Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.
4.0.4
fix: Update picomatch to fix regression #179 (8becb55)
backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch
[4.0.7] - 2024-05-22
this is basically v4.0.5, with some README updates
it is vulnerable to CVE-2024-4067
Updated braces to v3.0.3 to avoid CVE-2024-4068
does NOT break API compatibility
[4.0.6] - 2024-05-21
Added hasBraces to check if a pattern contains braces.
Fixes CVE-2024-4067
BREAKS API COMPATIBILITY
Should be labeled as a major release, but it's not.
[4.0.1 - 4.0.5]
[4.0.0] - 2019-03-20
Added
Adds support for options.onMatch. See the readme for details
Adds support for options.onIgnore. See the readme for details
Adds support for options.onResult. See the readme for details
Breaking changes
Require Node.js >= 8.6
Removed support for passing an array of brace patterns to micromatch.braces().
To strictly enforce closing brackets (for {, [, and (), you must now use strictBrackets=true instead of strictErrors.
cache - caching and all related options and methods have been removed
options.unixify was renamed to options.windows
options.nodupes Was removed. Duplicates are always removed by default. You can override this with custom behavior by using the onMatch, onResult and onIgnore functions.
options.snapdragon was removed, as snapdragon is no longer used.
options.sourcemap was removed, as snapdragon is no longer used, which provided sourcemap support.
[3.0.0] - 2017-04-11
Complete overhaul, with 36,000+ new unit tests validated against actual output generated by Bash and minimatch. More specifically, 35,000+ of the tests:
micromatch results are directly compared to bash results
in rare cases, when micromatch and bash disagree, micromatch's results are compared to minimatch's results
micromatch is much more accurate than minimatch, so there were cases where I had to make assumptions. I'll try to document these.
This refactor introduces a parser and compiler that are supersets of more granular parsers and compilers from other sub-modules. Each of these sub-modules has a singular responsibility and focuses on a certain type of matching that aligns with a specific part of the Bash "expansion" API.
These sub-modules work like plugins to seamlessly create the micromatch parser/compiler, so that strings are parsed in one pass, an AST is created, then a new string is generated by the compiler.
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
Bumps micromatch to 4.0.8 and updates ancestor dependencies micromatch, gatsby, gatsby-plugin-manifest, gatsby-plugin-offline, gatsby-plugin-react-helmet, gatsby-plugin-sharp, gatsby-remark-images, gatsby-source-filesystem, gatsby-transformer-sharp and react-dev-utils. These dependencies need to be updated together.
Updates
micromatchfrom 3.1.10 to 4.0.8Release notes
Sourced from micromatch's releases.
Changelog
Sourced from micromatch's changelog.
... (truncated)
Commits
8bd704e4.0.8a0e6841run verb to generate README documentation4ec2884Merge branch 'v4' into hauserkristof-feature/v4.0.803aa805Merge pull request #266 from hauserkristof/feature/v4.0.8814f5f7lint67fcce6fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5113f2e3fix: CVE numbers in CHANGELOGd9dbd9afeat: updated CHANGELOG2ab1315fix: use actions/setup-node@v41406ea3feat: rework test to work on macos with node 10,12 and 14Updates
gatsbyfrom 3.15.0 to 5.13.7Release notes
Sourced from gatsby's releases.
... (truncated)
Commits
d92aa8cchore(release): Publish74d1fd1fix(gatsby-adapter-netlify): support monorepos (#39005) (#39037)36f23d2chore(release): Publish04c438aperf(gatsby-adapter-netlify): improve adapt() performance (#38988) (#38991)6c63350chore(release): Publish326c89afeat: allow dsg/ssr renders without access to datastore if it's not required ...e7231ecchore: pin@vercel/webpack-asset-relocator-loader(#38981) (#38982)0f9ad54chore(release): Publishb6935a4chore(gatsby-source-contentful): upgrade is-online (#38862) (#38970)8f0f7c5chore(release): PublishUpdates
gatsby-plugin-manifestfrom 3.15.0 to 5.13.1Release notes
Sourced from gatsby-plugin-manifest's releases.
