In vulnerable versions of ws, the issue can be mitigated in the following ways:
Reduce the maximum allowed length of the request headers using the
[--max-http-header-size=size][] and/or the [maxHeaderSize][] options so
that no more headers than the server.maxHeadersCount limit can be sent.
Fix uri scheme validation (@ChALkeR).
Fix boolean schemas with strictKeywords option (#1270)
v6.12.4
Fix: coercion of one-item arrays to scalar that should fail validation (failing example).
v6.12.3
Pass schema object to processCode function
Option for strictNumbers (@issacgerges, #1128)
Fixed vulnerability related to untrusted schemas (CVE-2020-15366)
Time formats support two digit and colon-less variants of timezone offset (#1061 , @cjpillsbury)
Docs: RegExp related security considerations
Tests: Disabled failing typescript test
v6.10.2
Fix: the unknown keywords were ignored with the option strictKeywords: true (instead of failing compilation) in some sub-schemas (e.g. anyOf), when the sub-schema didn't have known keywords.
[create-jest] Add npm init / yarn create initialiser for Jest projects (#14465)
[jest-validate] Allow deprecation warnings for unknown options (#14499)
Fixes
[jest-resolver] Replace unmatched capture groups in moduleNameMapper with empty string instead of undefined (#14507)
[jest-snapshot] Allow for strings as well as template literals in inline snapshots (#14465)
[@jest/test-sequencer] Calculate test runtime if perStats.duration is missing (#14473)
Performance
[@jest/create-cache-key-function] Cache access of NODE_ENV and BABEL_ENV (#14455)
Chore & Maintenance
[jest-cli] Move internal config initialisation logic to the create-jest package (#14465)
29.6.4
Fixes
[jest-core] Fix typo in scheduleAndRun performance marker (#14434)
[jest-environment-node] Make sure atob and btoa are writeable in Node 20 (#14446)
[jest-worker] Additional error wrapper for parentPort.postMessage to fix unhandled DataCloneError. (#14437)
29.6.3
Fixes
[expect, @jest/expect-utils]ObjectContaining support sumbol as key (#14414)
[expect] Remove @types/node from dependencies (#14385)
[jest-core] Use workers in watch mode by default to avoid crashes (#14059 & #14085).
[jest-reporters] Update istanbul-lib-instrument dependency to v6. (#14401)
[jest-mock] Revert #13692 as it was a breaking change (#14429)
[jest-mock] Revert #13866 as it was a breaking change (#14429)
[jest-mock] Revert #13867 as it was a breaking change (#14429)
[@jest/reporters] Marks Reporter's hooks as optional (#14433)
[jest-runtime] Fix dynamic ESM import module bug when loaded module through jest.isolateModulesAsync (#14397)
Chore & Maintenance
[jest-changed-files, jest-circus, jest-console, @jest/core, @jest/runtime, @jest/transform] Use invariant and notEmpty from jest-util rather than own internal (#14366)
Coerce numbers to strings when passed to semver.coerce()
Add rtl option to coerce from right to left
6.1.3
Handle X-ranges properly in includePrerelease mode
6.1.2
Do not throw when testing invalid version strings
6.1.1
Add options support for semver.coerce()
Handle undefined version passed to Range.test
6.1.0
Add semver.compareBuild function
Support * in semver.intersects
6.0
Fix intersects logic.
This is technically a bug fix, but since it is also a change to behavior
that may require users updating their code, it is marked as a major
version increment.
5.7
Add minVersion method
5.6
Move boolean loose param to an options object, with
backwards-compatibility protection.
Add ability to opt out of special prerelease version handling with
the includePrerelease option flag.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/xBytez/slackbotapi/network/alerts).
Bumps the npm_and_yarn group with 10 updates:
2.88.0
2.88.2
7.5.10
8.17.1
5.5.2
6.12.6
3.0.0
3.0.1
2.3.2
3.0.3
24.9.0
29.7.0
5.7.1
6.3.1
0.2.3
0.4.0
3.0.4
3.1.2
2.4.3
2.5.0
Updates
request
from 2.88.0 to 2.88.2Changelog
Sourced from request's changelog.
Commits
Updates
ws
from 7.5.10 to 8.17.1Release notes
Sourced from ws's releases.
... (truncated)
Commits
3c56601
[dist] 8.17.1e55e510
[security] Fix crash when the Upgrade header cannot be read (#2231)6a00029
[test] Increase code coverageddfe4a8
[perf] Reduce the amount ofcrypto.randomFillSync()
callsb73b118
[dist] 8.17.029694a5
[test] Use thehighWaterMark
variable934c9d6
[ci] Test on node 221817bac
[ci] Do not test on node 2196c9b3d
[major] Flip the default value ofallowSynchronousEvents
(#2221)e5f32c7
[fix] Emit at most one event per event loop iteration (#2218)Updates
ajv
from 5.5.2 to 6.12.6Release notes
Sourced from ajv's releases.
... (truncated)
Commits
fe59143
6.12.6d580d3e
Merge pull request #1298 from ajv-validator/fix-urlfd36389
fix: regular expression for "url" format490e34c
docs: link to v7-beta branch9cd93a1
docs: note about v7 in readme877d286
Merge pull request #1262 from b4h0-c4t/refactor-opt-object-typef1c8e45
6.12.5764035e
Merge branch 'ChALkeR-chalker/fix-comma'3798160
Merge branch 'chalker/fix-comma' of git://github.com/ChALkeR/ajv into ChALkeR...a3c7eba
Merge branch 'refactor-opt-object-type' of github.com:b4h0-c4t/ajv into refac...Updates
ansi-regex
from 3.0.0 to 3.0.1Commits
f545bdb
3.0.1c57d4c2
fix a few old XO issues for backport419250f
Fix potential ReDoS (#37)Updates
braces
from 2.3.2 to 3.0.3Changelog
Sourced from braces's changelog.
Commits
Updates
jest
from 24.9.0 to 29.7.0Release notes
Sourced from jest's releases.
... (truncated)
Changelog
Sourced from jest's changelog.
... (truncated)
Commits
4e56991
v29.7.055cd6a0
v29.6.4fb7d95c
v29.6.349bacb9
chore: update jest repo organisation in urls (#14413)0fd5b1c
v29.6.21f019af
v29.6.1c1e5b8a
v29.6.06ffa48d
chore: upgrade TypeScript to v5 (#14155)a95eeb6
chore: update tsd runner (#14020)39f3bed
v29.5.0Maintainer changes
This version was pushed to npm by simenb, a new releaser for jest since your current version.
Updates
semver
from 5.7.1 to 6.3.1Release notes
Sourced from semver's releases.
Changelog
Sourced from semver's changelog.
... (truncated)
Commits
44d27bc
chore: release 6.3.1928e56d
fix: better handling of whitespace (#591)39f6326
chore:@npmcli/template-oss
@4
.16.00eeceec
6.3.02779d96
Expose the token enum on the exports9f5f615
changelogce6190e
6.2.024af461
Add test coverage for bin file388ec1c
Addrtl
option to coerce from right to leftd062593
coerce(number) will coerce to a stringMaintainer changes
This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.
Updates
json-schema
from 0.2.3 to 0.4.0Commits
f6f6a3b
Use a little more robust method of checking instancesef60987
Update versionb62f1da
Protect against constructor modification, #84fb427cd
Link to json-schema-org repository in addition to site, fixes #5422f1461
Don't allow proto property to be used for schema default/coerce, fixes #84c52a27c
Get basic test to passb3f42b3
Add security policy3b0cec3
Update versionc28470f
Update readme to acknowledge the state of the package7dff9cd
Merge pull request #81 from hodovani/patch-1Updates
minimatch
from 3.0.4 to 3.1.2Commits
699c459
3.1.22f2b5ff
fix: trim pattern25d7c0d
3.1.155dda29
fix: treat nocase:true as always having magic5e1fb8d
3.1.0f8145c5
Add 'allowWindowsEscape' option570e8b1
add publishConfig for v3 publishes5b7cd33
3.0.620b4b56
[fix] revert all breaking syntax changes2ff0388
document, expose, and test 'partial:true' optionUpdates
tough-cookie
from 2.4.3 to 2.5.0Commits
7c1fdf1
2.5.09ff4ba5
Qualify the store.removeAllCookies documentation1855bf3
Additional documentation for removeAllCookies5cc9bd2
Extract tests, cover multiple error path28f0808
Only call removeAllCookies if actually implemented62802ef
remove all cookies from cookie jar at once (#115)8783d46
Remove left-over mention of MPL from README8302ebc
Merge pull request #121 from salesforce/punycode-2.1d6ea115
Merge pull request #120 from salesforce/no-package-lockb897b49
Merge pull request #119 from salesforce/inline-versionDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show