chore(deps): bump the npm_and_yarn group across 3 directories with 13 updates #1

dependabot · 2024-05-06T00:50:25Z

Bumps the npm_and_yarn group with 2 updates in the /docs directory: ejs and node-fetch.
Bumps the npm_and_yarn group with 5 updates in the /web directory:

Package	From	To
ejs	`3.1.9`	`3.1.10`
nanoid	`3.3.7`	`5.0.7`
vite	`5.0.12`	`5.0.13`
@babel/traverse	`7.24.1`	`7.24.5`
express	`4.18.2`	`4.19.2`

Bumps the npm_and_yarn group with 8 updates in the /web/libs/editor/tests/e2e directory:

Package	From	To
semver	`5.7.1`	`5.7.2`
nanoid	`3.1.30`	`3.3.7`
@babel/traverse	`7.18.2`	`7.24.5`
@sideway/formula	`3.0.0`	`3.0.1`
ip	`1.1.5`	`1.1.9`
socket.io-parser	`3.3.2`	`3.3.3`
xml2js	`0.4.23`	`0.5.0`
word-wrap	`1.2.3`	`1.2.5`

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits

d3f807d Version 3.1.10
9ee26dd Mocha TDD
e469741 Basic pollution protection
715e950 Merge pull request #756 from Jeffrey-mu/main
cabe314 Include advanced usage examples
29b076c Added header
11503c7 Merge branch 'main' of github.com:mde/ejs into main
7690404 Added security banner to README
f47d7ae Update SECURITY.md
828cea1 Update SECURITY.md
Additional commits viewable in compare view

Updates follow-redirects from 1.15.5 to 1.15.6

Commits

35a517c Release version 1.15.6 of the npm package.
c4f847f Drop Proxy-Authorization across hosts.
8526b4a Use GitHub for disclosure.
See full diff in compare view

Updates node-fetch from 2.6.12 to 2.7.0

Release notes

Sourced from node-fetch's releases.

v2.7.0

2.7.0 (2023-08-23)

Features

AbortError (#1744) (9b9d458)

v2.6.13

2.6.13 (2023-08-18)

Bug Fixes

Remove the default connection close header (#1765) (65ae25a), closes #1735 #1473 #1736

Commits

9b9d458 feat: AbortError (#1744)
65ae25a fix: Remove the default connection close header (#1765)
See full diff in compare view

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits

d3f807d Version 3.1.10
9ee26dd Mocha TDD
e469741 Basic pollution protection
715e950 Merge pull request #756 from Jeffrey-mu/main
cabe314 Include advanced usage examples
29b076c Added header
11503c7 Merge branch 'main' of github.com:mde/ejs into main
7690404 Added security banner to README
f47d7ae Update SECURITY.md
828cea1 Update SECURITY.md
Additional commits viewable in compare view

Updates follow-redirects from 1.15.5 to 1.15.6

Commits

35a517c Release version 1.15.6 of the npm package.
c4f847f Drop Proxy-Authorization across hosts.
8526b4a Use GitHub for disclosure.
See full diff in compare view

Updates nanoid from 3.3.7 to 5.0.7

Release notes

Sourced from nanoid's releases.

5.0.7

Fixed Parcel support (by @WilhelmYakunin).

5.0.6

Fixed React Native support.

Changelog

Sourced from nanoid's changelog.

5.0.7

Fixed Parcel support (by @WilhelmYakunin).

5.0.6

Fixed React Native support.

5.0.5

Make browser’s version faster by increasing size a little (by Samuel Elgozi).

5.0.4

Fixed CLI docs (by @ilyaboka).

5.0.3

Fixed CLI docs (by Chris Schmich).

5.0.2

Fixed webcrypto import (by Divyansh Singh).

5.0.1

Fixed Node.js 18 support.

5.0

Moved Node.js version to Web Crypto API.

Removed async API since Web Crypto API has only sync version.

Removed Node.js 14 and 16 support.

4.0.2

Added link to Github Sponsors.

4.0.1

Reduced npm package size (by @HiChen404).

4.0

Removed CommonJS support. Nano ID 4 will work only with ESM applications. We will support 3.x branch with CommonJS for users who can’t migrate to ESM.

Removed Node.js 10 and Node.js 12 support.

Reduced npm package size.

