[Snyk] Upgrade: autoprefixer, fibers, handlebars, jstransformer-handlebars, marked, metalsmith, postcss, sass, semver, strftime #287
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade:
- autoprefixer from 10.0.4 to 10.4.20.
See this package in npm: https://www.npmjs.com/package/autoprefixer
- fibers from 5.0.0 to 5.0.3.
See this package in npm: https://www.npmjs.com/package/fibers
- handlebars from 4.7.6 to 4.7.8.
See this package in npm: https://www.npmjs.com/package/handlebars
- jstransformer-handlebars from 1.1.0 to 1.2.0.
See this package in npm: https://www.npmjs.com/package/jstransformer-handlebars
- marked from 1.2.5 to 1.2.9.
See this package in npm: https://www.npmjs.com/package/marked
- metalsmith from 2.3.0 to 2.6.3.
See this package in npm: https://www.npmjs.com/package/metalsmith
- postcss from 8.1.10 to 8.4.41.
See this package in npm: https://www.npmjs.com/package/postcss
- sass from 1.29.0 to 1.77.8.
See this package in npm: https://www.npmjs.com/package/sass
- semver from 7.3.2 to 7.6.3.
See this package in npm: https://www.npmjs.com/package/semver
- strftime from 0.10.0 to 0.10.3.
See this package in npm: https://www.npmjs.com/package/strftime
See this project in Snyk:
https://app.snyk.io/org/bvbvyoy-9ml/project/44763e79-c555-468b-b8d6-fbe64cd671f6?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade multiple dependencies.
👯♂ The following dependencies are linked and will therefore be updated together.ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
autoprefixer
from 10.0.4 to 10.4.20 | 37 versions ahead of your current version | a month ago
on 2024-08-02
fibers
from 5.0.0 to 5.0.3 | 3 versions ahead of your current version | 2 years ago
on 2022-08-30
handlebars
from 4.7.6 to 4.7.8 | 2 versions ahead of your current version | a year ago
on 2023-08-01
jstransformer-handlebars
from 1.1.0 to 1.2.0 | 1 version ahead of your current version | 3 years ago
on 2022-01-17
marked
from 1.2.5 to 1.2.9 | 4 versions ahead of your current version | 4 years ago
on 2021-02-03
metalsmith
from 2.3.0 to 2.6.3 | 10 versions ahead of your current version | 6 months ago
on 2024-03-05
postcss
from 8.1.10 to 8.4.41 | 74 versions ahead of your current version | a month ago
on 2024-08-05
sass
from 1.29.0 to 1.77.8 | 141 versions ahead of your current version | 2 months ago
on 2024-07-11
semver
from 7.3.2 to 7.6.3 | 16 versions ahead of your current version | 2 months ago
on 2024-07-16
strftime
from 0.10.0 to 0.10.3 | 3 versions ahead of your current version | 3 months ago
on 2024-06-12
Issues fixed by the recommended upgrade:
SNYK-JS-ANSIREGEX-1583908
SNYK-JS-BRACES-6838727
SNYK-JS-HANDLEBARS-1056767
SNYK-JS-NANOID-2332193
SNYK-JS-POSTCSS-1090595
SNYK-JS-POSTCSS-1255640
SNYK-JS-POSTCSS-5926692
SNYK-JS-BROWSERSLIST-1090194
SNYK-JS-GLOBPARENT-1016905
SNYK-JS-HANDLEBARS-1279029
SNYK-JS-INFLIGHT-6095116
Release notes
Package name: autoprefixer
-
10.4.20 - 2024-08-02
- Fixed
-
10.4.19 - 2024-03-20
- Removed
-
10.4.18 - 2024-03-01
- Fixed removing
-
10.4.17 - 2024-01-17
- Fixed
-
10.4.16 - 2023-09-20
- Improved performance (by @ romainmenke).
- Fixed docs (by @ coliff).
