Bump the npm_and_yarn group in /frontend with 7 updates #722

dependabot · 2024-12-23T10:56:50Z

Bumps the npm_and_yarn group in /frontend with 7 updates:

Package	From	To
jsonpath-plus	`8.1.0`	`10.0.7`
vite	`5.2.10`	`5.2.14`
cross-spawn	`7.0.3`	`7.0.6`
micromatch	`4.0.5`	`4.0.8`
nanoid	`3.3.7`	`3.3.8`
rollup	`4.16.1`	`4.29.1`
ws	`8.8.0`	`8.18.0`

Updates jsonpath-plus from 8.1.0 to 10.0.7

Changelog

Sourced from jsonpath-plus's changelog.

10.0.7

fix(security): prevent constructor access

docs: add security policy file

10.0.6

fix(security): prevent call/apply invocation of Function

10.0.5

fix: remove overly aggressive disabling of native functions but disallow __proto__

10.0.4

fix(security): further prevent binding of Function calls which may evade detection

10.0.3

fix(security): prevent binding of Function calls which may evade detection

10.0.2

fix(security): prevent Function calls outside of member expressions

10.0.1

fix(security): prohibit Function in "safe" vm

10.0.0

BREAKING CHANGES:

Require Node 18+

fix(security): use safe vm by default in Node

chore: bump jsep, devDeps. and lint

9.0.0

BREAKING CHANGES:

Removes preventEval property. Prefer eval: false instead.

Changed behavior of eval property. In the browser, eval/Function won't be used by default to evaluate expressions. Instead, we'll safely evaluate using a subset of JavaScript. To resume using unsafe eval in the browser, pass in the option eval: "native"

feat: add safe eval for browser and eval option (#185) (@80avin)

feat: add ignoreEvalErrors property (@80avin)

Commits

See full diff in compare view

Updates vite from 5.2.10 to 5.2.14

Release notes

Sourced from vite's releases.

v5.2.14

Please refer to CHANGELOG.md for details.

v5.2.13

Please refer to CHANGELOG.md for details.

v5.2.12

Please refer to CHANGELOG.md for details.

v5.2.11

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.2.14 (2024-09-16)

fix: avoid DOM Clobbering gadget in getRelativeUrlFromDocument (#18115) (ebb94c5), closes #18115

fix: fs raw query (#18112) (8339d74), closes #18112

5.2.13 (2024-06-07)

fix: backport to 5.2 (#17411) (e6913d1), closes #17411

5.2.12 (2024-05-28)

chore: move to eslint flat config (#16743) (8f16765), closes #16743

chore(deps): remove unused deps (#17329) (5a45745), closes #17329

chore(deps): update all non-major dependencies (#16722) (b45922a), closes #16722

fix: mention build.rollupOptions.output.manualChunks instead of build.rollupOutput.manualChunks (89378c0), closes #16721

fix(build): make SystemJSWrapRE match lazy (#16633) (6583ad2), closes #16633

fix(css): avoid generating empty JS files when JS files becomes empty but has CSS files imported (#1 (95fe5a7), closes #16078

fix(css): handle lightningcss compiled css in Deno (#17301) (8e4e932), closes #17301

fix(css): only use files the current bundle contains (#16684) (15a6ebb), closes #16684

fix(css): page reload was not happening with .css?raw (#16455) (8041846), closes #16455

fix(deps): update all non-major dependencies (#16603) (6711553), closes #16603

fix(deps): update all non-major dependencies (#16660) (bf2f014), closes #16660

fix(deps): update all non-major dependencies (#17321) (4a89766), closes #17321

fix(error-logging): rollup errors weren't displaying id and codeframe (#16540) (22dc196), closes #16540

fix(hmr): normalize the path info (#14255) (6a085d0), closes #14255

fix(hmr): trigger page reload when calling invalidate on root module (#16636) (2b61cc3), closes #16636

fix(logger): truncate log over 5000 characters long (#16581) (b0b839a), closes #16581