Commits

4d0036f Release 5.0.7 version
131d4d0 Sort imports
596a8b2 Move to console colors from Node.js
df9bb34 Move to flat ESLint config
d40c8e6 Sort imports
04727e4 Update dependencies
ff346fc add scoped name of urlAlphabet which is in export and import in one file (#473)
5bb460c Bump vite from 5.1.6 to 5.1.7 (#472)
9244d1c Update dependencies
4443103 Update translations
Additional commits viewable in compare view

Updates vite from 5.0.12 to 5.0.13

Changelog

Sourced from vite's changelog.

5.0.13 (2024-03-24)

fix: fs.deny with globs with directories (#16250) (d2db33f), closes #16250

Commits

80b1b07 release: v5.0.13
d2db33f fix: fs.deny with globs with directories (#16250)
See full diff in compare view

Updates @babel/traverse from 7.24.1 to 7.24.5

Release notes

Sourced from @babel/traverse's releases.

v7.24.5 (2024-04-29)

Thanks @romgrk and @sossost for your first PRs!

🐛 Bug Fix

babel-plugin-transform-classes, babel-traverse

#16377 fix: TypeScript annotation affects output (@liuxingbaoyu)

babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3

#16440 Fix suppressed error order (@sossost)

#16408 Await nullish async disposable (@JLHwung)

💅 Polish

babel-parser

#16407 Recover from exported using declaration (@JLHwung)

🏠 Internal

Other

#16414 Relax ESLint peerDependency constraint to allow v9 (@liuxingbaoyu)

babel-parser

#16425 Improve @babel/parser AST types (@nicolo-ribaudo)

#16417 Always pass type argument to .startNode (@nicolo-ribaudo)

babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse

#16439 Make NodePath<T | U> distributive (@nicolo-ribaudo)

babel-plugin-proposal-partial-application, babel-types

#16421 Remove JSXNamespacedName from valid CallExpression args (@nicolo-ribaudo)

babel-plugin-transform-class-properties, babel-preset-env

#16406 Do not load unnecessary Babel 7 syntax plugins in Babel 8 (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-helpers, babel-preset-env, babel-runtime-corejs3

#16357 Performance: improve objectWithoutPropertiesLoose on V8 (@romgrk)

Committers: 6

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

Rom Grk (@romgrk)

@liuxingbaoyu

ynnsuis (@sossost)

v7.24.4 (2024-04-03)

Thanks @Dunqing, @luiscubal, and @samualtnorman for your first PRs!

👓 Spec Compliance

babel-parser

#16403 Forbid initializerless using (@JLHwung)

babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3

#16388 Ensure decorators are callable (@JLHwung)

... (truncated)

Changelog

Sourced from @babel/traverse's changelog.

v7.24.5 (2024-04-29)

🐛 Bug Fix

babel-plugin-transform-classes, babel-traverse

#16377 fix: TypeScript annotation affects output (@liuxingbaoyu)

babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3

#16440 Fix suppressed error order (@sossost)

#16408 Await nullish async disposable (@JLHwung)

💅 Polish

babel-parser

#16407 Recover from exported using declaration (@JLHwung)

🏠 Internal

Other

#16414 Relax ESLint peerDependency constraint to allow v9 (@liuxingbaoyu)

babel-parser

#16425 Improve @babel/parser AST types (@nicolo-ribaudo)

#16417 Always pass type argument to .startNode (@nicolo-ribaudo)

babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse

#16439 Make NodePath<T | U> distributive (@nicolo-ribaudo)

babel-plugin-proposal-partial-application, babel-types

#16421 Remove JSXNamespacedName from valid CallExpression args (@nicolo-ribaudo)

babel-plugin-transform-class-properties, babel-preset-env

#16406 Do not load unnecessary Babel 7 syntax plugins in Babel 8 (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-helpers, babel-preset-env, babel-runtime-corejs3

#16357 Performance: improve objectWithoutPropertiesLoose on V8 (@romgrk)

v7.24.4 (2024-04-03)

👓 Spec Compliance

babel-parser

#16403 Forbid initializerless using (@JLHwung)

babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3

#16388 Ensure decorators are callable (@JLHwung)

🐛 Bug Fix

babel-generator

#16402 fix: Correctly prints { [key in Bar]? } (@liuxingbaoyu)

#16394 fix: Correctly generate TSMappedType (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-preset-env

#16390 Create bugfix plugin for classes in computed keys in Firefox (@nicolo-ribaudo)

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#16387 fix: support mutated outer decorated class binding (@JLHwung)

#16385 fix: Decorators when super() exists and protoInit is not needed (@liuxingbaoyu)

babel-plugin-transform-block-scoping

#16384 fix: Transform scoping for for X in loop (@liuxingbaoyu)

#16368 fix: Capture let when the for body is not a block (@liuxingbaoyu)

babel-core, babel-plugin-transform-block-scoped-functions, babel-plugin-transform-block-scoping

... (truncated)

Commits

ddbea7d v7.24.5
e779cad fix: TypeScript annotation affects output (#16377)
ee48754 Use multiple TypeScript projects (#16430)
4d8b2d0 Make NodePath\<T | U> distributive (#16439)
a84ec28 Enable eqeqeq rule (#16404)
See full diff in compare view

Updates express from 4.18.2 to 4.19.2

Release notes

Sourced from express's releases.

4.19.2

What's Changed

Improved fix for open redirect allow list bypass

Full Changelog: expressjs/express@4.19.1...4.19.2

4.19.1

What's Changed

Fix ci after location patch by @wesleytodd in expressjs/express#5552

fixed un-edited version in history.md for 4.19.0 by @wesleytodd in expressjs/express#5556

Full Changelog: expressjs/express@4.19.0...4.19.1

4.19.0

What's Changed

fix typo in release date by @UlisesGascon in expressjs/express#5527

docs: nominating @wesleytodd to be project captian by @wesleytodd in expressjs/express#5511

docs: loosen TC activity rules by @wesleytodd in expressjs/express#5510

Add note on how to update docs for new release by @crandmck in expressjs/express#5541

Prevent open redirect allow list bypass due to encodeurl

Release 4.19.0 by @wesleytodd in expressjs/express#5551

New Contributors

@crandmck made their first contribution in expressjs/express#5541

Full Changelog: expressjs/express@4.18.3...4.19.0

4.18.3

Main Changes

Fix routing requests without method

deps: [email protected]

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: [email protected]

Other Changes

Use https: protocol instead of deprecated git: protocol by @vcsjones in expressjs/express#5032

build: [email protected] and [email protected] by @abenhamdine in expressjs/express#5034

ci: update actions/checkout to v3 by @armujahid in expressjs/express#5027

test: remove unused function arguments in params by @raksbisht in expressjs/express#5124

Remove unused originalIndex from acceptParams by @raksbisht in expressjs/express#5119

Fixed typos by @raksbisht in expressjs/express#5117

examples: remove unused params by @raksbisht in expressjs/express#5113

fix: parameter str is not described in JSDoc by @raksbisht in expressjs/express#5130

fix: typos in History.md by @raksbisht in expressjs/express#5131

build : add [email protected] by @abenhamdine in expressjs/express#5028

test: remove unused function arguments in params by @raksbisht in expressjs/express#5137

... (truncated)

Changelog

Sourced from express's changelog.

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

Prevent open redirect allow list bypass due to encodeurl

deps: [email protected]

4.18.3 / 2024-02-29

Fix routing requests without method

deps: [email protected]

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: [email protected]

deps: [email protected]

Add partitioned option

Commits

04bc627 4.19.2
da4d763 Improved fix for open redirect allow list bypass
4f0f6cc 4.19.1
a003cfa Allow passing non-strings to res.location with new encoding handling checks f...
a1fa90f fixed un-edited version in history.md for 4.19.0
11f2b1d build: fix build due to inconsistent supertest behavior in older versions
084e365 4.19.0
0867302 Prevent open redirect allow list bypass due to encodeurl
567c9c6 Add note on how to update docs for new release (#5541)
69a4cf2 deps: [email protected]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.

Updates semver from 5.7.1 to 5.7.2

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

2f8fd41 #585 better handling of whitespace (#585) (@joaomoreno, @lukekarrys)

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

2f8fd41 #585 better handling of whitespace (#585) (@joaomoreno, @lukekarrys)

5.7

Add minVersion method

5.6

Move boolean loose param to an options object, with backwards-compatibility protection.

Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

Add version coercion capabilities

5.4

Add intersection checking

5.3

Add minSatisfying method

5.2

Add prerelease(v) that returns prerelease components

5.1

Add Backus-Naur for ranges

Remove excessively cute inspection methods

5.0

Remove AMD/Browserified build artifacts

Fix ltr and gtr when using the * range

Fix for range * with a prerelease identifier

Commits

f8cc313 chore: release 5.7.2
2f8fd41 fix: better handling of whitespace (#585)
deb5ad5 chore: @npmcli/template-oss@4.16.0
See full diff in compare view

Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.

Updates nanoid from 3.1.30 to 3.3.7

Release notes

Sourced from nanoid's releases.

5.0.7

Fixed Parcel support (by @WilhelmYakunin).

5.0.6

Fixed React Native support.

Changelog

Sourced from nanoid's changelog.

5.0.7

Fixed Parcel support (by @WilhelmYakunin).

5.0.6

Fixed React Native support.

5.0.5

Make browser’s version faster by increasing size a little (by Samuel Elgozi).

5.0.4

Fixed CLI docs (by @ilyaboka).

5.0.3

Fixed CLI docs (by Chris Schmich).

5.0.2

Fixed webcrypto import (by Divyansh Singh).

5.0.1

Fixed Node.js 18 support.

5.0

Moved Node.js version to Web Crypto API.

Removed async API since Web Crypto API has only sync version.

Removed Node.js 14 and 16 support.

4.0.2

Added link to Github Sponsors.

4.0.1

Reduced npm package size (by @HiChen404).

4.0

Removed CommonJS support. Nano ID 4 will work only with ESM applications. We will support 3.x branch with CommonJS for users who can’t migrate to ESM.

Removed Node.js 10 and Node.js 12 support.

Reduced npm package size.

Commits

4d0036f Release 5.0.7 version
131d4d0 Sort imports
596a8b2 Move to console colors from Node.js
df9bb34 Move to flat ESLint config
d40c8e6 Sort imports
04727e4 Update dependencies
ff346fc add scoped name of urlAlphabet which is in export and import in one file (#473)
5bb460c Bump vite from 5.1.6 to 5.1.7 (#472)
9244d1c Update dependencies
4443103 Update translations
Additional commits viewable in compare view

Updates @babel/traverse from 7.18.2 to 7.24.5

Release notes

Sourced from @babel/traverse's releases.

v7.24.5 (2024-04-29)

Thanks @romgrk and @sossost for your first PRs!

🐛 Bug Fix

babel-plugin-transform-classes, babel-traverse

#16377 fix: TypeScript annotation affects output (@liuxingbaoyu)

babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3

#16440 Fix suppressed error order (@sossost)

#16408 Await nullish async disposable (@JLHwung)

💅 Polish

babel-parser

#16407 Recover from exported using declaration (@JLHwung)

🏠 Internal

Other

#16414 Relax ESLint peerDependency constraint to allow v9 (@liuxingbaoyu)

babel-parser

#16425 Improve @babel/parser AST types (@nicolo-ribaudo)

#16417 Always pass type argument to .startNode (@nicolo-ribaudo)

babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse

#16439 Make NodePath<T | U> distributive (@nicolo-ribaudo)

babel-plugin-proposal-partial-application, babel-types

#16421 Remove JSXNamespacedName from valid CallExpression args (@nicolo-ribaudo)

babel-plugin-transform-class-properties, babel-preset-env

#16406 Do not load unnecessary Babel 7 syntax plugins in Babel 8 (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-helpers, babel-preset-env, babel-runtime-corejs3

#16357 Performance: improve objectWithoutPropertiesLoose on V8 (@romgrk)

Committers: 6

Babel Bot (@babel-bot)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

Rom Grk (@romgrk)

@liuxingbaoyu

ynnsuis (@sossost)

v7.24.4 (2024-04-03)

Thanks @Dunqing, @luiscubal, and @samualtnorman for your first PRs!

👓 Spec Compliance

babel-parser

#16403 Forbid initializerless using (@JLHwung)

babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3

#16388 Ensure decorators are callable (@JLHwung)

... (truncated)

Changelog

Sourced from @babel/traverse's changelog.

v7.24.5 (2024-04-29)

🐛 Bug Fix

babel-plugin-transform-classes, babel-traverse

#16377 fix: TypeScript annotation affects output (@liuxingbaoyu)

babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3

#16440 Fix suppressed error order (@sossost)

#16408 Await nullish async disposable (@JLHwung)

💅 Polish

babel-parser

#16407 Recover from exported using declaration (@JLHwung)

🏠 Internal

Other

#16414 Relax ESLint peerDependency constraint to allow v9 (@liuxingbaoyu)

babel-parser

#16425 Improve @babel/parser AST types (@nicolo-ribaudo)

#16417 Always pass type argument to .startNode (@nicolo-ribaudo)

babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse

#16439 Make NodePath<T | U> distributive (@nicolo-ribaudo)

babel-plugin-proposal-partial-application, babel-types

#16421 Remove JSXNamespacedName from valid CallExpression args (@nicolo-ribaudo)

babel-plugin-transform-class-properties, babel-preset-env

#16406 Do not load unnecessary Babel 7 syntax plugins in Babel 8 (@nicolo-ribaudo)

🏃‍♀️ Performance

babel-helpers, babel-preset-env, babel-runtime-corejs3

#16357 Performance: improve objectWithoutPropertiesLoose on V8 (@romgrk)

v7.24.4 (2024-04-03)

👓 Spec Compliance

babel-parser

#16403 Forbid initializerless using (@JLHwung)

babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3

#16388 Ensure decorators are callable (@JLHwung)

🐛 Bug Fix

babel-generator

#16402 fix: Correctly prints { [key in Bar]? } (@liuxingbaoyu)

#16394 fix: Correctly generate TSMappedType (@liuxingbaoyu)

babel-compat-data, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-preset-env

#16390 Create bugfix plugin for classes in computed keys in Firefox (@nicolo-ribaudo)

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#16387 fix: support mutated outer decorated class binding (@JLHwung)

#16385 fix: Decorators when super() exists and protoInit is not needed (@liuxingbaoyu)

babel-plugin-transform-block-scoping

#16384 fix: Transform scoping for for X in loop (@liuxingbaoyu)

#16368 fix: Capture let when the for body is not a block (@liuxingbaoyu)

babel-core, babel-plugin-transform-block-scoped-functions, babel-plugin-transform-block-scoping

... (truncated)

Commits

ddbea7d v7.24.5
e779cad fix: TypeScript annotation affects output (#16377)
ee48754 Use multiple TypeScript projects (#16430)
4d8b2d0 Make NodePath\<T | U> distributive (#16439)
a84ec28 Enable eqeqeq rule (#16404)
See full diff in compare view

Updates @sideway/formula from 3.0.0 to 3.0.1

Commits

5b44c1b 3.0.1
9fbc20a chore: better number regex
41ae98e Cleanup
c59f35e Move to Sideway
See full diff in compare view

Maintainer changes

This version was pushed to npm by marsup, a new releaser for @sideway/formula since your current version.

Updates ip from 1.1.5 to 1.1.9

Commits

1ecbf2f 1.1.9
6a3ada9 lib: fixed CVE-2023-42282 and added unit test
5dc3b2f 1.1.8
8e6f28b lib: even better node 6 support
088c9e5 1.1.7
1a4ca35 lib: add back support for Node.js 6
af82ef4 1.1.6
dba19f6 package: exclude test folder from publishing
7cd7f30 ci: use github workflows
4de50ae lib: node 18 support
See full diff in compare view

Updates socket.io-parser from 3.3.2 to 3.3.3

Release notes

Sourced from socket.io-parser's releases.

3.3.3

Bug Fixes

check the format of the index of each attachment (fb21e42)

Links

Diff: socketio/socket.io-parser@3.3.2...3.3.3

Branch: 3.3.x

Changelog

Sourced from socket.io-parser's changelog.

3.3.3 (2022-11-09)

Bug Fixes

check the format of the index of each attachment (fb21e42)

3.4.2 (2022-11-09)

Bug Fixes

check the format of the index of each attachment (04d23ce)

4.2.1 (2022-06-27)

Bug Fixes

check the format of the index of each attachment (b5d0cb7)

4.0.5 (2022-06-27)

Bug Fixes

check the format of the index of each attachment (b559f05)

4.2.0 (2022-04-17)

Features

allow the usage of custom replacer and reviver (#112) (b08bc1a)

4.1.2 (2022-02-17)

Bug Fixes

... (truncated)

Commits

cd11e38 chore(release): 3.3.3
fb21e42 fix: check the format of the index of each attachment
See full diff in compare view

Updates xml2js from 0.4.23 to 0.5.0

Commits

See full diff in compare view

Updates word-wrap from 1.2.3 to 1.2.5

Release notes

Sourced from word-wrap's releases.

1.2.5

Changes:

Reverts default value for options.indent to two spaces ' ...
Description has been truncated

… updates Bumps the npm_and_yarn group with 2 updates in the /docs directory: [ejs](https://github.com/mde/ejs) and [node-fetch](https://github.com/node-fetch/node-fetch). Bumps the npm_and_yarn group with 5 updates in the /web directory: | Package | From | To | | --- | --- | --- | | [ejs](https://github.com/mde/ejs) | `3.1.9` | `3.1.10` | | [nanoid](https://github.com/ai/nanoid) | `3.3.7` | `5.0.7` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.0.12` | `5.0.13` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.24.1` | `7.24.5` | | [express](https://github.com/expressjs/express) | `4.18.2` | `4.19.2` | Bumps the npm_and_yarn group with 8 updates in the /web/libs/editor/tests/e2e directory: | Package | From | To | | --- | --- | --- | | [semver](https://github.com/npm/node-semver) | `5.7.1` | `5.7.2` | | [nanoid](https://github.com/ai/nanoid) | `3.1.30` | `3.3.7` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.18.2` | `7.24.5` | | [@sideway/formula](https://github.com/sideway/formula) | `3.0.0` | `3.0.1` | | [ip](https://github.com/indutny/node-ip) | `1.1.5` | `1.1.9` | | [socket.io-parser](https://github.com/socketio/socket.io-parser) | `3.3.2` | `3.3.3` | | [xml2js](https://github.com/Leonidas-from-XIV/node-xml2js) | `0.4.23` | `0.5.0` | | [word-wrap](https://github.com/jonschlinkert/word-wrap) | `1.2.3` | `1.2.5` | Updates `ejs` from 3.1.9 to 3.1.10 - [Release notes](https://github.com/mde/ejs/releases) - [Commits](mde/ejs@v3.1.9...v3.1.10) Updates `follow-redirects` from 1.15.5 to 1.15.6 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.5...v1.15.6) Updates `node-fetch` from 2.6.12 to 2.7.0 - [Release notes](https://github.com/node-fetch/node-fetch/releases) - [Commits](node-fetch/node-fetch@v2.6.12...v2.7.0) Updates `ejs` from 3.1.9 to 3.1.10 - [Release notes](https://github.com/mde/ejs/releases) - [Commits](mde/ejs@v3.1.9...v3.1.10) Updates `follow-redirects` from 1.15.5 to 1.15.6 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.5...v1.15.6) Updates `nanoid` from 3.3.7 to 5.0.7 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.7...5.0.7) Updates `vite` from 5.0.12 to 5.0.13 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.0.13/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.0.13/packages/vite) Updates `@babel/traverse` from 7.24.1 to 7.24.5 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.24.5/packages/babel-traverse) Updates `express` from 4.18.2 to 4.19.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.18.2...4.19.2) Updates `semver` from 5.7.1 to 5.7.2 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md) - [Commits](npm/node-semver@v5.7.1...v5.7.2) Updates `nanoid` from 3.1.30 to 3.3.7 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.7...5.0.7) Updates `@babel/traverse` from 7.18.2 to 7.24.5 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.24.5/packages/babel-traverse) Updates `@sideway/formula` from 3.0.0 to 3.0.1 - [Commits](hapijs/formula@v3.0.0...v3.0.1) Updates `ip` from 1.1.5 to 1.1.9 - [Commits](indutny/node-ip@v1.1.5...v1.1.9) Updates `socket.io-parser` from 3.3.2 to 3.3.3 - [Release notes](https://github.com/socketio/socket.io-parser/releases) - [Changelog](https://github.com/socketio/socket.io-parser/blob/main/CHANGELOG.md) - [Commits](socketio/socket.io-parser@3.3.2...3.3.3) Updates `xml2js` from 0.4.23 to 0.5.0 - [Commits](https://github.com/Leonidas-from-XIV/node-xml2js/commits/0.5.0) Updates `word-wrap` from 1.2.3 to 1.2.5 - [Release notes](https://github.com/jonschlinkert/word-wrap/releases) - [Commits](jonschlinkert/word-wrap@1.2.3...1.2.5) --- updated-dependencies: - dependency-name: ejs dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-fetch dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ejs dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: semver dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@sideway/formula" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ip dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: socket.io-parser dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: xml2js dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: word-wrap dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dryrunsecurity · 2024-05-06T00:50:45Z

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Configured Codepaths Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings
AppSec Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
Sensitive Files Analyzer	❕	1 finding

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖.
Note that this summary is auto-generated and not meant to be a definitive list of security issues
but rather a helpful summary from a security perspective.

Summary:

The changes in this pull request primarily focus on updating various dependencies across different files in the project. The most notable change is the update to the nanoid library, which is a small, secure, URL-friendly, unique string ID generator for JavaScript. Updating this library to a newer version may include security fixes or improvements to the ID generation algorithm, which could help mitigate potential security risks related to the generation of unique identifiers.

The other dependency updates, such as the vite, xml2js, and ejs libraries, are generally not concerning from a security perspective. These are minor version updates that likely contain bug fixes and improvements rather than significant changes to the libraries' functionality. However, it's always important to review the release notes and change logs to ensure that any known security issues have been resolved.

Overall, the changes in this pull request do not appear to introduce any major security concerns. It's a good practice to keep dependencies up-to-date to ensure the project benefits from the latest security fixes and improvements. Additionally, it's recommended to monitor the project's dependencies for any future updates and to keep an eye on the security advisories for the libraries used in the project.

Files Changed:

web/package.json: The nanoid library is updated from version 3.3.0 to 5.0.7, which could potentially improve the security of unique identifier generation in the application. The vite library is also updated from version 5.0.12 to 5.0.13, which is a minor version change.
web/libs/editor/tests/e2e/package.json: The xml2js library is updated from version 0.4.23 to 0.5.0, which is a minor version update.
docs/yarn.lock: The ejs package is updated from version 3.1.9 to 3.1.10, which is also a minor version update.
web/libs/editor/tests/e2e/yarn.lock: Several new dependencies related to the Babel JavaScript compiler are added, and some existing dependencies are updated.

Powered by DryRun Security

dependabot bot added the dependencies Pull requests that update a dependency file label May 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 3 directories with 13 updates #1

chore(deps): bump the npm_and_yarn group across 3 directories with 13 updates #1

dependabot bot commented on behalf of github May 6, 2024

dryrunsecurity bot commented May 6, 2024 •

edited

Loading

chore(deps): bump the npm_and_yarn group across 3 directories with 13 updates #1

Are you sure you want to change the base?

chore(deps): bump the npm_and_yarn group across 3 directories with 13 updates #1

Conversation

dependabot bot commented on behalf of github May 6, 2024

v3.1.10

v2.7.0

2.7.0 (2023-08-23)

Features

v2.6.13

2.6.13 (2023-08-18)

Bug Fixes

v3.1.10

5.0.7

5.0.6

5.0.7

5.0.6

5.0.5

5.0.4

5.0.3

5.0.2

5.0.1

5.0

4.0.2

4.0.1

4.0

5.0.13 (2024-03-24)

v7.24.5 (2024-04-29)

🐛 Bug Fix

💅 Polish

🏠 Internal

🏃‍♀️ Performance

Committers: 6

v7.24.4 (2024-04-03)

👓 Spec Compliance

v7.24.5 (2024-04-29)

🐛 Bug Fix

💅 Polish

🏠 Internal

🏃‍♀️ Performance

v7.24.4 (2024-04-03)

👓 Spec Compliance

🐛 Bug Fix

4.19.2

What's Changed

4.19.1

What's Changed

4.19.0

What's Changed

New Contributors

4.18.3

Main Changes

Other Changes

4.19.2 / 2024-03-25

4.19.1 / 2024-03-20

4.19.0 / 2024-03-20

4.18.3 / 2024-02-29

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

5.7.2 (2023-07-10)

Bug Fixes

5.7

5.6

5.5

5.4

5.3

5.2

5.1

5.0

5.0.7

5.0.6

5.0.7

5.0.6

5.0.5

5.0.4

5.0.3

5.0.2

5.0.1

5.0

dryrunsecurity bot commented May 6, 2024 •

edited

Loading