Open renovate[bot] opened 1 year ago
This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
Hey! Changelogs info seems to be missing or might be in incorrect format. Please use the below template in PR description to ensure Changelogg can detect your changes:
- (tag) changelog_text
or
```
- tag: changelog_text
```
**OR**
You can add tag in PR header or while doing a commit too
```
(tag) PR header
```
or
```
tag: PR header
```
Valid tags: **added** / **feat**, **changed**, **deprecated**, **fixed** / **fix**, **removed**, **security**, **build**, **ci**, **chore**, **docs**, **perf**, **refactor**, **revert**, **style**, **test**
Thanks!
For more info, check out [changelogg docs](https://docs.changelogg.io/)
Pull request by bot. No need to analyze
The latest updates on your projects. Learn more about Vercel for Git ↗︎
Name | Status | Preview | Updated |
---|---|---|---|
styled-code-formats | ✅ Ready (Inspect) | Visit Preview | Mar 27, 2023 at 10:00PM (UTC) |
New dependency changes detected. Learn more about Socket for GitHub ↗︎
👍 No new dependency issues detected in pull request
To ignore an alert, reply with a comment starting with @SocketSecurity ignore
followed by a space separated list of package-name@version
specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@*
or ignore all packages with @SocketSecurity ignore-all
Issue | Status |
---|---|
Install scripts | ✅ 0 issues |
Native code | ✅ 0 issues |
Bin script shell injection | ✅ 0 issues |
Unresolved require | ✅ 0 issues |
Invalid package.json | ✅ 0 issues |
HTTP dependency | ✅ 0 issues |
Git dependency | ✅ 0 issues |
Potential typo squat | ✅ 0 issues |
Known Malware | ✅ 0 issues |
Telemetry | ✅ 0 issues |
Protestware/Troll package | ✅ 0 issues |
📊 Modified Dependency Overview:
⬆️ Updated Package | Version Diff | Capability Access | +/- Transitive Count |
Publisher |
---|---|---|---|---|
eslint-config-prettier@8.8.0 | 6.15.0...8.8.0 | None | +41/-25 |
lydell |
eslint@8.36.0 | 7.20.0...8.36.0 | filesystem, environment | +40/-24 |
eslintbot |
eslint-plugin-jest@27.2.1 | 23.20.0...27.2.1 | filesystem | +56/-26 |
simenb |
@typescript-eslint/parser@5.56.0 | 4.15.1...5.56.0 | None | +49/-39 |
jameshenry |
@typescript-eslint/eslint-plugin@5.56.0 | 4.15.1...5.56.0 | None | +55/-40 |
jameshenry |
🚮 Removed packages: lodash@4.17.20
Thanks for the PR!
This section of the codebase is owner by https://github.com/AlexRogalskiy/ - if they write a comment saying "LGTM" then it will be merged.
Thanks for opening an issue! Make sure you've followed CONTRIBUTING.md.
Is your PR ready for review and processing? Mark the PR ready by including #pr-ready
in a comment.
If you still have work to do, even after marking this ready. Put the PR on hold by including #pr-onhold
in a comment.
This PR contains the following updates:
4.17.20
->4.17.21
GitHub Vulnerability Alerts
CVE-2020-28500
All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the
toNumber
,trim
andtrimEnd
functions.Steps to reproduce (provided by reporter Liyuan Chen):
CVE-2021-23337
lodash
versions prior to 4.17.21 are vulnerable to Command Injection via the template function.Release Notes
lodash/lodash (lodash)
### [`v4.17.21`](https://togithub.com/lodash/lodash/compare/4.17.20...4.17.21) [Compare Source](https://togithub.com/lodash/lodash/compare/4.17.20...4.17.21)Configuration
📅 Schedule: Branch creation - "" in timezone Europe/Moscow, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.