[Snyk] Upgrade core-js from 3.13.1 to 3.38.0 #195

larkinwang20 · 2024-09-02T20:09:05Z

Snyk has created this PR to upgrade core-js from 3.13.1 to 3.38.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 78 versions ahead of your current version.
The recommended version was released on a month ago.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Information Exposure SNYK-JS-NANOID-2332193	521	Proof of Concept

Release notes

Package name: core-js

3.38.0 - 2024-08-04
- Changes v3.37.1...v3.38.0
- RegExp.escape proposal:
  - Built-ins:
    - RegExp.escape
  - Moved to stage 3, June 2024 and July 2024 TC39 meetings
  - Updated the way of escaping, regex-escaping/77
  - Throw an error on non-strings, regex-escaping/58
  - Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
- Promise.try proposal:
  - Built-ins:
    - Promise.try
  - Moved to stage 3, June 2024 TC39 meeting
  - Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
- Uint8Array to / from base64 and hex stage 3 proposal:
  - Built-ins:
    - Uint8Array.fromBase64
    - Uint8Array.fromHex
    - Uint8Array.prototype.setFromBase64
    - Uint8Array.prototype.setFromHex
    - Uint8Array.prototype.toBase64
    - Uint8Array.prototype.toHex
  - Added Uint8Array.prototype.{ setFromBase64, setFromHex } methods
  - Added Uint8Array.fromBase64 and Uint8Array.prototype.setFromBase64 lastChunkHandling option, proposal-arraybuffer-base64/33
  - Added Uint8Array.prototype.toBase64 omitPadding option, proposal-arraybuffer-base64/60
  - Added throwing a TypeError on arrays backed by detached buffers
  - Unconditional forced replacement changed to feature detection
- Fixed RegExp named capture groups polyfill in combination with non-capturing groups, #1352, thanks @ Ulop
- Improved some cases of environment detection
- Uses process.getBuiltinModule for getting built-in NodeJS modules where it's available
- Uses https instead of http in URL constructor feature detection to avoid extra notifications from some overly vigilant security scanners, #1345
- Some minor optimizations
- Updated browserslist in core-js-compat dependencies that fixes an upstream issue with incorrect interpretation of some browserslist queries, #1344, browserslist/829, browserslist/836
- Compat data improvements:
  - Added Safari 18.0 compat data:
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } marked as shipped from FF129
  - Symbol.asyncDispose added and marked as supported from V8 ~ Chromium 127
  - Promise.try added and marked as supported from V8 ~ Chromium 128
  - Added Deno 1.44 and 1.45 compat data mapping
  - self descriptor is broken in Deno 1.45.3 (again)
  - Added Electron 32 and 33 compat data mapping
  - Added Opera Android 83 compat data mapping
  - Added Samsung Internet 27 compat data mapping
  - Added Oculus Quest Browser 34 compat data mapping
3.37.1 - 2024-05-14
- Changes v3.37.0...v3.37.1
- Fixed URL.parse feature detection for some specific cases
- Compat data improvements:
  - Set methods proposal added and marked as supported from FF 127
  - Symbol.dispose added and marked as supported from V8 ~ Chromium 125
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } added and marked as supported from Deno 1.43
  - URL.parse added and marked as supported from Chromium 126
  - URL.parse added and marked as supported from NodeJS 22.0
  - URL.parse added and marked as supported from Deno 1.43
  - Added Rhino 1.7.15 compat data, many features marked as supported
  - Added NodeJS 22.0 compat data mapping
  - Added Deno 1.43 compat data mapping
  - Added Electron 31 compat data mapping
  - Updated Opera Android 82 compat data mapping
  - Added Samsung Internet 26 compat data mapping
  - Added Oculus Quest Browser 33 compat data mapping
3.37.0 - 2024-04-16
- Changes v3.36.1...v3.37.0
- New Set methods proposal:
  - Built-ins:
    - Set.prototype.intersection
    - Set.prototype.union
    - Set.prototype.difference
    - Set.prototype.symmetricDifference
    - Set.prototype.isSubsetOf
    - Set.prototype.isSupersetOf
    - Set.prototype.isDisjointFrom
