New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update all non-major dependencies #18

Open

renovate wants to merge 1 commit into master from renovate/all-minor-patch

Contributor

renovate bot commented Mar 5, 2023 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@commitlint/cli (source)	`17.4.2` -> `17.8.1`					devDependencies	minor
@commitlint/config-conventional (source)	`17.4.2` -> `17.8.1`					devDependencies	minor
@wildpeaks/eslint-config-commonjs	`15.6.0` -> `15.7.0`					devDependencies	minor
@wildpeaks/prettier-config	`15.6.0` -> `15.7.0`					devDependencies	minor
body-parser	`^1.20.1` -> `^1.20.3`					dependencies	patch
canvas	`^2.11.0` -> `^2.11.2`					dependencies	patch
dotenv	`^16.0.3` -> `^16.4.5`					dependencies	minor
eslint-config-prettier	`8.6.0` -> `8.10.0`					devDependencies	minor
express (source)	`^4.18.2` -> `^4.21.1`					dependencies	minor
helmet (source)	`^6.0.1` -> `^6.2.0`					dependencies	minor
lint-staged	`^13.1.0` -> `^13.3.0`					devDependencies	minor
node (source)	`>=v16.19.0` -> `>=16.20.2`					engines	minor
node-superfetch	`0.3.3` -> `0.3.4`					dependencies	patch
nodemon (source)	`2.0.20` -> `2.0.22`					devDependencies	patch
prettier (source)	`2.8.3` -> `2.8.8`					devDependencies	patch
pretty-quick	`^3.1.3` -> `^3.3.1`					devDependencies	minor
xss-clean	`^0.1.1` -> `^0.1.4`					dependencies	patch
yarn (source)	`3.3.1` -> `3.8.5`					packageManager	minor

Release Notes

conventional-changelog/commitlint (@commitlint/cli)

`v17.8.1`

Note: Version bump only for package @commitlint/cli

`v17.8.0`

Note: Version bump only for package @commitlint/cli

17.7.2 (2023-09-28)

Note: Version bump only for package @commitlint/cli

17.7.1 (2023-08-10)

Note: Version bump only for package @commitlint/cli

`v17.7.2`

Note: Version bump only for package @commitlint/cli

`v17.7.1`

Note: Version bump only for package @commitlint/cli

`v17.7.0`

Note: Version bump only for package @commitlint/cli

17.6.7 (2023-07-19)

Note: Version bump only for package @commitlint/cli

17.6.6 (2023-06-24)

Note: Version bump only for package @commitlint/cli

17.6.5 (2023-05-30)

Note: Version bump only for package @commitlint/cli

17.6.3 (2023-05-04)

Note: Version bump only for package @commitlint/cli

17.6.1 (2023-04-14)

Note: Version bump only for package @commitlint/cli

`v17.6.7`

Note: Version bump only for package @commitlint/cli

`v17.6.6`

Note: Version bump only for package @commitlint/cli

`v17.6.5`

Note: Version bump only for package @commitlint/cli

`v17.6.3`

Note: Version bump only for package @commitlint/cli

`v17.6.1`

Note: Version bump only for package @commitlint/cli

`v17.6.0`

Note: Version bump only for package @commitlint/cli

17.5.1 (2023-03-28)

Note: Version bump only for package @commitlint/cli

`v17.5.1`

Note: Version bump only for package @commitlint/cli

`v17.5.0`

Note: Version bump only for package @commitlint/cli

17.4.4 (2023-02-17)

Note: Version bump only for package @commitlint/cli

17.4.3 (2023-02-13)

Note: Version bump only for package @commitlint/cli

17.4.2 (2023-01-12)

Note: Version bump only for package @commitlint/cli

17.4.1 (2023-01-09)

Note: Version bump only for package @commitlint/cli

`v17.4.4`

Note: Version bump only for package @commitlint/cli

`v17.4.3`

Note: Version bump only for package @commitlint/cli

conventional-changelog/commitlint (@commitlint/config-conventional)

`v17.8.1`

Note: Version bump only for package @commitlint/config-conventional

`v17.8.0`

Note: Version bump only for package @commitlint/config-conventional

`v17.7.0`

Note: Version bump only for package @commitlint/config-conventional

17.6.7 (2023-07-19)

Note: Version bump only for package @commitlint/config-conventional

17.6.6 (2023-06-24)

Note: Version bump only for package @commitlint/config-conventional

17.6.5 (2023-05-30)

Note: Version bump only for package @commitlint/config-conventional

17.6.3 (2023-05-04)

Note: Version bump only for package @commitlint/config-conventional

17.6.1 (2023-04-14)

Note: Version bump only for package @commitlint/config-conventional

`v17.6.7`

Note: Version bump only for package @commitlint/config-conventional

`v17.6.6`

Note: Version bump only for package @commitlint/config-conventional

`v17.6.5`

Note: Version bump only for package @commitlint/config-conventional

`v17.6.3`

Note: Version bump only for package @commitlint/config-conventional

`v17.6.1`

Note: Version bump only for package @commitlint/config-conventional

`v17.6.0`

Note: Version bump only for package @commitlint/config-conventional

17.4.4 (2023-02-17)

Note: Version bump only for package @commitlint/config-conventional

17.4.3 (2023-02-13)

Note: Version bump only for package @commitlint/config-conventional

17.4.2 (2023-01-12)

Note: Version bump only for package @commitlint/config-conventional

`v17.4.4`

Note: Version bump only for package @commitlint/config-conventional

`v17.4.3`

Note: Version bump only for package @commitlint/config-conventional

wildpeaks/packages-eslint-config (@wildpeaks/eslint-config-commonjs)

`v15.7.0`: 15.7.0

Updated eslint, @typescript-eslint/eslint-plugin, @typescript-eslint/parser, prettier, and devDependencies.

expressjs/body-parser (body-parser)

`v1.20.3`

===================

deps: qs@6.13.0
add depth option to customize the depth level in the parser
IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

`v1.20.2`

===================

Fix strict json error message on Node.js 19+
deps: content-type@~1.0.5
- perf: skip value escaping when unnecessary
deps: raw-body@2.5.2

Automattic/node-canvas (canvas)

`v2.11.2`

==================

Fixed

Building on Windows in CI (and maybe other Windows configurations?) (#2216)

`v2.11.1`

==================

Fixed

Add missing property canvas to the CanvasRenderingContext2D type
Fixed glyph positions getting rounded, resulting text having a slight letter-spacing effect
Fixed ctx.font not being restored correctly after ctx.restore() (#1946)

motdotla/dotenv (dotenv)

`v16.4.5`

Changed

🐞 fix recent regression when using path option. return to historical behavior: do not attempt to auto find .env if path set. (regression was introduced in 16.4.3) #814

`v16.4.4`

Changed

🐞 Replaced chaining operator ?. with old school && (fixing node 12 failures) #812

`v16.4.3`

Changed

Fixed processing of multiple files in options.path #805

`v16.4.2`

Changed

Changed funding link in package.json to dotenvx.com

`v16.4.1`

Patch support for array as path option #797

`v16.4.0`

Add error.code to error messages around .env.vault decryption handling #795
Add ability to find .env.vault file when filename(s) passed as an array #784

`v16.3.2`

Added

Add debug message when no encoding set #735

Changed

Fix output typing for populate #792
Use subarray instead of slice #793

`v16.3.1`

Added

Add missing type definitions for processEnv and DOTENV_KEY options. #756

`v16.3.0`

Added

Optionally pass DOTENV_KEY to options rather than relying on process.env.DOTENV_KEY. Defaults to process.env.DOTENV_KEY #754

`v16.2.0`

Added

Optionally write to your own target object rather than process.env. Defaults to process.env. #753
Add import type URL to types file #751

`v16.1.4`

Added

Added .github/ to .npmignore #747

`v16.1.3`

Removed

Removed browser keys for path, os, and crypto in package.json. These were set to false incorrectly as of 16.1. Instead, if using dotenv on the front-end make sure to include polyfills for path, os, and crypto. node-polyfill-webpack-plugin provides these.

`v16.1.2`

Changed

Exposed private function _configDotenv as configDotenv. #744

`v16.1.1`

Added

Added type definition for decrypt function

Changed

Fixed {crypto: false} in packageJson.browser

`v16.1.0`

Added

Add populate convenience method #733
Accept URL as path option #720
Add dotenv to npm fund command
Spanish language README #698
Add .env.vault support. 🎉 (#730)

ℹ️ .env.vault extends the .env file format standard with a localized encrypted vault file. Package it securely with your production code deploys. It's cloud agnostic so that you can deploy your secrets anywhere – without risky third-party integrations. read more

Changed

Fixed "cannot resolve 'fs'" error on tools like Replit #693

prettier/eslint-config-prettier (eslint-config-prettier)

`v8.10.0`

Added: [max-statements-per-line]. Thanks to @Zamiell!

`v8.9.0`

Added: [vue/array-element-newline]. Thanks to @xcatliu!

`v8.8.0`

Added: [@typescript-eslint/lines-around-comment]. Thanks to @ttionya!

`v8.7.0`

Added: [@typescript-eslint/block-spacing]. Thanks to @ttionya!
Added: [@typescript-eslint/key-spacing]. Thanks to @ttionya!

expressjs/express (express)

`v4.21.1`

`v4.21.0`

What's Changed

Deprecate "back" magic string in redirects by @blakeembrey in https://github.com/expressjs/express/pull/5935
finalhandler@1.3.1 by @wesleytodd in https://github.com/expressjs/express/pull/5954
fix(deps): serve-static@1.16.2 by @wesleytodd in https://github.com/expressjs/express/pull/5951
Upgraded dependency qs to 6.13.0 to match qs in body-parser by @agadzinski93 in https://github.com/expressjs/express/pull/5946

New Contributors

@agadzinski93 made their first contribution in https://github.com/expressjs/express/pull/5946

Full Changelog: expressjs/express@4.20.0...4.21.0

`v4.20.0`

==========

deps: serve-static@0.16.0
- Remove link renderization in html while redirecting
deps: send@0.19.0
- Remove link renderization in html while redirecting
deps: body-parser@0.6.0
- add depth option to customize the depth level in the parser
- IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
Remove link renderization in html while using res.redirect
deps: path-to-regexp@0.1.10
- Adds support for named matching groups in the routes using a regex
- Adds backtracking protection to parameters without regexes defined
deps: encodeurl@~2.0.0
- Removes encoding of \, |, and ^ to align better with URL spec
Deprecate passing options.maxAge and options.expires to res.clearCookie
- Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

`v4.19.2`

==========

Improved fix for open redirect allow list bypass

`v4.19.1`

==========

Allow passing non-strings to res.location with new encoding handling checks

`v4.19.0`

`v4.18.3`

==========

Fix routing requests without method
deps: body-parser@1.20.2
- Fix strict json error message on Node.js 19+
- deps: content-type@~1.0.5
- deps: raw-body@2.5.2

helmetjs/helmet (helmet)

`v6.2.0`

Expose header names (e.g., strictTransportSecurity for the Strict-Transport-Security header, instead of hsts)
Rework documentation

`v6.1.5`

Fixed

Fixed yet another issue with TypeScript exports. See #420

`v6.1.4`

Fixed

Fix another issue with TypeScript default exports. See #418

`v6.1.3`

Fixed

Fix issue with TypeScript default exports. See #417

`v6.1.2`

Fixed

Retored main to package to help with some build tools

`v6.1.1`

Fixed

Fixed missing package metadata

`v6.1.0`

Changed

Improve support for various TypeScript setups, including "nodenext". See #405

lint-staged/lint-staged (lint-staged)

`v13.3.0`

Bug Fixes

dependencies: update most dependencies (7443870)
detect duplicate redundant braces in pattern (d895aa8)

Features

dependencies: update listr2@6.6.0 (09844ca)

`v13.2.3`

Bug Fixes

the --diff option implies --no-stash (66a716d)

`v13.2.2`

Bug Fixes

dependencies: update yaml@2.2.2 (GHSA-f9xv-q969-pqx4) (#1290) (cf691aa)

`v13.2.1`

Bug Fixes

ignore "package.json" as config file when it's invalid JSON (#1281) (e7ed6f7)

`v13.2.0`

Bug Fixes

dependencies: replace colorette with chalk for better color support detection (f598725)
use index-based stash references for improved MSYS2 compatibility (#1270) (60fcd99)

Features

version bump only (#1275) (05fb382)

`v13.1.4`

`v13.1.3`

`v13.1.2`

Bug Fixes

disable stash by default when using diff option (#1259) (142c6f2)

`v13.1.1`

Bug Fixes

allow re-enabling --stash when using the --diff option (99390c3)

nodejs/node (node)

`v16.20.2`: 2023-08-09, Version 16.20.2 'Gallium' (LTS), @RafaelGSS

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-32002: Policies can be bypassed via Module._load (High)
CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
OpenSSL Security Releases

More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.

Commits

[40c3958a5a] - deps: update archs files for OpenSSL-1.1.1v (RafaelGSS) #49043
[a9ac9da89a] - deps: fix openssl crypto clean (RafaelGSS) #49043
[362d4c7494] - deps: upgrade openssl sources to OpenSSL_1_1_1v (RafaelGSS) #49043
[d8ccfe9ad4] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#445
[242aaa0caa] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#459

`v16.20.1`: 2023-06-20, Version 16.20.1 'Gallium' (LTS), @RafaelGSS

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
OpenSSL Security Releases
c-ares vulnerabilities:

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

[5a92ea7a3b] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen)
[5df04e893a] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #48156
[c171cbd124] - deps: update c-ares to 1.19.1 (RafaelGSS) #48115
[155d3aac02] - deps: update archs files for OpenSSL-1.1.1u+quic (RafaelGSS) #48369
[8d4c8f8ebe] - deps: upgrade openssl sources to OpenSSL_1_1_1u (RafaelGSS) #48369
[1a5c9284eb] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
[e42ff4b018] - http: disable request smuggling via empty headers (Paolo Insogna) nodejs-private/node-private#429
[10042683c8] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
[a6f4e87bc9] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
[b77000f4d7] - test: allow SIGBUS in signal-handler abort test (Michaël Zasso) #47851

`v16.20.0`: 2023-03-29, Version 16.20.0 'Gallium' (LTS), @BethGriggs

Notable Changes

deps:
- update undici to 5.20.0 (Node.js GitHub Bot) #46711
- update c-ares to 1.19.0 (Michaël Zasso) #46415
- upgrade npm to 8.19.4 (npm team) #46677
- update corepack to 0.17.0 (Node.js GitHub Bot) #46842
(SEMVER-MINOR) src: add support for externally shared js builtins (Michael Dawson) #44376

Commits

[[de6dd67790](

Configuration

📅 Schedule: Branch creation - "before 12pm on Sunday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot requested a review from NotKaskus as a code owner

March 5, 2023 03:30

renovate bot added the Meta: Dependencies label

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 7b696db to f819eb5 Compare

March 10, 2023 13:36

renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from c28bae6 to 62eec32 Compare

March 22, 2023 21:00

renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from e7c163a to 9233ee8 Compare

March 29, 2023 23:03

renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 963ab48 to 5df8cc9 Compare

April 9, 2023 17:50

renovate bot force-pushed the renovate/all-minor-patch branch 5 times, most recently from 63a076c to 2dae2bd Compare

April 14, 2023 08:43

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from cda01b2 to ad87376 Compare

April 26, 2023 15:19

renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from ac49b14 to 030c143 Compare

May 7, 2023 00:52

renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 302d639 to 1995fa6 Compare

May 31, 2023 02:45

renovate bot force-pushed the renovate/all-minor-patch branch from 9e37c27 to bdffe5e Compare

October 4, 2023 00:13

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 43a87db to e2ddacd Compare

October 20, 2023 12:35

renovate bot force-pushed the renovate/all-minor-patch branch from e2ddacd to a7d4a5f Compare

November 14, 2023 20:01

renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from 754df39 to ff71c6c Compare

January 19, 2024 19:05

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from d4d075d to cdd6fe6 Compare

January 24, 2024 21:39

renovate bot force-pushed the renovate/all-minor-patch branch from cdd6fe6 to 6cdad73 Compare

February 1, 2024 21:30

renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from bcfb0c8 to 1620f35 Compare

February 13, 2024 19:47

renovate bot force-pushed the renovate/all-minor-patch branch from 1620f35 to bb3edde Compare

February 20, 2024 04:30

renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from b55fd0a to 1b3788c Compare

March 5, 2024 00:58

renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from e82a04f to a64cb6d Compare

March 25, 2024 15:38

renovate bot force-pushed the renovate/all-minor-patch branch from a64cb6d to ce2865c Compare

May 2, 2024 18:59

renovate bot force-pushed the renovate/all-minor-patch branch from ce2865c to bd9c1f0 Compare

June 21, 2024 16:42

renovate bot force-pushed the renovate/all-minor-patch branch from bd9c1f0 to b4969dc Compare

August 5, 2024 16:05

renovate bot force-pushed the renovate/all-minor-patch branch from b4969dc to 545f3fc Compare

August 24, 2024 16:54

renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from 6f97d97 to 4b17930 Compare

September 11, 2024 23:19


          chore(deps): update all non-major dependencies

93ea2ca

renovate bot force-pushed the renovate/all-minor-patch branch from 4b17930 to 93ea2ca Compare

October 8, 2024 20:01

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Meta: Dependencies