Skyscanner / sonar-secrets

SonarQube plugin for identifying hardcoded secrets, such as passwords, API keys, AWS credentials, etc..
Other
100 stars 24 forks source link

Bump javascript.version from 3.0.0.4962 to 7.2.1.14998 in /javascript #11

Closed dependabot[bot] closed 3 years ago

dependabot[bot] commented 3 years ago

Bumps javascript.version from 3.0.0.4962 to 7.2.1.14998. Updates javascript-frontend from 3.0.0.4962 to 7.2.1.14998

Release notes

Sourced from javascript-frontend's releases.

7.2.1

Bugfix release to address various issues in SonarLint.

7.2

Support TS 4.1

7.1

No release notes provided.

7.0.1

Revert custom rule API removal

7.0.0

All rules rely on TypeScript parser.

6.7.0.14237

No release notes provided.

6.6.0.13923

Many new rules related to cryptography (see MMF-1894 ) and many rules migrated to ESLint parser

6.5.0.13383

No release notes provided.

SonarJS 6.4.1

Bugfix release:

  • Filtering out huge files is now applied only to JS/TS.

SonarJS 6.4

New rules:

  • S2598: File uploads should be restricted (formidable)
  • S4502: Disabling CSRF protection is security-sensitive
  • S4507: Delivering code in production with debug features activated is security-sensitive
  • S5689: Recovering fingerprints from web application technologies should not be possible
  • S5691: Statically serving hidden files is security-sensitive
  • S5693: Allowing requests with excessive content length is security-sensitive

Improved rules:

  • S5122: now raised only when permissive CORS policy is obvious; Support for cors middleware.

Deprecated rules:

  • S1442 (superseded by S4507)
  • S1525 (superseded by S4507)

Changes in the requirements:

... (truncated)

Commits


Updates javascript-checks-testkit from 3.0.0.4962 to 7.2.1.14998

Release notes

Sourced from javascript-checks-testkit's releases.

7.2.1

Bugfix release to address various issues in SonarLint.

7.2

Support TS 4.1

7.1

No release notes provided.

7.0.1

Revert custom rule API removal

7.0.0

All rules rely on TypeScript parser.

6.7.0.14237

No release notes provided.

6.6.0.13923

Many new rules related to cryptography (see MMF-1894 ) and many rules migrated to ESLint parser

6.5.0.13383

No release notes provided.

SonarJS 6.4.1

Bugfix release:

  • Filtering out huge files is now applied only to JS/TS.

SonarJS 6.4

New rules:

  • S2598: File uploads should be restricted (formidable)
  • S4502: Disabling CSRF protection is security-sensitive
  • S4507: Delivering code in production with debug features activated is security-sensitive
  • S5689: Recovering fingerprints from web application technologies should not be possible
  • S5691: Statically serving hidden files is security-sensitive
  • S5693: Allowing requests with excessive content length is security-sensitive

Improved rules:

  • S5122: now raised only when permissive CORS policy is obvious; Support for cors middleware.

Deprecated rules:

  • S1442 (superseded by S4507)
  • S1525 (superseded by S4507)

Changes in the requirements:

... (truncated)

Commits


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
dependabot[bot] commented 3 years ago

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.