lirantal / lockfile-lint

Lint an npm or yarn lockfile to analyze and detect security issues
Apache License 2.0
780 stars 35 forks source link

[Snyk] Upgrade cosmiconfig from 7.1.0 to 8.0.0 #149

Closed lirantal closed 1 year ago

lirantal commented 1 year ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to upgrade cosmiconfig from 7.1.0 to 8.0.0.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
*Warning:* This is a major version upgrade, and may be a breaking change. - The recommended version is **1 version** ahead of your current version. - The recommended version was released **23 days ago**, on 2022-11-21.
Release notes
Package name: cosmiconfig
  • 8.0.0 - 2022-11-21
  • 7.1.0 - 2022-11-12

    7.1.0

      </li>
    </ul>
    from <a href="https://snyk.io/redirect/github/davidtheclark/cosmiconfig/releases">cosmiconfig GitHub release notes</a>

Commit messages
Package name: cosmiconfig
  • 7d1dce9 Merge pull request #274 from davidtheclark/prepare-v8
  • 500dada correct changelog text
  • 9254fb0 Merge branch 'main' into prepare-v8
  • 68298d4 Merge pull request #282 from davidtheclark/add-filepath-to-loader-errors
  • 706c2ee add changelog entry
  • fea5937 add filepath to loader errors
  • ec975e4 Merge pull request #281 from vkrol/vkrol-patch-1
  • 8b8bcf7 don't install latest npm
  • 93c009a fix changelog
  • 195a1c5 drop node 12 support
  • 386ff8c Merge branch 'main' into prepare-v8
  • c2e52ac fix minor typo in readme
  • b85d869 Merge branch 'v7.1' into main
  • 2a1a259 Fix the cosmiconfig() link in the cosmiconfigSync section
  • 0160c2d Add "Maintainers wanted" note to readme (#277)
  • 19bd87b Fix js-yaml, type imports (#275)
  • bf455a3 Prepare v8
  • c7dc6ab Remove badges for Travis and Appveyor (#273)
  • 48c1e4a Add changelog note about yaml dependency (#272)
  • 9155d8a @ types/parse-json should be a dev dependency (#256)
  • 2ef8ce6 Switch from yaml to js-yaml (#270)
  • 457a69d Try GitHub actions for CI (#271)
Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

codecov-commenter commented 1 year ago

Codecov Report

Patch and project coverage have no change.

Comparison is base (144dc55) 97.95% compared to head (9eb7007) 97.95%.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #149 +/- ## ======================================= Coverage 97.95% 97.95% ======================================= Files 13 13 Lines 342 342 Branches 73 73 ======================================= Hits 335 335 Misses 7 7 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.

lirantal commented 1 year ago

cosmiconfig drops support for Node.js 10.x and 12.x which we're still running here. I won't merge for now, even though these are unmaintained anymore, to allow some time for the community to pick up

lirantal commented 1 year ago

Merging now with test matrix running for versions 16, and 18. Node.js v10 and v12 are long unsupported and v14 (still supported with this change is also recently unmaintained)