Bump the npm_and_yarn group across 2 directories with 6 updates

Bumps the npm_and_yarn group with 5 updates in the /backend/custom_admin directory:

Package	From	To
braces	`3.0.2`	`3.0.3`
micromatch	`4.0.5`	`4.0.8`
postcss	`8.4.38`	`8.4.41`
ua-parser-js	`1.0.37`	`1.0.38`
vite	`5.0.12`	`5.4.2`

Bumps the npm_and_yarn group with 3 updates in the /email-templates directory: braces, micromatch and socket.io.

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

this is basically v4.0.5, with some README updates

it is vulnerable to CVE-2024-4067

Updated braces to v3.0.3 to avoid CVE-2024-4068

does NOT break API compatibility

[4.0.6] - 2024-05-21

Added hasBraces to check if a pattern contains braces.

Fixes CVE-2024-4067

BREAKS API COMPATIBILITY

Should be labeled as a major release, but it's not.

Commits

8bd704e 4.0.8
a0e6841 run verb to generate README documentation
4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
814f5f7 lint
67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
113f2e3 fix: CVE numbers in CHANGELOG
d9dbd9a feat: updated CHANGELOG
2ab1315 fix: use actions/setup-node@v4
1406ea3 feat: rework test to work on macos with node 10,12 and 14
Additional commits viewable in compare view

Updates postcss from 8.4.38 to 8.4.41

Release notes

Sourced from postcss's releases.

8.4.41

Fixed types (by @nex3 and @querkmachine).

Cleaned up RegExps (by @bluwy).

8.4.40

Moved to getter/setter in nodes types to help Sass team (by @nex3).

8.4.39

Fixed CssSyntaxError types (by @romainmenke).

Changelog

Sourced from postcss's changelog.

8.4.41

Fixed types (by @nex3 and @querkmachine).

Cleaned up RegExps (by @bluwy).

8.4.40

Moved to getter/setter in nodes types to help Sass team (by @nex3).

8.4.39

Fixed CssSyntaxError types (by @romainmenke).

Commits

57e0211 Release 8.4.41 version
f27134f Update dependencies
146d31c Merge pull request #1952 from nex3/rule-props
3707c3b Merge remote-tracking branch 'origin/main' into rule-props
9ab3619 Declare Input.toJSON()
be59ad4 Remove dead website
165154b Update dependencies
6127a44 Declaration#variable do not have setter
536726d Fix type
58fa0ef Sort keys
Additional commits viewable in compare view

Updates ua-parser-js from 1.0.37 to 1.0.38

Release notes

Sourced from ua-parser-js's releases.

v1.0.38

Version 1.0.38

Fix error on getOS() when userAgentData.platform is undefined

Add new browser: Opera GX, Twitter

Improve browser detection: DuckDuckGo

Improve device detection: OPPO Pad, Oculus Quest

Changelog

Sourced from ua-parser-js's changelog.

Version 0.7.38 / 1.0.38

Fix error on getOS() when userAgentData.platform is undefined

Add new browser: Opera GX, Twitter

Improve browser detection: DuckDuckGo

Improve device detection: OPPO Pad, Oculus Quest

Commits

693a83d Bump version 1.0.38 (mirror of 0.7.38)
cede701 Bump version 0.7.38
3bfd164 Fix #700 - Error on getOS() when userAgentData.platform is undefined
e7bfc4e Backport - Fix #730 - Improve browser detection: DuckDuckGo
775de4e Backport - Fix #722 - Add new browser name: Twitter
fecff02 Backport - Fix #721 - Improve detection: recognize OPPO Pad as tablet
d3d83fa Backport - Fix #708 - Improve detection for Quest 3
5790c0e Backport - Fix #697 - Add new browser: Opera GX - https://www.opera.com/gx
See full diff in compare view

Updates vite from 5.0.12 to 5.4.2

Release notes

Sourced from vite's releases.

create-vite@5.4.0

Please refer to CHANGELOG.md for details.

create-vite@5.3.0

Please refer to CHANGELOG.md for details.

create-vite@5.2.3

Please refer to CHANGELOG.md for details.

create-vite@5.2.2

Please refer to CHANGELOG.md for details.

create-vite@5.2.1

Please refer to CHANGELOG.md for details.

