Closed dependabot[bot] closed 4 months ago
Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information
Unable to locate .performanceTestingBot config file
Check out the playback for this Pull Request here.
Thanks @dependabot[bot] for opening this PR!
For COLLABORATOR only :
To add labels, comment on the issue
/label add label1,label2,label3
To remove labels, comment on the issue
/label remove label1,label2,label3
Processing PR updates...
[!IMPORTANT]
Auto Review Skipped
Bot user detected.
To trigger a single review, invoke the
@coderabbitai review
command.
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?
In many situations, applications will rely on OS provided functions, scripts, macros and utilities instead of reimplementing them in code. While functions would typically be accessed through a native interface library, the remaining three OS provided features will normally be invoked via the command line or launched as a process. If unsafe inputs are used to construct commands or arguments, it may allow arbitrary OS operations to be performed that can compromise the server.
This vulnerability refers to the ability of an attacker to arbitrarily perform a redirection (external) or forward (internal) against the system. It arises due to insufficient validation or sanitisation of inputs used to perform a redirect or forward and may result in privilege escalation (in the case of a forward) or may be used to launch phishing attacks against users (in the case of redirects).
A race condition is a flaw that produces an unexpected result when the timing of actions impact other actions.
Server-Side Request Forgery (SSRF) vulnerabilities are caused when an attacker can supply or modify a URL that reads or sends data to the server. The attacker can create a malicious request with a manipulated URL, when this request reaches the server, the server-side code executes the exploit URL causing the attacker to be able to read data from services that shouldn't be exposed.
First PR by @dependabot[bot]
PR Details of @dependabot[bot] in michaelgrosner-tribeca : | OPEN | CLOSED | TOTAL |
---|---|---|---|
1 | 0 | 1 |
New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
Package | New capabilities | Transitives | Size | Publisher |
---|---|---|---|---|
npm/@types/request@2.48.12 | Transitive: filesystem, network | +8 |
350 kB | types |
npm/angular@1.8.3 | None | 0 |
2.09 MB | angular |
npm/express@4.19.2 | environment, filesystem, network Transitive: eval, unsafe | +63 |
2.12 MB | wesleytodd |
npm/grunt@1.5.3 | Transitive: environment, eval, filesystem, shell | +98 |
3.66 MB | vladikoff |
npm/jquery@3.5.0 | None | 0 |
1.32 MB | mgol |
npm/moment@2.29.4 | None | 0 |
4.23 MB | ichernev |
npm/mongodb@3.1.13 | filesystem, network Transitive: eval, unsafe | +9 |
2.76 MB | mbroadst |
npm/request@2.88.2 | environment, filesystem, network Transitive: eval | +46 |
3.86 MB | mikeal |
npm/socket.io@2.5.0 | filesystem, network Transitive: environment, shell | +32 |
2.62 MB | darrachequesne |
🚮 Removed packages: npm/@types/request@0.0.46, npm/angular@1.6.4, npm/express@4.15.2, npm/grunt@1.0.1, npm/jquery@3.2.1, npm/lodash@4.17.4, npm/moment@2.18.1, npm/mongodb@2.2.25, npm/request@2.81.0, npm/socket.io@1.7.4
Bumps the npm_and_yarn group with 11 updates in the / directory:
1.6.4
1.8.3
1.6.14
1.8.9
4.15.2
4.19.2
1.0.1
1.5.3
3.2.1
3.5.0
4.17.4
4.17.21
2.18.1
2.29.4
2.2.25
3.1.13
2.81.0
2.88.2
0.0.46
2.48.12
1.4.5
2.4.0
Updates
angular
from 1.6.4 to 1.8.3Changelog
Sourced from angular's changelog.
... (truncated)
Commits
cf16b24
docs(changelog): add release notes for 1.8.3757d56e
docs(*): update end-of-life messages (#17177)f362437
docs(eol): add EOL options text and link to template header used in every pagefb04e42
test(Angular): fixangularInit()
tests on Safari v15+6a52c4f
test(input): fix tests on Firefox v93+ed30c4d
docs(README.md): add wiki link to MVC4032655
chore(deps): bump js-yaml from 3.5.5 to 3.14.147f8c65
chore(deps): bump normalize-url from 4.5.0 to 4.5.156b0ee3
chore(e2e): run tests against Chrome 91 on macOS Catalina58cd897
chore(e2e): run tests against Firefox 85 on macOS CatalinaUpdates
@types/angular
from 1.6.14 to 1.8.9Commits
Updates
express
from 4.15.2 to 4.19.2Release notes
Sourced from express's releases.
... (truncated)
Changelog
Sourced from express's changelog.
... (truncated)
Commits
04bc627
4.19.2da4d763
Improved fix for open redirect allow list bypass4f0f6cc
4.19.1a003cfa
Allow passing non-strings to res.location with new encoding handling checks f...a1fa90f
fixed un-edited version in history.md for 4.19.011f2b1d
build: fix build due to inconsistent supertest behavior in older versions084e365
4.19.00867302
Prevent open redirect allow list bypass due to encodeurl567c9c6
Add note on how to update docs for new release (#5541)69a4cf2
deps: cookie@0.6.0Maintainer changes
This version was pushed to npm by wesleytodd, a new releaser for express since your current version.
Updates
grunt
from 1.0.1 to 1.5.3Release notes
Sourced from grunt's releases.
... (truncated)
Changelog
Sourced from grunt's changelog.
... (truncated)
Commits
82d79b8
1.5.3572d79b
Merge pull request #1745 from gruntjs/fix-copy-op58016ff
Patch up race condition in symlink copying.0749e1d
Merge pull request #1746 from JamieSlome/patch-169b7c50
Create SECURITY.mdac667b2
1.5.27f15fd5
Update Changelogb0ec6e1
Merge pull request #1743 from gruntjs/cleanup-link433f91b
Clean up link handlingd5969ec
1.5.1Maintainer changes
This version was pushed to npm by vladikoff, a new releaser for grunt since your current version.
Updates
jquery
from 3.2.1 to 3.5.0Release notes
Sourced from jquery's releases.
Commits
7a0a850
3.5.08570a08
Release: Update AUTHORS.txtda3dd85
Ajax: Do not execute scripts for unsuccessful HTTP responses065143c
Ajax: Overwrite s.contentType with content-type header value, if any1a4f10d
Tests: Blacklist one focusin test in IE9e15d6b
Event: Use only one focusin/out handler per matching window & document966a709
Manipulation: Skip the select wrapper for <option> outside of IE 91d61fd9
Manipulation: Make jQuery.htmlPrefilter an identity function04bf577
Selector: Update Sizzle from 2.3.4 to 2.3.57506c9c
Build: Resolve Travis config warningsMaintainer changes
This version was pushed to npm by mgol, a new releaser for jquery since your current version.
Updates
lodash
from 4.17.4 to 4.17.21Commits
f299b52
Bump to v4.17.21c4847eb
Improve performance oftoNumber
,trim
andtrimEnd
on large input strings3469357
Prevent command injection through_.template
'svariable
optionded9bc6
Bump to v4.17.20.63150ef
Documentation fixes.00f0f62
test.js: Remove trailing comma.846e434
Temporarily use a custom fork oflodash-cli
.5d046f3
Re-enable Travis tests on4.17
branch.aa816b3
Remove/npm-package
.d7fbc52
Bump to v4.17.19Maintainer changes
This version was pushed to npm by bnjmnt4n, a new releaser for lodash since your current version.
Updates
moment
from 2.18.1 to 2.29.4Changelog
Sourced from moment's changelog.
... (truncated)
Commits
000ac18
Build 2.24.4f2006b6
Bump version to 2.24.4536ad0c
Update changelog for 2.29.49a3b589
[bugfix] Fix redos in preprocessRFC2822 regex (#6015)6374fd8
Merge branch 'master' into developb4e6153
Revert "[bugfix] Fix redos in preprocessRFC2822 regex (#6015)"7aebb16
[bugfix] Fix redos in preprocessRFC2822 regex (#6015)57c9062
Build 2.29.3aaf50b6
Fixup release complaints26f4aef
Bump version to 2.29.3Updates
mongodb
from 2.2.25 to 3.1.13Changelog
Sourced from mongodb's changelog.
... (truncated)
Commits
c6f417e
chore(release): 3.1.13210c71d
fix(db_ops): ensure we async resolve errors in createCollection5ad9fa9
fix(changeStream): properly handle changeStream event mid-close (#1902)e806be4
fix(bulk): honor ignoreUndefined in initializeUnorderedBulkOp050267d
fix(*): restore ability to webpack by removingmakeLazyLoader
6e896f4
docs: adding aggregation, createIndex, and runCommand examplescb3cd12
chore(release): 3.1.12508d685
Revert "chore(release): 3.2.0"e7619aa
chore(release): 3.2.0d0dc228
chore(travis): include forgotten stage info for sharded buildsMaintainer changes
This version was pushed to npm by mbroadst, a new releaser for mongodb since your current version.
Updates
request
from 2.81.0 to 2.88.2Changelog
Sourced from request's changelog.
Commits
Updates
@types/request
from 0.0.46 to 2.48.12Commits
Updates
socket.io
from 1.4.5 to 2.4.0Release notes
Sourced from socket.io's releases.
... (truncated)
Changelog
Sourced from socket.io's changelog.
... (truncated)
Commits
873fdc5
chore(release): 2.4.0f78a575
fix(security): do not allow all origins by defaultd33a619
fix: properly overwrite the query sent in the handshake3951a79
chore: bump engine.io version6fa026f
ci: migrate to GitHub Actions47161a6
[chore] Release 2.3.0cf39362
[chore] Bump socket.io-parser to version 3.4.04d01b2c
test: remove deprecated Buffer usage (#3481)8227192
[docs] Fix the default value of the 'origins' parameter (#3464)1150eb5
[chore] Bump engine.io to version 3.4.0Maintainer changes
This version was pushed to npm by darrachequesne, a new releaser for socket.io since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show