search

npm / npm-registry-client

http://npm.im/npm-registry-client
ISC License
264 stars 108 forks source link

build(deps): bump ssri from 5.2.4 to 8.0.1 #190

Open dependabot[bot] opened 3 years ago

dependabot[bot] commented 3 years ago

Bumps ssri from 5.2.4 to 8.0.1.

Changelog

Sourced from ssri's changelog.

8.0.1 (2021-01-27)

Bug Fixes

  • simplify regex for strict mode, add tests (76e2233)

8.0.0 (2020-02-18)

⚠ BREAKING CHANGES

  • SRI values with ../ in the algorithm name now throw as invalid (which they always probably should have!)
  • adds a new error that will be thrown. Empty SRIs are no longer considered valid for checking, only when using integrityStream to calculate the SRI value.

PR-URL: npm/ssri#12 Credit: @​claudiahdz

Features

Bug Fixes

  • harden SRI parsing against ../ funny business (4062735)
  • IntegrityStream responds to mutating opts object mid-stream (4a963e5)
  • throw null when sri is empty or bad (a6811cb), closes #12

7.1.0 (2019-10-24)

Bug Fixes

  • Do not blow up if the opts object is mutated (806e8c8)

Features

  • Add Integrity#merge method (0572c1d), closes #4

7.0.1 (2019-09-30)

7.0.0 (2019-09-18)

⚠ BREAKING CHANGES

... (truncated)

Commits
  • 3eec7a3 chore(release): 8.0.1
  • 2083289 chore: update package-lock and dev dependencies
  • 76e2233 fix: simplify regex for strict mode, add tests
  • 41b764f chore(release): 8.0.0
  • 4062735 fix: harden SRI parsing against ../ funny business
  • a6811cb fix: throw null when sri is empty or bad
  • 1727a7c chore: consistent project setup
  • 4a963e5 fix: IntegrityStream responds to mutating opts object mid-stream
  • 0e78fd7 feat: remove figgy-pudding
  • 79ba4ec chore(release): 7.1.0
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by nlf, a new releaser for ssri since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/npm/npm-registry-client/network/alerts).
coveralls commented 3 years ago

Coverage Status

Coverage remained the same at 90.52% when pulling b83bba14a3a62a32171511c3ef0c1a4cc20ef9b8 on dependabot/npm_and_yarn/ssri-8.0.1 into 14efa6848ca1e7278de0eb12a1430cdb85bddf02 on latest.