Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update all non-major dependencies #61

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): update all non-major dependencies #61

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Aug 12, 2024 •
edited
Loading

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@nuxt/kit (source) ^3.12.4 -> ^3.14.1592 age adoption passing confidence
@nuxt/schema (source) ^3.12.4 -> ^3.14.1592 age adoption passing confidence
@sxzz/eslint-config ^4.1.1 -> ^4.5.1 age adoption passing confidence
@types/node (source) ^20.14.14 -> ^20.17.10 age adoption passing confidence
bumpp ^9.4.2 -> ^9.9.0 age adoption passing confidence
eslint (source) ^9.8.0 -> ^9.16.0 age adoption passing confidence
pnpm (source) 9.6.0 -> 9.15.0 age adoption passing confidence
prettier (source) ^3.3.3 -> ^3.4.2 age adoption passing confidence
tsup (source) ^8.2.4 -> ^8.3.5 age adoption passing confidence
tsx (source) ^4.16.5 -> ^4.19.2 age adoption passing confidence
typescript (source) ^5.5.4 -> ^5.7.2 age adoption passing confidence
vite (source) ^5.3.5 -> ^5.4.11 age adoption passing confidence
vitest (source) ^2.0.5 -> ^2.1.8 age adoption passing confidence

Release Notes

nuxt/nuxt (@​nuxt/kit)

v3.14.1592

Compare Source

3.14.1592 is the next patch release.

👉 Changelog

compare changes

🩹 Fixes
  • rspack: Update webpackbar with support for rspack (#​29823)
  • nuxt: Assign default name to component without setup (#​29869)
  • kit: Use dst to deduplicate templates when adding them (#​29895)
  • nuxt: Handle empty plugin files (d44408e87)
  • vite: Use resolved nuxt template dst to invalidate modules (6cd3352de)
  • nuxt: Return null map for empty plugin metadata (302a66da9)
  • kit: Resolve module paths before appending subpaths (#​29955)
  • nuxt: Recompile templates on change events (#​29954)
  • nuxt: Do not include <NuxtWelcome> when building (#​29956)
  • nuxt: Allow scanning metadata from 2+ files at same path (#​29969)
  • nuxt: Do not disallow importing nitro dependencies (#​29975)
💅 Refactors
  • nuxt: Define layouts as async vue components (#​29957)
📖 Documentation
🏡 Chore
  • Remove unused imports and update eslint config (#​29876)
✅ Tests
🤖 CI
❤️ Contributors

v3.14.159

Compare Source

3.14.159 is a hotfix release to address regressions in v3.14.

We're leaning into the π theme - future patch releases of this minor version will just continue adding digits. (Sorry for any inconvenience! 😆)

👉 Changelog

compare changes

🩹 Fixes
  • nuxt: Update nitropack preset directory (#​29780)
  • kit: Fall back to meta version if there's no module.json (#​29793)
  • kit: Use mlly to resolve module paths to avoid cjs fallback (#​29799)
  • webpack,rspack: Add adapter for webpack-dev-middleware (#​29806)
  • nuxt: Remove null-byte prefix for virtual files (#​29809)
  • kit: Convert module path to file url before reading meta (fb833ac64)
📖 Documentation
🏡 Chore
❤️ Contributors

v3.14.0

Compare Source

3.14.0 is the next minor release.

👀 Highlights

Behind the scenes, a lot has been going on in preparation for the release of Nuxt v4 (particularly on the unjs side with preparations for Nitro v3!)

⚡️ Faster starts powered by jiti

Loading the nuxt config file, as well as modules and other build-time code, is now powered by jiti v2. You can see more about the release in the jiti v2 release notes, but one of the most important pieces is native node esm import (where possible), which should mean a faster start. ✨

📂 Shared folder for code and types shared with client/server

You should never import Vue app code in your nitro code (or the other way around). But this has meant a friction point when it comes to sharing types or utilities that don't rely on the nitro/vue contexts.

