[Snyk] Upgrade: , , , , , jstransformer-nunjucks, metalsmith, metalsmith-if, metalsmith-prism, metalsmith-static-files

[q1blue]

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

Name	Versions	Released on

@metalsmith/drafts
from 1.2.0 to 1.3.0 | 1 version ahead of your current version | 2 years ago
on 2022-12-07
@metalsmith/layouts
from 2.6.0 to 2.7.0 | 1 version ahead of your current version | a year ago
on 2023-04-03
@metalsmith/markdown
from 1.6.0 to 1.10.0 | 5 versions ahead of your current version | a year ago
on 2023-06-05
@metalsmith/metadata
from 0.1.0 to 0.3.0 | 3 versions ahead of your current version | a year ago
on 2023-06-11
@metalsmith/permalinks
from 2.4.0 to 3.0.1 | 5 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 8 months ago
on 2024-01-19
jstransformer-nunjucks
from 1.1.0 to 1.2.0 | 1 version ahead of your current version | a year ago
on 2023-07-18
metalsmith
from 2.5.1 to 2.6.3 | 4 versions ahead of your current version | 6 months ago
on 2024-03-05
metalsmith-if
from 0.1.1 to 1.0.0 | 1 version ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 7 months ago
on 2024-02-16
metalsmith-prism
from 4.1.0 to 4.2.2 | 5 versions ahead of your current version | a year ago
on 2023-08-16
metalsmith-static-files
from 0.2.0 to 0.4.0 | 3 versions ahead of your current version | 7 months ago
on 2024-02-01

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	141	Proof of Concept
	Cross-site Scripting (XSS) SNYK-JS-NUNJUCKS-5431309	141	Proof of Concept

Release notes

Package name: @metalsmith/drafts

• 1.3.0 - 2022-12-07
  
  • Drops support for metalsmith < 2.5.0 0f3dc82
  • Adds metalsmith.debug logs, removes setImmediate b5a11b3
  • Adds Typescript support b5d43c7
  • Renames default export to draft for better intellisense 4dd20fc
• 1.2.0 - 2022-08-06
  
  • Added conditional draft use in readme file #14
  • Support dual bundle ESM/CJS c26f5f3
  • Feature: accept single bool param to include/omit drafts from the output 0183e74
  • Add Typescript types & option JSdocs 5e97ec2
  • Add example to JSdoc 9427720
  • Drop support for Node < 12 fa8a498

from @metalsmith/drafts GitHub release notes

Package name: @metalsmith/layouts

• 2.7.0 - 2023-04-03
  
  • Fix docs for pattern option #188
  • Swaps out debug for metalsmith.debug & enhances debug log output f8cd111
  • Renames default export to layouts for better intellisense 10eaa0c
• 2.6.0 - 2022-09-04
  
  • feat: dual bundling ESM/CJS 771212c
  • feat: added Typescript support 507bb47

  Breaking change for uncommon use case:
  If you previously imported/required the get-transformer.js module directly from @ metalsmith/layouts/lib/get-transformer.js, you should now require it like so: require('@ metalsmith/layouts').getTransformer or import it like so import layouts from '@ metalsmith/layouts'; layouts.getTransformer...

from @metalsmith/layouts GitHub release notes

Package name: @metalsmith/markdown

• 1.10.0 - 2023-06-05
  
  • Resolves #68: adds ability to render targets in metalsmith.metadata() #68
  • test: update mocha to latest, move from nyc to c8 for test coverage, update Node versions b8872a8
  • Updates marked 4.2.12 -> 4.3.0 79a0939
  • Drops support for Node < 14.14.0 (Node 12 EOL = 2023-04-30) 67db54d
• 1.9.2 - 2023-05-08
  
  • Fixes missing types and adds source maps to package 78eaefc
• 1.9.1 - 2023-02-26
  
  • Updates marked from 4.2.4 -> 4.2.12 c9881d1
  • fix: don't log a warning for undefined key values, only when typeof is not string 53feb48
  • fix: don't crash but gracefully ignore undefined for wildcard keypaths d05e39a
• 1.9.0 - 2023-02-02
  