create-vite@5.2.0

Please refer to CHANGELOG.md for details.

create-vite@5.1.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.4.2 (2024-08-20)

chore: remove stale TODOs (#17866) (e012f29), closes #17866

refactor: remove redundant prepend/strip base (#17887) (3b8f03d), closes #17887

fix: resolve relative URL generated by renderBuiltUrl passed to module preload (#16084) (fac3a8e), closes #16084

feat: support originalFilename (#17867) (7d8c0e2), closes #17867

5.4.1 (2024-08-15)

fix: build.modulePreload.resolveDependencies is optimizable (#16083) (e961b31), closes #16083

fix: align CorsOptions.origin type with @types/cors (#17836) (1bda847), closes #17836

fix: typings for vite:preloadError (#17868) (6700594), closes #17868

fix(build): avoid re-define __vite_import_meta_env__ (#17876) (e686d74), closes #17876

fix(deps): update all non-major dependencies (#17869) (d11711c), closes #17869

fix(lightningcss): search for assets with correct base path (#17856) (4e5ce3c), closes #17856

fix(worker): handle self reference url worker in dependency for build (#17846) (391bb49), closes #17846

chore: fix picocolors import for local dev (#17884) (9018255), closes #17884

refactor: remove handleHotUpdate from watch-package-data plugin (#17865) (e16bf1f), closes #17865

5.4.0 (2024-08-07)

fix(build): windows platform build output path error (#17818) (6ae0615), closes #17818

fix(deps): update launch-editor to consume fix for windows paths (#17828) (cf2f90d), closes #17828

fix(ssr): fix global variable name conflict (#17809) (6aa2206), closes #17809

fix(worker): fix importScripts injection breaking iife code (#17827) (bb4ba9f), closes #17827

chore: bump typescript-eslint to v8 (#17624) (d1891fd), closes #17624

chore(deps): update all non-major dependencies (#17820) (bb2f8bb), closes #17820

perf(ssr): do a single-pass over AST with node cache arrays (#17812) (81327eb), closes #17812

5.4.0-beta.1 (2024-08-01)

fix: handle encoded base paths (#17577) (720447e), closes #17577

fix: opt-in server.fs.cachedChecks (#17807) (4de659c), closes #17807

feat(css): support sass compiler api and sass-embedded package (#17754) (1025bb6), closes #17754

5.4.0-beta.0 (2024-07-30)

fix: specify own Node version as target when bundling config files (#17307) (bbf001f), closes #17307

fix(build): handle invalid JSON in import.meta.env (#17648) (659b720), closes #17648

fix(deps): update all non-major dependencies (#17780) (e408542), closes #17780

fix(mergeConfig): don't recreate server.hmr.server instance (#17763) (5c55b29), closes #17763

feat(css): support sass modern api (#17728) (73a3de0), closes #17728

... (truncated)

Commits

b1ecdaf release: v5.4.2
e012f29 chore: remove stale TODOs (#17866)
3b8f03d refactor: remove redundant prepend/strip base (#17887)
fac3a8e fix: resolve relative URL generated by renderBuiltUrl passed to module prel...
7d8c0e2 feat: support originalFilename (#17867)
b44c20c release: v5.4.1
391bb49 fix(worker): handle self reference url worker in dependency for build (#17846)
e686d74 fix(build): avoid re-define __vite_import_meta_env__ (#17876)
9018255 chore: fix picocolors import for local dev (#17884)
1bda847 fix: align CorsOptions.origin type with @types/cors (#17836)
Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

this is basically v4.0.5, with some README updates

it is vulnerable to CVE-2024-4067

Updated braces to v3.0.3 to avoid CVE-2024-4068

does NOT break API compatibility

[4.0.6] - 2024-05-21

Added hasBraces to check if a pattern contains braces.

Fixes CVE-2024-4067

BREAKS API COMPATIBILITY

Should be labeled as a major release, but it's not.

Commits

8bd704e 4.0.8
a0e6841 run verb to generate README documentation
4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
814f5f7 lint
67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
113f2e3 fix: CVE numbers in CHANGELOG
d9dbd9a feat: updated CHANGELOG
2ab1315 fix: use actions/setup-node@v4
1406ea3 feat: rework test to work on macos with node 10,12 and 14
Additional commits viewable in compare view

Updates socket.io from 4.5.1 to 4.7.5

Release notes

Sourced from socket.io's releases.

