search

dynatrace-oss / barista

Barista - the Dynatrace design system. Tailored to scale.
https://barista.dynatrace.com
Apache License 2.0
143 stars 78 forks source link

build(deps): Bump axios and @slack/webhook in /tools/slack-release-notifier #2791

Closed dependabot[bot] closed 8 months ago

dependabot[bot] commented 1 year ago

Bumps axios to 1.6.1 and updates ancestor dependency @slack/webhook. These dependencies need to be updated together.

Updates axios from 0.21.4 to 1.6.1

Release notes

Sourced from axios's releases.

Release v1.6.1

Release notes:

Bug Fixes

  • formdata: fixed content-type header normalization for non-standard browser environments; (#6056) (dd465ab)
  • platform: fixed emulated browser detection in node.js environment; (#6055) (3dc8369)

Contributors to this release

Release v1.6.0

Release notes:

Bug Fixes

  • CSRF: fixed CSRF vulnerability CVE-2023-45857 (#6028) (96ee232)
  • dns: fixed lookup function decorator to work properly in node v20; (#6011) (5aaff53)
  • types: fix AxiosHeaders types; (#5931) (a1c8ad0)

PRs

  • CVE 2023 45857 ( #6028 )

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

Contributors to this release

Release v1.5.1

Release notes:

Bug Fixes

  • adapters: improved adapters loading logic to have clear error messages; (#5919) (e410779)
  • formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#5917) (bc9af51)
  • headers: allow content-encoding header to handle case-insensitive values (#5890) (#5892) (4c89f25)
  • types: removed duplicated code (9e62056)

Contributors to this release

... (truncated)

Changelog

Sourced from axios's changelog.

1.6.1 (2023-11-08)

Bug Fixes

  • formdata: fixed content-type header normalization for non-standard browser environments; (#6056) (dd465ab)
  • platform: fixed emulated browser detection in node.js environment; (#6055) (3dc8369)

Contributors to this release

1.6.0 (2023-10-26)

Bug Fixes

  • CSRF: fixed CSRF vulnerability CVE-2023-45857 (#6028) (96ee232)
  • dns: fixed lookup function decorator to work properly in node v20; (#6011) (5aaff53)
  • types: fix AxiosHeaders types; (#5931) (a1c8ad0)

PRs

  • CVE 2023 45857 ( #6028 )

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

Contributors to this release

1.5.1 (2023-09-26)

Bug Fixes

  • adapters: improved adapters loading logic to have clear error messages; (#5919) (e410779)
  • formdata: fixed automatic addition of the Content-Type header for FormData in non-browser environments; (#5917) (bc9af51)
  • headers: allow content-encoding header to handle case-insensitive values (#5890) (#5892) (4c89f25)
  • types: removed duplicated code (9e62056)

Contributors to this release

... (truncated)

Commits
  • f6d2cf9 chore(ci): fix publish action content permission; (#6061)
  • a22f4b9 chore(release): v1.6.1 (#6060)
  • cb8bb2b chore(ci): Publish to NPM with provenance (#5835)
  • 37cbf92 chore(ci): added labeling and notification for published PRs; (#6059)
  • dd465ab fix(formdata): fixed content-type header normalization for non-standard brows...
  • 3dc8369 fix(platform): fixed emulated browser detection in node.js environment; (#6055)
  • f7adacd chore(release): v1.6.0 (#6031)
  • 9917e67 chore(ci): fix release-it arg; (#6032)
  • 96ee232 fix(CSRF): fixed CSRF vulnerability CVE-2023-45857 (#6028)
  • 7d45ab2 chore(tests): fixed tests to pass in node v19 and v20 with keep-alive enabl...
  • Additional commits viewable in compare view


Updates @slack/webhook from 5.0.4 to 7.0.1

Release notes

Sourced from @​slack/webhook's releases.

@​slack/webhook@​7.0.1

What's Changed

a74e35b feat: upgrade axios to resolve CVE-2023-45857 (#1682)

New Contributors

@​slack/webhook@​7.0.0

What's Changed

85c07d9 Set minimum node version to 18 (#1666) 0ba6dc2 Add metadata to incoming webhooks parameters (#1617)

Breaking Changes

While this release is a new major version, the only "breaking change" is that we dropped support for node versions below v18 (at the time of this release, v16 and lower have reached their end of life). No APIs from this package were changed.

@​slack/webhook@​6.1.0

See the full list of issues/pull requests of this release here.

@​slack/webhook@​6.0.0

  • Updated minimum Nodejs version to 12.13.0, updated minimum TypeScript version to 4.1 (#1146, #1147) - thanks @​stevengill
Commits
  • 9edb0f3 webhook@7.0.1. Also bump sinon dev dependency to latest version. (#1685)
  • a74e35b feat: upgrade axios to resolve CVE-2023-45857 (#1682)
  • 155293e web-api: Fix import and constructor naming conventions (#1683)
  • a8b948d typo in types package README fix (#1678)
  • c7c2f44 npm link up the packages in this repo during CI (#1672)
  • 5c52029 added the config lookup and set method implementation (#1676)
  • 4a8eeac web-api: Remove warning from chat.update (#1674)
  • 6e8a31e @​slack/web-api: prep for next major release. bump min node to v18 (#1667)
  • 1374422 Add deprecation comment
  • 7857f26 Update files.upload.v2 internals due to server-side improvements
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by filmaj, a new releaser for @​slack/webhook since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/dynatrace-oss/barista/network/alerts).
dependabot[bot] commented 8 months ago

Superseded by #2814.