AlexRogalskiy / code-formats

šŸ”£ Styled Code Formats API
https://styled-code-formats.vercel.app
GNU General Public License v3.0
5 stars 1 forks source link

:arrow_up: Updates jsdom to v16.5.0 [SECURITY] - autoclosed #949

Closed renovate[bot] closed 4 months ago

renovate[bot] commented 1 year ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
jsdom 16.4.0 -> 16.5.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2021-20066

JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.


Release Notes

jsdom/jsdom (jsdom) ### [`v16.5.0`](https://togithub.com/jsdom/jsdom/blob/HEAD/Changelog.md#1650) [Compare Source](https://togithub.com/jsdom/jsdom/compare/16.4.0...16.5.0) - Added `window.queueMicrotask()`. - Added `window.event`. - Added `inputEvent.inputType`. (diegohaz) - Removed `ondragexit` from `Window` and friends, per a spec update. - Fixed the URL of `about:blank` iframes. Previously it was getting set to the parent's URL. (SimonMueller) - Fixed the loading of subresources from the filesystem when they had non-ASCII filenames. - Fixed the `hidden=""` attribute to cause `display: none` per the user-agent stylesheet. (ph-fritsche) - Fixed the `new File()` constructor to no longer convert `/` to `:`, per [a pending spec update](https://togithub.com/w3c/FileAPI/issues/41). - Fixed mutation observer callbacks to be called with the `MutationObserver` instance as their `this` value. - Fixed `` and `` to be mutable even when disabled, per [a spec update](https://togithub.com/whatwg/html/pull/5805). - Fixed `XMLHttpRequest` to not fire a redundant final `progress` event if a `progress` event was previously fired with the same `loaded` value. This would usually occur with small files. - Fixed `XMLHttpRequest` to expose the `Content-Length` header on cross-origin responses. - Fixed `xhr.response` to return `null` for failures that occur during the middle of the download. - Fixed edge cases around passing callback functions or event handlers. (ExE-Boss) - Fixed edge cases around the properties of proxy-like objects such as `localStorage` or `dataset`. (ExE-Boss) - Fixed a potential memory leak with custom elements (although we could not figure out how to trigger it). (soncodi)

Configuration

šŸ“… Schedule: Branch creation - "" in timezone Europe/Moscow, Automerge - At any time (no schedule defined).

šŸš¦ Automerge: Enabled.

ā™» Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

šŸ”• Ignore: Close this PR and you won't be reminded about this update again.



This PR has been generated by Mend Renovate. View repository job log here.

renovate[bot] commented 1 year ago

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.


changelogg[bot] commented 1 year ago

Hey! Changelogs info seems to be missing or might be in incorrect format. Please use the below template in PR description to ensure Changelogg can detect your changes:

    - (tag) changelog_text
or
```
- tag: changelog_text
```
**OR**
You can add tag in PR header or while doing a commit too
```    
(tag) PR header
```
or
```
tag: PR header
```
Valid tags: **added** / **feat**, **changed**, **deprecated**, **fixed** / **fix**, **removed**, **security**, **build**, **ci**, **chore**, **docs**, **perf**, **refactor**, **revert**, **style**, **test**
Thanks!
For more info, check out [changelogg docs](https://docs.changelogg.io/)
viezly[bot] commented 1 year ago

Pull request by bot. No need to analyze

vercel[bot] commented 1 year ago

The latest updates on your projects. Learn more about Vercel for Git ā†—ļøŽ

Name Status Preview Updated
styled-code-formats āœ… Ready (Inspect) Visit Preview Mar 27, 2023 at 10:00PM (UTC)
socket-security[bot] commented 1 year ago

New dependency changes detected. Learn more about Socket for GitHub ā†—ļøŽ

šŸ‘ No new dependency issues detected in pull request

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

Pull request alert summary
Issue Status
Install scripts āœ… 0 issues
Native code āœ… 0 issues
Bin script shell injection āœ… 0 issues
Unresolved require āœ… 0 issues
Invalid package.json āœ… 0 issues
HTTP dependency āœ… 0 issues
Git dependency āœ… 0 issues
Potential typo squat āœ… 0 issues
Known Malware āœ… 0 issues
Telemetry āœ… 0 issues
Protestware/Troll package āœ… 0 issues

šŸ“Š Modified Dependency Overview:

ā¬†ļø Updated Package Version Diff Capability Access +/- Transitive Count Publisher
eslint-config-prettier@8.8.0 6.15.0...8.8.0 None +41/-24 lydell
eslint@8.36.0 7.20.0...8.36.0 filesystem, environment +40/-23 eslintbot
jsdom@16.5.0 16.4.0...16.5.0 eval, network, filesystem, shell +10/-5 domenic
eslint-plugin-jest@27.2.1 23.20.0...27.2.1 filesystem +56/-25 simenb
@typescript-eslint/parser@5.56.0 4.15.1...5.56.0 None +49/-38 jameshenry
@typescript-eslint/eslint-plugin@5.56.0 4.15.1...5.56.0 None +55/-39 jameshenry
github-actions[bot] commented 1 year ago

Thanks for opening an issue! Make sure you've followed CONTRIBUTING.md.

github-actions[bot] commented 1 year ago

Hello from PR Helper

Is your PR ready for review and processing? Mark the PR ready by including #pr-ready in a comment.

If you still have work to do, even after marking this ready. Put the PR on hold by including #pr-onhold in a comment.

github-actions[bot] commented 1 year ago

Thanks for the PR!

This section of the codebase is owner by https://github.com/AlexRogalskiy/ - if they write a comment saying "LGTM" then it will be merged.