4.7.5

Bug Fixes

close the adapters when the server is closed (bf64870)

remove duplicate pipeline when serving bundle (e426f3e)

Links

Diff: https://github.com/socketio/socket.io/compare/4.7.4...4.7.5

Client release: 4.7.5

engine.io@~6.5.2 (no change)

ws@~8.11.0 (no change)

4.7.4

Bug Fixes

typings: calling io.emit with no arguments incorrectly errored (cb6d2e0), closes #4914

Links

Diff: https://github.com/socketio/socket.io/compare/4.7.3...4.7.4

Client release: 4.7.4

engine.io@~6.5.2 (no change)

ws@~8.11.0 (no change)

4.7.3

Bug Fixes

return the first response when broadcasting to a single socket (#4878) (df8e70f)

typings: allow to bind to a non-secure Http2Server (#4853) (8c9ebc3)

Links

Diff: https://github.com/socketio/socket.io/compare/4.7.2...4.7.3

Client release: 4.7.3

engine.io@~6.5.2 (no change)

ws@~8.11.0 (no change)

4.7.2

Bug Fixes

clean up child namespace when client is rejected in middleware (#4773) (0731c0d)

webtransport: properly handle WebTransport-only connections (3468a19)

webtransport: add proper framing (a306db0)

Links

... (truncated)

Changelog

Sourced from socket.io's changelog.

4.7.5 (2024-03-14)

Bug Fixes

close the adapters when the server is closed (bf64870)

remove duplicate pipeline when serving bundle (e426f3e)

Dependencies

engine.io@~6.5.2 (no change)

ws@~8.11.0 (no change)

4.7.4 (2024-01-12)

Bug Fixes

typings: calling io.emit with no arguments incorrectly errored (cb6d2e0), closes #4914

Dependencies

engine.io@~6.5.2 (no change)

ws@~8.11.0 (no change)

4.7.3 (2024-01-03)

Bug Fixes

return the first response when broadcasting to a single socket (#4878) (df8e70f)

typings: allow to bind to a non-secure Http2Server (#4853) (8c9ebc3)

Dependencies

engine.io@~6.5.2 (no change)

ws@~8.11.0 (no change)

4.7.2 (2023-08-02)

... (truncated)

Commits

5017681 chore(release): 4.7.5
bf64870 fix: close the adapters when the server is closed
748e18c ci: test with older TypeScript version
b9ce6a2 refactor: create specific adapter for parent namespaces (#4950)
54dabe5 ci: upgrade to actions/checkout@4 and actions/setup-node@4
e426f3e fix: remove duplicate pipeline when serving bundle
e36062c docs: update the webtransport example
0bbe8ae docs: only execute the passport middleware once
914a8bd docs: add example with JWT
d943c3e docs: update the Passport.js example
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/pythonitalia/pycon/network/alerts).

Note Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

pythonitalia / pycon

Bump the npm_and_yarn group across 2 directories with 6 updates #4022

4.0.8

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

[4.0.6] - 2024-05-21

8.4.41

8.4.40

8.4.39

8.4.41

8.4.40

8.4.39

v1.0.38

Version 1.0.38

Version 0.7.38 / 1.0.38

create-vite@5.4.0

create-vite@5.3.0

create-vite@5.2.3

create-vite@5.2.2

create-vite@5.2.1

create-vite@5.2.0

create-vite@5.1.0

5.4.2 (2024-08-20)

5.4.1 (2024-08-15)

5.4.0 (2024-08-07)

5.4.0-beta.1 (2024-08-01)

5.4.0-beta.0 (2024-07-30)

4.0.8

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

[4.0.6] - 2024-05-21

4.7.5

Bug Fixes

Links

4.7.4

Bug Fixes

Links

4.7.3

Bug Fixes

Links

4.7.2

Bug Fixes

Links

4.7.5 (2024-03-14)

Bug Fixes

Dependencies

4.7.4 (2024-01-12)

Bug Fixes

Dependencies

4.7.3 (2024-01-03)

Bug Fixes

Dependencies

4.7.2 (2023-08-02)