For this, we have a new shared/ folder (#​28682). You can't import Vue or nitro code into files in this folder, but it produces auto-imports you can consume throughout the rest of your app.

If needed you can use the new #shared alias which points to this folder.

The shared folder is alongside your server/ folder. (If you're using compatibilityVersion: 4, this means it's not inside your app/ folder.)

🦀 rspack builder

We're excited to announce a new first-class Nuxt builder for rspack. It's still experimental but we've refactored the internal Nuxt virtual file system to use unplugin to make this possible.

Let us know if you like it - and feel free to raise any issues you experience with it.

👉 To try it out, you can use this starter - or just install @nuxt/rspack-builder and set builder: 'rspack' in your nuxt config file.

✨ New composables

We have new useResponseHeader and useRuntimeHook composables (#​27131 and #​29741).

🔧 New module utilities

We now have a new addServerTemplate utility (#​29320) for adding virtual files for access inside nitro runtime routes.

🚧 v4 changes

We've merged some changes which only take effect with compatibilityVersion: 4, but which you can opt-into earlier.

  1. previously, if you had a component like ~/components/App/Header.vue this would be visible in your devtools as <Header>. From v4 we ensure this is <AppHeader>, but it's opt-in to avoid breaking any manual <KeepAlive> you might have implemented. (#​28745).

  2. Nuxt scans page metadata from your files, before calling pages:extend. But this has led to some confusing behaviour, as pages added at this point do not end up having their page metadata respected. So we now do not scan metadata before calling pages:extend. Instead, we have a new pages:resolved hook, which is called after pages:extend, after all pages have been augmented with their metadata. I'd recommend opting into this by setting experimental.scanPageMeta to after-resolve, as it solves a number of bugs.

🗺️ Roadmap to v3.15

They didn't quite make it in time for v3.14 but for the next minor release you can expect (among other things):

✅ Upgrading

As usual, our recommendation for upgrading is to run:

