search

intelops / genpod

GenPod.dev UI
Other
0 stars 4 forks source link

Bump the npm_and_yarn group with 9 updates #104

Open dependabot[bot] opened 1 month ago

dependabot[bot] commented 1 month ago

Bumps the npm_and_yarn group with 9 updates:

Package From To
vite 5.0.10 5.1.8
braces 3.0.2 3.0.3
ejs 3.1.9 3.1.10
express 4.18.2 4.21.0
micromatch 4.0.5 4.0.8
path-to-regexp 0.1.7 0.1.10
send 0.18.0 0.19.0
serve-static 1.15.0 1.16.2
tar 6.2.0 6.2.1

Updates vite from 5.0.10 to 5.1.8

Changelog

Sourced from vite's changelog.

5.1.8 (2024-09-19)

5.1.7 (2024-03-24)

5.1.6 (2024-03-11)

  • chore(deps): update all non-major dependencies (#16131) (a862ecb), closes #16131
  • fix: check for publicDir before checking if it is a parent directory (#16046) (b6fb323), closes #16046
  • fix: escape single quote when relative base is used (#16060) (8f74ce4), closes #16060
  • fix: handle function property extension in namespace import (#16113) (f699194), closes #16113
  • fix: server middleware mode resolve (#16122) (8403546), closes #16122
  • fix(esbuild): update tsconfck to fix bug that could cause a deadlock (#16124) (fd9de04), closes #16124
  • fix(worker): hide "The emitted file overwrites" warning if the content is same (#16094) (60dfa9e), closes #16094
  • fix(worker): throw error when circular worker import is detected and support self referencing worker (eef9da1), closes #16103
  • style(utils): remove null check (#16112) (0d2df52), closes #16112
  • refactor(runtime): share more code between runtime and main bundle (#16063) (93be84e), closes #16063

5.1.5 (2024-03-04)

5.1.4 (2024-02-21)

... (truncated)

Commits


Updates braces from 3.0.2 to 3.0.3

Commits


Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits


Updates express from 4.18.2 to 4.21.0

Release notes

Sourced from express's releases.

4.21.0

What's Changed

New Contributors

Full Changelog: https://github.com/expressjs/express/compare/4.20.0...4.21.0

4.20.0

What's Changed

Important

  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect

Other Changes

... (truncated)

Changelog

Sourced from express's changelog.

4.21.0 / 2024-09-11

  • Deprecate res.location("back") and res.redirect("back") magic string
  • deps: serve-static@1.16.2
    • includes send@0.19.0
  • deps: finalhandler@1.3.1
  • deps: qs@6.13.0

4.20.0 / 2024-09-10

  • deps: serve-static@0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

  • Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

  • Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@0.6.0

4.18.3 / 2024-02-29

  • Fix routing requests without method
  • deps: body-parser@1.20.2
    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.


Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

  • backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

  • this is basically v4.0.5, with some README updates
  • it is vulnerable to CVE-2024-4067
  • Updated braces to v3.0.3 to avoid CVE-2024-4068
  • does NOT break API compatibility

[4.0.6] - 2024-05-21

  • Added hasBraces to check if a pattern contains braces.
  • Fixes CVE-2024-4067
  • BREAKS API COMPATIBILITY
  • Should be labeled as a major release, but it's not.
Commits
  • 8bd704e 4.0.8
  • a0e6841 run verb to generate README documentation
  • 4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
  • 03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
  • 814f5f7 lint
  • 67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
  • 113f2e3 fix: CVE numbers in CHANGELOG
  • d9dbd9a feat: updated CHANGELOG
  • 2ab1315 fix: use actions/setup-node@v4
  • 1406ea3 feat: rework test to work on macos with node 10,12 and 14
  • Additional commits viewable in compare view


Updates path-to-regexp from 0.1.7 to 0.1.10

Release notes

Sourced from path-to-regexp's releases.

Backtrack protection

Fixed

  • Add backtrack protection to parameters 29b96b4
    • This will break some edge cases but should improve performance

https://github.com/pillarjs/path-to-regexp/compare/v0.1.9...v0.1.10

Support non-lookahead regex output

Added

  • Allow a non-lookahead regex (#312) c4272e4

https://github.com/component/path-to-regexp/compare/v0.1.8...v0.1.9

Support named matching groups in RegExp

Added

  • Add support for named matching groups (#301) 114f62d

https://github.com/pillarjs/path-to-regexp/compare/v0.1.7...v0.1.8

Commits


Updates send from 0.18.0 to 0.19.0

Release notes

Sourced from send's releases.

0.19.0

What's Changed

New Contributors

Full Changelog: https://github.com/pillarjs/send/compare/0.18.0...0.19.0

Changelog

Sourced from send's changelog.

0.19.0 / 2024-09-10

  • Remove link renderization in html while redirecting
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for send since your current version.


Updates serve-static from 1.15.0 to 1.16.2

Release notes

Sourced from serve-static's releases.

1.16.0

What's Changed

New Contributors

Full Changelog: https://github.com/expressjs/serve-static/compare/v1.15.0...1.16.0

Changelog

Sourced from serve-static's changelog.

1.16.2 / 2024-09-11

  • deps: encodeurl@~2.0.0

1.16.1 / 2024-09-11

  • deps: send@0.19.0

1.16.0 / 2024-09-10

  • Remove link renderization in html while redirecting
Commits
Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for serve-static since your current version.


Updates tar from 6.2.0 to 6.2.1

Commits


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/intelops/genpod/network/alerts).
dryrunsecurity[bot] commented 1 month ago

DryRun Security Summary

The provided code change updates the vite package version in the package.json file from 5.0.8 to 5.1.8, which is a routine dependency update that does not directly introduce any security concerns, but it's important to review the changelog or release notes for the new version and perform thorough testing to ensure that the changes do not introduce any regressions or unintended behavior.

Expand for full summary
**Summary:** The provided code change is an update to the `package.json` file, which is a configuration file used by the Node.js package manager, Yarn. The change involves updating the version of the `vite` package from `5.0.8` to `5.1.8`. From an application security perspective, this change does not directly introduce any security concerns, as updating dependencies is a common practice to keep the project up-to-date and potentially address any known vulnerabilities or bugs in the previous version. However, it's important to review the changelog or release notes for the new version of `vite` to ensure that there are no known security vulnerabilities or breaking changes that could impact the application. Additionally, it's a good practice to have a comprehensive test suite and perform thorough testing of the application after any dependency updates to ensure that the changes do not introduce any regressions or unintended behavior. Overall, the provided code change appears to be a routine update to a dependency, and there are no immediate security concerns that I can identify. As an application security engineer, it's important to remain vigilant and continue to monitor the project's dependencies for any security-related updates or issues. **Files Changed:** - `package.json`: The `package.json` file has been updated to use version `5.1.8` of the `vite` package, which is a dependency used in the project. This change does not directly introduce any security concerns, but it's important to review the changelog or release notes for the new version to ensure that there are no known security vulnerabilities or breaking changes.

Code Analysis

We ran 9 analyzers against 2 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer Findings
Sensitive Files Analyzer 1 finding

Riskiness

:green_circle: Risk threshold not exceeded.

View PR in the DryRun Dashboard.