentation
d0dff11 v6.12.2
f0b8d03 [Dev Deps] update @ljharb/eslint-config, object-inspect, tape
81835ff [Fix]: parse: parse encoded square brackets
db47dcc [readme] add CII best practices badge
Additional commits viewable in compare view

Updates urijs from 1.19.6 to 1.19.11

Release notes

Sourced from urijs's releases.

1.19.11 (April 3rd 2022)

SECURITY fixing URI.parse() handle excessive slashes in scheme-relative URLs - disclosed by zeyu2001 via https://huntr.dev/

SECURITY fixing URI.parse() remove \r (CR), \n, (LF) \t (TAB) - disclosed by haxatron via https://huntr.dev/

1.19.10 (March 5th 2022)

SECURITY fixing URI.parse() handle excessive colons in protocol delimiter - disclosed by huydoppa via https://huntr.dev/

1.19.9 (March 3rd 2022)

SECURITY fixing URI.parse() handle leading whitespace - disclosed by p0cas via https://huntr.dev/

1.19.8 (February 15th 2022)

SECURITY fixing URI.parse() treat scheme case-insenstivie when handling excessive slackes and backslashes - [PR #412](medialize/URI.js#412) by r0hanSH

1.19.7 (July 14th 2021)

SECURITY fixing URI.parseQuery() to prevent overwriting __proto__ in parseQuery() - disclosed privately by @NewEraCracker

SECURITY fixing URI.parse() to handle variable amounts of \ and / in scheme delimiter as Node and Browsers do - disclosed privately by ready-research via https://huntr.dev/

removed obsolete build tools

updated jQuery versions (verifying compatibility with 1.12.4, 2.2.4, 3.6.0)

Changelog

Sourced from urijs's changelog.

1.19.11 (April 3rd 2022)

SECURITY fixing URI.parse() handle excessive slashes in scheme-relative URLs - disclosed by zeyu2001 via https://huntr.dev/

SECURITY fixing URI.parse() remove \r (CR), \n, (LF) \t (TAB) - disclosed by haxatron via https://huntr.dev/

1.19.10 (March 5th 2022)

SECURITY fixing URI.parse() handle excessive colons in protocol delimiter - disclosed by huydoppa via https://huntr.dev/

1.19.9 (March 3rd 2022)

SECURITY fixing URI.parse() handle leading whitespace - disclosed by p0cas via https://huntr.dev/

1.19.8 (February 15th 2022)

SECURITY fixing URI.parse() treat scheme case-insenstivie when handling excessive slackes and backslashes - [PR #412](medialize/URI.js#412) by r0hanSH

1.19.7 (July 14th 2021)

SECURITY fixing URI.parseQuery() to prevent overwriting __proto__ in parseQuery() - disclosed privately by @NewEraCracker

SECURITY fixing URI.parse() to handle variable amounts of \ and / in scheme delimiter as Node and Browsers do - disclosed privately by ready-research via https://huntr.dev/

removed obsolete build tools

updated jQuery versions (verifying compatibility with 1.12.4, 2.2.4, 3.6.0)

