cr-gpt[bot]
commented
2 months ago Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information
Closed dependabot[bot] closed 2 months ago
cr-gpt[bot]
commented
2 months ago Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information
performance-testing-bot[bot]
commented
2 months ago Unable to locate .performanceTestingBot config file
secure-code-warrior-for-github[bot]
commented
2 months ago Denial of Service (DoS) attacks caused by Regular Expression which causes the system to hang or cause them to work very slowly when attacker sends a well-crafted input(exponentially related to input size).Denial of service attacks significantly degrade the service quality experienced by legitimate users. These attacks introduce large response delays, excessive losses, and service interruptions, resulting in direct impact on availability.
The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. Source: https://www.owasp.org/index.php/Denial_of_Service
code-companion-ai[bot]
commented
2 months ago Processing PR updates...
codesyncapp[bot]
commented
2 months ago Check out the playback for this Pull Request here.
git-greetings[bot]
commented
2 months ago Thanks @dependabot[bot] for opening this PR!
For COLLABORATOR only :
To add labels, comment on the issue
/label add label1,label2,label3
To remove labels, comment on the issue
/label remove label1,label2,label3
coderabbitai[bot]
commented
2 months ago [!IMPORTANT]
Auto Review Skipped
Bot user detected.
To trigger a single review, invoke the
@coderabbitai reviewcommand.You can disable this status message by setting the
reviews.review_statustofalsein the CodeRabbit configuration file.
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?
git-greetings[bot]
commented
2 months ago | PR Details of @dependabot[bot] in snyk-cli : | OPEN | CLOSED | TOTAL |
|---|---|---|---|
| 2 | 6 | 8 |
socket-security[bot]
commented
2 months ago New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
🚮 Removed packages: npm/@octokit/rest@18.12.0, npm/@open-policy-agent/opa-wasm@1.6.0, npm/@pagerduty/pdjs@2.2.4, npm/@sentry/node@7.34.0, npm/@sindresorhus/is@4.0.1, npm/@slack/webhook@7.0.2, npm/@snyk/cli-interface@2.12.0, npm/@snyk/cloud-config-parser@1.14.5, npm/@snyk/code-client@4.23.5, npm/@snyk/dep-graph@2.8.1, npm/@snyk/docker-registry-v2-client@2.11.0, npm/@snyk/fix-pipenv-pipfile@0.7.1, npm/@snyk/fix-poetry@0.9.1, npm/@snyk/gemfile@1.2.0, npm/@snyk/snyk-cocoapods-plugin@2.5.3, npm/@snyk/snyk-hex-plugin@1.1.6, npm/@types/body-parser@1.19.1, npm/@types/cross-spawn@6.0.2, npm/cdktf-cli@0.20.3
socket-security[bot]
commented
2 months ago 🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎
To accept the risk, merge this PR and you will not be notified again.
| Alert | Package | Note | Source |
|---|---|---|---|
| Install scripts | npm/protobufjs@6.8.8 |
| |
| Install scripts | npm/grpc@1.22.2 |
| |
| Install scripts | npm/pprof@1.1.0 |
| |
| Install scripts | npm/protobufjs@6.8.6 |
|
Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.
Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.
Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all
@SocketSecurity ignore npm/protobufjs@6.8.8@SocketSecurity ignore npm/grpc@1.22.2@SocketSecurity ignore npm/pprof@1.1.0@SocketSecurity ignore npm/protobufjs@6.8.6
Bumps the npm_and_yarn group with 1 update in the /test/acceptance/workspaces/npm-package directory: debug. Bumps the npm_and_yarn group with 1 update in the /test/acceptance/workspaces/npm-package-missing-dep directory: debug. Bumps the npm_and_yarn group with 1 update in the /test/acceptance/workspaces/npm-package-policy directory: marked. Bumps the npm_and_yarn group with 4 updates in the /test/acceptance/workspaces/npm-package-shrinkwrap directory: debug, acorn, ajv and rewire. Bumps the npm_and_yarn group with 2 updates in the /test/acceptance/workspaces/npm-package-with-dist-tag-subdependency directory: follow-redirects and cdktf-cli. Bumps the npm_and_yarn group with 1 update in the /test/acceptance/workspaces/npm-package-with-overrides directory: ip. Bumps the npm_and_yarn group with 2 updates in the /test/acceptance/workspaces/yarn-app directory: marked and moment. Bumps the npm_and_yarn group with 1 update in the /test/acceptance/workspaces/yarn-lock-v2-vuln directory: lodash. Bumps the npm_and_yarn group with 6 updates in the /test/acceptance/workspaces/yarn-out-of-sync directory:
3.2.53.2.72.1.12.1.33.12.03.14.14.17.114.17.213.0.43.1.25.5.15.7.2Bumps the npm_and_yarn group with 1 update in the /test/acceptance/workspaces/yarn-package directory: debug. Bumps the npm_and_yarn group with 1 update in the /test/acceptance/workspaces/yarn-v2 directory: lodash. Bumps the npm_and_yarn group with 5 updates in the /test/acceptance/workspaces/yarn-workspace-out-of-sync directory:
4.1.14.3.14.17.154.17.213.0.43.1.22.6.02.6.73.2.13.2.2Bumps the npm_and_yarn group with 5 updates in the /test/acceptance/workspaces/yarn-workspaces directory:
4.17.154.17.213.0.43.1.22.6.02.6.73.2.13.2.21.3.01.4.8Bumps the npm_and_yarn group with 3 updates in the /test/acceptance/workspaces/yarn-workspaces-v2 directory: minimatch, node-fetch and node-uuid. Bumps the npm_and_yarn group with 2 updates in the /test/acceptance/workspaces/yarn-workspaces-v2-resolutions directory: node-fetch and node-uuid. Bumps the npm_and_yarn group with 2 updates in the /ts-binary-wrapper directory: semver and @babel/traverse.
