[Snyk] Upgrade: lint-staged, prettier, prettier-plugin-solidity

[BitcoinOutput]

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

lint-staged
from 12.3.7 to 12.5.0 | 6 versions ahead of your current version | 2 years ago
on 2022-05-31
prettier
from 2.6.2 to 2.8.8 | 11 versions ahead of your current version | a year ago
on 2023-04-23
prettier-plugin-solidity
from 1.0.0-beta.19 to 1.4.1 | 18 versions ahead of your current version | a month ago
on 2024-08-18

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Uncontrolled resource consumption SNYK-JS-BRACES-6838727	696	Proof of Concept
	Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	696	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	696	Proof of Concept

Release notes

Package name: lint-staged

• 12.5.0 - 2022-05-31
  

  12.5.0 (2022-05-31)

  Bug Fixes

  • include all files when using --config <path> (641d1c2)
  • skip backup stash when using the --diff option (d4da24d)

  Features

  • add --diff-filter option for overriding list of (staged) files (753ef72)
  • add --diff option for overriding list of (staged) files (35fcce9)
• 12.4.3 - 2022-05-30
  

  12.4.3 (2022-05-30)

  Bug Fixes

  • deps: downgrade [email protected] to support Node.js 12 (383a96e)
  • deps: update commander@^9.2.0 (22ebf52)
  • deps: update yaml@^2.0.1 (ec73af0)
• 12.4.2 - 2022-05-24
  

  12.4.2 (2022-05-24)

  Bug Fixes

  • correctly handle --max-arg-length cli option (1db5f26)
• 12.4.1 - 2022-04-26
  

  12.4.1 (2022-04-26)

  Bug Fixes

  • correctly handle symlinked config files (b3f63ec)
• 12.4.0 - 2022-04-20
  

  12.4.0 (2022-04-20)

  Bug Fixes

  • handle empty input by returning empty array from parseGitZOutput (a118817)
  • limit configuration discovery to cwd (d8fdf1d)
  • restore functionality of parent globs for a single configuration file (877ab4c)

  Features

  • expose --max-arg-length cli option (e8291b0)
• 12.3.8 - 2022-04-15
  

  12.3.8 (2022-04-15)

  Bug Fixes

  • avoid passing unexpected arguments from forEach to process.kill() (1b1f0e4)
  • clear execution interruption interval on first catch (46952cb)
• 12.3.7 - 2022-03-17
  

  12.3.7 (2022-03-17)

  Bug Fixes

  • improve renderer logic for --silent and FORCE_COLOR settings (d327873)

from lint-staged GitHub release notes

Package name: prettier

• 2.8.8 - 2023-04-23
• 2.8.7 - 2023-03-24
• 2.8.6 - 2023-03-21
• 2.8.5 - 2023-03-20
• 2.8.4 - 2023-02-08
• 2.8.3 - 2023-01-14
• 2.8.2 - 2023-01-07
• 2.8.1 - 2022-12-07
• 2.8.0 - 2022-11-23
• 2.7.1 - 2022-06-16
• 2.7.0 - 2022-06-14
• 2.6.2 - 2022-04-02

from prettier GitHub release notes

Package name: prettier-plugin-solidity

• 1.4.1 - 2024-08-18
  

  @ pcaversaccio let us know that one of our formatting decisions was formatting an expected result so this was quickly reverted to the previous standard.

  // Input
  contract Comments {
  function ifElse() public {
  if (condition) {
  // ...
  } // Reason for else case
  else {
  // ...
  }
  }
  }

  // v1.4.0
  contract Comments {
  function ifElse() public {
  if (condition) {
  // ...
  } else {
  // Reason for else case
  // ...
  }
  }
  }

  // v1.4.1
  contract Comments {
  function ifElse() public {
  if (condition) {
  // ...
  } // Reason for else case
  else {
  // ...
  }
  }
  }

  
  


• 
  1.4.0 - 2024-08-16
  

  As we are preparing for a version 2.0.0 of this plugin there were a few tweaks in the formatting that we needed to address before proceeding forward.

