v3.4.4 release bumps resolve-url-loader to a version for which npm audit does not report a vulnerability. Note that this vulnerability did not affect Create React App projects, so this change is only necessary to satisfy auditing tools.
Migrating from 3.4.3 to 3.4.4
Inside any created project that has not been ejected, run:
v3.4.3 release bumps terser-webpack-plugin to a version for which npm audit does not report a vulnerability. Note that this vulnerability did not affect Create React App projects, so this change is only necessary to satisfy auditing tools.
Migrating from 3.4.2 to 3.4.3
Inside any created project that has not been ejected, run:
v3.4.2 release bumps webpack-dev-server to a version for which npm audit does not report a vulnerability. Note that this vulnerability did not affect Create React App projects, so this change is only necessary to satisfy auditing tools.
Migrating from 3.4.1 to 3.4.2
Inside any created project that has not been ejected, run:
backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch
[4.0.7] - 2024-05-22
this is basically v4.0.5, with some README updates
it is vulnerable to CVE-2024-4067
Updated braces to v3.0.3 to avoid CVE-2024-4068
does NOT break API compatibility
[4.0.6] - 2024-05-21
Added hasBraces to check if a pattern contains braces.
Fixes CVE-2024-4067
BREAKS API COMPATIBILITY
Should be labeled as a major release, but it's not.
[4.0.1 - 4.0.5]
[4.0.0] - 2019-03-20
Added
Adds support for options.onMatch. See the readme for details
Adds support for options.onIgnore. See the readme for details
Adds support for options.onResult. See the readme for details
Breaking changes
Require Node.js >= 8.6
Removed support for passing an array of brace patterns to micromatch.braces().
To strictly enforce closing brackets (for {, [, and (), you must now use strictBrackets=true instead of strictErrors.
cache - caching and all related options and methods have been removed
options.unixify was renamed to options.windows
options.nodupes Was removed. Duplicates are always removed by default. You can override this with custom behavior by using the onMatch, onResult and onIgnore functions.
options.snapdragon was removed, as snapdragon is no longer used.
options.sourcemap was removed, as snapdragon is no longer used, which provided sourcemap support.
[3.0.0] - 2017-04-11
Complete overhaul, with 36,000+ new unit tests validated against actual output generated by Bash and minimatch. More specifically, 35,000+ of the tests:
micromatch results are directly compared to bash results
in rare cases, when micromatch and bash disagree, micromatch's results are compared to minimatch's results
micromatch is much more accurate than minimatch, so there were cases where I had to make assumptions. I'll try to document these.
This refactor introduces a parser and compiler that are supersets of more granular parsers and compilers from other sub-modules. Each of these sub-modules has a singular responsibility and focuses on a certain type of matching that aligns with a specific part of the Bash "expansion" API.
These sub-modules work like plugins to seamlessly create the micromatch parser/compiler, so that strings are parsed in one pass, an AST is created, then a new string is generated by the compiler.
RFC 3447 and RFC 8017 allow for optional DigestAlgorithmNULL parameters
for sha* algorithms and require NULL paramters for md2 and md5
algorithms.
1.3.0 - 2022-03-17
Security
Three RSA PKCS#1 v1.5 signature verification issues were reported by Moosa
Yahyazadeh (moosa-yahyazadeh@uiowa.edu).
HIGH: Leniency in checking digestAlgorithm structure can lead to
signature forgery.
The code is lenient in checking the digest algorithm structure. This can
allow a crafted structure that steals padding bytes and uses unchecked
portion of the PKCS#1 encoded message to forge a signature when a low
public exponent is being used. For more information, please see
"Bleichenbacher's RSA signature forgery based on implementation
error"
by Hal Finney.
HIGH: Failing to check tailing garbage bytes can lead to signature
forgery.
The code does not check for tailing garbage bytes after decoding a
DigestInfo ASN.1 structure. This can allow padding bytes to be removed
and garbage data added to forge a signature when a low public exponent is
being used. For more information, please see "Bleichenbacher's RSA
signature forgery based on implementation
error"
by Hal Finney.
DigestInfo is not properly checked for proper ASN.1 structure. This can
lead to successful verification with signatures that contain invalid
structures but a valid digest.
[asn1] Add fallback to pretty print invalid UTF8 data.
[asn1] fromDer is now more strict and will default to ensuring all input
bytes are parsed or throw an error. A new option parseAllBytes can disable
this behavior.
NOTE: The previous behavior is being changed since it can lead to
security issues with crafted inputs. It is possible that code doing custom
DER parsing may need to adapt to this new behavior and optional flag.
[rsa] Add and use a validator to check for proper structure of parsed ASN.1
It serializes BigInt values as follows since this version. The result of serialization may be changed if you are passing BigInt values into the serialize-javascript.
Note: the randombytes has been added to the dependency package to improve the generation of UIDs. Check the #22 for more information. Thanks to @JordanMilne and @Siebes for this change.
It serializes Infinity values as follows since this version. The result of serialization may be changed if you are passing Infinity values into the serialize-javascript.
The package.json file for the whatsapp-clone client has been updated to change the version of the react-scripts dependency from ^3.0.1 to ^5.0.1. This update involves modifications to the scripts and configurations utilized by Create React App, which may impact various aspects of the application, including development and build processes.
Changes
File Path
Change Summary
whatsapp-clone/client/package.json
Updated react-scripts from ^3.0.1 to ^5.0.1
Poem
In the garden of code, where rabbits play,
A script upgraded, brightens the day.
Hops of new features, bugs on the run,
With react-scripts five, we leap, oh what fun!
So gather your carrots, and dance with glee,
For a smoother build, we toast with tea! 🐇✨
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?
Share
- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)
- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)
- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)
- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)
Tips
### Chat
There are 3 ways to chat with [CodeRabbit](https://coderabbit.ai):
- Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- `I pushed a fix in commit .`
- `Generate unit testing code for this file.`
- `Open a follow-up GitHub issue for this discussion.`
- Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples:
- `@coderabbitai generate unit testing code for this file.`
- `@coderabbitai modularize this function.`
- PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- `@coderabbitai generate interesting stats about this repository and render them as a table.`
- `@coderabbitai show all the console.log statements in this repository.`
- `@coderabbitai read src/utils.ts and generate unit testing code.`
- `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.`
- `@coderabbitai help me debug CodeRabbit configuration file.`
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.
### CodeRabbit Commands (invoked as PR comments)
- `@coderabbitai pause` to pause the reviews on a PR.
- `@coderabbitai resume` to resume the paused reviews.
- `@coderabbitai review` to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
- `@coderabbitai full review` to do a full review from scratch and review all the files again.
- `@coderabbitai summary` to regenerate the summary of the PR.
- `@coderabbitai resolve` resolve all the CodeRabbit review comments.
- `@coderabbitai configuration` to show the current CodeRabbit configuration for the repository.
- `@coderabbitai help` to get help.
Additionally, you can add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed.
### CodeRabbit Configuration File (`.coderabbit.yaml`)
- You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository.
- Please see the [configuration documentation](https://docs.coderabbit.ai/guides/configure-coderabbit) for more information.
- If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json`
### Documentation and Community
- Visit our [Documentation](https://coderabbit.ai/docs) for detailed information on how to use CodeRabbit.
- Join our [Discord Community](https://discord.com/invite/GsXnASn26c) to get help, request features, and share feedback.
- Follow us on [X/Twitter](https://twitter.com/coderabbitai) for updates and announcements.
Bumps the npm_and_yarn group with 2 updates in the /whatsapp-clone/client directory: semver and react-scripts.
Updates
semverfrom 5.5.0 to 7.6.3Release notes
Sourced from semver's releases.
... (truncated)
Changelog
Sourced from semver's changelog.
... (truncated)
Commits
0a12d6cchore: release 7.6.3 (#720)73a3d79fix: optimize Range parsing and formatting (#726)2975ecedocs: fix extra backtick typo (#719)eb1380bchore: release 7.6.2 (#714)6466ba9fix(lru): use map.delete() directly (#713)d777418chore: release 7.6.1 (#706)988a8dedeps: uninstalllru-cache(#709)5feeb7fchore: postinstall for dependabot template-oss PRdd09b60chore: bump@npmcli/template-ossto 4.22.0c570a34fix(linting): no-unused-varsMaintainer changes
This version was pushed to npm by npm-cli-ops, a new releaser for semver since your current version.
Updates
react-scriptsfrom 3.0.1 to 5.0.1Changelog
Sourced from react-scripts's changelog.
... (truncated)
Commits
19fa58dPublish9802941fix: webpack noise printed only if error or warning (#12245)2eef1d0Update templates to use React 18createRoot(#12220)221e511Publish5614c87Add support for Tailwind (#11717)20edab4fix(webpackDevServer): disable overlay for warnings (#11413)3afbbc0Update all dependencies (#11624)f5467d5feat(eslint-config-react-app): support ESLint 8.x (#11375)c7627ceUpdate webpack and dev server (#11646)544befeUpdate package.json (#11597)Updates
bracesfrom 2.3.2 to 3.0.3Changelog
Sourced from braces's changelog.
Commits
Updates
micromatchfrom 3.1.10 to 4.0.8Release notes
Sourced from micromatch's releases.
Changelog
Sourced from micromatch's changelog.
... (truncated)
Commits
8bd704e4.0.8a0e6841run verb to generate README documentation4ec2884Merge branch 'v4' into hauserkristof-feature/v4.0.803aa805Merge pull request #266 from hauserkristof/feature/v4.0.8814f5f7lint67fcce6fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5113f2e3fix: CVE numbers in CHANGELOGd9dbd9afeat: updated CHANGELOG2ab1315fix: use actions/setup-node@v41406ea3feat: rework test to work on macos with node 10,12 and 14Updates
ansi-htmlfrom 0.0.7 to 0.0.9Commits
Updates
browserslistfrom 4.7.0 to 4.23.3Release notes
Sourced from browserslist's releases.
Changelog
Sourced from browserslist's changelog.
... (truncated)
Commits
ee095bdRelease 4.32.3 version0f4e6f7Update dependencies8f87b3cfix: browser ray gt or gte compare with latest version (#836)cdcfbc0Release 4.23.2 version9e8188bUpdate dependencies543fc48Update Firefox ESRedd5309Release 4.23.1 version9e8ca3dSimplify codebbe6821Update locka36e1adUpdate ESLint and dependenciesUpdates
loader-utilsfrom 1.2.3 to 2.0.4Release notes
Sourced from loader-utils's releases.
... (truncated)
Changelog
Sourced from loader-utils's changelog.
... (truncated)
Commits
6688b50chore(release): 2.0.4ac09944fix: ReDoS problem (#225)7162619chore(release): 2.0.3a93cf6ffix(security): prototype polution exploit (#217)90c7c4bchore(release): 2.0.28c2d24efix: base64 generation and unicode characters (#197)5fb5562chore(release): 2.0.11069f61fix: md4 support on Node.js v17 (#193)d9f4e23chore(release): 2.0.0865dc03refactor: switch tomd4by default (#168)Updates
minimatchfrom 3.0.4 to 3.1.2Commits
699c4593.1.22f2b5fffix: trim pattern25d7c0d3.1.155dda29fix: treat nocase:true as always having magic5e1fb8d3.1.0f8145c5Add 'allowWindowsEscape' option570e8b1add publishConfig for v3 publishes5b7cd333.0.620b4b56[fix] revert all breaking syntax changes2ff0388document, expose, and test 'partial:true' optionUpdates
node-forgefrom 0.10.0 to 1.3.1Changelog
Sourced from node-forge's changelog.
... (truncated)
Commits
a0a4a42Release 1.3.1.a33830fUpdate changelog.740954dAllow optional DigestAlgorithm parameters.56f4316Allow DigestInfo.DigestAlgorith.parameters to be optionalcbf0bd5Start 1.3.1-0.6c5b901Release 1.3.0.0f3972aUpdate changelog.dc77b39Fix error checking.bb822c0Add advisory links.d4395feUpdate changelog.Updates
react-dev-utilsfrom 9.1.0 to 12.0.1Changelog
Sourced from react-dev-utils's changelog.
... (truncated)
Commits
19fa58dPublisha422bf2Ensure posix compliant joins for urls in middleware (#11640)221e511Publish3afbbc0Update all dependencies (#11624)3880ba6Remove dependency pinning (#11474)5cedfe4Bump browserslist from 4.14.2 to 4.16.5 (#11476)63bba07Upgrade jest and related packages from 26.6.0 to 27.1.0 (#11338)960b21eBump immer from 8.0.4 to 9.0.6 (#11364)f0a837cWebpack 5 (#11201)369fccffix: fast refresh stops on needed bail outs (#11105)Updates
serialize-javascriptfrom 1.9.1 to 4.0.0Release notes
Sourced from serialize-javascript's releases.
... (truncated)
Commits
a8a458cv4.0.00849988Update example codee997f21Bump nyc from 15.0.1 to 15.1.0 (#85)418dd82Revert "Revert "support for bigint (#80)""b54341ev3.1.07cee7e4Revert "support for bigint (#80)"026a445Bump mocha from 7.1.2 to 7.2.0 (#83)5130a71support for bigint (#80)ea76b23Bump mocha from 7.1.1 to 7.1.2 (#82)073c8d8Bump nyc from 15.0.0 to 15.0.1 (#81)Updates
shell-quotefrom 1.7.2 to 1.8.1Changelog
Sourced from shell-quote's changelog.
Issues
0 New issues
0 Accepted issues
Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code
See analysis details on SonarCloud
Here's the code health analysis summary for commits
d7f3b2c..1ffd8d1. View details on DeepSource ↗.Analysis Summary
Superseded by #104.