[Snyk] Upgrade: chalk, change-case, commander, fs-extra, glob, json5, jsonc-parser, tinycolor2 #162

WontonSam · 2024-09-11T18:01:39Z

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

Name	Versions	Released on

chalk
from 4.1.2 to 5.3.0 | 7 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | a year ago
on 2023-06-29
change-case
from 4.1.2 to 5.4.4 | 13 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 5 months ago
on 2024-04-03
commander
from 8.3.0 to 12.1.0 | 17 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 4 months ago
on 2024-05-18
fs-extra
from 10.0.0 to 11.2.0 | 6 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 9 months ago
on 2023-11-28
glob
from 7.2.0 to 11.0.0 | 54 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 2 months ago
on 2024-07-08
json5
from 2.2.2 to 2.2.3 | 1 version ahead of your current version | 2 years ago
on 2022-12-31
jsonc-parser
from 3.0.0 to 3.3.1 | 5 versions ahead of your current version | 3 months ago
on 2024-06-24
tinycolor2
from 1.4.2 to 1.6.0 | 13 versions ahead of your current version | 2 years ago
on 2023-02-03

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	631	Proof of Concept

Release notes

Package name: chalk

5.3.0 - 2023-06-29
- Add sideEffects field to package.json 5aafc0a
- Add support for Gitea Actions (#603) 29b8569
v5.2.0...v5.3.0
5.2.0 - 2022-12-08
- Improve Deno compatibility (#579) 7443e9f
- Detect true-color support for GitHub Actions (#579) 7443e9f
- Detect true-color support for Kitty terminal (#579) 7443e9f
- Fix test for Azure DevOps environment (#579) 7443e9f
v5.1.2...v5.2.0
5.1.2 - 2022-10-12
- Fix exported styles names (#569) a34bcf6
v5.1.1...v5.1.2
5.1.1 - 2022-10-12
- Improved the names of exports introduced in 5.1.0 (#567) 6e0df05
  - We of course preserved the old names.
v5.1.0...v5.1.1
5.1.0 - 2022-10-05
- Expose style names (#566) d7d7571
v5.0.1...v5.1.0
5.0.1 - 2022-03-08
- Add main field to package.json for backwards compatibility with some developer tools 85f7e96
v5.0.0...v5.0.1
5.0.0 - 2021-11-26
Breaking
- This package is now pure ESM. Please read this.
  - If you use TypeScript, you need to use TypeScript 4.7 or later. Why.
  - If you use a bundler, make sure it supports ESM and that you have correctly configured it for ESM.
  - The Chalk issue tracker is not a support channel for your favorite build/bundler tool.
  - It's totally fine to stay on Chalk v4. It's been stable for years.
- Require Node.js 12.20 fa16f4e
- Move some properties off the default export to individual named exports:
  - chalk.Instance → Chalk
  - chalk.supportsColor → supportsColor
  - chalk.stderr → chalkStderr
  - chalk.stderr.supportsColor → supportsColorStderr
- Remove .keyword(), .hsl(), .hsv(), .hwb(), and .ansi() coloring methods (#433) 4cf2e40
  - These were not commonly used and added a lot of bloat to Chalk. You can achieve the same by using the color-convert package.
- The tagged template literal support moved into a separate package: chalk-template (#524) c987c61
-import chalk from 'chalk';
+import chalkTemplate from 'chalk-template';

-chalk2 + 3 = {bold ${2 + 3}};
+chalkTemplate2 + 3 = {bold ${2 + 3}};

Improvements
- Bundle dependencies 04fdbd6
  - This means Chalk no longer has any dependencies 🎉
- The install size is less than half of v4.
- Add overline style (#433) 4cf2e40
- Preserve function prototype methods (#434) 0fba91b
v4.1.0...v5.0.0
4.1.2 - 2021-07-30
- Readme updates

from chalk GitHub release notes

Package name: change-case

5.4.4 - 2024-04-03
Fixed
- Fixed change-case/keys types by @ marcingajda in #337
Full Changelog: https://github.com/blakeembrey/change-case/compare/[email protected]@5.4.4
5.4.3 - 2024-02-14
Fixed
- Fixes options used recursively in change-case/keys - previously options were ignored after the first level #334 by @ Quicksaver
5.4.2 - 2024-01-14
5.4.1 - 2024-01-10
Fixed
- Remove lookbehind from regex for older browser support (6512635)
5.4.0 - 2024-01-08
Added
- Added a split option to the change-case transform functions to allow for customization on how words are extracted from input
Changed
- The package exports are now default instead of import to fix some tooling that doesn't work properly with import
- The exported split utility no longer accepts a second options argument
5.3.0 - 2023-12-06
Added
- New suffixCharacters option to retain characters during case conversion. Useful for retaining something like the _ in type_. Closes #322.
5.2.0 - 2023-11-17
Added
- Add delimiter option for customizing join character in any change case method
- Add mergeAmbiguousCharacters for camel and pascal case to avoid prefixing _ before numbers
5.1.2 - 2023-10-20
5.1.1 - 2023-10-20
[email protected]
5.1.0 - 2023-10-18
5.0.2 - 2023-10-03
5.0.1 - 2023-09-30
5.0.0 - 2023-09-30
4.1.2 - 2020-12-02

