Snyk has created this PR to upgrade core-js from 3.21.1 to 3.22.4.
:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 5 versions ahead of your current version.
The recommended version was released 21 days ago, on 2022-05-02.
Disabled forced replacement and added /actual/ entry points for methods from this proposal
Array.prototype.toSpliced throws a TypeError instead of RangeError if the result length is more than MAX_SAFE_INTEGER, proposal-change-array-by-copy/70
Added some more atob / btoa fixes:
NodeJS <17.9 atob does not ignore spaces, node/42530
Actual NodeJS atob does not validate encoding, node/42646
FF26- implementation does not properly convert argument to string
IE / Edge <16 implementation have wrong arity
Added /full/ namespace as the replacement for /features/ since it's more descriptive in context of the rest namespaces (/es/ ⊆ /stable/ ⊆ /actual/ ⊆ /full/)
Avoided propagation of removed parts of proposals to upper stages. For example, %TypedArray%.prototype.groupBy was removed from the Array grouping proposal a long time ago. We can't completely remove this method since it's a breaking change. But this proposal has been promoted to stage 3 - so the proposal should be promoted without this method, this method should not be available in /actual/ entries - but it should be available in early-stage entries to avoid breakage.
Significant internal refactoring and splitting of modules (but without exposing to public API since it will be a breaking change - it will be exposed in the next major version)
Bug fixes:
Fixed work of non-standard V8 Error features with wrapped Error constructors, #1061
null and undefined allowed as the second argument of structuredClone, #1056
Tooling:
Stabilized proposals are filtered out from the core-js-compat -> core-js-builder -> core-js-bundle output. That mean that if the output contains, for example, es.object.has-own, the legacy reference to it, esnext.object.has-own, no longer added.
Added support of entry points, modules, regexes, and arrays of them to those filters
Missed targets option of core-js-compat means that the targets filter just will not be applied, so the result will contain modules required for all possible engines
Compat data:
.stack property on DOMException marked as supported from Deno 1.15
Added Deno 1.21 compat data mapping
Added Electron 19.0 and updated 18.0 compat data mapping
Snyk has created this PR to upgrade core-js from 3.21.1 to 3.22.4.
:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
Release notes
Package name: core-js
.length
of polyfilled functions even in compressed code (excepting some ancient engines).name
of polyfilled accessors (excepting some ancient engines)ToString
conversion of polyfilled accessorsArray.prototype.includes
broken on sparse arraysURLSearchParams
in IE8- that was broken in the previous release__lookupGetter__
entriesRegExp
flags handlingfetch
APIArray
by copy proposal:/actual/
entry points for methods from this proposalArray.prototype.toSpliced
throws aTypeError
instead ofRangeError
if the result length is more thanMAX_SAFE_INTEGER
, proposal-change-array-by-copy/70atob
/btoa
fixes:atob
does not ignore spaces, node/42530atob
does not validate encoding, node/42646/full/
namespace as the replacement for/features/
since it's more descriptive in context of the rest namespaces (/es/
⊆/stable/
⊆/actual/
⊆/full/
)%TypedArray%.prototype.groupBy
was removed from theArray
grouping proposal a long time ago. We can't completely remove this method since it's a breaking change. But this proposal has been promoted to stage 3 - so the proposal should be promoted without this method, this method should not be available in/actual/
entries - but it should be available in early-stage entries to avoid breakage.Error
features with wrappedError
constructors, #1061null
andundefined
allowed as the second argument ofstructuredClone
, #1056core-js-compat
->core-js-builder
->core-js-bundle
output. That mean that if the output contains, for example,es.object.has-own
, the legacy reference to it,esnext.object.has-own
, no longer added.core-js-builder
andcore-js-compat
, now it'smodules
andexclude
optionstargets
option ofcore-js-compat
means that thetargets
filter just will not be applied, so the result will contain modules required for all possible engines.stack
property onDOMException
marked as supported from Deno 1.15Array.prototype.{ groupBy, groupByToMap }
implementationcore-js-compat
targets parser transforms engine names to lower caseatob
/btoa
marked as fixed in NodeJS 17.5Commit messages
Package name: core-js
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
🧐 View latest project report
🛠 Adjust upgrade PR settings
🔕 Ignore this dependency or unsubscribe from future upgrade PRs