  Empty assembly blocks

  // Input
  contract Assembly {
  function assemblyEmptyBlocks() public {
  assembly {}
  assembly {
  for {} lt(x, y) {} {}
  }
  }
  }

  // v1.3.1
  contract Assembly {
  function assemblyEmptyBlocks() public {
  assembly {

      }
      <span class="pl-k">assembly</span> {
          <span class="pl-k">for</span> {
  
          } <span class="pl-en">lt</span>(x, y) {
  
          } {
  
          }
      }
  }
  

  }

  // v1.4.0
  contract Assembly {
  function assemblyEmptyBlocks() public {
  assembly {}
  assembly {
  for {} lt(x, y) {} {}
  }
  }
  }

  Assembly stack assignments

  In versions of Solidity prior to v0.5.0 there was a syntax called stack assignment where the last value of the stack would be allocated to a variable. This statement is independent of what happens before it but in some cases the developer could write it in the same line as the last statement.
  So far we have been formatting this in the same line as the previous statement but since in v2.0.0 we will have access to an AST much closer to the actual grammar of solidity, it makes more sense to keep it in a separate statement.

  // Input
  contract Assembly {
  function stackAssignment() public {
  assembly {
  4 =: y
  }
  }
  }

  // v1.3.1
  contract Assembly {
  function assemblyEmptyBlocks() public {
  assembly {
  4 =: y
  }
  }
  }

  // v1.4.0
  contract Assembly {
  function assemblyEmptyBlocks() public {
  assembly {
  4
  =: y
  }
  }
  }

  HexLiterals in multiple lines

  Solidity allows to declare long HexLiterals as a list of HexLiterals separated by white space. The only reason for using this feature is to display said HexLiteral in multiple lines.

  // Input
  contract HexLiteral {
  bytes8 hex1 = hex'Dead' hex'Beef';
  }

  // v1.3.1
  contract Assembly {
  bytes8 hex1 = hex'Dead' hex'Beef';
  }

  // v1.4.0
  contract Assembly {
  bytes8 hex1 =
  hex'Dead'
  hex'Beef';
  }

  Modifier Definitions and Function TypeNames

  These 2 cases should format in the same way a function definition does but they remained with separate behaviours.

  // Input
  contract ModifierDefinitions {
  modifier long() override(Foo , Bar, Baz, Very, VeryVery, VeryLong, OverrideList) { ; }
  modifier threeParams(uint a, uint b, uint c) {}
  }

  // v1.3.1
  contract ModifierDefinitions {
  modifier long()
  override(
  Foo,
  Bar,
  Baz,
  Very,
  VeryVery,
  VeryLong,
  OverrideList
  ) {
  _;
  }
  modifier threeParams(
  uint a,
  uint b,
  uint c
  ) {}
  }

  // v1.4.0
  contract ModifierDefinitions {
  modifier long()
  override(
  Foo,
  Bar,
  Baz,
  Very,
  VeryVery,
  VeryLong,
  OverrideList
  )
  {
  _;
  }
  modifier threeParams(uint a, uint b, uint c) {}
  }

  // Input
  contract FunctionTypeNames {
  struct StructWithFunctionTypes {
  function(bytes32, bytes32, bytes32, bytes32, bytes32, bytes32) internal view[] d;
  }
  }

  // v1.3.1
  contract FunctionTypeNames {
  struct StructWithFunctionTypes {
  function(bytes32, bytes32, bytes32, bytes32, bytes32, bytes32)
  internal
  view[] d;
  }
  }

  // v1.4.0
  contract FunctionTypeNames {
  struct StructWithFunctionTypes {
  function(
  bytes32,
  bytes32,
  bytes32,
  bytes32,
  bytes32,
  bytes32
  ) internal view[] d;
  }
  }

  There are no comments for the else keyword

  As we moved into v2.0.0 we got to review many of the formatting prettier inspired us that were in the backlog.
  This particular decision had already been changed prettier and we base our work on old code released by prettier. @ pcaversaccio very diligently let us notice that this could not be reproduced in prettier, therefore it was quickly reverted in v1.4.1

  // Input
  contract Comments {
  function ifElse() public {
  if (condition) {
  // ...
  } // Reason for else case
  else {
  // ...
  }
  }
  }

  // v1.3.1
  contract Comments {
  function ifElse() public {
  if (condition) {
  // ...
  } // Reason for else case
  else {
  // ...
  }
  }
  }

  // v1.4.0
  contract Comments {
  function ifElse() public {
  if (condition) {
  // ...
  } else {
  // Reason for else case
  // ...
  }
  }
  }

  
  


• 
  1.3.1 - 2023-12-24
  

  Needed to put a specific experimentalTernaries behaviour behind a feature flag. (thanks @ pcaversaccio)

  
  


• 
  1.3.0 - 2023-12-22
  

  This version ships with 2 substantial changes.

  1. The parser had a great improvement in size package making our bundled size go from 773.5 KB to 417 KB and 90 KB gzipped, making our support for browser more impactful. (#967)
  2. We embraced prettier's ternaries formatting improvements and support the new option externalTernaries, so we invite people to start experimenting with it and give us some feedback. (#953)
• 1.2.0 - 2023-11-09
  

  A few improvements on this release:

  • Dropped support for node 14 (#887)
  • Migrated the whole codebase to ESM (#894)
    • The bundled version now has the .cjs extension
  • Improved the bundled file to better support projects targeting browsers (#943 thanks to @ folego and electric_gary on Telegram)
    • Projects can easily import from prettier-plugin-solidity/standalone
  • Added support for negative e notation 1000e-2 (solidity-parser/parser#95)
  • Full support of file level event definitions, introduced with solidity 0.8.22 (solidity-parser/parser#97)

  A few tweaks in the code and refactor for simplicity and efficiency.

• 1.1.4-dev - 2023-11-06
• 1.1.3 - 2023-03-01
  

  This version adds support for user-defined operators, a feature introduced in Solidity 0.8.19.

• 1.1.2 - 2023-02-06
  

  This version adds support for named parameters in mappings, introduced in Solidity 0.8.18. This means you can add names to your mappings parameters:

  mapping(address account => uint balance) balanceOf; 

  and Prettier Solidity will format it correctly.

  Thanks to @ zemse for working on this!

• 1.1.1 - 2022-12-29
  

  With this version we started supporting prettier V3 which at the moment it's in their 3.0.0-alpha.4 version. (#757)

  Some internal tweaks and removed some dependencies that were no longer used. (thanks to @ frangio for noticing #780)

• 1.1.0 - 2022-12-13
  

  With this version, we are releasing a standalone build (#727).
  It follows the same patterns Prettier uses for their internal plugins such as UMD.
  Hopefully this will make integration for projects based on the browser easy and will be automatically shipped on each release to http://unpkg.com/prettier-plugin-solidity@latest.

  We also took care of a small bug that would print an extra line when formatting solidity code within a markdown code block (#765).

• 1.0.0 - 2022-11-17
  

  We are happy to release the first stable version of Prettier Solidity! 🎉 🎉

  What does this mean for you as a user? Semantic versioning doesn't make a lot of sense for a formatter, so it's hard to give hard rules about what will be the meaning of future versions. But we'll try to follow these guidelines:

  • We won't make big formatting changes within the same major version. For example, you shouldn't get all your function signatures changed just because you upgraded to, say, v1.1.0.
  • We won't remove any option within the same major version.
  • We'll use patch versions (e.g., moving from 1.2.3 to 1.2.4) for bug fixes and very minor formatting changes.
  • We'll use minor versions (e.g., moving from 1.2.3 to 1.3.0) for new language constructs, new options (if any) and somewhat bigger formatting changes.

  What separates a "very minor formatting change" from a "bigger one" is hard to define precisely, of course, so some of these decisions will be very subjective, but we'll try to do our best.

  Thanks for using our plugin and remember to star the repo! ⭐

• 1.0.0-rc.1 - 2022-11-02
• 1.0.0-dev.24 - 2022-10-19
• 1.0.0-dev.23 - 2022-07-15
• 1.0.0-dev.22 - 2022-07-11
• 1.0.0-dev.21 - 2022-02-10
• 1.0.0-beta.24 - 2022-08-06
• 1.0.0-beta.20 - 2022-02-10
• 1.0.0-beta.19 - 2021-11-11

from prettier-plugin-solidity GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs