socket-security[bot]
commented
1 year ago 🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎
To accept the risk, merge this PR and you will not be notified again.
| Issue | Package | Version | Note | Source |
|---|---|---|---|---|
| Network access | mz | 2.7.0 |
|
pnpm-lock.yaml via tsup@7.1.0 |
Next steps
What is network access?
This module accesses the network.
Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.
Take a deeper look at the dependency
Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.
Remove the package
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
Mark a package as acceptable risk
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all
@SocketSecurity ignore mz@2.7.0
This PR contains the following updates:
^3.5.3->^3.6.0^3.5.3->^3.6.0^1.20.0->^1.21.08.6.2->8.6.4^7.0.0->^7.1.0Release Notes
nuxt/nuxt (@nuxt/kit)
### [`v3.6.0`](https://togithub.com/nuxt/nuxt/releases/tag/v3.6.0) [Compare Source](https://togithub.com/nuxt/nuxt/compare/v3.5.3...v3.6.0) > 3.6.0 is the next minor release, packed with improvements and bug fixes. #### 📣 Upcoming news In the coming week you can expect two announcements: 1. The open-sourcing of `nuxt/cli` by [**@pi0**](https://togithub.com/pi0) - a new, drop-in replacement for `nuxi` featuring more extensibility and better DX. We are aiming to release this alongside Nuxt 3.7, but you would be very welcome to test and contribute to `nuxi-ng` before then! 2. Three significant RFCs: **Nuxt Font**, **Nuxt Assets** and **Nuxt Scripts**. We're expecting an initial POC to take shape in the next month, and would very much appreciate community feedback on this. #### 👀 Highlights This minor release contains quite a lot, and we have big plans #####Shinigami92/eslint-define-config (eslint-define-config)
### [`v1.21.0`](https://togithub.com/Shinigami92/eslint-define-config/blob/HEAD/CHANGELOG.md#1210) [Compare Source](https://togithub.com/Shinigami92/eslint-define-config/compare/1.20.0...1.21.0) [diff](https://togithub.com/Shinigami92/eslint-define-config/compare/1.20.0...1.21.0) - Use esm by default ([#204]) - Update rules for: \[eslint, graphql-eslint, jsdoc, jsonc, testing-library, typescript-eslint, unicorn, vitest, vue] [#204]: https://togithub.com/Shinigami92/eslint-define-config/pull/204pnpm/pnpm (pnpm)
### [`v8.6.4`](https://togithub.com/pnpm/pnpm/releases/tag/v8.6.4) [Compare Source](https://togithub.com/pnpm/pnpm/compare/v8.6.3...v8.6.4) #### Patch Changes - In cases where both aliased and non-aliased dependencies exist to the same package, non-aliased dependencies will be used for resolving peer dependencies, addressing issue [#6588](https://togithub.com/pnpm/pnpm/issues/6588). - Ignore the port in the URL, while searching for authentication token in the `.npmrc` file [#6354](https://togithub.com/pnpm/pnpm/issues/6354). - Don't add the version of a local directory dependency to the lockfile. This information is not used anywhere by pnpm and is only causing more Git conflicts [#6695](https://togithub.com/pnpm/pnpm/pull/6695). #### Our Gold Sponsorsegoist/tsup (tsup)
### [`v7.1.0`](https://togithub.com/egoist/tsup/releases/tag/v7.1.0) [Compare Source](https://togithub.com/egoist/tsup/compare/v7.0.0...v7.1.0) ##### Features - Ensure matching declaration file exists for each output bundle format ([#934](https://togithub.com/egoist/tsup/issues/934)) ([fb4c2b6](https://togithub.com/egoist/tsup/commit/fb4c2b6e75e29c58956eaaa6afab12b130accb14))Configuration
📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate. View repository job log here.