  - Moved to stable ES, April 2024 TC39 meeting
  - Added es. namespace modules, /es/ and /stable/ namespaces entries
- Explicit Resource Management stage 3 proposal
  - Some minor updates like explicit-resource-management/217
- Added Math.sumPrecise stage 2.7 proposal:
  - Built-ins:
    - Math.sumPrecise
- Promise.try proposal:
  - Built-ins:
    - Promise.try
  - Added optional arguments support, promise-try/16
  - Moved to stage 2.7, April 2024 TC39 meeting
- RegExp.escape stage 2 proposal:
  - Moved to hex-escape semantics, regex-escaping/67
    - It's not the final change of the way of escaping, waiting for regex-escaping/77 soon
- Pattern matching stage 1 proposal:
  - Built-ins:
    - Symbol.customMatcher
  - Once again, the used well-known symbol was renamed
  - Added new entries for that
- Added Extractors stage 1 proposal:
  - Built-ins:
    - Symbol.customMatcher
  - Since the Symbol.customMatcher well-known symbol from the pattern matching proposal is also used in the exactors proposal, added an entry also for this proposal
- Added URL.parse, url/825
- Engines bugs fixes:
  - Added a fix of Safari { Object, Map }.groupBy bug that does not support iterable primitives
  - Added a fix of Safari bug with double call of constructor in Array.fromAsync
- Compat data improvements:
  - URL.parse added and marked as supported from FF 126
  - URL.parse added and marked as supported from Bun 1.1.4
  - URL.canParse fixed and marked as supported from Bun 1.1.0
  - New Set methods fixed in JavaScriptCore and marked as supported from Bun 1.1.1
  - Added Opera Android 82 compat data mapping
3.36.1 - 2024-03-19
- Changes v3.36.0...v3.36.1
- Fixed some validation cases in Object.setPrototypeOf, #1329, thanks @ minseok-choe
- Fixed the order of validations in Array.from, #1331, thanks @ minseok-choe
- Added a fix of Bun queueMicrotask arity
- Added a fix of Bun URL.canParse arity
- Added a fix of Bun SuppressedError extra arguments support and arity
- Compat data improvements:
  - value argument of URLSearchParams.prototype.{ has, delete } marked as supported from Bun 1.0.31
  - Added React Native 0.74 Hermes compat data, Array.prototype.{ toSpliced, toReversed, with } and atob marked as supported
  - Added Deno 1.41.3 compat data mapping
  - Added Opera Android 81 compat data mapping
  - Added Samsung Internet 25 compat data mapping
  - Added Oculus Quest Browser 32 compat data mapping
  - Updated Electron 30 compat data mapping
3.36.0 - 2024-02-14
- ArrayBuffer.prototype.transfer and friends proposal:
  - Built-ins:
    - ArrayBuffer.prototype.detached
    - ArrayBuffer.prototype.transfer
    - ArrayBuffer.prototype.transferToFixedLength
  - Moved to stable ES, Febrary 2024 TC39 meeting
  - Added es. namespace modules, /es/ and /stable/ namespaces entries
- Uint8Array to / from base64 and hex proposal:
  - Methods:
    - Uint8Array.fromBase64
    - Uint8Array.fromHex
    - Uint8Array.prototype.toBase64
    - Uint8Array.prototype.toHex
  - Moved to stage 3, Febrary 2024 TC39 meeting
  - Added /actual/ namespace entries
  - Skipped adding new methods of writing to existing arrays to clarification some moments
- Promise.try proposal has been resurrected and moved to stage 2, Febrary 2024 TC39 meeting
- Added an entry point for the new TC39 proposals stage - core-js/stage/2.7 - still empty
- Fixed regression in Set.prototype.intersection feature detection
- Fixed a missed check in Array.prototype.{ indexOf, lastIndexOf, includes }, #1325, thanks @ minseok-choe
- Fixed a missed check in Array.prototype.{ reduce, reduceRight }, #1327, thanks @ minseok-choe
- Fixed Array.from and some other methods with proxy targets, #1322, thanks @ minseok-choe
- Fixed dependencies loading for modules from ArrayBuffer.prototype.transfer and friends proposal in some specific cases in IE10-
- Dropped context workaround from collection static methods entries since with current methods semantic it's no longer required
- Added instance methods polyfills to entries of collections static methods that produce collection instances
