Skip to content

chore(deps): bump the npm_and_yarn group across 3 directories with 15 updates #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

chore(deps): bump the npm_and_yarn group across 3 directories with 15 updates #8

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Jun 19, 2024

Bumps the npm_and_yarn group with 3 updates in the /docs directory: ejs, node-fetch and ws.
Bumps the npm_and_yarn group with 7 updates in the /web directory:

Package From To
ejs 3.1.9 3.1.10
nanoid 3.3.7 5.0.7
vite 5.0.12 5.0.13
@babel/traverse 7.24.1 7.24.7
engine.io 3.6.1 3.6.2
express 4.18.2 4.19.2
socket.io 2.5.0 2.5.1

Bumps the npm_and_yarn group with 8 updates in the /web/libs/editor/tests/e2e directory:

Package From To
semver 5.7.1 5.7.2
nanoid 3.1.30 3.3.7
@babel/traverse 7.18.2 7.24.7
@sideway/formula 3.0.0 3.0.1
socket.io-parser 3.3.2 3.3.3
socket.io 2.4.1 2.5.1
xml2js 0.4.23 0.5.0
word-wrap 1.2.3 1.2.5

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits

Updates follow-redirects from 1.15.5 to 1.15.6

Commits

Updates node-fetch from 2.6.12 to 2.7.0

Release notes

Sourced from node-fetch's releases.

v2.7.0

2.7.0 (2023-08-23)

Features

v2.6.13

2.6.13 (2023-08-18)

Bug Fixes

Commits

Updates ws from 8.13.0 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

  • Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

  1. Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits
  • 3c56601 [dist] 8.17.1
  • e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 6a00029 [test] Increase code coverage
  • ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
  • b73b118 [dist] 8.17.0
  • 29694a5 [test] Use the highWaterMark variable
  • 934c9d6 [ci] Test on node 22
  • 1817bac [ci] Do not test on node 21
  • 96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
  • e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
  • Additional commits viewable in compare view

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits

Updates follow-redirects from 1.15.5 to 1.15.6

Commits

Updates nanoid from 3.3.7 to 5.0.7

Release notes

Sourced from nanoid's releases.

5.0.7

5.0.6

  • Fixed React Native support.
Changelog

Sourced from nanoid's changelog.

5.0.7

5.0.6

  • Fixed React Native support.

5.0.5

  • Make browser’s version faster by increasing size a little (by Samuel Elgozi).

5.0.4

5.0.3

  • Fixed CLI docs (by Chris Schmich).

5.0.2

  • Fixed webcrypto import (by Divyansh Singh).

5.0.1

  • Fixed Node.js 18 support.

5.0

  • Moved Node.js version to Web Crypto API.
  • Removed async API since Web Crypto API has only sync version.
  • Removed Node.js 14 and 16 support.

4.0.2

  • Added link to Github Sponsors.

4.0.1

4.0

  • Removed CommonJS support. Nano ID 4 will work only with ESM applications. We will support 3.x branch with CommonJS for users who can’t migrate to ESM.
  • Removed Node.js 10 and Node.js 12 support.
  • Reduced npm package size.
Commits

Updates vite from 5.0.12 to 5.0.13

Changelog

Sourced from vite's changelog.

5.0.13 (2024-03-24)

Commits

Updates @babel/traverse from 7.24.1 to 7.24.7

Release notes

Sourced from @​babel/traverse's releases.

v7.24.7 (2024-06-05)

🐛 Bug Fix

🏠 Internal

  • babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

Committers: 7

v7.24.6 (2024-05-24)

Thanks @​amjed-98, @​blakewilson, @​coelhucas, and @​SukkaW for your first PRs!

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
    • #16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
  • babel-parser, babel-plugin-transform-typescript

🏠 Internal

  • babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-helpers
  • babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-parser, babel-traverse
  • Other

... (truncated)

Changelog

Sourced from @​babel/traverse's changelog.

v7.24.7 (2024-06-05)

🐛 Bug Fix

🏠 Internal

  • babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

v7.24.6 (2024-05-24)

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
    • #16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
  • babel-parser, babel-plugin-transform-typescript

🏠 Internal

  • babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-helpers
  • babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-parser, babel-traverse
  • Other

v7.24.5 (2024-04-29)

🐛 Bug Fix

  • babel-plugin-transform-classes, babel-traverse
  • babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3

💅 Polish

  • babel-parser

... (truncated)

Commits

Updates engine.io from 3.6.1 to 3.6.2

Release notes

Sourced from engine.io's releases.

