Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump the npm_and_yarn group across 2 directories with 16 updates #6

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Jul 15, 2024

Bumps the npm_and_yarn group with 15 updates in the / directory:

Package From To
follow-redirects 1.9.0 1.15.6
async 3.1.0 3.2.2
socket.io 2.2.0 2.5.0
ws 3.3.3 5.2.4
@babel/traverse 7.6.0 7.24.8
ansi-regex 4.1.0 4.1.1
growl 1.9.2 removed
mocha 3.5.3 10.6.0
handlebars 4.2.0 4.7.8
minimist 0.0.8 1.2.8
mkdirp 0.5.1 0.5.6
node-fetch 2.6.0 2.7.0
socket.io-parser 3.3.0 3.3.3
y18n 4.0.0 4.0.3
yargs-parser 13.1.1 13.1.2

Bumps the npm_and_yarn group with 1 update in the /examples directory: socket.io.

Updates follow-redirects from 1.9.0 to 1.15.6

Commits
  • 35a517c Release version 1.15.6 of the npm package.
  • c4f847f Drop Proxy-Authorization across hosts.
  • 8526b4a Use GitHub for disclosure.
  • b1677ce Release version 1.15.5 of the npm package.
  • d8914f7 Preserve fragment in responseUrl.
  • 6585820 Release version 1.15.4 of the npm package.
  • 7a6567e Disallow bracketed hostnames.
  • 05629af Prefer native URL instead of deprecated url.parse.
  • 1cba8e8 Prefer native URL instead of legacy url.resolve.
  • 72bc2a4 Simplify _processResponse error handling.
  • Additional commits viewable in compare view

Updates async from 3.1.0 to 3.2.2

Changelog

Sourced from async's changelog.

v3.2.2

  • Fix potential prototype pollution exploit

v3.2.1

v3.2.0

  • Fix a bug in Safari related to overwriting func.name
  • Remove built-in browserify configuration (#1653)
  • Varios doc fixes (#1688, #1703, #1704)

v3.1.1

  • Allow redefining name property on wrapped functions.
Commits

Updates socket.io from 2.2.0 to 2.5.0

Release notes

Sourced from socket.io's releases.

2.5.0

⚠️ WARNING ⚠️

The default value of the maxHttpBufferSize option has been decreased from 100 MB to 1 MB, in order to prevent attacks by denial of service.

Security advisory: GHSA-j4f2-536g-r55m

Bug Fixes

  • fix race condition in dynamic namespaces (05e1278)
  • ignore packet received after disconnection (22d4bdf)
  • only set 'connected' to true after middleware execution (226cc16)
  • prevent the socket from joining a room after disconnection (f223178)

Links:

2.4.1

This release reverts the breaking change introduced in 2.4.0 (socketio/socket.io@f78a575).

If you are using Socket.IO v2, you should explicitly allow/disallow cross-origin requests:

  • without CORS (server and client are served from the same domain):
const io = require("socket.io")(httpServer, {
  allowRequest: (req, callback) => {
    callback(null, req.headers.origin === undefined); // cross-origin requests will not be allowed
  }
});
  • with CORS (server and client are served from distinct domains):
io.origins(["http://localhost:3000"]); // for local development
io.origins(["https://example.com"]);

In any case, please consider upgrading to Socket.IO v3, where this security issue is now fixed (CORS is disabled by default).

Reverts

  • fix(security): do not allow all origins by default (a169050)

Links:

... (truncated)

Changelog

Sourced from socket.io's changelog.

