search

codetheweb / anylist

📋 a wrapper for AnyList's API (unoffical, reverse engineered)
81 stars 20 forks source link

Bump got from 10.7.0 to 11.8.5 #23

Closed dependabot[bot] closed 6 months ago

dependabot[bot] commented 2 years ago

Bumps got from 10.7.0 to 11.8.5.

Release notes

Sourced from got's releases.

v11.8.5

https://github.com/sindresorhus/got/compare/v11.8.4...v11.8.5

v11.8.3

  • Bump cacheable-request dependency (#1921) 9463bb6
  • Fix HTTPError missing .code property (#1739) 0e167b8

https://github.com/sindresorhus/got/compare/v11.8.2...v11.8.3

v11.8.2

  • Make the dnsCache option lazy (#1529) 3bd245f This slightly improves Got startup performance and fixes an issue with Jest.

https://github.com/sindresorhus/got/compare/v11.8.1...v11.8.2

v11.8.1

  • Do not throw on custom stack traces (#1491) 4c815c3a609eb74d0eb139414d9996b4f65dc3c0

v11.8.0

  • Fix for sending files with size 0 on stat (#1488) 7acd380
  • beforeRetry allows stream body if different from original (#1501) 3dd2273
  • Set default value for an options object (#1495) 390b145

https://github.com/sindresorhus/got/compare/v11.7.0...v11.8.0

v11.7.0

Improvements

  • Add pfx HTTPS option (#1364) c33df7f
  • Update body after beforeRequest (#1453) e1c1844
  • Don't allocate buffer twice (#1403) 7bc69d9

Fixes

  • Fix a regression where body was sent after redirect 88b32ea
  • Fix destructure error on promise.json() c97ce7c
  • Do not ignore userinfo on a redirect to the same origin 52de13b

https://github.com/sindresorhus/got/compare/v11.6.2...v11.7.0

v11.6.2

Bug fixes

  • Inherit the prefixUrl option from parent if it's undefined (#1448) a3da70a78aeb7f44dd3e0d0fa47cebe9541eb91e
  • Prepare a fix for hanging promise on Node.js 14.10.x 29d4e325b110ccf7571d4265d40760be4175f7ff
  • Prepare for Node.js 15.0.0 c126ff19c4e893975cbf6c2c8bebce6ed7631276

... (truncated)

Commits


Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/codetheweb/anylist/network/alerts).
> **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days.
michaelmior commented 1 year ago

Would be great if this could be merged (along with some other dependency updates) and a new release made.

codetheweb commented 1 year ago

Is there anything specific that needs to be fixed by a dependency bump?

michaelmior commented 1 year ago

This version of got has a security vulnerability. This makes it possible for a MITM attack on AnyList to potentially do something destructive to a local server.

codetheweb commented 1 year ago

The probability of this being exploited in any meaningful seems extremely remote...

That being said, happy to accept a PR with this and other dependencies bumped.

michaelmior commented 1 year ago

There are already existing PRs. Are you looking to have them combined into a single PR? If so, I would suggest using a tool such as Depfu which supports creating a single PR for multiple updates.

codetheweb commented 1 year ago

Yep, a single PR would be ideal. I'm looking for something that's as little work as possible on my end since I no longer use or maintain this repo, so a combined PR would be appreciated. :)

michaelmior commented 1 year ago

It would be less work to just press the merge button on each of the existing PRs instead of creating a new PR. Or are you interested in switching to something like Depfu so a single PR could be created automatically in the future?

dependabot[bot] commented 6 months ago

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.