npx nuxi@latest upgrade --force

This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

👉 Changelog

compare changes

🚀 Enhancements
  • deps: Upgrade to latest version of jiti (#​27995)
  • kit,nuxt,vite,webpack: Reimplement cjs utils using jiti (#​29073)
  • nuxt: Normalise component names to match nuxt pattern (#​28745)
  • kit,schema: Add addServerTemplate utility (#​29320)
  • nuxt: Add useResponseHeader composable (#​27131)
  • rspack,webpack: Add rspack builder (#​29142)
  • nuxt,schema: pages:resolved hook + scan meta post extend (#​28861)
  • nuxt: Allow enabling route props in definePageMeta (#​29586)
  • schema,nuxt: Add shared/ folder and #shared alias (#​28682)
  • nuxt: Allow chunk error or manifest update -> reload (#​28160)
  • nuxt: Add useRuntimeHook composable (#​29741)
🔥 Performance
  • nuxt: Remove unneeded second call to useNuxtApp (#​29514)
  • vite: Avoid redundant postcss plugins overwrite (#​29619)
  • kit,nuxt,vite,webpack: Hoist regex patterns (#​29620)
🩹 Fixes
  • nuxt: Simplify plugin InjectionType template conditional (#​29023)
  • nuxt: Access server build from webpack memfs (#​29027)
  • nuxt: Do not resolve non-absolute component paths (#​29036)
  • nuxt: Defer unsetting error handler until suspense resolves (#​29037)
  • nuxt: Pass DOMException as fetch abort exception (#​29058)
  • vite: Don't force protocol if disabled devServer.https (#​29049)
  • nuxt: Empty nitro buildDir in dev mode (#​29068)
  • nuxt: Don't resolve relative import type paths for deps (#​29069)
  • kit: Handle passing 'bare' relative paths to modules (c7fecd8a1)
  • kit: Try resolving module path from each node_modules dir (70a622d43)
  • kit,vite,webpack: Resolve postcss paths from each modules dir (#​29096)
  • kit,vite,webpack: Strip node_modules/ from parent urls (5bd42c893)
  • nuxt: Add crossorigin attribute for stylesheets (#​29138)
  • nuxt: Use routeRules to hint pages to prerender (#​29172)
  • nuxt: Pass absolute external link urls to link:prefetch (#​29321)
  • nuxt: Error on build when required module is missing (#​29287)
  • nuxt: Prevent 404 when hitting component test endpoint (cb725f014)
  • nuxt: Avoid throwing 404 error before middleware finishes (#​29054)
  • schema: Use ConfigLayer type from c12 (#​29370)
  • nuxt: Fix nested page types in typedPages (#​29352)
  • nuxt: Allow islands to manipulate head client-side (#​29186)
  • vite: Dim repeat count in logs (#​29392)
  • schema: Mark configFile as required in layer type (3bbcd7d21)
  • nuxt: Remove vue compiler hints from auto import (#​29713)
  • vite: Update signature for createIsExternal (686be8168)
  • nuxt: Respect existing props value in definePageMeta (#​29683)
  • schema: Hoist nitropack/types to ensure api routes are typed (54096875e)
💅 Refactors
  • nuxt: Use addBuildPlugin internally (#​29157)
  • nuxt,schema,vite,webpack: Use unplugin for vfs (#​29165)
📖 Documentation
  • Use defineNuxtComponent instead of defineComponent (#​29011)
  • Remove duotone icons for clarity (#​29040)
  • Fix typo (#​29045)
  • Remove specific Nuxt 4 release date (#​29151)
  • Remove redundant newlines and indentations (#​29190)
  • Add links to short videos from daniel (#​29185)
  • Fix comments typo in auto-imports example (#​29195)
  • Add missing word (#​29230)
  • Add a section about useRequestFetch and event.$fetch (#​29099)
  • Add example of typing custom useFetch errors (#​29253)
  • Ensure manifest code snippet works with pnpm (#​29273)
  • Consistent directory structure (#​29292)
  • Update to new ofetch headers for interceptors (#​29118)
  • Mention upgrading third-party configs (#​27768)
  • Improve explanation of ssr + data fetching (#​29010)
  • Add a description for .env.test (#​29398)
  • Add section on 'updateAppConfig' in the 'app.config' page (#​29397)
  • Add example to navigateTo util (#​29611)
  • Remove mockImplementation() call (#​29669)
  • Update lifecycle hooks (#​29678)
  • Type cast api plugin in custom usefetch example (#​29756)
  • Correct some errors about proxying headers with $fetch (#​29755)
  • Add information on --envName flag (#​28909)
  • Add error expectation (09885b87e)
📦 Build
  • ui-templates: Switch to beasties (1b5391182)
🏡 Chore
✅ Tests
🤖 CI
❤️ Contributors

v3.13.2

Compare Source

3.13.2 is the next regularly scheduled patch release.

✅ Upgrading

As usual, our recommendation for upgrading is to run:

npx nuxi@latest upgrade --force

This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

👉 Changelog

compare changes

🔥 Performance
  • nuxt: Remove interop default for dynamic components (#​28912)
🩹 Fixes
  • nuxt: Fix ssr log querySelector (#​28864)
  • schema: Enable propsDestructure by default (#​28830)
  • nuxt: Ensure injected route has enumerable keys (#​28841)
  • nuxt: Don't override vue instance with legacy asyncData (#​28842)
  • nuxt: Render server errors with ssr: false (#​28834)
  • nuxt: Resolve full component paths (#​28843)
  • nuxt: Improve accuracy of module resolution conditions (#​28846)
  • nuxt: Log more context of prerendering errors (#​28895)
  • nuxt: Enable injectAtEnd to reduce circular auto-imports (#​28822)
  • nuxt: Ensure we process files in buildDir for unimport (#​28899)
  • nuxt: Do not accept attrs on <NuxtErrorBoundary> (#​28901)
  • nuxt,schema: Accept any module in inline modules array (#​28922)
  • nuxt: Fall back to original component filePath (#​28925)
  • nuxt: Make runWithContext generic (#​28926)
  • nuxt: Set inheritAttrs: false for fragment components (#​28939)
  • nuxt: Use case-insensitive regexp for <script> blocks (4fd24381c)
  • nuxt: Ensure component imports are injected last (#​28944)
  • nuxt: Catch chunk errors directly in navigation (820908696)
  • nuxt: Add missing isNuxtMajorVersion export (#​29016)
  • nuxt: Correct type for useError (#​28996)
💅 Refactors
  • nuxt: Use vite:preloadError event (#​28862)
📖 Documentation
🏡 Chore
✅ Tests
  • Collect bundle sizes in parallel (1ce81069d)
  • Add regression test for using route in template (#​28967)
  • Convert set to array (6ee3b3adc)
  • Switch inline snapshot to object comparison (ae5135363)
🤖 CI
  • Access issue number from payload (8e4585c14)
  • Configure codeql to ignore tests (d5f98a757)
  • Add default permissions for workflows (3ede01cd4)
  • Scan source files with codeql (#​28943)
  • Skip setting up node before codeql scan (c4d7c92e9)
❤️ Contributors

v3.13.1

Compare Source

3.13.1 is the next regularly scheduled patch release.

👀 Highlights

Although this is a patch release, there are two features I'd love to draw your attention to.

  1. 🆔 useId now uses a built-in Vue composable for stable ids between server + client! https://github.com/nuxt/nuxt/pull/28285
  2. 🔥 a new experimental.buildCache feature now allows for quicker app rebuilds https://github.com/nuxt/nuxt/pull/28726

As always, feedback is appreciated 🙏 ❤️

✅ Upgrading

As usual, our recommendation for upgrading is to run:

npx nuxi@latest upgrade --force

This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

👉 Changelog

compare changes

🔥 Performance
  • nuxt: Cache vue app build outputs (#​28726)
  • nuxt: Use ServerPlaceholder for ssr client components (#​28563)
  • nuxt: Use reducer array + handle modified proto (#​28768)
🩹 Fixes
  • schema: Resolve user-provided serverDir relative to root (#​28700)
  • nuxt: Handle mismatching declaration/plugin extensions (#​28709)
  • nuxt: Do not accept arbitrary strings for MiddlewareKey (#​28676)
  • nuxt: Do not pass listeners to custom NuxtLink (#​28738)
  • nuxt: Generate basic jsdoc for module config entry (#​27689)
  • nuxt: Augment NuxtOptions as well as config (#​28747)
  • nuxt: Improve error logging in import protections (#​28753)
  • nuxt: Handle deleted cookies from CookieStore events (#​28760)
  • nuxt: Allow updating appConfig with non-iterable objects (#​28773)
  • nuxt: Improve isNuxtError type inference (#​28814)
💅 Refactors
  • nuxt: Update to vue v3.5 + native useId (#​28285)
📖 Documentation
  • Fix typo (#​28724)
  • Update broken/redirected links (#​28739)
  • Capitalize text (#​28734)
  • Updated line number for nuxt build-time hooks (#​28746)
  • Add missing query returned value from useRoute() (#​28743)
  • Persist package manager choice in code blocks (#​28514)
  • Fix postcss codeblock typo (#​28801)
  • Include --frozen-lockfile when installing dependencies (#​28794)
🏡 Chore
✅ Tests
❤️ Contributors

v3.13.0

Compare Source

👀 Highlights

I'm pretty excited about this release - we've ported some features we had planned for Nuxt v4 back to v3, as well as a raft of bug fixes and performance improvements - as usual.

Here are a few of things I'm most excited about.

🏘️ Route Groups

We now support naming directories with parentheses/brackets to organise your routes without affecting the path.

For example:

-| pages/
---| index.vue
---| (marketing)/
-----| about.vue
-----| contact.vue

This will produce /, /about and /contact pages in your app. The marketing group is ignored for purposes of your URL structure.

Read more in the original PR.

🏝️ Islands and Head Metadata

It's now possible for server component islands to manipulate the head, such as by adding SEO metadata when rendering.

Read more in #​27987.

🪝 Custom Prefetch Triggers

We now support custom prefetch triggers for NuxtLink (#​27846).

For example:

<template>
  <div>
    <NuxtLink prefetch-on="interaction">
      This will prefetch when hovered or when it gains focus
    </NuxtLink>
    <!-- note that you probably don't want both enabled! -->
    <NuxtLink :prefetch-on="{ visibility: true, interaction: true }">
      This will prefetch when hovered/focus - or when it becomes visible
    </NuxtLink>
  </div>
</template>

It's also possible to enable/disable these globally for your app and override them per link.

For example:

export default defineNuxtConfig({
  experimental: {
    defaults: {
      nuxtLink: {
        prefetch: true,
        prefetchOn: { visibility: false, interaction: true }
      }
    }
  }
})
🗺️ Better Server Source Maps

When running with node --enable-source-maps, you may have noticed that the source maps for the Vue files in your server build pointed to the Vite build output (something like .nuxt/dist/server/_nuxt/index-O15BBwZ3.js).

Now, even after your Nitro build, your server source maps will reference your original source files (#​28521).

Note that one of the easiest ways of improving your build performance is to turn off source maps if you aren't using them, which you can do easily in your nuxt.config:

export default defineNuxtConfig({
  sourcemap: {
    server: false,
    client: true,
  },
})
🎁 New Features for Module Authors

In the run-up to Nuxt v4, we're working on adding some key functionality for module authors, including a new isNuxtMajorVersion utility where required (#​27579) and better inferred typing for merged module options using the new defineNuxtModule().with() method (#​27520).

✨ Improved Dev Warnings

We no longer warn when using data fetching composables in middleware (#​28604) and we warn when user components' names begin with Lazy (#​27838).

🚨 Vue TypeScript Changes

For a while, in the Vue ecosystem, we've been augmenting @vue/runtime-core to add custom properties and more to vue. However, this inadvertently breaks the types for projects that augment vue - which is now the officially recommended in the docs way to augment these interfaces (for example, ComponentCustomProperties, GlobalComponents and so on).

This means all libraries must update their code (or it will break the types of libraries that augment vue instead).

We've updated our types in Nuxt along these lines but you may experience issues with the latest vue-router when used with libraries which haven't yet done so.

Please create an issue with a reproduction - I'll happily help create a PR to resolve in the upstream library in question. Or you may be able to work around the issue by creating a declarations.d.ts in the root of your project with the following code (credit):

import type {
  ComponentCustomOptions as _ComponentCustomOptions,
  ComponentCustomProperties as _ComponentCustomProperties,
} from 'vue';

declare module '@&#8203;vue/runtime-core' {
  interface ComponentCustomProperties extends _ComponentCustomProperties {}
  interface ComponentCustomOptions extends _ComponentCustomOptions {}
}
✅ Upgrading

As usual, our recommendation for upgrading is to run:

npx nuxi@latest upgrade --force

This will refresh your lockfile as well, and ensures that you pull in updates from other dependencies that Nuxt relies on, particularly in the unjs ecosystem.

👉 Changelog

compare changes

🚀 Enhancements
  • nuxt: Await custom routes function in router.options (#​27644)
  • kit: Add new isNuxtMajorVersion compatibility util (#​27579)
  • kit,schema: Add .with for better module options types (#​27520)
  • nuxt: Warn when user components' names begin with Lazy (#​27838)
  • nuxt: Allow specifying app id when creating a nuxt app (#​28392)
  • nuxt: Custom enable/disable hooks for usePreviewMode (#​28371)
  • kit: Add prepend option to addRouteMiddleware (#​28496)
  • nuxt: Allow organising pages within route groups (#​28276)
  • vite: Preserve vite sourcemaps for nitro build (#​28521)
  • nuxt: Allow defining triggers for prefetching links (#​27846)
  • nuxt: Namespace __NUXT__ when using multi-app (#​27263)
  • nuxt: Allow server islands to manipulate head (#​27987)
🔥 Performance
  • nuxt: Call cookie decode function only for named cookie (#​28215)
  • nuxt: Avoid making client-only component setup async (#​28334)
  • nuxt: Avoid multiple calls to getCachedData (#​28472)
🩹 Fixes
  • nuxt: Don't warn for definePageMeta in client-only pages (#​28246)
  • kit: Include module dist/runtime/ in tsconfig includes (#​28237)
  • schema: Support absolute/relative paths for assetsDir (59f0099f4)
  • schema: Do not override user serverDir (#​28249)
  • schema: Use new options syntax for vite-plugin-vue (#​28307)
  • schema: Export new module return types (c0ad8db93)
  • kit: Add missing type import (1a60b4541)
  • vite,webpack: Handle local postcss plugins (#​28481)
  • nuxt: Handle scroll-padding-top: auto in scrollBehavior (#​28320)
  • nuxt: Ensure runtimeConfig.public is reactive on client (#​28443)
  • nuxt: Update renamed stub composables from nuxt/scripts (#​28449)
  • nuxt: Augment @vue/runtime-core and @vue/runtime-dom (#​28446)
  • nuxt: Scan jsx pages for page metadata (#​28479)
  • nuxt: Handle plugin type extensions more correctly (#​28480)
  • vite: Respect baseURL for public assets in dev (#​28482)
  • vite: Add transformation result to log for parse errors (#​28508)
  • vite: Include module symbols in generated code (#​28509)
  • nuxt: Add reason when aborting request in useFetch (#​28517)
  • nuxt: Only augment vue, not sub-packages (#​28542)
  • nuxt: Avoid stripping js extensions in plugin injections (#​28593)
  • nuxt: Preserve route-specific metadata on route.meta (#​28441)
  • nuxt: Don't warn when data fetching in middleware (#​28604)
  • nuxt: Extract route rules/page meta in 2+ script blocks (#​28625)
  • nuxt: Allow customising status code in validate method (#​28612)
  • nuxt: Do not provide default prefetchOn prop (#​28630)
  • nuxt: Revert back to object syntax for island head (#​28656)
📖 Documentation

Configuration

📅 Schedule: Branch creation - "* 0-3 * * 1" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@stackblitz StackBlitz
Copy link

stackblitz bot commented Aug 12, 2024

Review PR in StackBlitz Codeflow Run & review this pull request in StackBlitz Codeflow.

@renovate renovate bot force-pushed the renovate/all-minor-patch branch 9 times, most recently from 42c218d to c8ae648 Compare August 19, 2024 08:32
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from 4154f16 to d102b4f Compare August 27, 2024 07:38
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 5d869c7 to 4450001 Compare September 3, 2024 16:15
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from b2dae46 to b3ac2c5 Compare September 8, 2024 10:48
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 6170407 to 29fbad2 Compare November 13, 2024 14:17
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 7 times, most recently from 3ce9d42 to 15a9f0b Compare November 20, 2024 14:13
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 10 times, most recently from 72dcd73 to a5353cc Compare November 29, 2024 13:01
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 6ea2972 to 49d684a Compare December 4, 2024 12:02
@socket-security Socket Security
Copy link

socket-security bot commented Dec 4, 2024 •
edited
Loading

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSourceCI
Possible typosquat attack npm/[email protected] ⚠︎

View full report↗︎

Next steps

What is a typosquat?

Package name is similar to other popular packages and may not be the package you want.

Use care when consuming similarly named packages and ensure that you did not intend to consume a different package. Malicious packages often publish using similar names as existing popular packages.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

@renovate renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from d7be2b9 to eee8cc1 Compare December 8, 2024 20:09
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from eee8cc1 to fdf2926 Compare December 11, 2024 12:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants