Bump the npm_and_yarn group across 1 directory with 17 updates #1

dependabot · 2024-08-23T19:55:43Z

Bumps the npm_and_yarn group with 12 updates in the / directory:

Package	From	To
canvas	`1.6.2`	`1.6.11`
debug	`2.4.5`	`2.6.9`
request	`2.79.0`	`2.88.2`
async	`2.1.4`	`3.2.6`
brace-expansion	`1.1.6`	`1.1.11`
es5-ext	`0.10.12`	`0.10.64`
fsevents	`1.0.15`	`1.2.13`
is-my-json-valid	`2.15.0`	`2.20.6`
js-yaml	`3.7.0`	`3.14.1`
lodash	`4.17.2`	`4.17.21`
minimatch	`3.0.3`	`3.1.2`
sshpk	`1.10.1`	`1.18.0`

Updates canvas from 1.6.2 to 1.6.11

Changelog

Sourced from canvas's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

(Unreleased)

Changed

Added

Fixed

3.0.0

This release notably changes to using N-API. 🎉

Breaking

Dropped support for Node.js 16.x and below.

Changed

Migrated to N-API (by way of node-addon-api) and removed libuv and v8 dependencies

Change from node-pre-gyp to prebuild-install

Defer the initialization of the op variable to the default switch case to avoid a compiler warning. (#2229)

Use a default switch case with a null statement if some enum values aren't suppsed to be handled, this avoids a compiler warning. (#2229)

Migrate from librsvg's deprecated rsvg_handle_get_dimensions() and rsvg_handle_render_cairo() functions to the new rsvg_handle_get_intrinsic_size_in_pixels() and rsvg_handle_render_document() respectively. (#2229)

Avoid calling virtual methods in constructors/destructors to avoid bypassing virtual dispatch. (#2229)

Remove unused private field backend in the Backend class. (#2229)

Add Node.js v20 to CI. (#2237)

Replaced dtslint with tsd (#2313)

Added

Added string tags to support class detection

Fixed

Fix a case of use-after-free. (#2229)

Fix usage of garbage value by filling the allocated memory entirely with zeros if it's not modified. (#2229)

Fix a potential memory leak. (#2229)

Fix the wrong type of setTransform

Fix the improper parsing of rgb functions issue. (#2300)

Fix issue related to improper parsing of leading and trailing whitespaces in CSS color. (#2301)

RGB functions should support real numbers now instead of just integers. (#2339)

Allow alternate or properly escaped quotes within font-family names

Fix TextMetrics type to include alphabeticBaseline, emHeightAscent, and emHeightDescent properties

2.11.2

Fixed

Building on Windows in CI (and maybe other Windows configurations?) (#2216)

2.11.1

... (truncated)

Commits

3db3a21 1.6.11
4996527 Merge pull request #1166 from Automattic/bump-nan
c90b8e0 Bump NAN for Node.js 10.x compatibility
265d084 1.6.10
3304f65 Merge pull request #1131 from LinusU/backport-fixes
f9f6135 Only increment src pointer when reading from source
5fcade8 Return error when missing color map in GIF
9324932 Return error for too large GIF-files
c3e4ccb Prevent JPEG errors from crashing process
a815257 Add support for context globalAlpha for gradients and patterns (#1064)
Additional commits viewable in compare view

Updates debug from 2.4.5 to 2.6.9

Release notes

Sourced from debug's releases.

2.6.9

Patches

Remove ReDoS regexp in %o formatter: #504

Credits

Huge thanks to @zhuangya for their help!

release 2.6.7

No release notes provided.

release 2.6.6

No release notes provided.

release 2.6.5

No release notes provided.

release 2.6.4

No release notes provided.

release 2.6.3

No release notes provided.

release 2.6.2

No release notes provided.

release 2.6.1

No release notes provided.

release 2.6.0

No release notes provided.

release 2.5.2

No release notes provided.

release 2.5.1

No release notes provided.

Changelog

Sourced from debug's changelog.

2.6.9 / 2017-09-22

remove ReDoS regexp in %o formatter (#504)

2.6.8 / 2017-05-18

Fix: Check for undefined on browser globals (#462, @marbemac)

2.6.7 / 2017-05-16

Fix: Update ms to 2.0.0 to fix regular expression denial of service vulnerability (#458, @hubdotcom)

Fix: Inline extend function in node implementation (#452, @dougwilson)

Docs: Fix typo (#455, @msasad)

2.6.5 / 2017-04-27

Fix: null reference check on window.documentElement.style.WebkitAppearance (#447, @thebigredgeek)

Misc: clean up browser reference checks (#447, @thebigredgeek)

Misc: add npm-debug.log to .gitignore (@thebigredgeek)

2.6.4 / 2017-04-20

Fix: bug that would occure if process.env.DEBUG is a non-string value. (#444, @LucianBuzzo)

Chore: ignore bower.json in npm installations. (#437, @joaovieira)

Misc: update "ms" to v0.7.3 (@tootallnate)

2.6.3 / 2017-03-13

Fix: Electron reference to process.env.DEBUG (#431, @paulcbetts)

Docs: Changelog fix (@thebigredgeek)

2.6.2 / 2017-03-10

Fix: DEBUG_MAX_ARRAY_LENGTH (#420, @slavaGanzin)

Docs: Add backers and sponsors from Open Collective (#422, @piamancini)

Docs: Add Slackin invite badge (@tootallnate)

2.6.1 / 2017-02-10

Fix: Module's export default syntax fix for IE8 Expected identifier error

Fix: Whitelist DEBUG_FD for values 1 and 2 only (#415, @pi0)

... (truncated)

Commits

13abeae Release 2.6.9
f53962e remove ReDoS regexp in %o formatter (#504)
52e1f21 Release 2.6.8
2482e08 Check for undefined on browser globals (#462)
6bb07f7 release 2.6.7
15850cb Fix Regular Expression Denial of Service (ReDoS)
4a6c85c update "debug" to v1.0.0 (#454)
b68dbf8 Fix typo (#455)
1351d2f Inline extend function in node implementation (#452)
c211947 update version for component
Additional commits viewable in compare view

Updates request from 2.79.0 to 2.88.2

Changelog

Sourced from request's changelog.

Change Log

v2.88.0 (2018/08/10)

#2996 fix(uuid): import versioned uuid (@kwonoj)

#2994 Update to oauth-sign 0.9.0 (@dlecocq)

#2993 Fix header tests (@simov)

#2904 #515, #2894 Strip port suffix from Host header if the protocol is known. (#2904) (@paambaati)

#2791 Improve AWS SigV4 support. (#2791) (@vikhyat)

#2977 Update test certificates (@simov)

v2.87.0 (2018/05/21)

#2943 Replace hawk dependency with a local implemenation (#2943) (@hueniverse)

v2.86.0 (2018/05/15)

#2885 Remove redundant code (for Node.js 0.9.4 and below) and dependency (@ChALkeR)

#2942 Make Test GREEN Again! (@simov)

#2923 Alterations for failing CI tests (@gareth-robinson)

v2.85.0 (2018/03/12)

#2880 Revert "Update hawk to 7.0.7 (#2880)" (@simov)

v2.84.0 (2018/03/12)

#2793 Fixed calculation of oauth_body_hash, issue #2792 (@dvishniakov)

#2880 Update hawk to 7.0.7 (#2880) (@kornel-kedzierski)

v2.83.0 (2017/09/27)

#2776 Updating tough-cookie due to security fix. (#2776) (@karlnorling)

v2.82.0 (2017/09/19)

#2703 Add Node.js v8 to Travis CI (@ryysud)

#2751 Update of hawk and qs to latest version (#2751) (@Olivier-Moreau)

#2658 Fixed some text in README.md (#2658) (@Marketionist)

#2635 chore(package): update aws-sign2 to version 0.7.0 (#2635) (@greenkeeperio-bot)

#2641 Update README to simplify & update convenience methods (#2641) (@FredKSchott)

#2541 Add convenience method for HTTP OPTIONS (#2541) (@jamesseanwright)

#2605 Add promise support section to README (#2605) (@FredKSchott)

#2579 refactor(lint): replace eslint with standard (#2579) (@ahmadnassri)