from change-case GitHub release notes

Package name: commander

12.1.0 - 2024-05-18
Added
- auto-detect special node flags node --eval and node --print when call .parse() with no arguments (#2164)
Changed
- prefix require of Node.js core modules with node: (#2170)
- format source files with Prettier (#2180)
- switch from StandardJS to directly calling ESLint for linting (#2153)
- extend security support for previous major version of Commander (#2150)
Removed
- removed unimplemented Option.fullDescription from TypeScript definition (#2191)
12.0.0 - 2024-02-03
Added
- .addHelpOption() as another way of configuring built-in help option (#2006)
- .helpCommand() for configuring built-in help command (#2087)
Fixed
- Breaking: use non-zero exit code when spawned executable subcommand terminates due to a signal (#2023)
- Breaking: check passThroughOptions constraints when using .addCommand and throw if parent command does not have .enablePositionalOptions() enabled (#1937)
Changed
- Breaking: Commander 12 requires Node.js v18 or higher (#2027)
- Breaking: throw an error if add an option with a flag which is already in use (#2055)
- Breaking: throw an error if add a command with name or alias which is already in use (#2059)
- Breaking: throw error when calling .storeOptionsAsProperties() after setting an option value (#1928)
- replace non-standard JSDoc of @ api private with documented @ private (#1949)
- .addHelpCommand() now takes a Command (passing string or boolean still works as before but deprecated) (#2087)
- refactor internal implementation of built-in help option (#2006)
- refactor internal implementation of built-in help command (#2087)
Deprecated
- .addHelpCommand() passing string or boolean (use .helpCommand() or pass a Command) (#2087)
Removed
- Breaking: removed default export of a global Command instance from CommonJS (use the named program export instead) (#2017)
Migration Tips

global program

If you are using the deprecated default import of the global Command object, you need to switch to using a named import (or create a new Command).
```
// const program = require('commander');
const { program } = require('commander');
```
option and command clashes

A couple of configuration problems now throw an error, which will pick up issues in existing programs:
- adding an option which uses the same flag as a previous option
- adding a command which uses the same name or alias as a previous command
12.0.0-1 - 2024-01-19
Added
- .addHelpOption() as another way of configuring built-in help option (#2006)
- .helpCommand() for configuring built-in help command (#2087)
Changed
- .addHelpCommand() now takes a Command (passing string or boolean still works as before but deprecated) (#2087)
- refactor internal implementation of built-in help option (#2006)
- refactor internal implementation of built-in help command (#2087)
Deprecated
- .addHelpCommand() passing string or boolean (use .helpCommand() or pass a Command) (#2087)
12.0.0-0 - 2023-11-11
Fixed
- Breaking: use non-zero exit code when spawned executable subcommand terminates due to a signal (#2023)
- Breaking: check passThroughOptions constraints when using .addCommand and throw if parent command does not have .enablePositionalOptions() enabled (#1937)
Changed
- Breaking: Commander 12 requires Node.js v18 or higher (#2027)
- Breaking: throw an error if add an option with a flag which is already in use (#2055)
- Breaking: throw an error if add a command with name or alias which is already in use (#2059)
- Breaking: throw error when calling .storeOptionsAsProperties() after setting an option value (#1928)
- replace non-standard JSDoc of @ api private with documented @ private (#1949)
Removed
- Breaking: removed default export of a global Command instance from CommonJS (use the named program export instead) (#2017)
Migration Tips

global program

If you are using the deprecated default import of the global Command object, you need to switch to using a named import (or create a new Command).
```
// const program = require('commander');
const { program } = require('commander');
```
option and command clashes

A couple of configuration problems now throw an error, which will pick up issues in existing programs:
- adding an option which uses the same flag as a previous option
- adding a command which uses the same name or alias as a previous command
11.1.0 - 2023-10-13
Fixed
- TypeScript: update OptionValueSource to allow any string, to match supported use of custom sources (#1983)
- TypeScript: add that Command.version() can also be used as getter (#1982)
- TypeScript: add null return type to Commands.executableDir(), for when not configured (#1965)
- subcommands with an executable handler and only a short help flag are now handled correctly by the parent's help command (#1930)
Added
- registeredArguments property on Command with the array of defined Argument (like Command.options for Option) (#2010)
- TypeScript declarations for Option properties: envVar, presetArg (#2019)
- TypeScript declarations for Argument properties: argChoices, defaultValue, defaultValueDescription (#2019)
- example file which shows how to configure help to display any custom usage in the list of subcommands (#1896)
Changed
- (developer) refactor TypeScript configs for multiple use-cases, and enable checks in JavaScript files in supporting editors (#1969)
Deprecated
- Command._args was private anyway, but now available as registeredArguments (#2010)
11.0.0 - 2023-06-16
Fixed
- help command works when help option is disabled (#1864)
Changed
- leading and trailing spaces are now ignored by the .arguments() method (#1874)
- refine "types" exports for ESM to follow TypeScript guidelines (#1886)
- Breaking: Commander 11 requires Node.js v16 or higher
10.0.1 - 2023-04-15
Added
- improvements to documentation (#1858, #1859, #1860)
Fixed
- remove unused Option.optionFlags property from TypeScript definition (#1844)
Changed
- assume boolean option intended if caller passes string instead of hash to .implies() (#1854)
10.0.0 - 2023-01-14
Added
- wrap command description in help (#1804)
Changed
- Breaking: Commander 10 requires Node.js v14 or higher
9.5.0 - 2023-01-07
Added
- .getOptionValueSourceWithGlobals() (#1832)
- showGlobalOptions for .configureHelp{} and Help (#1828)
9.4.1 - 2022-09-30
Fixed
- .setOptionValue() now also clears option source (#1795)
- TypeScript: add implied to OptionValueSource for option values set by using .implies() (#1794)
- TypeScript : add undefined to return type of .getOptionValueSource() (#1794)
Changed
- additions to README
9.4.0 - 2022-07-15
9.3.0 - 2022-05-28
9.2.0 - 2022-04-15
9.1.0 - 2022-03-18
9.0.0 - 2022-01-29
9.0.0-1 - 2022-01-14
9.0.0-0 - 2021-12-22
8.3.0 - 2021-10-22

from commander GitHub release notes

Package name: fs-extra

11.2.0 - 2023-11-28
11.2.0
11.1.1 - 2023-03-20
11.1.1
11.1.0 - 2022-11-29
11.1.0
11.0.0 - 2022-11-28
11.0.0
10.1.0 - 2022-04-16
10.1.0
10.0.1 - 2022-02-22
10.0.1
10.0.0 - 2021-05-03
10.0.0

from fs-extra GitHub release notes

Package name: glob

from glob GitHub release notes

Package name: json5

2.2.3 - 2022-12-31
- Fix: [email protected] is now the 'latest' release according to npm instead of v1.0.2. ([#299])
2.2.2 - 2022-12-16
- Fix: Properties with the name __proto__ are added to objects and arrays.
  (#199) This also fixes a prototype pollution vulnerability reported by
  Jonathan Gregson! (#295).

from json5 GitHub release notes

Package name: jsonc-parser

3.3.1 - 2024-06-24
Changes:
- #92: remove exports, prepare 3.3.1
This list of changes was auto generated.
3.3.0 - 2024-06-24
Changes:

Feature Requests:
- #11: Can we have a "insertFinalNewline" option in "FormattingOptions"?
- #4: Source map referenced but not included in published package
Bugs:
- #33: Formatting valid json content is causing an invalid json
- #40: parseTree() returns undefined on empty string input
Others:
- #90: prepare 3.3.0
- #88: Allow the visitor to cease callbacks
- #89: Bump braces from 3.0.2 to 3.0.3
See More
- #84: prepare 3.2.1
- #81: perf(format): cache breaklines and spaces as much as possible
- #79: update dependencies

Snyk has created this PR to upgrade: - chalk from 4.1.2 to 5.3.0. See this package in npm: https://www.npmjs.com/package/chalk - change-case from 4.1.2 to 5.4.4. See this package in npm: https://www.npmjs.com/package/change-case - commander from 8.3.0 to 12.1.0. See this package in npm: https://www.npmjs.com/package/commander - fs-extra from 10.0.0 to 11.2.0. See this package in npm: https://www.npmjs.com/package/fs-extra - glob from 7.2.0 to 11.0.0. See this package in npm: https://www.npmjs.com/package/glob - json5 from 2.2.2 to 2.2.3. See this package in npm: https://www.npmjs.com/package/json5 - jsonc-parser from 3.0.0 to 3.3.1. See this package in npm: https://www.npmjs.com/package/jsonc-parser - tinycolor2 from 1.4.2 to 1.6.0. See this package in npm: https://www.npmjs.com/package/tinycolor2 See this project in Snyk: https://app.snyk.io/org/cachiman-inc/project/62ad277c-46d4-41af-871c-bab3d2a31405?utm_source=github&utm_medium=referral&page=upgrade-pr

google-cla · 2024-09-11T18:01:46Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[Snyk] Upgrade: chalk, change-case, commander, fs-extra, glob, json5, jsonc-parser, tinycolor2 #162

Are you sure you want to change the base?

[Snyk] Upgrade: chalk, change-case, commander, fs-extra, glob, json5, jsonc-parser, tinycolor2 #162

Conversation

WontonSam commented Sep 11, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

Breaking

Improvements

Added

Changed

Removed

Added

Fixed

Changed

Deprecated

Removed

Migration Tips

Added

Changed

Deprecated

Fixed

Changed

Removed

Migration Tips

Fixed

Added

Changed

Deprecated

Fixed

Changed

Added

Fixed

Changed

Added

Changed

Added

Fixed

Changed

Changes:

Changes:

Feature Requests:

Bugs:

Others:

google-cla bot commented Sep 11, 2024