-
10.4.15 - 2023-08-13
- Fixed
- Fixed docs (by @ coliff).
-
10.4.14 - 2023-03-09
- Improved startup time and reduced JS bundle size (by @ Knagis).
-
10.4.13 - 2022-10-27
- Fixed missed prefixes on vendor prefixes in name of CSS Custom Property.
-
10.4.12 - 2022-09-20
- Fixed support of unit-less zero angle in backgrounds (by @ yisibl).
-
10.4.11 - 2022-09-14
- Fixed
-
10.4.10 - 2022-09-13
-
10.4.9 - 2022-09-11
-
10.4.8 - 2022-07-29
-
10.4.7 - 2022-05-02
-
10.4.6 - 2022-05-01
-
10.4.5 - 2022-04-23
-
10.4.4 - 2022-03-16
-
10.4.3 - 2022-03-15
-
10.4.2 - 2022-01-07
-
10.4.1 - 2021-12-29
-
10.4.0 - 2021-10-28
-
10.3.7 - 2021-10-04
-
10.3.6 - 2021-09-26
-
10.3.5 - 2021-09-22
-
10.3.4 - 2021-09-02
-
10.3.3 - 2021-08-26
-
10.3.2 - 2021-08-21
-
10.3.1 - 2021-07-12
-
10.3.0 - 2021-07-10
-
10.2.6 - 2021-05-26
-
10.2.5 - 2021-03-05
-
10.2.4 - 2021-01-29
-
10.2.3 - 2021-01-19
-
10.2.2 - 2021-01-19
-
10.2.1 - 2021-01-08
-
10.2.0 - 2021-01-06
-
10.1.0 - 2020-12-08
-
10.0.4 - 2020-11-27
from autoprefixer GitHub release notesfit-contentprefix for Firefox.end value has mixed support, consider using flex-endwarning sinceend/startnow have good support.-webkit-box-orienton-webkit-line-clamp(@ Goodwine).user-select: containprefixes.::backdropprefixes (by @ yisibl).text-decorationprefixes by moving to MDN data (by @ romainmenke).Package name: fibers
-
5.0.3 - 2022-08-30
-
5.0.2 - 2022-07-28
-
5.0.1 - 2022-01-24
-
5.0.0 - 2020-04-22
- Added npm binary support for node v14.x
- Dropped npm binary support for node v10.x
- Dropped binary support for all 32-bit platforms
from fibers GitHub release notescreating tag for version 5.0.2
5.0.1
Package name: handlebars
-
4.7.8 - 2023-08-01
- Make library compatible with workers (#1894) - 3d3796c
- Don't rely on Node.js global object (#1776) - 2954e7e
- Fix compiling of each block params in strict mode (#1855) - 30dbf04
- Fix rollup warning when importing Handlebars as ESM - 03d387b
- Fix bundler issue with webpack 5 (#1862) - c6c6bbb
- Use https instead of git for mustache submodule - 88ac068
-
4.7.7 - 2021-02-15
-
4.7.6 - 2020-04-03
from handlebars GitHub release notesCommits
v4.7.7
v4.7.6
Package name: jstransformer-handlebars
-
1.2.0 - 2022-01-17
- Updated to Handlebars 4.7.7
- Documented render options in readme
-
1.1.0 - 2018-01-28
from jstransformer-handlebars GitHub release notes1.1.0
Package name: marked
-
1.2.9 - 2021-02-03
- allow sublist to be single space in pedantic (#1924) (1e36afd)
-
1.2.8 - 2021-01-26
- leave whitespace only lines alone (#1889) (53c79ee)
-
1.2.7 - 2020-12-15
- Replace use of startsWith and endsWith with regex for IE11 (#1877) (4fdde20), closes #1876
-
1.2.6 - 2020-12-10
- fix atx heading and make regex safe (#1853) (70ee29c)
- fix link with angle brackets around href (#1851) (656c3e4)
-
1.2.5 - 2020-11-19
- fix em and strong starting with special char (#1832) (f9bc93b)
- task lists not rendered when GFM is disabled (#1825) (3942e89), closes #1823
from marked GitHub release notes1.2.9 (2021-02-03)
Bug Fixes
1.2.8 (2021-01-26)
Bug Fixes
1.2.7 (2020-12-15)
Bug Fixes
1.2.6 (2020-12-10)
Bug Fixes
possible breaking change: When using the block.heading rule the text provided in capture group 2 will not be trimmed of whitespace.
1.2.5 (2020-11-19)
Bug Fixes
Package name: metalsmith
-
2.6.3 - 2024-03-05
- Drops support for Node < 14.18.0 (4 minor, deprecated versions) to be able to use 'node:' protocol imports"
- Updated README.md code samples, links, and troubleshooting section
- Dependencies:
- Fixes ms.watch(false) unreliable behavior when the build errors.
-
2.6.2 - 2023-11-15
- TS fixes: add generic to Metalsmith.File, bring back Metalsmith.DoneCallback, add Metalsmith.Plugin promise signature
- #394 Avoid leaking unhandled rejections in build/watch promises.
- Fix a typo in CLI help message
-
2.6.1 - 2023-07-11
-
2.6.0 - 2023-05-29
- [#356] Added Typescript support
- Added --debug and --dry-run options to metalsmith (build) command
- Added --env option to metalsmith (build) command
- Added Metalsmith CLI support for loading a .(c)js config. Reads from metalsmith.js as second default after metalsmith.json
- Added support for running (C/M)JS config files from CLI
- Dependencies:
- #231 Dropped support for Node < 14.14.0
- Dependencies:
- Modernized Metalsmith CLI, prepared transition to imports instead of require
- Dependencies:
- Fixes a duplicate empty input check in metalsmith.match
- Gray-matter excerpts are removed from contents instead of being duplicated to the
- Gray-matter excerpts are trimmed
-
2.5.1 - 2022-10-07
- Dependencies:
- Clarified semver policy in README.md
- Added SECURITY.md
- Fixes #373: do not crash when postinstall script fails in specific environments
-
2.5.0 - 2022-06-10
- #354 Added
- #356 Added
- #362 Upgraded all generator-based methods (
- Added org migration notification to postinstall script to encourage users to upgrade
- #231 Dropped support for Node < 12
- Dependencies:
- Restructured and updated
- #247 Calling
- #355 Proper path resolution for edge-cases using CLI, running metalsmith from outside or subfolder of
-
2.4.3 - 2022-05-16
- Dependencies:
- Updated README.md
- Fixes repeat
-
2.4.2 - 2022-02-13
- Dependencies:
- Updated README.md
- Fixed Metalsmith JSDoc type hints in VS code
-
2.4.1 - 2022-01-31
- #338 Added
- #358 Added TS-style JSdocs
- Use native
- #226 Allow passing a gray-matter options object to
- Modernized dev setup
- Added 8 new tests (match method, front-matter options, path & symbolic link handling)
- Files object file paths are now guaranteed to be sorted aphabetically.
- #211
- #231 Dropped support for Node < 8
- Dependencies:
-
-
- #206
- #226 Metalsmith will no longer 'swallow' errors on invalid front-matter, they will be passed to
- Fix test error on Windows #158 (@ moozzyk)
- #281 Metalsmith now properly handles symbolic links (will throw an ENOENT error or they can be
- #178
- #295 Metalsmith now catches all FS errors and passes them to the build callback/ thenable appropriately.
- Replace all occurences of
- Development Dependencies:
-
2.4.0 - 2022-01-31
- #338 Added
- #358 Added TS-style JSdocs
- Use native
- #226 Allow passing a gray-matter options object to
- Modernized dev setup
- Added 8 new tests (match method, front-matter options, path & symbolic link handling)
- Files object file paths are now guaranteed to be sorted aphabetically.
- #211
- #231 Dropped support for Node < 8
- Dependencies:
-
-
- #206
- #226 Metalsmith will no longer 'swallow' errors on invalid front-matter, they will be passed to
- Fix test error on Windows #158 (@ moozzyk)
- #281 Metalsmith now properly handles symbolic links (will throw an ENOENT error or they can be
- #178
- #295 Metalsmith now catches all FS errors and passes them to the build callback/ thenable appropriately.
- Replace all occurences of
- Development Dependencies:
-
2.3.0 - 2016-10-28
from metalsmith GitHub release notesRemoved
b170cf0Updated
774a164chokidar: 3.5.3 ▶︎ 3.6.0Fixed
0d8d7913ae6275cac48fc,5b48dce642a17634239d9Documents metalsmith.watch() getter signature in TSa719025Normalizes ms.watch().paths to an array, allows access to a subset of chokidar options as advertised5a516b2Sets chokidar watchOption awaitWriteFinish to false, and batch timer to 0 to speed up watching23b0944Fixes #389: ensure not missing watcher ready event to successfully launch build05265ceFixes formatting issue in types JSdoc commentsAdded
58d22a32d84fbe9661ddc45a4afe424e6ecchokidar9d40674lodash.clonedeepwithe12537fRemoved
80d8508rimraf: replaced with native Node.js methodsae05945cross-spawn:baee1deUpdated
24fcffb4929bc2commander: 6.2.1 -> 10.0.124fcffb0810728Fixed
60e173aexcerptproperty2bfe800acb363eFull Changelog: v2.5.1...v2.6.0
774a164debug: 4.3.3 ▶︎ 4.3.4Fixed
Important note to metalsmith-watch users:
Although 2.5.0 is a semver-minor release, it breaks compatibility with metalsmith-watch, which relies on the Metalsmith < 2.4.x private method signature using the outdated unyield package. See issue #374 for more details.
Added
Metalsmith#envmethod. Supports passingDEBUGandDEBUG_LOGamongst others. SetsCLI: truewhen run from the metalsmith CLI.b42df8c,446c676,33d936b,4c483a3Metalsmith#debugmethod for creating plugin debuggersMetalsmith#read,Metalsmith#readFile,Metalsmith#write,Metalsmith#writeFile,Metalsmith#runandMetalsmith#process) to dual callback-/ promise-based methods16a91c5,faf6ab6,6cb62293a11a24Removed
0a53007thunkify: replaced with promise-based implementationfaf6ab6unyieldreplaced with promise-based implementationfaf6ab6co-fs-extra: replaced with native Node.js methodsfaf6ab6chalk: not necessary for the few colors used by Metalsmith CLI1dae1cbclone: see #247a871af6Updated
README.md0da0c4dMetalsmith#metadatano longer clones the object passed to it, overwriting the previous metadata, but merges it into existing metadata.Fixed
metalsmith.directory()5d75539Updated
774a164micromatch: 4.0.4 ▶︎ 4.0.5Fixed
metalsmith.matchfile cache in repeat runs without re-read, see metalsmith/layouts#183a727309Updated
af9dec0chalk: 3.0.0 ▶︎ 4.1.2Fixed
ebf82f4Fixed
Bugfix: include index.js in package.json files
Unfortunately release 2.4.0 missed the index.js file and was only usable by doing require('metalsmith/lib'). For this reason the release notes from 2.4.0 are re-included below:
Added
Metalsmith#matchmethod. Plugins no longer need to require a matching library705c4bb,f01c724828b17efs.rminstead ofrimrafwhen available (Node 14.4+)fcbb76e,66e4376Metalsmith#frontmattera6438d2ef7b7814eb1184Metalsmith#buildnow returns a promise which you can attach athen/catchto orawait. The build callback model is still available.6d5a42dRemoved
2db47f5,75e6878has-generators: obsolete in supported Node versions2db47f5absolutereplaced with native Nodepath.isAbsolutec05f9e2(@ Zearin)isreplaced with own implementation7eaac9e2,54dba0c1(@ Zearin)recursive-readdir: replaced with own implementation4eb1184Updated
Dependencies:
75e6878chalk: 1.1.3 ▶︎ 3.0.0gray-matter: 2.0.0 ▶︎ 4.0.3stat-mode: 0.2.0 ▶︎ 1.0.0rimraf: 2.2.8 ▶︎ 3.0.2ware: 1.2.0 ▶︎ 1.3.0commander(used in CLI): 2.15.1 ▶︎ 6.2.1win-fork(used in CLI): replaced withcross-spawn:7.0.3Updated
CHANGELOG.mdformat to follow “Keep A Changelog” (#266) (@ Zearin)Fixed
Metalsmith#ignorenow only matches paths relative toMetalsmith#source(as it should). See linked issue for details4eb1184Metalsmith#builda6438d2Metalsmith#ignore'd)4eb1184Metalsmith#ignorenow removes the matched files before they arestattedfor glob-based ignores (saving some perf & potential errors).Security
new BufferwithBuffer.fromnpm auditvulnerability fixescoveralls: 2.11.6 ▶︎ 3.0.1 (#308) (@ Zearin)Fix 5 “Moderate” vulnerabilities
metalsmith-markdown: 0.2.1 ▶︎ 0.2.2 (#312) (@ Zearin)Fix 1 “Low” vulnerability
Unfortunately this release missed the index.js file and is only usable by doing
require('metalsmith/lib'). This has quickly been fixed in 2.4.1 and the release notes ported to itAdded
Metalsmith#matchmethod. Plugins no longer need to require a matching library705c4bb,f01c724828b17efs.rminstead ofrimrafwhen available (Node 14.4+)fcbb76e,66e4376Metalsmith#frontmattera6438d2ef7b7814eb1184Metalsmith#buildnow returns a promise which you can attach athen/catchto orawait. The build callback model is still available.6d5a42dRemoved
2db47f5,75e6878has-generators: obsolete in supported Node versions2db47f5absolutereplaced with native Nodepath.isAbsolutec05f9e2(@ Zearin)isreplaced with own implementation7eaac9e2,54dba0c1(@ Zearin)recursive-readdir: replaced with own implementation4eb1184Updated
Dependencies:
75e6878chalk: 1.1.3 ▶︎ 3.0.0gray-matter: 2.0.0 ▶︎ 4.0.3stat-mode: 0.2.0 ▶︎ 1.0.0rimraf: 2.2.8 ▶︎ 3.0.2ware: 1.2.0 ▶︎ 1.3.0commander(used in CLI): 2.15.1 ▶︎ 6.2.1win-fork(used in CLI): replaced withcross-spawn:7.0.3Updated
CHANGELOG.mdformat to follow “Keep A Changelog” (#266) (@ Zearin)Fixed
Metalsmith#ignorenow only matches paths relative toMetalsmith#source(as it should). See linked issue for details4eb1184Metalsmith#builda6438d2Metalsmith#ignore'd)4eb1184Metalsmith#ignorenow removes the matched files before they arestattedfor glob-based ignores (saving some perf & potential errors).Security
new BufferwithBuffer.fromnpm auditvulnerability fixescoveralls: 2.11.6 ▶︎ 3.0.1 (#308) (@ Zearin)Fix 5 “Moderate” vulnerabilities
metalsmith-markdown: 0.2.1 ▶︎ 0.2.2 (#312) (@ Zearin)Fix 1 “Low” vulnerability
Package name: postcss
-
8.4.41 - 2024-08-05
- Fixed types (by @ nex3 and @ querkmachine).
- Cleaned up RegExps (by @ bluwy).
-
8.4.40 - 2024-07-24
- Moved to getter/setter in nodes types to help Sass team (by @ nex3).
-
8.4.39 - 2024-06-29
- Fixed
-
8.4.38 - 2024-03-20
- Fixed
-
8.4.37 - 2024-03-19
-
8.4.36 - 2024-03-17
-
8.4.35 - 2024-02-07
-
8.4.34 - 2024-02-05
-
8.4.33 - 2024-01-04
-
8.4.32 - 2023-12-02
-
8.4.31 - 2023-09-28
-
8.4.30 - 2023-09-18
-
8.4.29 - 2023-08-29
-
8.4.28 - 2023-08-15
-
8.4.27 - 2023-07-21
-
8.4.26 - 2023-07-13
-
8.4.25 - 2023-07-06
-
8.4.24 - 2023-05-28
-
8.4.23 - 2023-04-19
-
8.4.22 - 2023-04-16
-
8.4.21 - 2023-01-06
-
8.4.20 - 2022-12-11
-
8.4.19 - 2022-11-10
-
8.4.18 - 2022-10-12
-
8.4.17 - 2022-09-30
-
8.4.16 - 2022-08-06
-
8.4.15 - 2022-08-06
-
8.4.14 - 2022-05-18
-
8.4.13 - 2022-04-30
-
8.4.12 - 2022-03-16
-
8.4.11 - 2022-03-15
-
8.4.10 - 2022-03-15
-
8.4.9 - 2022-03-15
-
8.4.8 - 2022-03-07
-
8.4.7 - 2022-02-24
-
8.4.6 - 2022-02-01
-
8.4.5 - 2021-12-13
-
8.4.4 - 2021-11-27
-
8.4.3 - 2021-11-26
-
8.4.2 - 2021-11-26
-
8.4.1 - 2021-11-24
-
8.4.0 - 2021-11-24
-
8.3.11 - 2021-10-21
-
8.3.10 - 2021-10-20
-
8.3.9 - 2021-10-04
-
8.3.8 - 2021-09-25
-
8.3.7 - 2021-09-22
-
8.3.6 - 2021-07-21
-
8.3.5 - 2021-06-17
-
8.3.4 - 2021-06-14
-
8.3.3 - 2021-06-14
-
8.3.2 - 2021-06-11
-
8.3.1 - 2021-06-09
-
8.3.0 - 2021-05-21
-
8.2.15 - 2021-05-10
-
8.2.14 - 2021-05-05
-
8.2.13 - 2021-04-26
-
8.2.12 - 2021-04-22
-
8.2.11 - 2021-04-22
-
8.2.10 - 2021-04-11
-
8.2.9 - 2021-03-30
-
8.2.8 - 2021-03-09
-
8.2.7 - 2021-03-03
-
8.2.6 - 2021-02-10
-
8.2.5 - 2021-02-06
-
8.2.4 - 2021-01-09
-
8.2.3 - 2021-01-07
-
8.2.2 - 2020-12-29
-
8.2.1 - 2020-12-09
-
8.2.0 - 2020-12-08
-
8.1.14 - 2020-12-04
-
8.1.13 - 2020-12-03
-
8.1.12 - 2020-12-03
-
8.1.11 - 2020-12-03
-
8.1.10 - 2020-11-23
from postcss GitHub release notesCssSyntaxErrortypes (by @ romainmenke).endIndex: 0in errors and warnings (by @ romainmenke).Package name: sass
To install Sass 1.77.8, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.
Changes
See the full changelog for changes in earlier releases.
See sass/sass#3885
…264)
To install Sass 1.77.5, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.
Changes
@ extend.See the full changelog for changes in earlier releases.
To install Sass 1.77.4, download one of the packages below and add it to your PATH, or see the Sass website for full installation instructions.
Changes
Embedded Sass
Support passing
Versioninput forfatalDeprecationsas string over embedded protocol.Fix a bug in the JS Embedded Host where
Versioncould be incorrectly accepted as input forsilenceDeprecationsandfutureDeprecationsin pure JS.See the full changelog for changes in earlier releases.