fix(optimizer): log dependencies added by plugins (#16729) (f0fb987), closes #16729

fix(sourcemap): improve sourcemap compatibility for vue2 (#16594) (913c040), closes #16594

docs: correct proxy shorthand example (#15938) (abf766e), closes #15938

docs: deprecate server.hot (#16741) (e7d38ab), closes #16741

5.2.11 (2024-05-02)

feat: improve dynamic import variable failure error message (#16519) (f8feeea), closes #16519

fix: dynamic-import-vars plugin normalize path issue (#16518) (f71ba5b), closes #16518

fix: scripts and styles were missing from built HTML on Windows (#16421) (0e93f58), closes #16421

fix(deps): update all non-major dependencies (#16488) (2d50be2), closes #16488

fix(deps): update all non-major dependencies (#16549) (2d6a13b), closes #16549

fix(dev): watch publicDir explicitly to include it outside the root (#16502) (4d83eb5), closes #16502

fix(preload): skip preload for non-static urls (#16556) (bb79c9b), closes #16556

fix(ssr): handle class declaration and expression name scoping (#16569) (c071eb3), closes #16569

fix(ssr): handle function expression name scoping (#16563) (02db947), closes #16563

Commits

673ae16 release: v5.2.14
ebb94c5 fix: avoid DOM Clobbering gadget in getRelativeUrlFromDocument (#18115)
8339d74 fix: fs raw query (#18112)
51bf7ea release: v5.2.13
e6913d1 fix: backport to 5.2 (#17411)
bed3faa release: v5.2.12
5a45745 chore(deps): remove unused deps (#17329)
15a6ebb fix(css): only use files the current bundle contains (#16684)
f0fb987 fix(optimizer): log dependencies added by plugins (#16729)
8f16765 chore: move to eslint flat config (#16743)
Additional commits viewable in compare view

Updates cross-spawn from 7.0.3 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

disable regexp backtracking (#160) (5ff3a07)

Commits

77cd97f chore(release): 7.0.6
6717de4 chore: upgrade standard-version
f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json
9a7e3b2 chore: fix build status badge
0852683 chore(release): 7.0.5
640d391 fix: fix escaping bug introduced by backtracking
bff0c87 chore: remove codecov
a7c6abc chore: replace travis with github workflows
9b9246e chore(release): 7.0.4
5ff3a07 fix: disable regexp backtracking (#160)
Additional commits viewable in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

this is basically v4.0.5, with some README updates

it is vulnerable to CVE-2024-4067

Updated braces to v3.0.3 to avoid CVE-2024-4068

does NOT break API compatibility

[4.0.6] - 2024-05-21

Added hasBraces to check if a pattern contains braces.

Fixes CVE-2024-4067

BREAKS API COMPATIBILITY

Should be labeled as a major release, but it's not.

Commits

8bd704e 4.0.8
a0e6841 run verb to generate README documentation
4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
814f5f7 lint
67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
113f2e3 fix: CVE numbers in CHANGELOG
d9dbd9a feat: updated CHANGELOG
2ab1315 fix: use actions/setup-node@v4
1406ea3 feat: rework test to work on macos with node 10,12 and 14
Additional commits viewable in compare view

Updates nanoid from 3.3.7 to 3.3.8

Changelog

Sourced from nanoid's changelog.

3.3.8

Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

Commits

3044cd5 Release 3.3.8 version
4fe3495 Update size limit
d643045 Fix pool pollution, infinite loop (#510)
See full diff in compare view

Updates rollup from 4.16.1 to 4.29.1

Release notes

Sourced from rollup's releases.

v4.29.1

4.29.1

2024-12-21

Bug Fixes

Fix crash from deoptimized logical expressions (#5771)

Pull Requests

#5769: Remove unnecessary lifetimes (@lukastaegert)