... (truncated)
Changelog
Sourced from gatsby-plugin-manifest's changelog.
... (truncated)
Commits
b24134dchore(release): Publish18ffcfachore(release): Publish26871b8chore(release): Publish next9a26700chore(changelogs): update changelogs (#38667)7ba63ebchore(changelogs): update changelogs (#38658)d90d747chore(changelogs): update changelogs (#38642)ca15ef3chore(deps): upgrade sharp to latest v0.32.6 (#38374)db248abchore(changelogs): update changelogs (#38526)e6e2fb4chore(release): Publish next pre-minor1ebae56chore(release): Publish nextUpdates
gatsby-plugin-offlinefrom 4.15.0 to 6.13.3Release notes
Sourced from gatsby-plugin-offline's releases.
... (truncated)
Changelog
Sourced from gatsby-plugin-offline's changelog.
... (truncated)
Commits
30621b4chore(release): Publish282caaffix: pin cheerio (#39066) (#39069)8f0f7c5chore(release): Publishedaf016fix(gatsby-adapter-netlify): handler generation on windows (#38900) (#38929)b24134dchore(release): Publish18ffcfachore(release): Publish26871b8chore(release): Publish next9a26700chore(changelogs): update changelogs (#38667)7ba63ebchore(changelogs): update changelogs (#38658)d90d747chore(changelogs): update changelogs (#38642)Updates
gatsby-plugin-react-helmetfrom 4.15.0 to 6.13.1Release notes
Sourced from gatsby-plugin-react-helmet's releases.
... (truncated)
Changelog
Sourced from gatsby-plugin-react-helmet's changelog.
... (truncated)
Commits
b24134dchore(release): Publish18ffcfachore(release): Publishdb248abchore(changelogs): update changelogs (#38526)e6e2fb4chore(release): Publish next pre-minorfd4d702chore(changelogs): update changelogs (#38248)0991178chore(release): Publish next pre-minorebe9bc6chore(release): Publish next57a4af5chore(changelogs): update changelogs (#38096)99664bcchore(release): Publish next pre-minora9c54f7chore(release): Publish nextUpdates
gatsby-plugin-sharpfrom 3.15.0 to 5.13.1Release notes
Sourced from gatsby-plugin-sharp's releases.
... (truncated)
Changelog
Sourced from gatsby-plugin-sharp's changelog.
... (truncated)
Commits
b24134dchore(release): Publish18ffcfachore(release): Publish26871b8chore(release): Publish next9a26700chore(changelogs): update changelogs (#38667)7ba63ebchore(changelogs): update changelogs (#38658)d90d747chore(changelogs): update changelogs (#38642)ca15ef3chore(deps): upgrade sharp to latest v0.32.6 (#38374)db248abchore(changelogs): update changelogs (#38526)e6e2fb4chore(release): Publish next pre-minor1ebae56chore(release): Publish nextUpdates
gatsby-remark-imagesfrom 4.2.0 to 7.13.2Release notes
Sourced from gatsby-remark-images's releases.
... (truncated)
Changelog
Sourced from gatsby-remark-images's changelog.
... (truncated)
Commits
30621b4chore(release): Publish282caaffix: pin cheerio (#39066) (#39069)b24134dchore(release): Publish18ffcfachore(release): Publish26871b8chore(release): Publish next9a26700chore(changelogs): update changelogs (#38667)7ba63ebchore(changelogs): update changelogs (#38658)d90d747chore(changelogs): update changelogs (#38642)db248abchore(changelogs): update changelogs (#38526)e6e2fb4chore(release): Publish next pre-minorUpdates
gatsby-source-filesystemfrom 3.15.0 to 5.13.1Release notes
Sourced from gatsby-source-filesystem's releases.
... (truncated)
Changelog
Sourced from gatsby-source-filesystem's changelog.
OK, I won't notify you again about this release, but will get in touch when a new version is available.
If you change your mind, just re-open this PR and I'll resolve any conflicts on it.