  • Resolves #65: adds globalRefs option #65
  • Resolves #63: provides a render option allowing usage of any markdown parser. #63
  • Documents the render option and restructures README.md in alignment with other core plugins 2ea44cd
• 1.8.0 - 2022-12-18
  
  • Resolves #62, deprecates markdown options.<option> in favor of options.engineOptions.<option> #62
  • Provides dual ESM/CJS module a3b6271
  • Adds Typescript support 5ce04b8
  • Updates marked from 4.2.0 -> 4.2.4 fd2fc65
  • Renames default export to markdown for better auto-complete ba9c515
• 1.6.0 - 2022-05-29
  
  • Resolves #60: support nested keypaths for keys option #60
  • Fixes #61: replace Travis CI badge with GH actions in README.md #61
  • Feature: Add support for simple wildcards, get 100% test coverage 9c53cfe
  • Update supported Node version to >=10, update marked 4.0.12 -> 4.0.16 c0d1a86

from @metalsmith/markdown GitHub release notes

Package name: @metalsmith/metadata

• 0.3.0 - 2023-06-11
  
  • Fixes a regression introduced in 0.2.1 with array merges, handles repeat runs properly 65d480e
  • Drops support for metalsmith < 2.5.0 & uses metalsmith.debug instead of debug 73898bf
  • Updates deepmerge 4.2.2 -> 4.3.1 379fc4d
  • Drops support for Node < 14.14.0 & migrates tests to ESM on src file 28a0cc5
  • Includes source maps in dist for better debugging 2555da5
  • Renames default export to 'metadata' for better editor intellisense a63c1d3
• 0.2.1 - 2023-05-29
  
  • Explicitly specify array merge as concat 9102291
• 0.2.0 - 2022-11-04
  
  • feat: provides dual bundling ESM/CJS 6f4f9dc
  • Update debug from 4.3.3 -> 4.3.4, use strict f6d5125
  • Adds Typescript definitions e0b6f7d
• 0.1.0 - 2022-03-19
  
  • Complete re-write of metadata. #27
  • Nested config files #19
  • Don't attempt to parse a file if the key already exists in the metadata, even if the file is missing #9
  • Revert 9e2224d #16
  • Normalizing path options for Windows compatibility. #7
  • Update dependencies #8
  • Allow .yml as file extension for YAML as well #12
  • feat: rewrite 030593c
  • added tests e6ad84a
  • added proper error reporting to done() 6d21924
  • run format and changelog a761955
  • debug next branch e8b0513
  • run utilities ca4bdf6
  • Changed options file path e370e5a
  • first commit 48bcefc
  • edited readme 299ec8a
  • fixed issue with yaml files in folder ab93171
  • feat: complete & sort package.json 387a0ea
  • don't try and parse if the key already exists in the metadata... c3353d8
  • Add tests for nested and deep-nested path e525a11
  • more tests 6b0cf69
  • manual merge 9a8d64c
  • run changelog 8d2ad44
  • fix: fixed file/dir path for external reads d3fc01e
  • Add regex for normalizing path c9cf34a
  • updated name to @ metalsmith/metadata aabfe1c
  • fixed path separator 6375b00
  • removed console.logs 7edb15d
  • fixed spelling bc578ef
  • bump version number cc8b115
  • fix test name 965a9b5
  • removed obsolete code 9dbd53c

from @metalsmith/metadata GitHub release notes

Package name: @metalsmith/permalinks

• 3.0.1 - 2024-01-19
  
  • Fixes #139: don't slugify dirname, add nested file test, document default slug options in types #139
  • fix: slug options to defaultLinkset.slug, correct date jsdoc 4b60c50
  • fix: accept simple quotes in permalinks as even Windows accepts it 5af7d5d
• 3.0.0 - 2023-12-13
  
