search

udistrital / cumplidos_dve_cliente

Cliente de cumplidos para docentes de vinculación especial
0 stars 0 forks source link

build(deps): bump node-forge and @angular-devkit/build-angular #120

Closed dependabot[bot] closed 1 year ago

dependabot[bot] commented 1 year ago

Bumps node-forge to 1.3.1 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates node-forge from 0.10.0 to 1.3.1

Changelog

Sourced from node-forge's changelog.

1.3.1 - 2022-03-29

Fixes

  • RFC 3447 and RFC 8017 allow for optional DigestAlgorithm NULL parameters for sha* algorithms and require NULL paramters for md2 and md5 algorithms.

1.3.0 - 2022-03-17

Security

  • Three RSA PKCS#1 v1.5 signature verification issues were reported by Moosa Yahyazadeh (moosa-yahyazadeh@uiowa.edu).
  • HIGH: Leniency in checking digestAlgorithm structure can lead to signature forgery.
  • HIGH: Failing to check tailing garbage bytes can lead to signature forgery.
  • MEDIUM: Leniency in checking type octet.
    • DigestInfo is not properly checked for proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.
    • CVE ID: CVE-2022-24773
    • GHSA ID: GHSA-2r2c-g63r-vccr

Fixed

  • [asn1] Add fallback to pretty print invalid UTF8 data.
  • [asn1] fromDer is now more strict and will default to ensuring all input bytes are parsed or throw an error. A new option parseAllBytes can disable this behavior.
    • NOTE: The previous behavior is being changed since it can lead to security issues with crafted inputs. It is possible that code doing custom DER parsing may need to adapt to this new behavior and optional flag.
  • [rsa] Add and use a validator to check for proper structure of parsed ASN.1

... (truncated)

Commits


Updates @angular-devkit/build-angular from 12.2.18 to 16.1.1

Release notes

Sourced from @​angular-devkit/build-angular's releases.

v16.1.1

16.1.1 (2023-06-22)

@​angular-devkit/build-angular

Commit Description
fix - f017fee2e actually disable Vite prebundling file discovery
fix - 2b4beaca2 experimental esbuild pipeline, add es2015 to main fields for RxJS v6 compatibility
fix - e3c85e00e track postcss provided file dependencies in esbuild builder
fix - 1419fff88 unpin and downgrade browserslist
fix - 950a4b60f watch all bundler provided inputs with esbuild builder

v16.1.0

16.1.0 (2023-06-13)

@​schematics/angular

Commit Description
feat - b14b95990 add bootstrap-agnostic utilities for writing ng-add schematics

@​angular-devkit/build-angular

Commit Description
feat - 3ede1a2ca allow forcing esbuild builder with dev-server
feat - 2d141fe3b show estimated transfer size with esbuild builder
feat - 9aa9b5264 support autoprefixer/tailwind CSS with Less/Sass in esbuild builder
feat - 3d1c09b23 support dev-server package prebundling with esbuild builder
feat - d8930facc support incremental TypeScript semantic diagnostics in esbuild builder
fix - 5cacd34a2 watch all TypeScript referenced files in esbuild builder
perf - 8336ad80d enable in-memory load result caching for stylesheets in esbuild builder

v16.1.0-rc.0

16.1.0-rc.0 (2023-06-07)

@​schematics/angular

Commit Description
feat - b14b95990 add bootstrap-agnostic utilities for writing ng-add schematics

@​angular-devkit/build-angular

Commit Description
fix - 772fe84ed ignore .git folder in browser-esbuild watcher
fix - 7155cbe5b ignore folders starting with a dot in browser-esbuild watcher

v16.1.0-next.2

16.1.0-next.2 (2023-06-01)

@​angular-devkit/build-angular

Commit Description
feat - 9aa9b5264 support autoprefixer/tailwind CSS with Less/Sass in esbuild builder

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

16.1.1 (2023-06-22)

@​angular-devkit/build-angular

Commit Type Description
f017fee2e fix actually disable Vite prebundling file discovery
2b4beaca2 fix experimental esbuild pipeline, add es2015 to main fields for RxJS v6 compatibility
e3c85e00e fix track postcss provided file dependencies in esbuild builder
1419fff88 fix unpin and downgrade browserslist
950a4b60f fix watch all bundler provided inputs with esbuild builder

16.1.0 (2023-06-13)

@​schematics/angular

Commit Type Description
b14b95990 feat add bootstrap-agnostic utilities for writing ng-add schematics

@​angular-devkit/build-angular

Commit Type Description
3ede1a2ca feat allow forcing esbuild builder with dev-server
2d141fe3b feat show estimated transfer size with esbuild builder
9aa9b5264 feat support autoprefixer/tailwind CSS with Less/Sass in esbuild builder
3d1c09b23 feat support dev-server package prebundling with esbuild builder
d8930facc feat support incremental TypeScript semantic diagnostics in esbuild builder
5cacd34a2 fix watch all TypeScript referenced files in esbuild builder
8336ad80d perf enable in-memory load result caching for stylesheets in esbuild builder

16.0.6 (2023-06-13)

@​angular-devkit/build-angular

Commit Type Description
eebb54cbf fix correctly handle sass imports
081b62539 fix support proxy configuration array-form in esbuild builder

... (truncated)

Commits
  • d0a593b release: cut the v16.1.1 release
  • 01ec505 build: update critters to 0.19.0
  • e3c85e0 fix(@​angular-devkit/build-angular): track postcss provided file dependencies ...
  • 950a4b6 fix(@​angular-devkit/build-angular): watch all bundler provided inputs with es...
  • 686d839 ci: publish to builds repos for all managed branches (feature and releasable ...
  • 2b4beac fix(@​angular-devkit/build-angular): experimental esbuild pipeline, add `es201...
  • 8e55424 test: update autoprefixer behavior tests to not use metadata emit
  • 71e571b Revert "fix(@​angular-devkit/build-angular): preemptively remove AOT metadata ...
  • 1419fff fix(@​angular-devkit/build-angular): unpin and downgrade browserslist
  • f017fee fix(@​angular-devkit/build-angular): actually disable Vite prebundling file di...
  • Additional commits viewable in compare view


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/udistrital/cumplidos_dve_cliente/network/alerts).
dependabot[bot] commented 1 year ago

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.