Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/cfpb/sbl-frontend/network/alerts).
Bumps the npm_and_yarn group with 5 updates:
1.7.41.7.54.5.34.5.54.0.54.0.86.2.16.3.02.79.12.79.2Updates
axiosfrom 1.7.4 to 1.7.5Release notes
Sourced from axios's releases.
Changelog
Sourced from axios's changelog.
Commits
59cd6b0chore(release): v1.7.5 (#6574)6700a8afix(core): add the missed implementation of AxiosError#status property; (#6573)7004707fix(adapter): fix undefined reference to hasBrowserEnv (#6572)fed1a4bfix(core): fixReferenceError: navigator is not definedfor custom environm...550d885fix(fetch): fix credentials handling in Cloudflare workers (#6533)bcd1c6dchore(actions): fix sponsor action; (#6566)c8b7be5chore(action): excludesponsorsbranch from CI tests; (#6564)67aa1efchore(sponsor): update sponsor block (#6559)ff254a5chore(action): change sponsors uri origin; (#6563)4f99675chore(sponsor): update sponsor block (#6558)Updates
vitefrom 4.5.3 to 4.5.5Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
Commits
f1d8845release: v4.5.52466c08release: v4.5.4e812716fix: avoid DOM Clobbering gadget ingetRelativeUrlFromDocument(#18115)b901438fix: backport #18112, fs raw queryUpdates
micromatchfrom 4.0.5 to 4.0.8Release notes
Sourced from micromatch's releases.
Changelog
Sourced from micromatch's changelog.
Commits
8bd704e4.0.8a0e6841run verb to generate README documentation4ec2884Merge branch 'v4' into hauserkristof-feature/v4.0.803aa805Merge pull request #266 from hauserkristof/feature/v4.0.8814f5f7lint67fcce6fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5113f2e3fix: CVE numbers in CHANGELOGd9dbd9afeat: updated CHANGELOG2ab1315fix: use actions/setup-node@v41406ea3feat: rework test to work on macos with node 10,12 and 14Updates
path-to-regexpfrom 6.2.1 to 6.3.0Release notes
Sourced from path-to-regexp's releases.
Commits
75a92c36.3.0f1253b4Add backtrack protection to 6.x (#324)28a5b276.2.2270876dTest on min node 16d5a42b6Run tests on ubuntu1c265a1Upgrade dev deps, prettier formatc7ec332Fix readme example25da491Bump node v14 for tests980d1dbAdd v8 coveragee828000Update shield URLUpdates
rollupfrom 2.79.1 to 2.79.2Changelog
Sourced from rollup's changelog.
... (truncated)
Commits
c9bd03d2.79.248aef33fix: resolve DOM Clobbering CVE-2024-43788 (backport to v2) (#5677)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show