YamagutiSenior / juice-shop

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application
https://owasp-juice.shop
MIT License
0 stars 0 forks source link

[Snyk] Upgrade i18n from 0.11.1 to 0.15.1 #8

Open YamagutiSenior opened 1 month ago

YamagutiSenior commented 1 month ago

snyk-top-banner

Snyk has created this PR to upgrade i18n from 0.11.1 to 0.15.1.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


Release notes
Package name: i18n
  • 0.15.1 - 2022-09-22
  • 0.15.0 - 2022-05-19

    add YAML support by parser config

  • 0.14.2 - 2022-03-05

    Fixed

    Fixes #493 - using i18n with a combination of retry and sync settings lead to a 'Maximum call stack size exceeded' exception due to an infinite loop while writing phrases to all locale files.

    const i18n = new I18n({
        // [...]
        retryInDefaultLocale: true,
        syncFiles: true,
    })
  • 0.14.1 - 2022-01-30

    Fixed

    • upgrade all dev dependencies without breaking changes
    • upgrade all dependencies without breaking changes

    This also updates to mocha 9.2.0 (mochajs/mocha#4814) which fixes GHSA-qrpm-p2h7-hrv2

  • 0.14.0 - 2022-01-23

    Changed

    • replaces sprintf-js with fast-printf #453
    • replaces deprecated messageformat with @ messageformat/core #472
    • drops node support <10
    • local dev defaults to node 16
  • 0.13.4 - 2021-12-29

    Fixed

    • upgrade all dev dependencies without breaking changes
    • upgrade all dependencies without breaking changes

    see aa60ac7, 3139881 and 4e6963f for details

    Added

    • test directory traversal (#486)
  • 0.13.3 - 2021-05-08

    Fixed

    • upgrade transitive dev dependency of eslint, mocha, zombie to lodash@4.17.21
    • upgrade transitive dev dependency of zombie to url-parse@1.5.1
    • upgrade transitive dev dependency of eslint-plugin-import to hosted-git-info@2.8.9
  • 0.13.2 - 2020-08-21

    Fixed

    • moved devDeps from dependencies to devDependencies #446
    • removed unused packages from all dependencies
  • 0.13.1 - 2020-08-20

    Fixed

    • npx npm-force-resolutions failed #445

    Details

    A preinstall script was added to force resolving specific versions of lodash and ajv. Those are sub-dependencies of zombie and its packages. Zombie is devDependency of i18n. But zombie still refers to older versions reported to vulnerable - so I decided to force fixed versions.

    Of course that preinstall should count on any npm install i18n, it's renamed to force-resolutions so I can still resolve audit issues in dev while also supporting clean installs.

    "scripts": {
      "preinstall": "npx npm-force-resolutions"
    }

    now reads as

    "scripts": {
      "force-resolutions": "npx npm-force-resolutions"
    }

    And doesn't get triggered by npm install.

  • 0.13.0 - 2020-08-20

    Added

    • new option retryInDefaultLocale as proposed by PR #206
    • new option header as proposed by PRs #390 and #407
    • pre-commit hooks to ensure code-style (even on contributions)

    Fixed

    • typos in README

    Changed

    • tooling: eslint with standard.js & prettier presets replaces jshint
  • 0.12.0 - 2020-08-16
  • 0.11.1 - 2020-08-04
from i18n GitHub release notes

[!IMPORTANT]

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

sonarcloud[bot] commented 1 month ago

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud