Fix uri scheme validation (@ChALkeR).
Fix boolean schemas with strictKeywords option (#1270)
v6.12.4
Fix: coercion of one-item arrays to scalar that should fail validation (failing example).
v6.12.3
Pass schema object to processCode function
Option for strictNumbers (@issacgerges, #1128)
Fixed vulnerability related to untrusted schemas (CVE-2020-15366)
Time formats support two digit and colon-less variants of timezone offset (#1061 , @cjpillsbury)
Docs: RegExp related security considerations
Tests: Disabled failing typescript test
v6.10.2
Fix: the unknown keywords were ignored with the option strictKeywords: true (instead of failing compilation) in some sub-schemas (e.g. anyOf), when the sub-schema didn't have known keywords.
As we noted when we released Version 3.0, we will support Version 2 through May 2023. As a part of our long-term archive support for Version 2.x, we're releasing USWDS 2.14.0. This release has no functional changes, but it strips all nonessential development dependencies from the codebase. This will allow both the design system and long-term users of 2.x to treat this and any subsequent 2.x release as a long-term archival release, with a limited security vulnerability footprint.
If you use USWDS 2.13.3 and will not be upgrading to 3.0, consider updating to USWDS 2.14.0.
Details
This release removes all dependencies, except those required to build and release. There were no vulnerabilities in the standard dependencies, but there were critical vulnerabilities in a few development dependencies:
Component library
@frctl/fractal
@frctl/mandelbrot
@frctl/nunjucks
Testing
mocha
gulp-spawn-mocha
Compiling
nswatch: Legacy watch task, wasn't used.
gulp-svg-sprite: Added compiled SVG to repo.
handlebars and handlebars-helpers: Used in generating formatted tokens
in SASS
We removed all these dependencies and committed any necessary static assets to the package. We've committed an archival version of the Fractal site in GitHub, but it is not included in the package.
Finally, we added an overrides field to package.json to handle the last remaining vulnerability in gulp.
You can trigger a rebase of this PR by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/GSA/cio.gov-redo/network/alerts).
Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
Bumps the npm_and_yarn group with 15 updates in the / directory:
6.10.0
6.12.6
3.0.0
3.0.1
2.7.1
2.8.9
1.3.5
1.3.8
0.2.3
0.4.0
1.4.1
1.4.2
3.0.4
3.1.2
1.2.0
1.2.8
1.6.7
1.7.0
1.0.6
1.0.7
6.5.2
6.5.3
5.7.0
5.7.2
4.0.0
4.0.3
11.1.1
2.0.2
2.14.0
Updates
ajv
from 6.10.0 to 6.12.6Release notes
Sourced from ajv's releases.
Commits
fe59143
6.12.6d580d3e
Merge pull request #1298 from ajv-validator/fix-urlfd36389
fix: regular expression for "url" format490e34c
docs: link to v7-beta branch9cd93a1
docs: note about v7 in readme877d286
Merge pull request #1262 from b4h0-c4t/refactor-opt-object-typef1c8e45
6.12.5764035e
Merge branch 'ChALkeR-chalker/fix-comma'3798160
Merge branch 'chalker/fix-comma' of git://github.com/ChALkeR/ajv into ChALkeR...a3c7eba
Merge branch 'refactor-opt-object-type' of github.com:b4h0-c4t/ajv into refac...Updates
ansi-regex
from 3.0.0 to 3.0.1Commits
f545bdb
3.0.1c57d4c2
fix a few old XO issues for backport419250f
Fix potential ReDoS (#37)Updates
hosted-git-info
from 2.7.1 to 2.8.9Changelog
Sourced from hosted-git-info's changelog.
... (truncated)
Commits
8d4b369
chore(release): 2.8.929adfe5
fix: backport regex fix from #76afeaefd
chore(release): 2.8.85038b18
fix: #61 & #65 addressing issues w/ url.URL implmentation which regressed nod...7440afa
chore(release): 2.8.72d0bb66
fix: Do not attempt to use url.URL when unavailablef2cdfcf
fix: Do not pass scp-style URLs to the WhatWG url.URLe1b83df
chore(release): 2.8.6ff259a6
Ensure passwords in hosted Git URLs are correctly escaped624fd6f
chore(release): 2.8.5Maintainer changes
This version was pushed to npm by nlf, a new releaser for hosted-git-info since your current version.
Updates
ini
from 1.3.5 to 1.3.8Commits
a2c5da8
1.3.8af5c6bb
Do not use Object.create(null)8b648a1
don't test where our devdeps don't even workc74c8af
1.3.7024b8b5
update deps, add linting032fbaf
Use Object.create(null) to avoid default object property hazards2da9039
1.3.6cfea636
better git push script, before publish instead of after56d2805
do not allow invalid hazardous string as section nameMaintainer changes
This version was pushed to npm by isaacs, a new releaser for ini since your current version.
Updates
json-schema
from 0.2.3 to 0.4.0Commits
f6f6a3b
Use a little more robust method of checking instancesef60987
Update versionb62f1da
Protect against constructor modification, #84fb427cd
Link to json-schema-org repository in addition to site, fixes #5422f1461
Don't allow proto property to be used for schema default/coerce, fixes #84c52a27c
Get basic test to passb3f42b3
Add security policy3b0cec3
Update versionc28470f
Update readme to acknowledge the state of the package7dff9cd
Merge pull request #81 from hodovani/patch-1Updates
jsprim
from 1.4.1 to 1.4.2Changelog
Sourced from jsprim's changelog.
Commits
5c8475f
joyent/node-jsprim#35 Backport json-schema 0.4.0 to version 1.4.xMaintainer changes
This version was pushed to npm by bahamat, a new releaser for jsprim since your current version.
Updates
minimatch
from 3.0.4 to 3.1.2Commits
699c459
3.1.22f2b5ff
fix: trim pattern25d7c0d
3.1.155dda29
fix: treat nocase:true as always having magic5e1fb8d
3.1.0f8145c5
Add 'allowWindowsEscape' option570e8b1
add publishConfig for v3 publishes5b7cd33
3.0.620b4b56
[fix] revert all breaking syntax changes2ff0388
document, expose, and test 'partial:true' optionUpdates
minimist
from 1.2.0 to 1.2.8Changelog
Sourced from minimist's changelog.
... (truncated)
Commits
6901ee2
v1.2.8a026794
Merge tag 'v0.2.3'c0b2661
v0.2.363b8fee
[Fix] Fix long option followed by single dash (#17)72239e6
[Tests] Remove duplicate test (#12)34b0f1c
[eslint] fix indentation3226afa
[Dev Deps] add missingnpmignore
dev dep098873c
[Dev Deps] update@ljharb/eslint-config
,aud
9ec4d27
[Fix] Fix long option followed by single dashba92fe6
[actions] Avoid 0.6 tests due to build failuresMaintainer changes
This version was pushed to npm by ljharb, a new releaser for minimist since your current version.
Updates
extract-zip
from 1.6.7 to 1.7.0Release notes
Sourced from extract-zip's releases.
Commits
c2b1c17
1.7.0990fc64
Add error handler to zipfile object (#67)8285111
feat: don't pin dependency requirements (#88)2a8df24
1.6.830ab06c
build(deps): upgrade mkdirp to 0.5.4 for security2b2a84e
build: ignore lock filesUpdates
path-parse
from 1.0.6 to 1.0.7Commits
Updates
qs
from 6.5.2 to 6.5.3Changelog
Sourced from qs's changelog.
Commits
298bfa5
v6.5.3ed0f5dc
[Fix]parse
: ignore__proto__
keys (#428)691e739
[Robustness]stringify
: avoid relying on a globalundefined
(#427)1072d57
[readme] remove travis badge; add github actions/codecov badges; update URLs12ac1c4
[meta] fix README.md (#399)0338716
[actions] backport actions from main5639c20
Clean up license text so it’s properly detected as BSD-3-Clause51b8a0b
add FUNDING.yml45f6759
[Fix] fix for an impossible situation: when the formatter is called with a no...f814a7f
[Dev Deps] backport from mainUpdates
semver
from 5.7.0 to 5.7.2Release notes
Sourced from semver's releases.
Changelog
Sourced from semver's changelog.
Commits
f8cc313
chore: release 5.7.22f8fd41
fix: better handling of whitespace (#585)deb5ad5
chore:@npmcli/template-oss
@4
.16.0c83c18c
5.7.1956e228
Correct typo in READMEMaintainer changes
This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.
Updates
y18n
from 4.0.0 to 4.0.3Changelog
Sourced from y18n's changelog.
Commits
0aa97c5
chore: release 4.x.x (#128)a8e7f04
build(release-please): configure branch properly (#127)1e21a53
fix(release): 4.x.x should not enforce Node 10 (#126)8dc7580
docs: update CHANGELOG7de58ca
fix: address prototype pollution issueMaintainer changes
This version was pushed to npm by oss-bot, a new releaser for y18n since your current version.
Removes
yargs-parser
Updates
uswds
from 2.0.2 to 2.14.0Release notes
Sourced from uswds's releases.
... (truncated)
Commits
f9bb082
Merge branch 'v2-develop' into v2-main41fb7c8
Merge pull request #5221 from uswds/release-2.14.0f54a1b3
Update uswds-2.14.0-zip-hash.txtb6e7fd2
Publish from the v2-main branch5437030
Merge pull request #5220 from uswds/release-2.14.0d25b704
Update uswds-2.14.0-zip-hash.txtf7ba7b9
Update remaining 2.13.3 referencesc834cb4
Merge branch 'release-2.14.0' into v2-develop88aad12
Update uswds-2.14.0-zip-hash.txt8f12c07
Create uswds-2.14.0-zip-hash.txtYou can trigger a rebase of this PR by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show