Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): [security] bump swiper from 4.4.2 to 6.5.1 #9308

Closed

Conversation

dependabot-preview[bot]
Copy link
Contributor

@dependabot-preview dependabot-preview bot commented May 10, 2021

Bumps swiper from 4.4.2 to 6.5.1. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Prototype Pollution in swiper Versions of the package swiper before 6.5.1 are susceptible to prototype pollution.

Affected versions: < 6.5.1

Changelog

Sourced from swiper's changelog.

6.5.1 (2021-03-29)

Bug Fixes

  • a11y: correct aria-roledescription attribute name (1b73c3b), closes #4371
  • core: fixed proto pollution (ec358de)
  • core: fixed proto pollution (9dad273)
  • isObject cross window (7c36077)
  • isObject cross window (95b5dfe)
  • update virtual slides (e33242c)
  • core: replace unsupported Object.entries (6dff71d), closes #4341
  • core: use getComputedStyle helper (9698e58), closes #4337

Features

  • a11y.slideLabelMessage (9fd6e68)
  • custom html element support (f96db02)
  • navigation: set disabled prop on nav element if it is a <button> element (7536fbd), closes #4312

6.5.0 (2021-03-05)

Bug Fixes

  • a11y: space should trigger role button (3d4039b)
  • core: correctly update slideIndex when other elements are present in slides wrapper (21e7713)
  • core: don't toggle zoom during transition (16f185e), closes #4259
  • core: don't try to move slider when it is locked (51fd048), closes #4284
  • e2e: initSwiper (9915f8b)
  • lazy: fixed issue with lazy loading when freeMode stops without momentum (82bcc5c), closes #4274 #4275
  • navigation: don't hide navigation on pagination click (7b7cccf), closes #4285
  • pagination: don't hide pagination on navigation click (68b8a93), closes #4285
  • svelte: fix Svelte cjs exports (478289c), closes #4297

Features

  • components: added "resizeObserver" boolean option/prop to enable ResizeObserver (f03ffbb), closes #4244
  • core: added support to use ResizeObserver with new "resizeObserver" parameter (5f80052), closes #4244
  • core: possible to enable breakpoints based on container width (instead of window width) (42db86d), closes #4244
  • init cypress (6159524)

6.4.15 (2021-02-18)

Bug Fixes

  • angular, vue, svelte: add 'observer', etc. to params-list (8f1cd29)
  • core: correctly store class names (02265ec), closes #4247

6.4.14 (2021-02-17)

Bug Fixes

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Automerge options (never/patch/minor, and dev/runtime dependencies)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

@dependabot-preview dependabot-preview bot added dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability labels May 10, 2021
@dependabot-preview dependabot-preview bot force-pushed the dependabot/npm_and_yarn/swiper-6.5.1 branch 3 times, most recently from 5e883ff to 28afc52 Compare May 21, 2021 09:27
@dependabot-preview
Copy link
Contributor Author

Dependabot tried to update this pull request, but something went wrong. The most likely cause is #9379, which may be blocking Dependabot from updating your dependency files.

@dependabot-preview
Copy link
Contributor Author

Dependabot tried to update this pull request, but something went wrong. The most likely cause is #9406, which may be blocking Dependabot from updating your dependency files.

@dependabot-preview dependabot-preview bot force-pushed the dependabot/npm_and_yarn/swiper-6.5.1 branch 2 times, most recently from 5012957 to 7f06e9e Compare June 1, 2021 15:18
@dependabot-preview dependabot-preview bot force-pushed the dependabot/npm_and_yarn/swiper-6.5.1 branch 2 times, most recently from 52227a3 to b8bd8fe Compare June 9, 2021 01:46
@dependabot-preview
Copy link
Contributor Author

Dependabot tried to update this pull request, but something went wrong. The most likely cause is #9507, which may be blocking Dependabot from updating your dependency files.

@dependabot-preview
Copy link
Contributor Author

Dependabot tried to update this pull request, but something went wrong. The most likely cause is #9528, which may be blocking Dependabot from updating your dependency files.

@dependabot-preview
Copy link
Contributor Author

Dependabot tried to update this pull request, but something went wrong. The most likely cause is #9565, which may be blocking Dependabot from updating your dependency files.

@dependabot-preview dependabot-preview bot force-pushed the dependabot/npm_and_yarn/swiper-6.5.1 branch from a0f1aec to c296caf Compare June 21, 2021 15:00
@dependabot-preview dependabot-preview bot force-pushed the dependabot/npm_and_yarn/swiper-6.5.1 branch 2 times, most recently from 9fb82d3 to f79c7e3 Compare July 2, 2021 08:11
@dependabot-preview
Copy link
Contributor Author

Dependabot tried to update this pull request, but something went wrong. The most likely cause is #9688, which may be blocking Dependabot from updating your dependency files.

Bumps [swiper](https://github.com/nolimits4web/Swiper) from 4.4.2 to 6.5.1. **This update includes a security fix.**
- [Release notes](https://github.com/nolimits4web/Swiper/releases)
- [Changelog](https://github.com/nolimits4web/swiper/blob/master/CHANGELOG.md)
- [Commits](nolimits4web/swiper@v4.4.2...v6.5.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
@dependabot-preview dependabot-preview bot force-pushed the dependabot/npm_and_yarn/swiper-6.5.1 branch from f79c7e3 to 1cf085d Compare July 7, 2021 07:25
@dependabot-preview
Copy link
Contributor Author

Dependabot tried to update this pull request, but something went wrong. The most likely cause is #9703, which may be blocking Dependabot from updating your dependency files.

@dependabot-preview
Copy link
Contributor Author

Dependabot tried to update this pull request, but something went wrong. The most likely cause is #9735, which may be blocking Dependabot from updating your dependency files.

@Chen-jj Chen-jj closed this Jul 10, 2021
@dependabot-preview
Copy link
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot-preview dependabot-preview bot deleted the dependabot/npm_and_yarn/swiper-6.5.1 branch July 10, 2021 15:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant