socket-security[bot]
commented
1 week ago New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
| Package | New capabilities | Transitives | Size | Publisher |
|---|---|---|---|---|
| npm/@yao-pkg/pkg@6.1.1 | environment, filesystem, network, shell, unsafe Transitive: eval | +133 |
14.9 MB | roberts_lando |
🚮 Removed packages: npm/@yao-pkg/pkg@5.16.1
Bumps @yao-pkg/pkg from 5.16.1 to 6.1.1.
Release notes
Sourced from
@yao-pkg/pkg's releases.... (truncated)
Changelog
Sourced from
@yao-pkg/pkg's changelog.Commits
55c70faRelease 6.1.193fed60fix: missingfs/promisespatches to resolveNot founderror (#124)8913dffRelease 6.1.0fa4f911chore: fix yarn.lock issues2aae943feat: bump fetch 3.5.17 with node 22.11.0 supportc9b77faRelease 6.0.14acb187fix: deprecated_extendin bootstrap.js (#118)d818a04fix: follow exact SEA baking procedure for Mac (#116)e41355cfix: avoid endless loop when handling symlinks (#109) by@q0rban(#109)81bd04atest: fix verify pkg version testDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show