2.5.0 (2022-06-26)

Bug Fixes

  • fix race condition in dynamic namespaces (05e1278)
  • ignore packet received after disconnection (22d4bdf)
  • only set 'connected' to true after middleware execution (226cc16)
  • prevent the socket from joining a room after disconnection (f223178)

2.4.1 (2021-01-07)

Reverts

  • fix(security): do not allow all origins by default (a169050)

2.4.0 (2021-01-04)

Bug Fixes

  • security: do not allow all origins by default (f78a575)
  • properly overwrite the query sent in the handshake (d33a619)
Commits
  • baa6804 chore(release): 2.5.0
  • f223178 fix: prevent the socket from joining a room after disconnection
  • 226cc16 fix: only set 'connected' to true after middleware execution
  • 05e1278 fix: fix race condition in dynamic namespaces
  • 22d4bdf fix: ignore packet received after disconnection
  • dfded53 chore: update engine.io version to 3.6.0
  • e6b8697 chore(release): 2.4.1
  • a169050 revert: fix(security): do not allow all origins by default
  • 873fdc5 chore(release): 2.4.0
  • f78a575 fix(security): do not allow all origins by default
  • Additional commits viewable in compare view

Updates ws from 3.3.3 to 5.2.4

Release notes

Sourced from ws's releases.

5.2.4

Bug fixes

  • Backported e55e5106 to the 5.x release line (4abd8f6d).

5.2.3

Bug fixes

  • Backported 00c425ec to the 5.x release line (76d47c14).

5.2.2

Bug fixes

  • Fixed a use after invalidation bug introduced in 6046a28 (8aba871).

5.2.1

Bug fixes

  • Fixed a bug that could prevent buffered data from being processed under certain circumstances (6046a28).

5.2.0

Features

  • Added ability to specify custom headers when rejecting the handshake (#1379).

5.1.1

Bug fixes

  • Fixed a regression introduced in 9e152f9 (#1347).

5.1.0

Features

  • The address argument of the WebSocket constructor can now be a URL instance (#1329).
  • The options argument of the WebSocket constructor now accepts any TLS option that is also accepted by https.request() (#1332).

5.0.0

Breaking changes

  • Dropped support for Node.js < 4.5.0 (#1313).
  • The connection is no longer closed if the server does not agree to any of the client's requested subprotocols (#1312).
  • net.Socket errors are no longer re-emitted (a4050db).

... (truncated)

Commits
  • aa8fe0a [dist] 5.2.4
  • 4abd8f6 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 36a3f4d [lint] Add space before function parentheses
  • 6dd88e7 [dist] 5.2.3
  • 76d47c1 [security] Fix ReDoS vulnerability
  • 5d55e52 [dist] 5.2.2
  • 8aba871 [fix] Fix use after invalidation bug
  • 175ce46 [dist] 5.2.1
  • 307be7a [fix] Remove the 'data' listener when the receiver emits an error
  • 6046a28 [fix] Do not prematurely remove the listener of the 'data' event
  • Additional commits viewable in compare view

Updates @babel/traverse from 7.6.0 to 7.24.8

Release notes

Sourced from @​babel/traverse's releases.

v7.24.8 (2024-07-11)

Thanks @​H0onnn, @​jkup and @​SreeXD for your first pull requests!

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

Committers: 9

v7.24.7 (2024-06-05)

🐛 Bug Fix

🏠 Internal

  • babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

... (truncated)

Changelog

Sourced from @​babel/traverse's changelog.

v7.24.8 (2024-07-11)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

v7.24.7 (2024-06-05)

🐛 Bug Fix

🏠 Internal

  • babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

v7.24.6 (2024-05-24)

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
    • #16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
  • babel-parser, babel-plugin-transform-typescript

... (truncated)

Commits

Updates ansi-regex from 4.1.0 to 4.1.1

Commits

Removes growl

Updates mocha from 3.5.3 to 10.6.0

Release notes

Sourced from mocha's releases.

v10.6.0

What's Changed

Full Changelog: mochajs/mocha@v10.5.2...v10.6.0

v10.5.2

What's Changed

New Contributors

Full Changelog: mochajs/mocha@v10.5.1...v10.5.2

v10.5.1

What's Changed

New Contributors

Full Changelog: mochajs/mocha@v10.5.0...v10.5.1

v10.5.0

🎉 Enhancements

🐛 Fixes

🔩 Other

v10.4.0

10.4.0 / 2024-03-26

... (truncated)

Changelog

Sourced from mocha's changelog.

