Bump the npm_and_yarn group with 4 updates #216

dependabot · 2024-10-04T09:55:29Z

Bumps the npm_and_yarn group with 4 updates: vite, micromatch, rollup and ws.

Updates vite from 4.5.3 to 4.5.5

Changelog

4.5.5 (2024-09-16)

4.5.4 (2024-09-16)

fix: avoid DOM Clobbering gadget in getRelativeUrlFromDocument (#18115) (e812716), closes #18115

fix: backport #18112, fs raw query (b901438), closes #18112

Commits

f1d8845 release: v4.5.5
2466c08 release: v4.5.4
e812716 fix: avoid DOM Clobbering gadget in getRelativeUrlFromDocument (#18115)
b901438 fix: backport #18112, fs raw query
See full diff in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

this is basically v4.0.5, with some README updates

it is vulnerable to CVE-2024-4067

Updated braces to v3.0.3 to avoid CVE-2024-4068

does NOT break API compatibility

[4.0.6] - 2024-05-21

Added hasBraces to check if a pattern contains braces.

Fixes CVE-2024-4067

BREAKS API COMPATIBILITY

Should be labeled as a major release, but it's not.

Commits

8bd704e 4.0.8
a0e6841 run verb to generate README documentation
4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
814f5f7 lint
67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
113f2e3 fix: CVE numbers in CHANGELOG
d9dbd9a feat: updated CHANGELOG
2ab1315 fix: use actions/setup-node@v4
1406ea3 feat: rework test to work on macos with node 10,12 and 14
Additional commits viewable in compare view

Updates rollup from 3.28.0 to 3.29.5

Release notes

Sourced from rollup's releases.

v3.29.4

3.29.4

2023-09-28

Bug Fixes

Fix static analysis when an exported function uses callbacks (#5158)

Pull Requests

#5158: Deoptimize all parameters when losing track of a function (@lukastaegert)

v3.29.3

3.29.3

2023-09-24

Bug Fixes

Fix a bug where code was wrongly tree-shaken after mutating function parameters (#5153)

Pull Requests

#5145: docs: improve the docs repl appearance in the light mode (@TrickyPi)

#5148: chore(deps): update dependency @vue/eslint-config-typescript to v12 (@renovate[bot])

#5149: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#5153: Fully deoptimize first level path when deoptimizing nested parameter paths (@lukastaegert)

v3.29.2

3.29.2

2023-09-15

Bug Fixes

Export TreeshakingPreset type (#5131)

Pull Requests

#5131: fix: exports TreeshakingPreset (@moltar)

#5134: docs: steps to enable symlinks on windows (@thebanjomatic)

#5137: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

v3.29.1

3.29.1

2023-09-10

Bug Fixes

... (truncated)

Changelog

Sourced from rollup's changelog.

rollup changelog

4.24.0

2024-10-02

Features

Support preserving and transpiling JSX syntax (#5668)

Pull Requests

#5668: Introduce JSX support (@lukastaegert, @Martin-Idel, @felixhuttmann, @AlexDroll, @tiptr)

4.23.0

2024-10-01

Features

Collect all emitted names and originalFileNames for assets (#5686)

Pull Requests

#5686: Add names and originalFileNames to assets (@lukastaegert)

4.22.5

2024-09-27

Bug Fixes

Allow parsing of certain unicode characters again (#5674)

Pull Requests

#5674: Fix panic with unicode characters (@sapphi-red, @lukastaegert)

#5675: chore(deps): update dependency rollup to v4.22.4 [security] (@renovate[bot])

#5680: chore(deps): update dependency @rollup/plugin-commonjs to v28 (@renovate[bot], @lukastaegert)

#5681: chore(deps): update dependency @rollup/plugin-replace to v6 (@renovate[bot])

#5682: chore(deps): update dependency @rollup/plugin-typescript to v12 (@renovate[bot])

#5684: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

4.22.4

2024-09-21

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

... (truncated)

Commits

dfd233d 3.29.5
2ef77c0 Fix DOM Clobbering CVE
a6448b9 3.29.4
4e92d60 Deoptimize all parameters when losing track of a function (#5158)
801ffd1 3.29.3
353e462 Fully deoptimize first level path when deoptimizing nested parameter paths (#...
a1a89e7 chore(deps): update dependency @vue/eslint-config-typescript to v12 (#5148)
cc14f70 chore(deps): lock file maintenance minor/patch updates (#5149)
1e8355b docs: improve the docs repl appearance in the light mode (#5145)
5950fc8 Adapt branches in REPL workflow
Additional commits viewable in compare view

Updates ws from 8.16.0 to 8.18.0

Release notes

Sourced from ws's releases.

8.18.0

Features

Added support for Blob (#2229).

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

... (truncated)

Commits

976c53c [dist] 8.18.0
59b9629 [feature] Add support for Blob (#2229)
0d1b5e6 [security] Use more descriptive text for 2017 vulnerability link
15f11a0 [security] Add new DoS vulnerability to SECURITY.md
3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 4 updates: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [micromatch](https://github.com/micromatch/micromatch), [rollup](https://github.com/rollup/rollup) and [ws](https://github.com/websockets/ws). Updates `vite` from 4.5.3 to 4.5.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v4.5.5/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v4.5.5/packages/vite) Updates `micromatch` from 4.0.5 to 4.0.8 - [Release notes](https://github.com/micromatch/micromatch/releases) - [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md) - [Commits](micromatch/micromatch@4.0.5...4.0.8) Updates `rollup` from 3.28.0 to 3.29.5 - [Release notes](https://github.com/rollup/rollup/releases) - [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md) - [Commits](rollup/rollup@v3.28.0...v3.29.5) Updates `ws` from 8.16.0 to 8.18.0 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.16.0...8.18.0) --- updated-dependencies: - dependency-name: vite dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: micromatch dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: rollup dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

vercel · 2024-10-04T09:55:32Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
kiro	❌ Failed (Inspect)			Oct 4, 2024 9:56am

dependabot bot added javascript Pull requests that update Javascript code 🎛️ dependencies Pull requests that update a dependency file labels Oct 4, 2024

dependabot bot mentioned this pull request Oct 4, 2024

Bump ws from 8.16.0 to 8.17.1 #179

Closed

vercel bot had a problem deploying to Preview October 4, 2024 09:56 Failure

Linzell merged commit 995392d into master Oct 5, 2024
2 of 3 checks passed

dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-18729680fe branch October 5, 2024 10:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group with 4 updates #216

Bump the npm_and_yarn group with 4 updates #216

dependabot bot commented on behalf of github Oct 4, 2024

vercel bot commented Oct 4, 2024 •

edited

Loading

Bump the npm_and_yarn group with 4 updates #216

Bump the npm_and_yarn group with 4 updates #216

Conversation

dependabot bot commented on behalf of github Oct 4, 2024

4.5.5 (2024-09-16)

4.5.4 (2024-09-16)

4.0.8

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

[4.0.6] - 2024-05-21

v3.29.4

3.29.4

Bug Fixes

Pull Requests

v3.29.3

3.29.3

Bug Fixes

Pull Requests

v3.29.2

3.29.2

Bug Fixes

Pull Requests

v3.29.1

3.29.1

Bug Fixes

rollup changelog

4.24.0

Features

Pull Requests

4.23.0

Features

Pull Requests

4.22.5

Bug Fixes

Pull Requests

4.22.4

Bug Fixes

8.18.0

Features

8.17.1

Bug fixes

vercel bot commented Oct 4, 2024 • edited Loading

vercel bot commented Oct 4, 2024 •

edited

Loading