Updates
debugfrom 2.2.0 to 2.6.9Release notes
Sourced from debug's releases.
... (truncated)
Changelog
Sourced from debug's changelog.
... (truncated)
Commits
13abeaeRelease 2.6.9f53962eremove ReDoS regexp in %o formatter (#504)52e1f21Release 2.6.82482e08Check for undefined on browser globals (#462)6bb07f7release 2.6.715850cbFix Regular Expression Denial of Service (ReDoS)4a6c85cupdate "debug" to v1.0.0 (#454)b68dbf8Fix typo (#455)1351d2fInline extend function in node implementation (#452)c211947update version for componentUpdates
msfrom 0.7.1 to 2.0.0Release notes
Sourced from ms's releases.
Commits
1c6264b2.1.382495adUse GitHub Actions CI (#154)1a13a88Run prettier 2.x (#153)1048042Add prettier as a dev dependency (#135)f2bfb40Rename zeit to vercel (#151)adf1eb2Bump eslint from 4.12.1 to 4.18.2 (#122)79208852.1.2199ff78Update chat badge (#119)d1add60Update regexp for10-.5is invalid input (#117)d95e17fSupport error in case of Infinity (#116)Maintainer changes
This version was pushed to npm by styfle, a new releaser for ms since your current version.
Updates
debugfrom 2.2.0 to 2.6.9Release notes
Sourced from debug's releases.
... (truncated)
Changelog
Sourced from debug's changelog.
... (truncated)
Commits
13abeaeRelease 2.6.9f53962eremove ReDoS regexp in %o formatter (#504)52e1f21Release 2.6.82482e08Check for undefined on browser globals (#462)6bb07f7release 2.6.715850cbFix Regular Expression Denial of Service (ReDoS)4a6c85cupdate "debug" to v1.0.0 (#454)b68dbf8Fix typo (#455)1351d2fInline extend function in node implementation (#452)c211947update version for componentUpdates
markedfrom 0.3.6 to 4.0.10Release notes
Sourced from marked's releases.
... (truncated)
Commits
ae01170chore(release): 4.0.10 [skip ci]fceda57🗜️ build [skip ci]8f80657fix(security): fix redos vulnerabilitiesc4a3ccdMerge pull request from GHSA-rrrm-qjm4-v8hfd7212a6chore(deps-dev): Bump jasmine from 4.0.0 to 4.0.1 (#2352)5a84db5chore(deps-dev): Bump rollup from 2.62.0 to 2.63.0 (#2350)2bc67a5chore(deps-dev): Bump markdown-it from 12.3.0 to 12.3.2 (#2351)98996b8chore(deps-dev): Bump@babel/preset-envfrom 7.16.5 to 7.16.7 (#2353)ebc2c95chore(deps-dev): Bump highlight.js from 11.3.1 to 11.4.0 (#2354)e5171a9chore(release): 4.0.9 [skip ci]Maintainer changes
This version was pushed to npm by tonybrix, a new releaser for marked since your current version.
Updates
debugfrom 3.1.0 to 3.2.7Release notes
Sourced from debug's releases.
... (truncated)
Changelog
Sourced from debug's changelog.
... (truncated)
Commits
13abeaeRelease 2.6.9f53962eremove ReDoS regexp in %o formatter (#504)52e1f21Release 2.6.82482e08Check for undefined on browser globals (#462)6bb07f7release 2.6.715850cbFix Regular Expression Denial of Service (ReDoS)4a6c85cupdate "debug" to v1.0.0 (#454)b68dbf8Fix typo (#455)1351d2fInline extend function in node implementation (#452)c211947update version for componentUpdates
msfrom 2.0.0 to 2.1.1Release notes
Sourced from ms's releases.
Commits
1c6264b2.1.382495adUse GitHub Actions CI (#154)1a13a88Run prettier 2.x (#153)1048042Add prettier as a dev dependency (#135)f2bfb40Rename zeit to vercel (#151)adf1eb2Bump eslint from 4.12.1 to 4.18.2 (#122)79208852.1.2199ff78Update chat badge (#119)d1add60Update regexp for10-.5is invalid input (#117)d95e17fSupport error in case of Infinity (#116)Maintainer changes
This version was pushed to npm by styfle, a new releaser for ms since your current version.
Updates
acornfrom 5.7.1 to 5.7.4Commits
6370e90Mark version 5.7.4fbc15b1More rigorously check surrogate pairs in regexp validator910e62bMark version 5.7.33442a80Make generate-identifier-regex capable of rewriting src/identifier.js22b22f3Raise specific errors for unterminated template literals1461c7cFix a lint error0c12f63Fix tokenizing of regexps after .of832c308Fix 404 url95ca55cMark version 5.7.2bba80abRemove another fixed test from the 262 whitelistUpdates
ajvfrom 5.5.2 to 6.12.6Release notes
Sourced from ajv's releases.
... (truncated)
Commits
fe591436.12.6d580d3eMerge pull request #1298 from ajv-validator/fix-urlfd36389fix: regular expression for "url" format490e34cdocs: link to v7-beta branch9cd93a1docs: note about v7 in readme877d286Merge pull request #1262 from b4h0-c4t/refactor-opt-object-typef1c8e456.12.5764035eMerge branch 'ChALkeR-chalker/fix-comma'3798160Merge branch 'chalker/fix-comma' of git://github.com/ChALkeR/ajv into ChALkeR...a3c7ebaMerge branch 'refactor-opt-object-type' of github.com:b4h0-c4t/ajv into refac...Updates
rewirefrom 4.0.1 to 7.0.0Release notes
Sourced from rewire's releases.
Changelog
Sourced from rewire's changelog.
Commits
ff62cfcv7.0.0e0ea17dRemove CoffeeScript supporta183ba7Add TypeScript support2d7729fMerge remote-tracking branch 'origin/master' into pulls/ts-support092e554Also drop official Node 16 supportf32ef51Update package-lock.json6deb9bdUpdate ESLint and drop official Node 10.x, 12.x, 14.x supportc9b536fNEW Add support for .ts filesf5c655aAdd test case for re-assigning consts9e7f846v6.0.0Updates
ansi-regexfrom 2.1.1 to 5.0.1Release notes
Sourced from ansi-regex's releases.
Commits
a9babce5.0.14657833fix incorrect formatc3c0b3fFix potential ReDoS (#37)178363bMove to GitHub Actions (#35)0755e66Add@Qix- to funding.yml2b56fb05.0.0f26f7feMeta tweakse77ea17Add TypeScript definition (#32)166a0d5Require Node.js 8f115fcaTidelift tasksUpdates
js-yamlfrom 3.12.0 to 4.1.0Changelog
Sourced from js-yaml's changelog.
Commits
37caaad3.14.1 released094c0f7dist rebuild9586ebeAvoid calling hasOwnProperty of user-controlled objects34e50723.14.0 released7b25c83Browser files rebuild6f73473Dev deps bump0c29349Travis-CI: drop old nodejs versions10be97efix(loader): Add support forsafe/loadAll(input, options)d6983ddFix issue #526: wrong quote position writing condensed flow (#527)93fbf7dfix issue 526 (wrong quote position writing condensed flow)Updates
minimatchfrom 3.0.4 to 3.1.2Commits
699c4593.1.22f2b5fffix: trim pattern25d7c0d3.1.155dda29fix: treat nocase:true as always having magic5e1fb8d3.1.0f8145c5Add 'allowWindowsEscape' option570e8b1add publishConfig for v3 publishes5b7cd333.0.620b4b56[fix] revert all breaking syntax changes2ff0388document, expose, and test 'partial:true' optionUpdates
follow-redirectsfrom 1.15.4 to 1.15.6Commits
35a517cRelease version 1.15.6 of the npm package.c4f847fDrop Proxy-Authorization across hosts.8526b4aUse GitHub for disclosure.b1677ceRelease version 1.15.5 of the npm package.d8914f7Preserve fragment in responseUrl.Updates
cdktf-clifrom 0.20.3 to 0.20.7Release notes
Sourced from cdktf-cli's releases.