#5771: fix: do not optimize the literal value if the cache is deoptimized (@TrickyPi)

v4.29.0

4.29.0

2024-12-20

Features

Treat objects as truthy and always check second argument to better simplify logical expressions (#5763)

Pull Requests

#5759: docs: add utf-8 encoding to JSON file reading (@chouchouji)

#5760: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])

#5763: fix: introduce UnknownFalsyValue for enhancing if statement tree-shaking (@TrickyPi)

#5766: chore(deps): update dependency @rollup/plugin-node-resolve to v16 (@renovate[bot])

#5767: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])

v4.28.1

4.28.1

2024-12-06

Bug Fixes

Support running Rollup natively on LoongArch (#5749)

Add optional debugId to SourceMap types (#5751)

Pull Requests

#5749: feat: add support for LoongArch (@darkyzhou)

#5751: feat: Add debugId to SourceMap types (@timfish, @lukastaegert)

#5752: chore(deps): update dependency mocha to v11 (@renovate[bot])

#5753: chore(deps): update dependency vite to v6 (@renovate[bot])

#5754: fix(deps): update swc monorepo (major) (@renovate[bot])

#5755: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#5756: Test if saving the Cargo cache can speed up FreeBSD (@lukastaegert)

... (truncated)

Changelog

Sourced from rollup's changelog.

4.29.1

2024-12-21

Bug Fixes

Fix crash from deoptimized logical expressions (#5771)

Pull Requests

#5769: Remove unnecessary lifetimes (@lukastaegert)

#5771: fix: do not optimize the literal value if the cache is deoptimized (@TrickyPi)

4.29.0

2024-12-20

Features

Treat objects as truthy and always check second argument to better simplify logical expressions (#5763)

Pull Requests

#5759: docs: add utf-8 encoding to JSON file reading (@chouchouji)

#5760: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])

#5763: fix: introduce UnknownFalsyValue for enhancing if statement tree-shaking (@TrickyPi)

#5766: chore(deps): update dependency @rollup/plugin-node-resolve to v16 (@renovate[bot])

#5767: fix(deps): lock file maintenance minor/patch updates (@renovate[bot])

4.28.1

2024-12-06

Bug Fixes

Support running Rollup natively on LoongArch (#5749)

Add optional debugId to SourceMap types (#5751)

Pull Requests

#5749: feat: add support for LoongArch (@darkyzhou)

#5751: feat: Add debugId to SourceMap types (@timfish, @lukastaegert)

#5752: chore(deps): update dependency mocha to v11 (@renovate[bot])

#5753: chore(deps): update dependency vite to v6 (@renovate[bot])

#5754: fix(deps): update swc monorepo (major) (@renovate[bot])

#5755: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#5756: Test if saving the Cargo cache can speed up FreeBSD (@lukastaegert)

4.28.0

... (truncated)

Commits

5d37778 4.29.1
86e1f43 fix: do not optimize the literal value if the cache is deoptimized (#5771)
f116952 Remove unnecessary lifetimes (#5769)
dadd488 4.29.0
a4b78eb fix(deps): lock file maintenance minor/patch updates (#5767)
d52f00d fix: introduce UnknownFalsyValue for enhancing if statement tree-shaking (#5763)
65c8901 chore(deps): update dependency @rollup/plugin-node-resolve to v16 (#5766)
7a8ac46 docs: add utf-8 encoding to JSON file reading (#5759)
31f1670 fix(deps): lock file maintenance minor/patch updates (#5760)
e60fb1c 4.28.1
Additional commits viewable in compare view

Updates ws from 8.8.0 to 8.18.0

Release notes

Sourced from ws's releases.

8.18.0

Features

Added support for Blob (#2229).

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

... (truncated)

Commits

976c53c [dist] 8.18.0
59b9629 [feature] Add support for Blob (#2229)
0d1b5e6 [security] Use more descriptive text for 2017 vulnerability link
15f11a0 [security] Add new DoS vulnerability to SECURITY.md
3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group in /frontend with 7 updates: | Package | From | To | | --- | --- | --- | | [jsonpath-plus](https://github.com/s3u/JSONPath) | `8.1.0` | `10.0.7` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.2.10` | `5.2.14` | | [cross-spawn](https://github.com/moxystudio/node-cross-spawn) | `7.0.3` | `7.0.6` | | [micromatch](https://github.com/micromatch/micromatch) | `4.0.5` | `4.0.8` | | [nanoid](https://github.com/ai/nanoid) | `3.3.7` | `3.3.8` | | [rollup](https://github.com/rollup/rollup) | `4.16.1` | `4.29.1` | | [ws](https://github.com/websockets/ws) | `8.8.0` | `8.18.0` | Updates `jsonpath-plus` from 8.1.0 to 10.0.7 - [Release notes](https://github.com/s3u/JSONPath/releases) - [Changelog](https://github.com/JSONPath-Plus/JSONPath/blob/main/CHANGES.md) - [Commits](https://github.com/s3u/JSONPath/commits/v10.0.7) Updates `vite` from 5.2.10 to 5.2.14 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v5.2.14/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.2.14/packages/vite) Updates `cross-spawn` from 7.0.3 to 7.0.6 - [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md) - [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6) Updates `micromatch` from 4.0.5 to 4.0.8 - [Release notes](https://github.com/micromatch/micromatch/releases) - [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md) - [Commits](micromatch/micromatch@4.0.5...4.0.8) Updates `nanoid` from 3.3.7 to 3.3.8 - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.3.7...3.3.8) Updates `rollup` from 4.16.1 to 4.29.1 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v4.16.1...v4.29.1) Updates `ws` from 8.8.0 to 8.18.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.8.0...8.18.0) --- updated-dependencies: - dependency-name: jsonpath-plus dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: cross-spawn dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: micromatch dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: nanoid dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot requested a review from a team as a code owner December 23, 2024 10:56

dependabot bot added scope/frontend Related to frontend changes type/dependencies A pull request/issue dedicated to updating the dependency(-ies) labels Dec 23, 2024

kapybro bot added status/triage Issues pending maintainers triage status/triage/manual Manual triage in progress status/triage/completed Automatic triage completed and removed status/triage Issues pending maintainers triage labels Dec 23, 2024

Haarolean approved these changes Dec 23, 2024

View reviewed changes

Haarolean merged commit e44d16f into main Dec 23, 2024
36 of 38 checks passed

Haarolean deleted the dependabot/npm_and_yarn/frontend/npm_and_yarn-3ee1712370 branch December 23, 2024 12:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group in /frontend with 7 updates #722

Bump the npm_and_yarn group in /frontend with 7 updates #722

dependabot bot commented on behalf of github Dec 23, 2024

Bump the npm_and_yarn group in /frontend with 7 updates #722

Bump the npm_and_yarn group in /frontend with 7 updates #722

Conversation

dependabot bot commented on behalf of github Dec 23, 2024

10.0.7

10.0.6

10.0.5

10.0.4

10.0.3

10.0.2

10.0.1

10.0.0

9.0.0

v5.2.14

v5.2.13

v5.2.12

v5.2.11

5.2.14 (2024-09-16)

5.2.13 (2024-06-07)

5.2.12 (2024-05-28)

5.2.11 (2024-05-02)

7.0.6 (2024-11-18)

Bug Fixes

7.0.5 (2024-11-07)

Bug Fixes

7.0.4 (2024-11-07)

Bug Fixes

4.0.8

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

[4.0.6] - 2024-05-21

3.3.8

v4.29.1

4.29.1

Bug Fixes

Pull Requests

v4.29.0

4.29.0

Features

Pull Requests

v4.28.1

4.28.1

Bug Fixes

Pull Requests

4.29.1

Bug Fixes

Pull Requests

4.29.0

Features

Pull Requests

4.28.1

Bug Fixes

Pull Requests

4.28.0

8.18.0

Features

8.17.1

Bug fixes