10.6.0 / 2024-07-02

🎉 Enhancements

10.5.2 / 2024-06-25

🐛 Fixes

10.5.1 / 2024-06-24

🐛 Fixes

  • #5086 fix: Add error handling for nonexistent file case with --file option (@​khoaHyh)

10.5.0 / 2024-06-24

🎉 Enhancements

🐛 Fixes

🔩 Other

10.4.0 / 2024-03-26

🎉 Enhancements

🐛 Fixes

... (truncated)

Commits
  • 177732f Release 10.6.0
  • 021aa80 docs: add 10.6.0 to CHANGELOG.md
  • 528836e docs: fix month numbers in CHANGELOG.md
  • bb8d7b9 feat: allow ^ versions for miscellaneous packages (#5154)
  • 514b83f feat: allow ^ versions for data serialization packages (#5153)
  • be82606 feat: allow ^ versions for file matching packages (#5151)
  • 71e9fba feat: allow ^ versions for yargs packages (#5152)
  • 38695da feat: allow ^ versions for character encoding packages (#5150)
  • b2a6358 Release 10.5.2
  • a3bb86d docs: add 10.5.2 to CHANGELOG.md
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by joshuakgoldberg, a new releaser for mocha since your current version.


Updates handlebars from 4.2.0 to 4.7.8

Release notes

Sourced from handlebars's releases.

v4.7.8

  • Make library compatible with workers (#1894) - 3d3796c
  • Don't rely on Node.js global object (#1776) - 2954e7e
  • Fix compiling of each block params in strict mode (#1855) - 30dbf04
  • Fix rollup warning when importing Handlebars as ESM - 03d387b
  • Fix bundler issue with webpack 5 (#1862) - c6c6bbb
  • Use https instead of git for mustache submodule - 88ac068

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.8 - July 27th, 2023

  • Make library compatible with workers (#1894) - 3d3796c
  • Don't rely on Node.js global object (#1776) - 2954e7e
  • Fix compiling of each block params in strict mode (#1855) - 30dbf04
  • Fix rollup warning when importing Handlebars as ESM - 03d387b
  • Fix bundler issue with webpack 5 (#1862) - c6c6bbb
  • Use https instead of git for mustache submodule - 88ac068

Commits

v4.7.7 - February 15th, 2021

  • fix weird error in integration tests - eb860c0
  • fix: check prototype property access in strict-mode (#1736) - b6d3de7
  • fix: escape property names in compat mode (#1736) - f058970
  • refactor: In spec tests, use expectTemplate over equals and shouldThrow (#1683) - 77825f8
  • chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

  • the changes from version 4.6.0 now also apply in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

v4.7.6 - April 3rd, 2020

Chore/Housekeeping:

Compatibility notes:

  • Restored Node.js compatibility

Commits

v4.7.5 - April 2nd, 2020

Chore/Housekeeping:

  • Node.js version support has been changed to v6+ Reverted in 4.7.6

Compatibility notes:

... (truncated)

Commits
  • 8dc3d25 v4.7.8
  • 668c4fb Fix browser tests in CI pipeline
  • c65c6cc Test on Node 18
  • 3d3796c Make library compatible with workers
  • 075b354 Fix sync issue with npm lock-file
  • 30dbf04 Fix compiling of each block params in strict mode
  • e3a5448 Fix bundler issue with webpack 5
  • 8e23642 Fix integration-tests issue with npm >= 7
  • 88ac068 use https instead of git for mustache submodule
  • c68bc08 Fix typo
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.


Updates minimist from 0.0.8 to 1.2.8

Changelog

Sourced from minimist's changelog.

v1.2.8 - 2023-02-09

Merged

Fixed

Commits

  • Merge tag 'v0.2.3' a026794
  • [eslint] fix indentation and whitespace 5368ca4
  • [eslint] fix indentation and whitespace e5f5067
  • [eslint] more cleanup 62fde7d
  • [eslint] more cleanup 36ac5d0
  • [meta] add auto-changelog 73923d2
  • [actions] add reusable workflows d80727d
  • [eslint] add eslint; rules to enable later are warnings 48bc06a
  • [eslint] fix indentation 34b0f1c
  • [readme] rename and add badges 5df0fe4
  • [Dev Deps] switch from covert to nyc a48b128
  • [Dev Deps] update covert, tape; remove unnecessary tap f0fb958
  • [meta] create FUNDING.yml; add funding in package.json 3639e0c
  • [meta] use npmignore to autogenerate an npmignore file be2e038
  • Only apps should have lockfiles 282b570
  • isConstructorOrProto adapted from PR ef9153f
  • [Dev Deps] update @ljharb/eslint-config, aud 098873c
  • [Dev Deps] update @ljharb/eslint-config, aud 3124ed3
  • [meta] add safe-publish-latest 4b927de
  • [Tests] add aud in posttest b32d9bd
  • [meta] update repo URLs f9fdfc0
  • [actions] Avoid 0.6 tests due to build failures ba92fe6
  • [Dev Deps] update tape 950eaa7
  • [Dev Deps] add missing npmignore dev dep 3226afa
  • Merge tag 'v0.2.2' 980d7ac

v1.2.7 - 2022-10-10

Commits

... (truncated)

Commits
  • 6901ee2 v1.2.8
  • a026794 Merge tag 'v0.2.3'
  • c0b2661 v0.2.3
  • 63b8fee [Fix] Fix long option followed by single dash (#17)
  • 72239e6 [Tests] Remove duplicate test (#12)
  • 34b0f1c [eslint] fix indentation
  • 3226afa [Dev Deps] add missing npmignore dev dep
  • 098873c [Dev Deps] update @ljharb/eslint-config, aud
  • 9ec4d27 [Fix] Fix long option followed by single dash
  • ba92fe6 [actions] Avoid 0.6 tests due to build failures
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for minimist since your current version.


Updates mkdirp from 0.5.1 to 0.5.6

Commits
Maintainer changes

This version was pushed to npm by isaacs, a new releaser for mkdirp since your current version.


Updates node-fetch from 2.6.0 to 2.7.0

Release notes

Sourced from node-fetch's releases.

v2.7.0

2.7.0 (2023-08-23)

Features

v2.6.13

2.6.13 (2023-08-18)

Bug Fixes

v2.6.12

2.6.12 (2023-06-29)

Bug Fixes

v2.6.11

2.6.11 (2023-05-09)

Reverts

v2.6.10

2.6.10 (2023-05-08)

Bug Fixes

v2.6.9

2.6.9 (2023-01-30)

Bug Fixes

v2.6.8

2.6.8 (2023-01-13)

... (truncated)

Commits

Bumps the npm_and_yarn group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.9.0` | `1.15.6` |
| [async](https://github.com/caolan/async) | `3.1.0` | `3.2.2` |
| [socket.io](https://github.com/socketio/socket.io) | `2.2.0` | `2.5.0` |
| [ws](https://github.com/websockets/ws) | `3.3.3` | `5.2.4` |
| [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.6.0` | `7.24.8` |
| [ansi-regex](https://github.com/chalk/ansi-regex) | `4.1.0` | `4.1.1` |
| [growl](https://github.com/tj/node-growl) | `1.9.2` | `removed` |
| [mocha](https://github.com/mochajs/mocha) | `3.5.3` | `10.6.0` |
| [handlebars](https://github.com/handlebars-lang/handlebars.js) | `4.2.0` | `4.7.8` |
| [minimist](https://github.com/minimistjs/minimist) | `0.0.8` | `1.2.8` |
| [mkdirp](https://github.com/isaacs/node-mkdirp) | `0.5.1` | `0.5.6` |
| [node-fetch](https://github.com/node-fetch/node-fetch) | `2.6.0` | `2.7.0` |
| [socket.io-parser](https://github.com/socketio/socket.io-parser) | `3.3.0` | `3.3.3` |
| [y18n](https://github.com/yargs/y18n) | `4.0.0` | `4.0.3` |
| [yargs-parser](https://github.com/yargs/yargs-parser) | `13.1.1` | `13.1.2` |

Bumps the npm_and_yarn group with 1 update in the /examples directory: [socket.io](https://github.com/socketio/socket.io).


Updates `follow-redirects` from 1.9.0 to 1.15.6
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.9.0...v1.15.6)

Updates `async` from 3.1.0 to 3.2.2
- [Release notes](https://github.com/caolan/async/releases)
- [Changelog](https://github.com/caolan/async/blob/master/CHANGELOG.md)
- [Commits](caolan/async@v3.1.0...v3.2.2)

Updates `socket.io` from 2.2.0 to 2.5.0
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/2.5.0/CHANGELOG.md)
- [Commits](socketio/socket.io@2.2.0...2.5.0)

Updates `ws` from 3.3.3 to 5.2.4
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@3.3.3...5.2.4)

Updates `@babel/traverse` from 7.6.0 to 7.24.8
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.24.8/packages/babel-traverse)

Updates `ansi-regex` from 4.1.0 to 4.1.1
- [Release notes](https://github.com/chalk/ansi-regex/releases)
- [Commits](chalk/ansi-regex@v4.1.0...v4.1.1)

Removes `growl`

Updates `mocha` from 3.5.3 to 10.6.0
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md)
- [Commits](mochajs/mocha@v3.5.3...v10.6.0)

Updates `handlebars` from 4.2.0 to 4.7.8
- [Release notes](https://github.com/handlebars-lang/handlebars.js/releases)
- [Changelog](https://github.com/handlebars-lang/handlebars.js/blob/v4.7.8/release-notes.md)
- [Commits](handlebars-lang/handlebars.js@v4.2.0...v4.7.8)

Updates `minimist` from 0.0.8 to 1.2.8
- [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md)
- [Commits](minimistjs/minimist@v0.0.8...v1.2.8)

Updates `mkdirp` from 0.5.1 to 0.5.6
- [Changelog](https://github.com/isaacs/node-mkdirp/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-mkdirp@0.5.1...v0.5.6)

Updates `node-fetch` from 2.6.0 to 2.7.0
- [Release notes](https://github.com/node-fetch/node-fetch/releases)
- [Commits](node-fetch/node-fetch@v2.6.0...v2.7.0)

Updates `socket.io-parser` from 3.3.0 to 3.3.3
- [Release notes](https://github.com/socketio/socket.io-parser/releases)
- [Changelog](https://github.com/socketio/socket.io-parser/blob/3.3.3/CHANGELOG.md)
- [Commits](socketio/socket.io-parser@3.3.0...3.3.3)

Updates `xmlhttprequest-ssl` from 1.5.5 to 1.6.3
- [Commits](mjwwit/node-XMLHttpRequest@1.5.5...1.6.3)

Updates `y18n` from 4.0.0 to 4.0.3
- [Release notes](https://github.com/yargs/y18n/releases)
- [Changelog](https://github.com/yargs/y18n/blob/y18n-v4.0.3/CHANGELOG.md)
- [Commits](yargs/y18n@v4.0.0...y18n-v4.0.3)

Updates `yargs-parser` from 13.1.1 to 13.1.2
- [Release notes](https://github.com/yargs/yargs-parser/releases)
- [Changelog](https://github.com/yargs/yargs-parser/blob/main/docs/CHANGELOG-full.md)
- [Commits](https://github.com/yargs/yargs-parser/commits)

Updates `socket.io` from 0.9.19 to 4.7.5
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/2.5.0/CHANGELOG.md)
- [Commits](socketio/socket.io@2.2.0...2.5.0)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: async
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: socket.io
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@babel/traverse"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ansi-regex
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: growl
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: mocha
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: handlebars
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimist
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: mkdirp
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: node-fetch
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: socket.io-parser
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: xmlhttprequest-ssl
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: y18n
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: yargs-parser
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: socket.io
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jul 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants