search

NodeSecure / vulnera

Programmatically fetch security vulnerabilities with one or many strategies (NPM Audit, Sonatype, Snyk, Node.js DB).
MIT License
30 stars 14 forks source link

chore(deps): bump the dependencies group with 2 updates #244

Closed dependabot[bot] closed 4 months ago

dependabot[bot] commented 4 months ago

Bumps the dependencies group with 2 updates: @pnpm/audit and @pnpm/lockfile-file.

Updates @pnpm/audit from 7.0.27 to 8.0.0

Release notes

Sourced from @​pnpm/audit's releases.

v8.0.0

We are excited to announce the latest release of pnpm! To install it, check the installation page.

image

Major Changes

Node.js 14 Support Discontinued

If you still require Node.js 14, don't worry. We ship pnpm bundled with Node.js. This means that regardless of which Node.js version you've installed, pnpm will operate using the necessary Node.js runtime. For this to work you need to install pnpm either using the standalone script or install the @pnpm/exe package.

Configuration Updates

Most of the configuration changes are related to peer dependencies. Most of these settings were implemented long ago, and we recommended them to users encountering peer dependency issues. The recently added dedupe-peer-dependents resolved many such problems. With these new defaults, pnpm will face significantly fewer issues during migration from other package managers.

Lockfile Modifications

  • Lockfile v6 is adopted. This new format improves the readability of the lockfile by removing hashes from package IDs. It also has some rearrangement of fields in the importers section. The new pnpm-lock.yaml file is more resistant to git merge conflicts!
  • The registry field is removed from the resolution object in pnpm-lock.yaml.
  • A lockfile is generated even for projects with no dependencies.

Other Changes

  • When there's a files field in the package.json, only the files that are listed in it will be deployed. The same logic is applied when injecting packages. This behaviour can be changed by setting the deploy-all-files setting to true (Related issue #5911).
  • Direct dependencies are deduped. If a dependency is present in both a project and the workspace root, it will only be linked to the workspace root.

Migration Instructions

Before updating pnpm to v8 in your CI, regenerate your pnpm-lock.yaml. To upgrade your lockfile, run pnpm install and commit the changes. Existing dependencies will not be updated; however, due to configuration changes in pnpm v8, some missing peer dependencies may be added to the lockfile and some packages may get deduplicated.

You can commit the new lockfile even before upgrading Node.js in the CI, as pnpm v7 already supports the new lockfile format.

pnpm v7 Support

pnpm v7 will likely not receive any new features, but it will continue to get bug fixes for a few months and vulnerability fixes for at least a year.

Our Gold Sponsors

... (truncated)

Commits


Updates @pnpm/lockfile-file from 8.1.8 to 9.0.0

Release notes

Sourced from @​pnpm/lockfile-file's releases.

v9.0.0-rc.2

Installation instructions: https://pnpm.io/9.x/installation

Major Changes

  • Node.js v16 support dropped. Use at least Node.js v18.12.

  • Lockfile version bumped to v9.

  • Support for lockfile v5 is dropped. Use pnpm v8 to convert lockfile v5 to lockfile v6 #7470.

  • The dedupe-injected-deps setting is true by default.

  • The default value of the link-workspace-packages setting changed from true to false. This means that by default, dependencies will be linked from workspace packages only when they are specified using the workspace protocol.

  • The default value of the hoist-workspace-packages is true.

  • pnpm licenses list prints license information of all versions of the same package in case different versions use different licenses. The format of the pnpm licenses list --json output has been changed #7528.

  • A new command added for printing completion code to the console: pnpm completion [shell]. The old command that modified the user's shell dotfiles has been removed #3083.

  • pnpm will now check the package.json file for a packageManager field. If this field is present and specifies a different package manager or a different version of pnpm than the one you're currently using, pnpm will not proceed. This ensures that you're always using the correct package manager and version that the project requires.

  • enable-pre-post-scripts is set to true by default. This means that when you run a script like start, prestart and poststart will also run.

  • When installing git-hosted dependencies, only pick the files that would be packed with the package #7638.

  • Use the same directory for state files on macOS as on Linux (~/.local/state/pnpm).

  • Peer dependencies of peer dependencies are now resolved correctly. When peer dependencies have peer dependencies of their own, the peer dependencies are grouped with their own peer dependencies before being linked to their dependents.

    For instance, if card has react in peer dependencies and react has typescript in its peer dependencies, then the same version of react may be linked from different places if there are multiple versions of typescript. For instance:

    project1/package.json
{
  "dependencies": {
    "card": "1.0.0",
    "react": "16.8.0",
    "typescript": "7.0.0"
  }
}
project2/package.json
{
  "dependencies": {
    "card": "1.0.0",
    "react": "16.8.0",
    "typescript": "8.0.0"
  }
}
node_modules

... (truncated)

Commits


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
dependabot[bot] commented 4 months ago

Superseded by #245.