#2598 Update codecov to version 2.0.2 🚀 (@greenkeeperio-bot)

#2590 Adds test-timing keepAlive test (@nicjansma)

#2589 fix tabulation on request example README.MD (@odykyi)

#2594 chore(dependencies): har-validator to 5.x [removes babel dep] (@ahmadnassri)

v2.81.0 (2017/03/09)

#2584 Security issue: Upgrade qs to version 6.4.0 (@sergejmueller)

#2578 safe-buffer doesn't zero-fill by default, its just a polyfill. (#2578) (@mikeal)

#2566 Timings: Tracks 'lookup', adds 'wait' time, fixes connection re-use (#2566) (@nicjansma)

#2574 Migrating to safe-buffer for improved security. (@mikeal)

#2573 fixes #2572 (@ahmadnassri)

v2.80.0 (2017/03/04)

... (truncated)

Commits

See full diff in compare view

Updates async from 2.1.4 to 3.2.6

Release notes

Sourced from async's releases.

v2.3.0

Added support for ES2017 async functions. Wherever you can pass a Node-style/CPS function that uses a callback, you can also pass an async function. Previously, you had to wrap async functions with asyncify. The caveat is that it will only work if async functions are supported natively in your environment, transpiled implementations can't be detected. (#1386, #1390)

v2.2.0

Added groupBy, and the Series/Limit equivalents, analogous to _.groupBy (#1364)

Fixed transform bug when callback was not passed (#1381)

v2.1.5

Fix auto bug when function names collided with Array.prototype (#1358)

Improve some error messages (#1349)

Avoid stack overflow case in queue

Fixed an issue in some, every and find where processing would continue after the result was determined.

Cleanup implementations of some, every and find

Changelog

Sourced from async's changelog.

v3.2.5

Ensure Error objects such as AggregateError are propagated without modification (#1920)

v3.2.4

Fix a bug in priorityQueue where it didn't wait for the result. (#1725)

Fix a bug where unshiftAsync was included in priorityQueue. (#1790)

v3.2.3

Fix bugs in comment parsing in autoInject. (#1767, #1780)

v3.2.2

Fix potential prototype pollution exploit

v3.2.1

Use queueMicrotask if available to the environment (#1761)

Minor perf improvement in priorityQueue (#1727)

More examples in documentation (#1726)

Various doc fixes (#1708, #1712, #1717, #1740, #1739, #1749, #1756)

Improved test coverage (#1754)

v3.2.0

Fix a bug in Safari related to overwriting func.name

Remove built-in browserify configuration (#1653)

Varios doc fixes (#1688, #1703, #1704)

v3.1.1

Allow redefining name property on wrapped functions.

v3.1.0

Added q.pushAsync and q.unshiftAsync, analagous to q.push and q.unshift, except they always do not accept a callback, and reject if processing the task errors. (#1659)

Promises returned from q.push and q.unshift when a callback is not passed now resolve even if an error ocurred. (#1659)

Fixed a parsing bug in autoInject with complicated function bodies (#1663)

Added ES6+ configuration for Browserify bundlers (#1653)

Various doc fixes (#1664, #1658, #1665, #1652)

v3.0.1

Bug fixes

Fixed a regression where arrays passed to queue and cargo would be completely flattened. (#1645)

Clarified Async's browser support (#1643)

v3.0.0

The async/await release!

There are a lot of new features and subtle breaking changes in this major version, but the biggest feature is that most Async methods return a Promise if you omit the callback, meaning you can await them from within an async function.
</tr></table> 

... (truncated)

Commits

85fb18f Version 3.2.6
8c0c941 Update built files
5f756b4 Fix ReDoS (#1980)
39cdc9b build(deps-dev): bump karma from 6.4.3 to 6.4.4 (#1985)
7b8ddeb build(deps-dev): bump @babel/core from 7.24.7 to 7.25.2 (#1981)
4634a9d build(deps-dev): bump rollup from 4.18.0 to 4.19.2 (#1982)
afb176c build(deps-dev): bump chai from 4.4.1 to 4.5.0 (#1983)
3568a74 build(deps-dev): bump @babel/eslint-parser from 7.24.7 to 7.25.1 (#1984)
9e885fd build(deps-dev): bump babel-plugin-istanbul from 6.1.1 to 7.0.0 (#1986)
f9c7f2a build(deps-dev): bump semver from 7.6.2 to 7.6.3 (#1987)
Additional commits viewable in compare view

Updates brace-expansion from 1.1.6 to 1.1.11

Release notes

Sourced from brace-expansion's releases.

v1.1.11

brace-expansion

Brace expansion, as known from sh/bash, in JavaScript.

Example

var expand = require('brace-expansion');
expand('file-{a,b,c}.jpg')
// => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg']
expand('-v{,,}')
// => ['-v', '-v', '-v']
expand('file{0..2}.jpg')
// => ['file0.jpg', 'file1.jpg', 'file2.jpg']
expand('file-{a..c}.jpg')
// => ['file-a.jpg', 'file-b.jpg', 'file-c.jpg']
expand('file{2..0}.jpg')
// => ['file2.jpg', 'file1.jpg', 'file0.jpg']
expand('file{0..4..2}.jpg')
// => ['file0.jpg', 'file2.jpg', 'file4.jpg']
expand('file-{a..e..2}.jpg')
// => ['file-a.jpg', 'file-c.jpg', 'file-e.jpg']
expand('file{00..10..5}.jpg')
// => ['file00.jpg', 'file05.jpg', 'file10.jpg']
expand('{{A..C},{a..c}}')
// => ['A', 'B', 'C', 'a', 'b', 'c']
expand('ppp{,config,oe{,conf}}')
// => ['ppp', 'pppconfig', 'pppoe', 'pppoeconf']

API

... (truncated)

Commits

e52ad1c Merge pull request #42 from juliangruber/greenkeeper/update-to-node-10
fb4c692 Update to node 10 in .travis.yml
01a21de 1.1.11
d7c93ee sponsors
54a6176 1.1.10
327c729 Merge pull request #40 from Parcley/add-license-1
b6ba2e0 create LICENSE file
0f82dab 1.1.9
acd1754 support
40ff02d Merge pull request #39 from EdwardBetts/spelling
Additional commits viewable in compare view

Updates es5-ext from 0.10.12 to 0.10.64

Release notes

Sourced from es5-ext's releases.

0.10.64 (2024-02-27)

Bug Fixes

Revert update to postinstall script meant to fix Powershell issue, as it's a regression for some Linux terminals (c2e2bb9)

Comparison since last release

0.10.63 (2024-02-23)

Bug Fixes

Do not rely on problematic regex (3551cdd), addresses #201

Support ES2015+ function definitions in function#toStringTokens() (a52e957), addresses #021

Ensure postinstall script does not crash on Windows, fixes #181 (bf8ed79)

Maintenance Improvements

Simplify the manifest message (7855319)

Comparison since last release

0.10.62 (2022-08-02)

Maintenance Improvements

Manifest improvements:

(#190) (b8dc53f)

(c51d552)

Comparison since last release

0.10.61 (2022-04-20)

Bug Fixes

Ensure postinstall script does not error (a0be4fd)

Maintenance Improvements

Bump dependencies (d7e0a61)

Comparison since last release

0.10.60 (2022-04-07)

Maintenance Improvements

Improve postinstall script configuration (ab6b121)

... (truncated)

Changelog

Sourced from es5-ext's changelog.

0.10.64 (2024-02-27)

Bug Fixes

Revert update to postinstall script meant to fix Powershell issue, as it's a regression for some Linux terminals (c2e2bb9)

0.10.63 (2024-02-23)

Bug Fixes

Do not rely on problematic regex (3551cdd), addresses #201

Support ES2015+ function definitions in function#toStringTokens() (a52e957), addresses #021

Ensure postinstall script does not crash on Windows, fixes #181 (bf8ed79)

Maintenance Improvements

Simplify the manifest message (7855319)

0.10.62 (2022-08-02)

Maintenance Improvements

Manifest improvements:

(#190) (b8dc53f)

(c51d552)

0.10.61 (2022-04-20)

Bug Fixes

Ensure postinstall script does not error (a0be4fd)

Maintenance Improvements

Bump dependencies (d7e0a61)

0.10.60 (2022-04-07)

Maintenance Improvements

Improve postinstall script configuration (ab6b121)

0.10.59 (2022-03-17)

Maintenance Improvements

Improve manifest wording (#122) (eb7ae59)

Update data in manifest (3d2935a)

0.10.58 (2022-03-11)

... (truncated)

Commits

f76b03d chore: Release v0.10.64
2881acd chore: Bump dependencies
c2e2bb9 fix: Revert update meant to fix Powershell issue, as it's a regression
16f2b72 docs: Fix date in the changelog
de4e03c chore: Release v0.10.63
3fd53b7 chore: Upgrade lint-staged to v13
bf8ed79 chore: Ensure postinstall script does not crash on Windows
2cbbb07 chore: Bump dependencies
22d0416 chore: Bump LICENSE year
a52e957 fix: Support ES2015+ function definitions in function#toStringTokens()
Additional commits viewable in compare view

Updates extend from 3.0.0 to 3.0.2

Changelog

Sourced from extend's changelog.

3.0.2 / 2018-07-19

[Fix] Prevent merging __proto__ property (#48)

[Dev Deps] update eslint, @ljharb/eslint-config, tape

[Tests] up to node v10.7, v9.11, v8.11, v7.10, v6.14, v4.9; use nvm install-latest-npm

3.0.1 / 2017-04-27

[Fix] deep extending should work with a non-object (#46)

[Dev Deps] update tape, eslint, @ljharb/eslint-config

[Tests] up to node v7.9, v6.10, v4.8; improve matrix

[Docs] Switch from vb.teelaun.ch to versionbadg.es for the npm version badge SVG.

[Docs] Add example to readme (#34)

Commits

8d106d2 v3.0.2
e97091f [Dev Deps] update tape
e841aac [Tests] up to node v10.7
0e68e71 [Fix] Prevent merging proto property
a689700 Only apps should have lockfiles
f13c1c4 [Dev Deps] update eslint, @ljharb/eslint-config, tape
f3570fe [Tests] up to node v10.0, v9.11, v8.11, v7.10, v6.14, v4.9; use...
138b515 v3.0.1
7e19a6f [Tests] up to node v7.9, v6.10, v4.8; improve matrix
0191e27 [Dev Deps] update tape, eslint, @ljharb/eslint-config
Additional commits viewable in compare view

Updates fsevents from 1.0.15 to 1.2.13

Release notes

Sourced from fsevents's releases.

Release v1.2.13

Only build on Mac-OSX

Release v1.2.11

Removing node-pre-gyp so that building fsevents becomes easier and enabled without the download of binaries.

The credentials to the AWS store have been lost. Releasing to AWS is both insecure and no longer possible due to the lost credentials.

Intermediate Release

No release notes provided.

Release v1.2.9 - Node v12 compatibility

No release notes provided.

Release Pre-NAPI v1.2.8

No release notes provided.

Version Bump (bundle node-pre-gyp)

No release notes provided.

Prebuilt v11.x

No release notes provided.

v1.2.3

Added node v10 for pre-built binaries

C++ tuning to fix potential SIGILL and cyclic dependency (#204)

v1.2.2

Fixed node-pre-gyp bundling issue

v1.2.1

[unpublished because of errors during publish process]

v1.2.0

BREAKING: End support for Node v0.12. If you are using Node v0.12 please pin your fsevents dependencies to v1.1.3. Not bumping semver major for this release was a compromise solution discussed in #199 and #201.

Node v0.10 should continue to work with local compilation for now, but hosted pre-built binaries will no longer be provided. If this is a constraint for you, please pin to an earlier version.

Fixed security vulnerability warnings by updating node-pre-gyp to ^0.9.0

Compatibility updates for nan v2.9.0

v1.1.3

Added node v9 for pre-built binaries

Fixed bug related to using --no-bin-links option on install

Updated node-pre-gyp to latest version (0.6.39)

v1.1.2

Added Node.js v8 to the prebuild binary assets.

Stopped prebuilding for io.js (can still be built locally)

Updated node-pre-gyp to latest version (0.6.36)

v1.1.1

... (truncated)

Commits

844a05d Version Bump
f393f2a Only build fsevents on macOS (#322)
6a281a7 [publish binary]
acc2bce [publish binary]
f532b6e [publish binary]
4c6a1c0 Add node 13 to travis matrix.
92e40aa Release 1.2.12.
909af26 Release v1.2.11
7074adb Release v1.2.10
0a052f6 Node.js v12 support for v1.x (#274)
Additional commits viewable in compare view

Updates is-my-json-valid from 2.15.0 to 2.20.6

Commits

58d30cb 2.20.6
f76edf0 Merge pull request #188 from axelniklasson/master
4eef089 Upgrade jsonpointer to address security vulnerability
441f812 2.20.5
d36a1b1 Merge pull request #182 from ChALkeR/chalker/fix-comma
b6ea484 Fix uri prefix detection
5389c5b Merge pull request #181 from ChALkeR/chalker/fix-undef
df5b313 add funding file
c224619 Fix 'required' implementation
2534af4 2.20.4
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by linusu, a new releaser for is-my-json-valid since your current version.

Updates js-yaml from 3.7.0 to 3.14.1

Changelog

Sourced from js-yaml's changelog.

[3.14.1] - 2020-12-07

Security

Fix possible code execution in (already unsafe) .load() (in &anchor).

[3.14.0] - 2020-05-22

Changed

Support safe/loadAll(input, options) variant of call.

CI: drop outdated nodejs versions.

Dev deps bump.

Fixed

Quote = in plain scalars #519.

Check the node type for !<?> tag in case user manually specifies it.

Verify that there are no null-bytes in input.

Fix wrong quote position when writing condensed flow, #526.

[3.13.1] - 2019-04-05

Security

Fix possible code execution in (already unsafe) .load(), #480.

[3.13.0] - 2019-03-20

Security

Security fix: safeLoad() can hang when arrays with nested refs used as key. Now throws exception for nested arrays. #475.

[3.12.2] - 2019-02-26

Fixed

Fix noArrayIndent option for root level, #468.

[3.12.1] - 2019-01-05

Added

Added noArrayIndent option, #432.

[3.12.0] - 2018-06-02

Changed

Support arrow functions without a block statement, #421.

[3.11.0] - 2018-03-05

Added

Add arrow functions suport for !!js/function.

Fixed

Fix dump in bin/octal/hex formats for negative integers, #399.

... (truncated)

Commits

37caaad 3.14.1 released
094c0f7 dist rebuild
9586ebe Avoid calling hasOwnProperty of user-controlled objects
34e5072 3.14.0 released
7b25c83 Browser files rebuild
6f73473 Dev deps bump
0c29349 Travis-CI: drop old nodejs versions
10be97e fix(loader): Add support for safe/loadAll(input, options)
d6983dd Fix issue #526: wrong quote position writing condensed flow (#527)
93fbf7d fix issue 526 (wrong quote position writing condensed flow)
Additional commits viewable in compare view

Updates jsonpointer from 4.0.0 to 5.0.1

Release notes

Sourced from jsonpointer's releases.

Version 5.0.1

Changelog

Fix incorrect typings for compile get/set methods (#58, thanks to @haakemon)

Fix null values throwing exception when traversing over while getting (#50, thanks to @reckter)

Fix tests for null and undefined assertions (janl/node-jsonpointer@a5706e8)

v5.0.0

5.0.0 (2021-10-31)

Bug Fixes
Fix prototype pollution (#51)

The original, non-mutated objects are now returned if any of the keys __proto__, constructor or prototype are used in a json pointer.
// returns the unmodified input {}
jsonpointer.set({}, '/foo/__proto__/boo', 'polluted')
When passing non-string arrays to a .set operation, an error is thrown:
// throws `new Error('Invalid JSON pointer. Must be of type string or number.')`
jsonpointer.set({}, [['__proto__'], ['__proto__'], 'boo'], 'polluted')
v4.1.0

4.1.0 (2020-07-03)

Bug Fixes

prototype pollution (234e343)

Features

docs: thank contributors (b67e402)

docs: use npm test (ad96a94)

re-add semantic release (49b7074)

Version 4.0.1

Whitelist production relevant files in package.json. This decreases the npm package size a bit. janl/node-jsonpointer#26

Commits

4a253c0 Adopt strictEqual changes and only return null when the get succeeded
bad4983 Fix null values throwing exception when traversing over while getting
a5706e8 test: Always use strictEqual to ensure null and undefined values are asserted...
b8e1e6a fix incorrect typings for compile get/set methods
c4de620 Merge pull request #53 from janl/release/5.0.0
8dbf304 feat: v5
84cf173 Merge pull request #52 from janl/fix/test
f716e5c chore: more rip travis
e2ae355 chore: remove comment
d23693b chore: update primary branch
Additional commits viewable in compare view

Updates lodash from 4.17.2 to 4.17.21

Commits

f299b52 Bump to v4.17.21
c4847eb Improve performance of toNumber, trim and trimEnd on large input strings
3469357 Prevent command injection through _.template's variable option
ded9bc6 Bump to v4.17.20.
63150ef Documentation fixes.
00f0f62 test.js: Remove trailing comma.
846e434 Temporarily use a custom fork of lodash-cli.
5d046f3 Re-enable Travis tests on 4.17 branch.
aa816b3 Remove /npm-package.

Bumps the npm_and_yarn group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [canvas](https://github.com/Automattic/node-canvas) | `1.6.2` | `1.6.11` | | [debug](https://github.com/debug-js/debug) | `2.4.5` | `2.6.9` | | [request](https://github.com/request/request) | `2.79.0` | `2.88.2` | | [async](https://github.com/caolan/async) | `2.1.4` | `3.2.6` | | [brace-expansion](https://github.com/juliangruber/brace-expansion) | `1.1.6` | `1.1.11` | | [es5-ext](https://github.com/medikoo/es5-ext) | `0.10.12` | `0.10.64` | | [fsevents](https://github.com/fsevents/fsevents) | `1.0.15` | `1.2.13` | | [is-my-json-valid](https://github.com/mafintosh/is-my-json-valid) | `2.15.0` | `2.20.6` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.7.0` | `3.14.1` | | [lodash](https://github.com/lodash/lodash) | `4.17.2` | `4.17.21` | | [minimatch](https://github.com/isaacs/minimatch) | `3.0.3` | `3.1.2` | | [sshpk](https://github.com/joyent/node-sshpk) | `1.10.1` | `1.18.0` | Updates `canvas` from 1.6.2 to 1.6.11 - [Release notes](https://github.com/Automattic/node-canvas/releases) - [Changelog](https://github.com/Automattic/node-canvas/blob/master/CHANGELOG.md) - [Commits](Automattic/node-canvas@v1.6.2...v1.6.11) Updates `debug` from 2.4.5 to 2.6.9 - [Release notes](https://github.com/debug-js/debug/releases) - [Changelog](https://github.com/debug-js/debug/blob/2.6.9/CHANGELOG.md) - [Commits](debug-js/debug@2.4.5...2.6.9) Updates `request` from 2.79.0 to 2.88.2 - [Changelog](https://github.com/request/request/blob/master/CHANGELOG.md) - [Commits](https://github.com/request/request/commits) Updates `async` from 2.1.4 to 3.2.6 - [Release notes](https://github.com/caolan/async/releases) - [Changelog](https://github.com/caolan/async/blob/master/CHANGELOG.md) - [Commits](caolan/async@v2.1.4...v3.2.6) Updates `brace-expansion` from 1.1.6 to 1.1.11 - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](juliangruber/brace-expansion@v1.1.6...1.1.11) Updates `es5-ext` from 0.10.12 to 0.10.64 - [Release notes](https://github.com/medikoo/es5-ext/releases) - [Changelog](https://github.com/medikoo/es5-ext/blob/main/CHANGELOG.md) - [Commits](medikoo/es5-ext@v0.10.12...v0.10.64) Updates `extend` from 3.0.0 to 3.0.2 - [Changelog](https://github.com/justmoon/node-extend/blob/main/CHANGELOG.md) - [Commits](justmoon/node-extend@v3.0.0...v3.0.2) Updates `fsevents` from 1.0.15 to 1.2.13 - [Release notes](https://github.com/fsevents/fsevents/releases) - [Commits](fsevents/fsevents@v1.0.15...v1.2.13) Updates `is-my-json-valid` from 2.15.0 to 2.20.6 - [Commits](mafintosh/is-my-json-valid@v2.15.0...v2.20.6) Updates `js-yaml` from 3.7.0 to 3.14.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.7.0...3.14.1) Updates `jsonpointer` from 4.0.0 to 5.0.1 - [Release notes](https://github.com/janl/node-jsonpointer/releases) - [Commits](janl/node-jsonpointer@4.0.0...v5.0.1) Updates `lodash` from 4.17.2 to 4.17.21 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.2...4.17.21) Updates `minimatch` from 3.0.3 to 3.1.2 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.0.3...v3.1.2) Updates `qs` from 6.3.0 to 6.5.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.3.0...v6.5.3) Updates `sshpk` from 1.10.1 to 1.18.0 - [Release notes](https://github.com/joyent/node-sshpk/releases) - [Commits](https://github.com/joyent/node-sshpk/commits) Updates `tough-cookie` from 2.3.2 to 2.5.0 - [Release notes](https://github.com/salesforce/tough-cookie/releases) - [Changelog](https://github.com/salesforce/tough-cookie/blob/master/CHANGELOG.md) - [Commits](salesforce/tough-cookie@v2.3.2...v2.5.0) Updates `tunnel-agent` from 0.4.3 to 0.6.0 - [Commits](request/tunnel-agent@v0.4.3...v0.6.0) --- updated-dependencies: - dependency-name: canvas dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: debug dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: request dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: async dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: brace-expansion dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: es5-ext dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: extend dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fsevents dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: is-my-json-valid dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jsonpointer dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: lodash dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: sshpk dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tough-cookie dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tunnel-agent dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added the dependencies Pull requests that update a dependency file label Aug 23, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 17 updates #1

Bump the npm_and_yarn group across 1 directory with 17 updates #1

Uh oh!

dependabot bot commented on behalf of github Aug 23, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Bump the npm_and_yarn group across 1 directory with 17 updates #1

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 17 updates #1

Uh oh!

Conversation

dependabot bot commented on behalf of github Aug 23, 2024

Changelog

(Unreleased)

Changed

Added

Fixed

3.0.0

Breaking

Changed

Added

Fixed

2.11.2

Fixed

2.6.9

Patches

Credits

release 2.6.7

release 2.6.6

release 2.6.5

release 2.6.4

release 2.6.3

release 2.6.2

release 2.6.1

release 2.6.0

release 2.5.2

release 2.5.1

2.6.9 / 2017-09-22

2.6.8 / 2017-05-18

2.6.7 / 2017-05-16

2.6.5 / 2017-04-27

2.6.4 / 2017-04-20

2.6.3 / 2017-03-13

2.6.2 / 2017-03-10

2.6.1 / 2017-02-10

Change Log

v2.88.0 (2018/08/10)

v2.87.0 (2018/05/21)

v2.86.0 (2018/05/15)

v2.85.0 (2018/03/12)

v2.84.0 (2018/03/12)

v2.83.0 (2017/09/27)

v2.82.0 (2017/09/19)

v2.81.0 (2017/03/09)

v2.80.0 (2017/03/04)

v2.3.0

v2.2.0

v2.1.5

v3.2.5

v3.2.4

v3.2.3

v3.2.2

v3.2.1

v3.2.0

v3.1.1

v3.1.0

v3.0.1

Bug fixes

v3.0.0

v1.1.11

brace-expansion

Example

API

0.10.64 (2024-02-27)

Bug Fixes

0.10.63 (2024-02-23)

Bug Fixes

Maintenance Improvements

0.10.62 (2022-08-02)

Maintenance Improvements

0.10.61 (2022-04-20)

Bug Fixes

Maintenance Improvements

0.10.60 (2022-04-07)

Maintenance Improvements

0.10.64 (2024-02-27)