3.6.2

This release contains a bump of the ws dependency, which includes an important security fix.

Advisory: GHSA-3h5v-q93c-6h6q

Links

Changelog

Sourced from engine.io's changelog.

3.6.2 (2024-06-18)

This release contains a bump of the ws dependency, which includes an important security fix.

Advisory: GHSA-3h5v-q93c-6h6q

Dependencies

6.5.4 (2023-11-09)

This release contains some minor changes which should improve the memory usage of the server, notably this.

Dependencies

6.5.3 (2023-10-06)

Bug Fixes

  • improve compatibility with node16 module resolution (#689) (c6bf8c0)
  • webtransport: properly handle abruptly closed connections (ff1c861)

Dependencies

6.5.2 (2023-08-01)

Bug Fixes

  • webtransport: add proper framing (a306db0)

Dependencies

... (truncated)

Commits

Updates express from 4.18.2 to 4.19.2

Release notes

Sourced from express's releases.

4.19.2

What's Changed

Full Changelog: expressjs/express@4.19.1...4.19.2

4.19.1

What's Changed

Full Changelog: expressjs/express@4.19.0...4.19.1

4.19.0

What's Changed

New Contributors

Full Changelog: expressjs/express@4.18.3...4.19.0

4.18.3

Main Changes

Other Changes

... (truncated)

Changelog

Sourced from express's changelog.

4.19.2 / 2024-03-25

  • Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

  • Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

4.18.3 / 2024-02-29

Commits
  • 04bc627 4.19.2
  • da4d763 Improved fix for open redirect allow list bypass
  • 4f0f6cc 4.19.1
  • a003cfa Allow passing non-strings to res.location with new encoding handling checks f...
  • a1fa90f fixed un-edited version in history.md for 4.19.0
  • 11f2b1d build: fix build due to inconsistent supertest behavior in older versions
  • 084e365 4.19.0
  • 0867302 Prevent open redirect allow list bypass due to encodeurl
  • 567c9c6 Add note on how to update docs for new release (#5541)
  • 69a4cf2 deps: [email protected]
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.


Updates socket.io from 2.5.0 to 2.5.1

Release notes

Sourced from socket.io's releases.

2.5.1

Bug Fixes

  • add a noop handler for the error event (d30630b)

Links:

Changelog

Sourced from socket.io's changelog.

2.5.1 (2024-06-19)

Bug Fixes

  • add a noop handler for the error event (d30630b)
Commits

Updates semver from 5.7.1 to 5.7.2

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

5.7

  • Add minVersion method

5.6

  • Move boolean loose param to an options object, with backwards-compatibility protection.
  • Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

  • Add version coercion capabilities

5.4

  • Add intersection checking

5.3

  • Add minSatisfying method

5.2

  • Add prerelease(v) that returns prerelease components

5.1

  • Add Backus-Naur for ranges
  • Remove excessively cute inspection methods

5.0

  • Remove AMD/Browserified build artifacts
  • Fix ltr and gtr when using the * range
  • Fix for range * with a prerelease identifier
Commits
Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.


Updates nanoid from 3.1.30 to 3.3.7

Release notes

Sourced from nanoid's releases.

5.0.7

5.0.6

  • Fixed React Native support.
Changelog

Sourced from nanoid's changelog.

5.0.7

5.0.6

  • Fixed React Native support.

5.0.5

  • Make browser’s version faster by increasing size a little (by Samuel Elgozi).

5.0.4

5.0.3

  • Fixed CLI docs (by Chris Schmich).

5.0.2

  • Fixed webcrypto import (by Divyansh Singh).

5.0.1

  • Fixed Node.js 18 support.

5.0

  • Moved Node.js version to Web Crypto API.
  • Removed async API since Web Crypto API has only sync version.
  • Removed Node.js 14 and 16 support.

4.0.2

  • Added link to Github Sponsors.

4.0.1

4.0

  • Removed CommonJS support. Nano ID 4 will work only with ESM applications. We will support 3.x branch with CommonJS for users who can’t migrate to ESM.
  • Removed Node.js 10 and Node.js 12 support.
  • Reduced npm package size.
Commits

Updates @babel/traverse from 7.18.2 to 7.24.7

Release notes

Sourced from @​babel/traverse's releases.

v7.24.7 (2024-06-05)

🐛 Bug Fix

🏠 Internal

  • babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

Committers: 7

v7.24.6 (2024-05-24)

Thanks @​amjed-98, @​blakewilson, @​coelhucas, and @​SukkaW for your first PRs!

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
    • #16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
  • babel-parser, babel-plugin-transform-typescript

🏠 Internal

  • babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-helpers
  • babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-parser, babel-traverse
  • Other

... (truncated)

Changelog

Sourced from @​babel/traverse's changelog.

v7.24.7 (2024-06-05)

🐛 Bug Fix

🏠 Internal

  • babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

v7.24.6 (2024-05-24)

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
    • #16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
  • babel-parser, babel-plugin-transform-typescript

🏠 Internal

  • babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
    • #16501 Generate helper metadata at build tim...

      Description has been truncated

@dependabot
chore(deps): bump the npm_and_yarn group across 3 directories with 15…
c0abd43 
… updates

Bumps the npm_and_yarn group with 3 updates in the /docs directory: [ejs](https://github.com/mde/ejs), [node-fetch](https://github.com/node-fetch/node-fetch) and [ws](https://github.com/websockets/ws).
Bumps the npm_and_yarn group with 7 updates in the /web directory:

| Package | From | To |
| --- | --- | --- |
| [ejs](https://github.com/mde/ejs) | `3.1.9` | `3.1.10` |
| [nanoid](https://github.com/ai/nanoid) | `3.3.7` | `5.0.7` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.0.12` | `5.0.13` |
| [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.24.1` | `7.24.7` |
| [engine.io](https://github.com/socketio/engine.io) | `3.6.1` | `3.6.2` |
| [express](https://github.com/expressjs/express) | `4.18.2` | `4.19.2` |
| [socket.io](https://github.com/socketio/socket.io) | `2.5.0` | `2.5.1` |

Bumps the npm_and_yarn group with 8 updates in the /web/libs/editor/tests/e2e directory:

| Package | From | To |
| --- | --- | --- |
| [semver](https://github.com/npm/node-semver) | `5.7.1` | `5.7.2` |
| [nanoid](https://github.com/ai/nanoid) | `3.1.30` | `3.3.7` |
| [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.18.2` | `7.24.7` |
| [@sideway/formula](https://github.com/sideway/formula) | `3.0.0` | `3.0.1` |
| [socket.io-parser](https://github.com/socketio/socket.io-parser) | `3.3.2` | `3.3.3` |
| [socket.io](https://github.com/socketio/socket.io) | `2.4.1` | `2.5.1` |
| [xml2js](https://github.com/Leonidas-from-XIV/node-xml2js) | `0.4.23` | `0.5.0` |
| [word-wrap](https://github.com/jonschlinkert/word-wrap) | `1.2.3` | `1.2.5` |



Updates `ejs` from 3.1.9 to 3.1.10
- [Release notes](https://github.com/mde/ejs/releases)
- [Commits](mde/ejs@v3.1.9...v3.1.10)

Updates `follow-redirects` from 1.15.5 to 1.15.6
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.5...v1.15.6)

Updates `node-fetch` from 2.6.12 to 2.7.0
- [Release notes](https://github.com/node-fetch/node-fetch/releases)
- [Commits](node-fetch/node-fetch@v2.6.12...v2.7.0)

Updates `ws` from 8.13.0 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.13.0...8.17.1)

Updates `ejs` from 3.1.9 to 3.1.10
- [Release notes](https://github.com/mde/ejs/releases)
- [Commits](mde/ejs@v3.1.9...v3.1.10)

Updates `follow-redirects` from 1.15.5 to 1.15.6
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.5...v1.15.6)

Updates `nanoid` from 3.3.7 to 5.0.7
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.7...5.0.7)

Updates `vite` from 5.0.12 to 5.0.13
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.0.13/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.0.13/packages/vite)

Updates `@babel/traverse` from 7.24.1 to 7.24.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.24.7/packages/babel-traverse)

