Open renovate[bot] opened 3 weeks ago
coderabbitai[bot]
commented
3 weeks ago [!IMPORTANT]
Review skipped
Bot user detected.
To trigger a single review, invoke the
@coderabbitai reviewcommand.You can disable this status message by setting the
reviews.review_statustofalsein the CodeRabbit configuration file.
socket-security[bot]
commented
3 weeks ago New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
| Package | New capabilities | Transitives | Size | Publisher |
|---|---|---|---|---|
| npm/release-it@14.14.3 | environment, filesystem Transitive: eval, network, shell, unsafe | +381 |
24.2 MB | webpro |
🚮 Removed packages: npm/release-it@14.11.5
socket-security[bot]
commented
3 weeks ago 🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎
To accept the risk, merge this PR and you will not be notified again.
| Alert | Package | Note | Source | CI |
|---|---|---|---|---|
| Critical CVE | npm/vm2@3.9.19 |
| ⚠︎ | |
| Critical CVE | npm/vm2@3.9.19 |
| ⚠︎ |
Contains a Critical Common Vulnerability and Exposure (CVE).
Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.
Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all
@SocketSecurity ignore npm/vm2@3.9.19
This PR contains the following updates:
^3.3.0->3.3.014.11.5->14.14.3Add the preset
:preserveSemverRangesto your config if you don't want to pin your dependencies.Release Notes
release-it/release-it (release-it)
### [`v14.14.3`](https://redirect.github.com/release-it/release-it/releases/tag/14.14.3) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.14.2...14.14.3) - Remove `.only` test ([`dd249c6`](https://redirect.github.com/release-it/release-it/commit/dd249c6)) - Temporarily(?) ignore docs.gihub.com links (returning 403) ([`ec3e4db`](https://redirect.github.com/release-it/release-it/commit/ec3e4db)) - Improve docs re. git.tagMatch ([`93c583c`](https://redirect.github.com/release-it/release-it/commit/93c583c)) - Replace "resources" at the bottom with link to license, order examples ([`e9c6b8d`](https://redirect.github.com/release-it/release-it/commit/e9c6b8d)) - Update docs.github.com links ([`2fe93fd`](https://redirect.github.com/release-it/release-it/commit/2fe93fd)) - Add test for `git.tagMatch` + changelog behavior ([`5e843f1`](https://redirect.github.com/release-it/release-it/commit/5e843f1)) - Improve documentatiion, mainly re. `git.tagMatch` ([`751e171`](https://redirect.github.com/release-it/release-it/commit/751e171)) - Remove xlink namespace from svg ([`9ce7501`](https://redirect.github.com/release-it/release-it/commit/9ce7501)) - Remove duplicate test and wrap up proxy fix ([`f1e8843`](https://redirect.github.com/release-it/release-it/commit/f1e8843)) - Fixes github.proxy not working ([#863](https://redirect.github.com/release-it/release-it/issues/863)) ([#893](https://redirect.github.com/release-it/release-it/issues/893)) ([`1fe1afa`](https://redirect.github.com/release-it/release-it/commit/1fe1afa)) ### [`v14.14.2`](https://redirect.github.com/release-it/release-it/releases/tag/14.14.2) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.14.1...14.14.2) **NOTE** This is the latest release still supporting Node.js v10. Major issues reported in release-it v14 might still receive bug fixes and patch releases, but no new features. - Strict Node.js v10 support ([#892](https://redirect.github.com/release-it/release-it/issues/892)) ([`43d74fe`](https://redirect.github.com/release-it/release-it/commit/43d74fe)) ### [`v14.14.1`](https://redirect.github.com/release-it/release-it/releases/tag/14.14.1) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.14.0...14.14.1) - Update dependencies (still supporting Node.js v10) ([`7018194`](https://redirect.github.com/release-it/release-it/commit/7018194)) - Add note about using Inquirer.js in hooks (closes [#821](https://redirect.github.com/release-it/release-it/issues/821)) ([`2f10cc4`](https://redirect.github.com/release-it/release-it/commit/2f10cc4)) - Add comment re. quoting CLI hook arguments (closes [#865](https://redirect.github.com/release-it/release-it/issues/865)) ([`ea11a0d`](https://redirect.github.com/release-it/release-it/commit/ea11a0d)) - Also transfer `tagMatch` to release plugins (fixes [#885](https://redirect.github.com/release-it/release-it/issues/885)) ([`0e0ad33`](https://redirect.github.com/release-it/release-it/commit/0e0ad33)) - Downgrade mock-fs and install polyfill for Promise.allSettled (to support Node v10) ([`56f1ec7`](https://redirect.github.com/release-it/release-it/commit/56f1ec7)) - test: fix CI test for different Node versions ([#888](https://redirect.github.com/release-it/release-it/issues/888)) ([`e8a57cc`](https://redirect.github.com/release-it/release-it/commit/e8a57cc)) - chore(deps): downgrade `inquirer` from 8.2.2 to 8.2.0 to avoid dropping Node 10 support ([#887](https://redirect.github.com/release-it/release-it/issues/887)) ([`2a9a31c`](https://redirect.github.com/release-it/release-it/commit/2a9a31c)) ### [`v14.14.0`](https://redirect.github.com/release-it/release-it/releases/tag/14.14.0) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.13.1...14.14.0) - Update dependencies ([`c61c780`](https://redirect.github.com/release-it/release-it/commit/c61c780)) - Minor edits to new gitlab milestones feature ([`63869b8`](https://redirect.github.com/release-it/release-it/commit/63869b8)) - Add `gitlab.milestones` option to associate milestones with a release ([#883](https://redirect.github.com/release-it/release-it/issues/883)) ([`af0882f`](https://redirect.github.com/release-it/release-it/commit/af0882f)) - More consistently use example.org in docs, links and even tests ([`3ccdef0`](https://redirect.github.com/release-it/release-it/commit/3ccdef0)) - Clarify the `github.host` config option ([#875](https://redirect.github.com/release-it/release-it/issues/875)) ([`6d7c3f2`](https://redirect.github.com/release-it/release-it/commit/6d7c3f2)) ### [`v14.13.1`](https://redirect.github.com/release-it/release-it/releases/tag/14.13.1) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.13.0...14.13.1) - Take `latestTag` from config context (allowing any value) ([`9fe82ed`](https://redirect.github.com/release-it/release-it/commit/9fe82ed)) - Saleor project was moved to dedicated GitHub organization ([#873](https://redirect.github.com/release-it/release-it/issues/873)) ([`1e0f8f7`](https://redirect.github.com/release-it/release-it/commit/1e0f8f7)) ### [`v14.13.0`](https://redirect.github.com/release-it/release-it/releases/tag/14.13.0) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.12.5...14.13.0) - Allow wildcards for required branch(es) (closes [#877](https://redirect.github.com/release-it/release-it/issues/877)) ([`fb8622b`](https://redirect.github.com/release-it/release-it/commit/fb8622b)) - Fix/add tests and wrap up `npm.allowSameVersion` ([`739f6f6`](https://redirect.github.com/release-it/release-it/commit/739f6f6)) - Allow running npm version with arg `--allow-same-version` ([#878](https://redirect.github.com/release-it/release-it/issues/878)) ([`2a7565d`](https://redirect.github.com/release-it/release-it/commit/2a7565d)) ### [`v14.12.5`](https://redirect.github.com/release-it/release-it/releases/tag/14.12.5) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.12.4...14.12.5) - Fix body when auto-generating release notes (and updating) GitHub releases ([`2c42a8e`](https://redirect.github.com/release-it/release-it/commit/2c42a8e)) - Fix spec for different version of Git ([`c20d9d0`](https://redirect.github.com/release-it/release-it/commit/c20d9d0)) - Remove deprecated ref from docs ([`5e0d4c0`](https://redirect.github.com/release-it/release-it/commit/5e0d4c0)) ### [`v14.12.4`](https://redirect.github.com/release-it/release-it/releases/tag/14.12.4) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.12.3...14.12.4) - Update node-fetch (security issue in transitive dep, closes [#862](https://redirect.github.com/release-it/release-it/issues/862)) ([`d9aaa6c`](https://redirect.github.com/release-it/release-it/commit/d9aaa6c)) - Remove the unused deprecated feature itself ([`d80beaf`](https://redirect.github.com/release-it/release-it/commit/d80beaf)) - Remove old code coverage stuff ([`bdf6d18`](https://redirect.github.com/release-it/release-it/commit/bdf6d18)) ### [`v14.12.3`](https://redirect.github.com/release-it/release-it/releases/tag/14.12.3) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.12.2...14.12.3) - Update dependencies ([`d464518`](https://redirect.github.com/release-it/release-it/commit/d464518)) ### [`v14.12.2`](https://redirect.github.com/release-it/release-it/releases/tag/14.12.2) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.12.1...14.12.2) - Add warning when `github.web` and `github.assets` are both set (closes [#836](https://redirect.github.com/release-it/release-it/issues/836)) ([`9e72c16`](https://redirect.github.com/release-it/release-it/commit/9e72c16)) - Don't return nock interceptor ([`616525f`](https://redirect.github.com/release-it/release-it/commit/616525f)) - Explain `tagName` prefix better (closes [#848](https://redirect.github.com/release-it/release-it/issues/848)) ([`f9d1b17`](https://redirect.github.com/release-it/release-it/commit/f9d1b17)) - Use empty string (not null) for release notes body in GitHub release request (fixes #[#855](https://redirect.github.com/release-it/release-it/issues/855)) ([`bdbc2ca`](https://redirect.github.com/release-it/release-it/commit/bdbc2ca)) - fix spelling on git documentation ([#854](https://redirect.github.com/release-it/release-it/issues/854)) ([`66c6f3b`](https://redirect.github.com/release-it/release-it/commit/66c6f3b)) - Added comment about pre-release bumps (e.g. `preminor`) ([`aa34389`](https://redirect.github.com/release-it/release-it/commit/aa34389)) ### [`v14.12.1`](https://redirect.github.com/release-it/release-it/releases/tag/14.12.1) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.12.0...14.12.1) - Fix tests on Linux ([`6495d3d`](https://redirect.github.com/release-it/release-it/commit/6495d3d)) - Add `latestVersion` argument to `getChangelog` in test helper ([`d0ec1bb`](https://redirect.github.com/release-it/release-it/commit/d0ec1bb)) ### [`v14.12.0`](https://redirect.github.com/release-it/release-it/releases/tag/14.12.0) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.11.8...14.12.0) - Update example projects ([`b500aac`](https://redirect.github.com/release-it/release-it/commit/b500aac)) - Add support for pre-releases in `runTasks` test helper ([`b73770e`](https://redirect.github.com/release-it/release-it/commit/b73770e)) - Remove unused argument from `getIncrement` (test helper) ([`93b0a74`](https://redirect.github.com/release-it/release-it/commit/93b0a74)) - Print `--release-version` after incremented version is resolved ([`5b04ba5`](https://redirect.github.com/release-it/release-it/commit/5b04ba5)) - Update dependencies ([`fb73af2`](https://redirect.github.com/release-it/release-it/commit/fb73af2)) - Add `node-redis` to example projects ([`069a65f`](https://redirect.github.com/release-it/release-it/commit/069a65f)) - Add test for GitHub enterprise host web release url ([`e4718b0`](https://redirect.github.com/release-it/release-it/commit/e4718b0)) - Wrap up the `github.autoGenerate` feature ([`a467b5f`](https://redirect.github.com/release-it/release-it/commit/a467b5f)) - Update README.md ([#853](https://redirect.github.com/release-it/release-it/issues/853)) ([`0a4c605`](https://redirect.github.com/release-it/release-it/commit/0a4c605)) - support github's auto generated release notes ([#843](https://redirect.github.com/release-it/release-it/issues/843)) ([`b612ce7`](https://redirect.github.com/release-it/release-it/commit/b612ce7)) - feat : add a host info when generating web url ([#828](https://redirect.github.com/release-it/release-it/issues/828)) ([`1b1034c`](https://redirect.github.com/release-it/release-it/commit/1b1034c)) ### [`v14.11.8`](https://redirect.github.com/release-it/release-it/releases/tag/14.11.8) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.11.7...14.11.8) - Update some dependencies ([`67d0709`](https://redirect.github.com/release-it/release-it/commit/67d0709)) - Revert "unused" argument (fixes [https://github.com/release-it/conventional-changelog/issues/38](https://redirect.github.com/release-it/conventional-changelog/issues/38)) ([`824558f`](https://redirect.github.com/release-it/release-it/commit/824558f)) ### [`v14.11.7`](https://redirect.github.com/release-it/release-it/releases/tag/14.11.7) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.11.6...14.11.7) - Quote sha with caret (fixes [#801](https://redirect.github.com/release-it/release-it/issues/801)) ([`fc0379c`](https://redirect.github.com/release-it/release-it/commit/fc0379c)) - Defensive prop reading ([`56033ca`](https://redirect.github.com/release-it/release-it/commit/56033ca)) - Add test for custom release notes command (related to [#830](https://redirect.github.com/release-it/release-it/issues/830)) ([`cd77539`](https://redirect.github.com/release-it/release-it/commit/cd77539)) - Remove unused argument in changelog method calls ([`f31868e`](https://redirect.github.com/release-it/release-it/commit/f31868e)) - Add section "Publish to private registry" (closes [#824](https://redirect.github.com/release-it/release-it/issues/824)) ([`deb7c9a`](https://redirect.github.com/release-it/release-it/commit/deb7c9a)) - Fix Example Projects list ([#827](https://redirect.github.com/release-it/release-it/issues/827)) ([`3edbb23`](https://redirect.github.com/release-it/release-it/commit/3edbb23)) ### [`v14.11.6`](https://redirect.github.com/release-it/release-it/releases/tag/14.11.6) [Compare Source](https://redirect.github.com/release-it/release-it/compare/14.11.5...14.11.6) - Update dependencies ([`9a1d34b`](https://redirect.github.com/release-it/release-it/commit/9a1d34b)) - Fix tag name in github web release fallback url ([`14fcad0`](https://redirect.github.com/release-it/release-it/commit/14fcad0)) - Changed git docs with correct hook ([#804](https://redirect.github.com/release-it/release-it/issues/804)) ([`588d776`](https://redirect.github.com/release-it/release-it/commit/588d776))Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - "before 4am on Monday" (UTC).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.