guardrails[bot]
commented
2 years ago :warning: We detected 2 security issues in this pull request:
Vulnerable Libraries (2)
Severity | Details ----- | -------- High | [pkg:npm/flat@5.0.2@5.0.2](https://github.com/recurly/starsky/blob/e9798c5bafc6217c171c5efc31a0e04eb66201a6/package-lock.json#L345) (t) - **no patch available** High | [pkg:npm/mocha@10.1.0@10.1.0](https://github.com/recurly/starsky/blob/e9798c5bafc6217c171c5efc31a0e04eb66201a6/package.json#L26) - **no patch available** More info on how to fix Vulnerable Libraries in [JavaScript](https://docs.guardrails.io/docs/en/vulnerabilities/javascript/using_vulnerable_libraries.html?utm_source=ghpr#).
👉 Go to the dashboard for detailed results.
📥 Happy? Share your feedback with us.
Bumps minimatch to 3.0.8 and updates ancestor dependencies minimatch, mocha and jshint. These dependencies need to be updated together.
Updates
minimatchfrom 0.2.14 to 3.0.8Commits
782c2643.0.86ade2dafix: trim patterna6f52b03.0.7e4cd434fix: treat nocase:true as always having magice6bbe1cpublishConfig for 3.05b7cd333.0.620b4b56[fix] revert all breaking syntax changes2ff0388document, expose, and test 'partial:true' option5dbd6a7ci: tests and makeworkdbda065full test coverage, adding tests, deleting dead codeMaintainer changes
This version was pushed to npm by isaacs, a new releaser for minimatch since your current version.
Updates
mochafrom 1.16.1 to 10.1.0Release notes
Sourced from mocha's releases.
... (truncated)
Changelog
Sourced from mocha's changelog.
... (truncated)
Commits
5f96d51build(v10.1.0): releaseed74f16build(v10.1.0): update CHANGELOG51d4746chore(devDeps): update 'ESLint' to v8 (#4926)4e06a6ffix(browser): increase contrast for replay buttons (#4912)41567dfSupport prefers-color-scheme: dark (#4896)61b4b92fix the regular expression for functioncleaninutils.js(#4770)77c18d2chore: use standard 'Promise.allSettled' instead of polyfill (#4905)84b2f84chore(ci): upgrade GH actions to latest versions (#4899)023f548build(v10.0.0): release62b1566build(v10.0.0): update CHANGELOGMaintainer changes
This version was pushed to npm by juergba, a new releaser for mocha since your current version.
Updates
jshintfrom 2.3.0 to 2.13.5Release notes
Sourced from jshint's releases.
... (truncated)
Changelog
Sourced from jshint's changelog.
... (truncated)
Commits
95a6036v2.13.5d9583d5[[CHORE]] Remove unused script5c256a2[[FIX]] Tolerate late definition of async function (#3618)61c868cv2.13.4eb4609a[[FIX]] Remove shelljsb23e125[[CHORE]] Remove shelljs from internal tooling56d4a47[[CHORE]] Use consistent interface for fs ops33cfc87[[CHORE]] Migrate from TravisCI to CircleCIa53cc95[[CHORE]] Update version of package manifest (#3602)2a842acv2.13.3Maintainer changes
This version was pushed to npm by jugglinmike, a new releaser for jshint since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/recurly/starsky/network/alerts).