Commits

b655c1b chore(build): bumping to version 1.19.11
b0c9796 fix(parse): handle CR,LF,TAB
88805fd fix(parse): handle excessive slashes in scheme-relative URLs
926b2aa chore(build): bumping to version 1.19.10
a8166fe fix(parse): handle excessive colons in scheme delimiter
01920b5 chore(build): bumping to version 1.19.9
86d1052 fix(parse): remove leading whitespace
efae1e5 chore(build): bumping to version 1.19.8
6ea641c fix(parse): case insensitive scheme - #412
19e54c7 chore(build): bumping to version 1.19.7
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 9 updates: | Package | From | To | | --- | --- | --- | | [ansi-regex](https://github.com/chalk/ansi-regex) | `4.1.0` | `5.0.1` | | [async](https://github.com/caolan/async) | `2.6.3` | `3.2.4` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.7.6` | `4.7.8` | | [moment](https://github.com/moment/moment) | `2.29.1` | `2.30.1` | | [nunjucks](https://github.com/mozilla/nunjucks) | `3.2.3` | `3.2.4` | | [object-path](https://github.com/mariocasciaro/object-path) | `0.11.5` | `0.11.8` | | [qs](https://github.com/ljharb/qs) | `6.5.2` | `6.13.0` | | [urijs](https://github.com/medialize/URI.js) | `1.19.6` | `1.19.11` | Updates `ansi-regex` from 4.1.0 to 5.0.1 - [Release notes](https://github.com/chalk/ansi-regex/releases) - [Commits](chalk/ansi-regex@v4.1.0...v5.0.1) Updates `async` from 2.6.3 to 3.2.4 - [Release notes](https://github.com/caolan/async/releases) - [Changelog](https://github.com/caolan/async/blob/master/CHANGELOG.md) - [Commits](caolan/async@v2.6.3...v3.2.4) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `handlebars` from 4.7.6 to 4.7.8 - [Release notes](https://github.com/handlebars-lang/handlebars.js/releases) - [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.8/release-notes.md) - [Commits](handlebars-lang/handlebars.js@v4.7.6...v4.7.8) Updates `moment` from 2.29.1 to 2.30.1 - [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md) - [Commits](moment/moment@2.29.1...2.30.1) Updates `nunjucks` from 3.2.3 to 3.2.4 - [Release notes](https://github.com/mozilla/nunjucks/releases) - [Changelog](https://github.com/mozilla/nunjucks/blob/master/CHANGELOG.md) - [Commits](mozilla/nunjucks@v3.2.3...v3.2.4) Updates `object-path` from 0.11.5 to 0.11.8 - [Commits](https://github.com/mariocasciaro/object-path/commits/v0.11.8) Updates `qs` from 6.5.2 to 6.13.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.5.2...v6.13.0) Updates `urijs` from 1.19.6 to 1.19.11 - [Release notes](https://github.com/medialize/URI.js/releases) - [Changelog](https://github.com/medialize/URI.js/blob/gh-pages/CHANGELOG.md) - [Commits](medialize/URI.js@v1.19.6...v1.19.11) --- updated-dependencies: - dependency-name: ansi-regex dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: async dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: handlebars dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: moment dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nunjucks dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: object-path dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: urijs dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2024-08-11T08:31:54Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Aug 11, 2024

zoetrope closed this Aug 11, 2024

dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-fa51b45181 branch August 11, 2024 08:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group with 9 updates #70

Bump the npm_and_yarn group with 9 updates #70

dependabot bot commented on behalf of github Aug 11, 2024

dependabot bot commented on behalf of github Aug 11, 2024

Bump the npm_and_yarn group with 9 updates #70

Bump the npm_and_yarn group with 9 updates #70

Conversation

dependabot bot commented on behalf of github Aug 11, 2024

v5.0.1

Fixes (backport of 6.0.1 to v5)

v5.0.0

Breaking

Enhancements

v3.2.4

v3.2.3

v3.2.2

v3.2.1

v3.2.0

v3.1.1

v3.1.0

v3.0.1

Bug fixes

v3.0.0

v4.7.8

v4.7.8 - July 27th, 2023

v4.7.7 - February 15th, 2021

2.30.1

2.30.0 Full changelog

2.29.4

2.29.3 Full changelog

2.29.2 See full changelog

v3.2.4

What's Changed

3.2.4 (Apr 13 2023)

6.13.0

6.12.3

6.12.2

6.12.1

6.12.0

6.11.2

6.11.1

1.19.11 (April 3rd 2022)

1.19.10 (March 5th 2022)

1.19.9 (March 3rd 2022)

1.19.8 (February 15th 2022)

1.19.7 (July 14th 2021)

1.19.11 (April 3rd 2022)

1.19.10 (March 5th 2022)

1.19.9 (March 3rd 2022)

1.19.8 (February 15th 2022)

1.19.7 (July 14th 2021)

dependabot bot commented on behalf of github Aug 11, 2024

Fixes (backport of `6.0.1` to v5)