Updates `engine.io` from 3.6.1 to 3.6.2
- [Release notes](https://github.com/socketio/engine.io/releases)
- [Changelog](https://github.com/socketio/engine.io/blob/main/CHANGELOG.md)
- [Commits](socketio/engine.io@3.6.1...3.6.2)

Updates `express` from 4.18.2 to 4.19.2
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@4.18.2...4.19.2)

Updates `socket.io` from 2.5.0 to 2.5.1
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/2.5.1/CHANGELOG.md)
- [Commits](socketio/socket.io@2.5.0...2.5.1)

Updates `semver` from 5.7.1 to 5.7.2
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md)
- [Commits](npm/node-semver@v5.7.1...v5.7.2)

Updates `nanoid` from 3.1.30 to 3.3.7
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.7...5.0.7)

Updates `@babel/traverse` from 7.18.2 to 7.24.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.24.7/packages/babel-traverse)

Updates `@sideway/formula` from 3.0.0 to 3.0.1
- [Commits](hapijs/formula@v3.0.0...v3.0.1)

Updates `socket.io-parser` from 3.3.2 to 3.3.3
- [Release notes](https://github.com/socketio/socket.io-parser/releases)
- [Changelog](https://github.com/socketio/socket.io-parser/blob/main/CHANGELOG.md)
- [Commits](socketio/socket.io-parser@3.3.2...3.3.3)

Updates `socket.io` from 2.4.1 to 2.5.1
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/2.5.1/CHANGELOG.md)
- [Commits](socketio/socket.io@2.5.0...2.5.1)

Updates `xml2js` from 0.4.23 to 0.5.0
- [Commits](https://github.com/Leonidas-from-XIV/node-xml2js/commits/0.5.0)

Updates `word-wrap` from 1.2.3 to 1.2.5
- [Release notes](https://github.com/jonschlinkert/word-wrap/releases)
- [Commits](jonschlinkert/word-wrap@1.2.3...1.2.5)

---
updated-dependencies:
- dependency-name: ejs
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-fetch
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ejs
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@babel/traverse"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: engine.io
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: socket.io
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: semver
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: nanoid
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/traverse"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@sideway/formula"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: socket.io-parser
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: socket.io
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: xml2js
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: word-wrap
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 19, 2024
@dryrunsecurity DryRunSecurity
Copy link

dryrunsecurity bot commented Jun 19, 2024 •
edited
Loading

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security Status Findings
Configured Codepaths Analyzer ✅ 0 findings
IDOR Analyzer ✅ 0 findings
Secrets Analyzer ✅ 0 findings
SQL Injection Analyzer ✅ 0 findings
Authn/Authz Analyzer ✅ 0 findings
Sensitive Files Analyzer ❕ 1 finding
Server-Side Request Forgery Analyzer ✅ 0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The changes in this pull request primarily involve updating dependencies across various files in the project. The updates include the xml2js library, the nanoid library, the vite development tool, the ejs package, the socket.io library, and the playwright library. While these are generally routine dependency updates, it's important to review them carefully to ensure that there are no known security vulnerabilities or compatibility issues introduced by the changes.

The application security engineer should review the release notes and changelogs for the updated dependencies, check for any security-related improvements or fixes, and ensure that the new versions are compatible with the rest of the project's dependencies. Additionally, thorough regression testing should be performed to identify any unexpected behavior or regressions that could impact the application's security or functionality.

Files Changed:

  1. web/libs/editor/tests/e2e/package.json: The xml2js dependency has been updated from version 0.4.23 to 0.5.0. This is a minor version update that is generally low-risk, but the release notes should be reviewed to ensure there are no security-related changes.

  2. web/package.json: The nanoid library has been updated from version 3.3.0 to 5.0.7, and the vite development tool has been updated from version 5.0.12 to 5.0.13. These updates should be reviewed for any security-related improvements or fixes.

  3. docs/yarn.lock: The ejs package has been updated from version 3.1.9 to 3.1.10. This is a minor version update that is likely to include bug fixes and improvements, but it should still be reviewed for any security-related changes.

  4. web/libs/editor/tests/e2e/yarn.lock: The socket.io dependency has been updated to version 2.5.1, and the playwright dependency has been updated to version 1.17.1. Various other dependencies have also been updated to their latest versions. These updates should be reviewed for any known security vulnerabilities or compatibility issues.

Powered by DryRun Security

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants