search

calpa / gatsby-starter-calpa-blog

Calpa's Blog (GatsbyJS Starter X Netlify CMS)
https://v1.calpa.me/
MIT License
333 stars 61 forks source link

🚨 [security] Update stylelint 9.10.1 → 16.3.1 (major) #314

Closed depfu[bot] closed 5 months ago

depfu[bot] commented 6 months ago

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ stylelint (9.10.1 → 16.3.1) · Repo · Changelog

Security Advisories 🚨

🚨 Stylelint has vulnerability in semver dependency

Summary

Our meow dependency (which we use for our CLI) depended on semver@5.7.1 . A vulnerability in this version of semver was recently identified and surfaced by npm audit:

Regular Expression Denial of Service - GHSA-c2qf-rxjj-qqgw

Details

Original post by the reporter:

"my npm audit show the report

semver <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - GHSA-c2qf-rxjj-qqgw
No fix available

And my dependencies tree for semver show your package

├─┬ stylelint@15.9.0
│ └─┬ meow@9.0.0
│ └─┬ read-pkg-up@7.0.1
│ └─┬ read-pkg@5.2.0
│ └─┬ normalize-package-data@2.5.0
│ └── semver@5.7.1 deduped

I found that meow@10.x.x contains normalize-package-data@5 and I can fix this vulnerability because it uses semver@7. But I can't update meow to the new major version because your package doesn't allow it."

Update your package to use the 'meow' version >=10"

PoC

N/A

Impact

We anticipate the impact to be low as Stylelint is a dev tool and meow is only used on the CLI pathway.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ html-tags (indirect, 2.0.0 → 3.3.1) · Repo

Release Notes

3.3.1

  • Add search HTML element to type definitions (#12) 273706f

v3.3.0...v3.3.1

3.3.0

v3.2.0...v3.3.0

3.2.0

v3.1.0...v3.2.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ known-css-properties (indirect, 0.11.0 → 0.30.0) · Repo

Release Notes

0.30.0

Update properties

  • Chrome 119
  • Firefox 119
  • Chrome 120
  • Firefox 120
  • Chrome 121
  • Firefox 121
  • Chrome 122
  • Firefox 122
  • Samsung internet 23.0
  • ios safari 17.3
  • Safari 17.1
  • w3c 2024/02/07

0.29.0

Update properties

  • Safari 16.5
  • Safari 17.0
  • ios safari 17.0
  • Chrome 116
  • Chrome 117
  • Chrome android 117
  • Chrome 118
  • Firefox 114
  • Firefox 116
  • Firefox 117
  • Firefox 118
  • Firefox android 118
  • W3C data 2023/10/15

Update dependencies

Full Changelog: v0.28.0...v0.29.0

0.28.0

  • Chrome 111
  • Chrome 112
  • Chrome 113
  • Chrome 114
  • Chrome 114
  • Chrome 115
  • Firefox 111
  • Firefox 112
  • Firefox 113
  • Firefox 115
  • Chrome android 113
  • Chrome android 114
  • Firefox mobile 115
  • Safari 16.4
  • Samsung internet 22.0
  • W3C data 2023/07/20

0.27.0

New properties

  • Chrome 108
  • Chrome 109
  • Chrome 110
  • Chrome android 110
  • Firefox 107
  • Firefox 108
  • Firefox 109
  • Firefox 110
  • Firefox mobile 110
  • Opera mobile 73
  • Samsung internet 19.0
  • W3C data 2023/02/19

Full Changelog: v0.26.0...v0.27.0

0.26.0

What's Changed

  • Updates 2022/10/30 by @vio in #156
    • Chrome 101 - 107
    • Chrome android 101
    • Firefox 100 - 106
    • Firefox mobile 101
    • Firefox mobile 106
    • Safari 15.6
    • Safari 16.0
    • Safari ios 16.0
    • W3C data 2022/10/30
  • Update dependency eslint to v8.18.0 by @renovate in #153
  • Update dependency globby to v13.1.2 by @renovate in #154

Full Changelog: v0.25.0...v0.26.0

0.25.0

Full Changelog: v0.24.0...v0.25.0

0.24.0

Data

Improvements

Dependencies

  • 800c09d Update dependency eslint to v8 (Renovate Bot)
  • d3833ca Update dependency axios to v0.21.2 [SECURITY] (Renovate Bot)
  • e25fce7 Update dependency globby to v12.0.2 (Renovate Bot)
  • 81d79cc Update dependency globby to v12 (Renovate Bot)
  • 6d91286 Update dependency eslint to v7.32.0 (Renovate Bot)

0.23.0

  • Chrome 89-91
  • Firefox 86-89
  • Safari OSX/iOS 14.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ postcss-safe-parser (indirect, 4.0.2 → 7.0.0) · Repo · Changelog

Release Notes

5.0.2 (from changelog)

  • Added funding links.

5.0.1 (from changelog)

  • Fixed parsing missed semicolon.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 43 commits:

🆕 @​csstools/css-parser-algorithms (added, 2.6.1)

🆕 @​csstools/css-tokenizer (added, 2.2.4)

🆕 @​csstools/media-query-list-parser (added, 2.1.9)

🆕 @​csstools/selector-specificity (added, 3.0.2)

🆕 @​dual-bundle/import-meta-resolve (added, 4.0.0)

🆕 colord (added, 2.9.3)

🆕 css-functions-list (added, 3.2.1)

🆕 env-paths (added, 2.2.1)

🆕 lodash.truncate (added, 4.4.2)

🆕 nanoid (added, 3.3.7)

🆕 require-from-string (added, 2.0.2)

🆕 source-map-js (added, 1.2.0)

🆕 supports-hyperlinks (added, 3.0.0)

🗑️ @​mrmlnc/readdir-enhanced (removed)

🗑️ call-me-maybe (removed)

🗑️ clone-regexp (removed)

🗑️ decamelize-keys (removed)

🗑️ execall (removed)

🗑️ glob-to-regexp (removed)

🗑️ gonzales-pe (removed)

🗑️ is-supported-regexp-flag (removed)

🗑️ leven (removed)

🗑️ minimist-options (removed)

🗑️ normalize-selector (removed)

🗑️ postcss-html (removed)

🗑️ postcss-jsx (removed)

🗑️ postcss-less (removed)

🗑️ postcss-markdown (removed)

🗑️ postcss-reporter (removed)

🗑️ postcss-sass (removed)

🗑️ postcss-scss (removed)

🗑️ postcss-syntax (removed)

🗑️ quick-lru (removed)

🗑️ specificity (removed)

🗑️ style-search (removed)

🗑️ sugarss (removed)

🗑️ unist-util-find-all-after (removed)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
codesandbox[bot] commented 6 months ago

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders
Open Preview

depfu[bot] commented 5 months ago

Closed in favor of #316.