  • Resolves #88, opens up permalinks usage for files with any extension. #88
  • Resolves #75, adds support for dot.notated.pattern.parts #75
  • BREAKING: Resolves #131, replaces moment.js with subset of own date-formatting tokens. #131
  • BREAKING: Resolves #19, throw an error when the permalink resolves with invalid filepath chars #19
  • BREAKING: Resolves #132, removes deprecated options 'relative','duplicatesFail','unique' and 'indexFile' and related bloat #132
  • Updates README.md & types for v3.0.0 3d7ea2e
  • test: refactor to ESM (actual) 7d9a2d2
  • BREAKING: refactors options and default linkset handling 7d5ca36
  • BREAKING: throws an error on missing, non-optional pattern parts. See also #22 (comment) 552b549
  • Allows front-matter defined permalinks to use :placeholder patterns 053e92e
  • BREAKING: Solves #94, removes invalid file path characters & sets more sensible slugify defaults b30d875
  • test: remove obsolete test d5d199f
  • Formalize default permalink pattern to ':dirname/:basename' 176515e
  • Updates slugify 1.6.5 -> 1.6.6 a1d2a2f
  • Updates regexparam 2.0.1 -> 3.0.0 804e1cd
  • test: refactor to ESM 046770e
  • Drops support for Node < 14.14.0 3c4bba9
• 2.5.1 - 2023-02-02
  
  • Fixes #135 and also removes some warnings that logged when they shouldn't #135
• 2.5.0 - 2023-01-04
  
  • Resolves #134: deprecates & merges options 'duplicatesFail' & 'unique' into new option 'duplicates' #134
  • Fixes #48, aligns linkset & default options date & slug formatting #48
  • Resolves #44: eliminate ambiguity with setImmediate(done) #44
  • Resolves #129: provides dual ESM/CJS module #129
  • Drops support for Metalsmith < 2.5.0, replaces debug with metalsmith.debug 7e1c0dc
  • Deprecates file.path in favor of file.permalink and adds better testing c7a56f1
  • Adds Typescript definitions 6354c95
  • Aligns behavior of using alt indexFile and adds indexFile test 5d6d861
  • Deprecates the file.path property in favor of file.permalink 4130e03
  • Deprecates options.indexFile in favor of options.directoryIndex b6ee083
  • test: add test case for array matches & cheat coverage 5f7734c
  • docs: correct typo's & omissions in README.md 94816a2
  • Deprecates the 'relative' option, cfr. #132 ffb7fcb
  • fix: ESM build export * instead of default from regexparam e1a9fe6
• 2.4.1 - 2022-10-31
  
  • Updates regexparam 2.0.0 -> 2.0.1, debug 4.3.3 -> 4.3.4 309e998
  • Dropped support for Node < 12 ec20c30
• 2.4.0 - 2022-01-30
  
  • Resolves #122: remove deprecated substitute pkg, add regexparam instead #122
  • Fixes #120: default linkset options should be overwritten by other linksets #120
  • Resolves #121: Align dot & repo files with core plugins #121
  • Update debug to 4.3.3, moment to 2.29.1, slugify to 1.6.5 4360a30 13e3dbf
  • feat: proper jsdocs, cleaner option handling code 4684767
  • feat: allow optional pattern placeholder a7f89ea
  • fix: remove console.log typo, fix few README typo's 2ea03de
  • Fixes debug channel to '@ metalsmith/permalinks' 21bc858

from @metalsmith/permalinks GitHub release notes

Package name: jstransformer-nunjucks

• 1.2.0 - 2023-07-18
  
  • Refactors filter, extension & globals resolution & addresses lint issues
  • Replaces legacy extend-shallow with Object.assign
  • Updated Nunjucks 3.2.3 => 3.2.4
  • Fixed typo in README badge
• 1.1.0 - 2022-05-16
  
  • Updated Nunjucks 3.0.0 => 3.2.3
  • Drop support for Node < 8.0.0
  • Restructure to conform to xo rules
  • Tidy up README.md

from jstransformer-nunjucks GitHub release notes

Package name: metalsmith

• 2.6.3 - 2024-03-05
  

  Removed

  • Drops support for Node < 14.18.0 (4 minor, deprecated versions) to be able to use 'node:' protocol imports" b170cf0

  Updated

  • Updated README.md code samples, links, and troubleshooting section
  • Dependencies: 774a164
    • chokidar: 3.5.3 ▶︎ 3.6.0

  Fixed

  • Fixes ms.watch(false) unreliable behavior when the build errors. 0d8d791
• 2.6.2 - 2023-11-15
  
  • TS fixes: add generic to Metalsmith.File, bring back Metalsmith.DoneCallback, add Metalsmith.Plugin promise signature 3ae6275
  • #394 Avoid leaking unhandled rejections in build/watch promises. cac48fc, 5b48dce
  • Fix a typo in CLI help message 642a176
• 2.6.1 - 2023-07-11
  
  • 34239d9 Documents metalsmith.watch() getter signature in TS
  • a719025 Normalizes ms.watch().paths to an array, allows access to a subset of chokidar options as advertised
  • 5a516b2 Sets chokidar watchOption awaitWriteFinish to false, and batch timer to 0 to speed up watching
  • 23b0944 Fixes #389: ensure not missing watcher ready event to successfully launch build
  • 05265ce Fixes formatting issue in types JSdoc comments
• 2.6.0 - 2023-05-29
  

  Added

  • [#356] Added Typescript support 58d22a3
  • Added --debug and --dry-run options to metalsmith (build) command 2d84fbe
  • Added --env option to metalsmith (build) command 9661ddc
  • Added Metalsmith CLI support for loading a .(c)js config. Reads from metalsmith.js as second default after metalsmith.json 45a4afe
  • Added support for running (C/M)JS config files from CLI 424e6ec
  • Dependencies:
    • chokidar 9d40674
    • lodash.clonedeepwith e12537f

  Removed

  • #231 Dropped support for Node < 14.14.0 80d8508
  • Dependencies:
    • rimraf: replaced with native Node.js methods ae05945
    • cross-spawn: baee1de

  Updated

  • Modernized Metalsmith CLI, prepared transition to imports instead of require 24fcffb 4929bc2
  • Dependencies:
    • commander: 6.2.1 -> 10.0.1 24fcffb 0810728

  Fixed

  • Fixes a duplicate empty input check in metalsmith.match 60e173a
  • Gray-matter excerpts are removed from contents instead of being duplicated to the excerpt property 2bfe800
  • Gray-matter excerpts are trimmed acb363e

  Full Changelog: v2.5.1...v2.6.0

• 2.5.1 - 2022-10-07
  
  • Dependencies: 774a164
    • debug: 4.3.3 ▶︎ 4.3.4
  • Clarified semver policy in README.md
  • Added SECURITY.md

  Fixed

  • Fixes #373: do not crash when postinstall script fails in specific environments

from metalsmith GitHub release notes

Package name: metalsmith-if

• 1.0.0 - 2024-02-16
  
  • Update dependencies to latest metalsmith and mocha
  • Modernize javascript style
• 0.1.1 - 2015-09-04

from metalsmith-if GitHub release notes

Package name: metalsmith-prism

• 4.2.2 - 2023-08-16
• 4.2.1 - 2023-08-15
• 4.2.0 - 2023-06-02
• 4.1.2 - 2023-03-22
• 4.1.1 - 2022-10-19
• 4.1.0 - 2022-09-24

from metalsmith-prism GitHub release notes

Package name: metalsmith-static-files

• 0.4.0 - 2024-02-01
• 0.3.0 - 2023-06-02
• 0.2.1 - 2022-10-19
• 0.2.0 - 2022-09-24

from metalsmith-static-files GitHub release notes

---

Important

• Warning: This PR contains a major version upgrade, and may be a breaking change.
• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[netlify]

❌ Deploy Preview for celebrated-lollipop-213a38 failed. Why did it fail? →

Name	Link
🔨 Latest commit	8617d5e
🔍 Latest deploy log	https://app.netlify.com/sites/celebrated-lollipop-213a38/deploys/66df7270185fdc000808fe7a