- Added missed Date.prototype.toJSON to JSON.stringify entries dependencies
- Added debugging info in some missed cases
- Compat data improvements:
  - { Map, Object }.groupBy, Promise.withResolvers, ArrayBuffer.prototype.transfer and friends marked as supported from Safari 17.4
  - New Set methods fixed and marked as supported from V8 ~ Chrome 123
  - Added Deno 1.40 compat data mapping
  - Symbol.metadata marked as supported from Deno 1.40.4
  - Updated Electron 30 compat data mapping
3.35.1 - 2024-01-20
- Fixed internal ToLength operation with bigints, #1318
- Removed significant redundant code from String#split polyfill
- Fixed setting names of methods with symbol keys in some old engines
- Minor fix of prototype methods export logic in the pure version
- Compat data improvements:
  - Iterator helpers proposal methods marked as supported from V8 ~ Chrome 122
  - Note that V8 ~ Chrome 122 add Set methods, but they have a bug similar to Safari
  - self marked as fixed from Bun 1.0.22
  - SuppressedError and Symbol.{ dispose, asyncDispose } marked as supported from Bun 1.0.23
  - Added Oculus Quest Browser 31 compat data mapping
  - Updated Electron 29 and added Electron 30 compat data mapping
3.35.0 - 2023-12-28
- { Map, Set, WeakMap, WeakSet }.{ from, of } became non-generic, following this and some other notes. Now they can be invoked without this, but no longer return subclass instances
- Fixed handling some cases of non-enumerable symbol keys from Symbol polyfill
- Removed unneeded NodeJS domains-related logic from queueMicrotask polyfill
- Fixed subclassing of wrapped ArrayBuffer
- Refactoring, many different minor optimizations
- Compat data improvements:
  - Array.fromAsync marked as supported from V8 ~ Chrome 121
  - It seems that the ancient Array.prototype.push bug is fixed in V8 ~ Chrome 122 (Hallelujah!)
  - ArrayBuffer.prototype.transfer and friends proposal features marked as supported from FF 122 and Bun 1.0.19
  - Object.groupBy and Map.groupBy marked as supported from Bun 1.0.19
  - Since Iterator helpers proposal methods are still not disabled in Deno, the web compatibility issue why it was disabled in Chromium makes no sense for Deno and fixed in the spec, they marked as supported from Deno 1.37
  - Added Opera Android 80 and updated Opera Android 79 compat data mapping
  - Added Samsung Internet 24 compat data mapping
3.34.0 - 2023-12-05
- Array grouping proposal:
  - Methods:
    - Object.groupBy
    - Map.groupBy
  - Moved to stable ES, November 2023 TC39 meeting
  - Added es. namespace modules, /es/ and /stable/ namespaces entries
- Promise.withResolvers proposal:
  - Method:
    - Promise.withResolvers
  - Moved to stable ES, November 2023 TC39 meeting
  - Added es. namespace module, /es/ and /stable/ namespaces entries
- Fixed a web incompatibility issue of Iterator helpers proposal, proposal-iterator-helpers/287 and some following changes, November 2023 TC39 meeting
- Added Uint8Array to / from base64 and hex stage 2 proposal:
  - Methods:
    - Uint8Array.fromBase64
    - Uint8Array.fromHex
    - Uint8Array.prototype.toBase64
    - Uint8Array.prototype.toHex
- Relaxed some specific cases of Number.fromString validation before clarification of proposal-number-fromstring/24
- Fixed @@ toStringTag property descriptors on DOM collections, #1312
- Fixed the order of arguments validation in Array iteration methods, #1313
- Some minor atob / btoa improvements
- Compat data improvements:
  - Promise.withResolvers marked as shipped from FF121
3.33.3 - 2023-11-19
- Fixed an issue getting the global object on Duktape, #1303
- Avoid sharing internal [[DedentMap]] from String.dedent proposal between core-js instances before stabilization of the proposal
- Some internal untangling
- Compat data improvements:
  - Added Deno 1.38 compat data mapping
  - Array.fromAsync marked as supported from Deno 1.38
  - Symbol.{ dispose, asyncDispose } marked as supported from Deno 1.38
  - Added Opera Android 79 compat data mapping
  - Added Oculus Quest Browser 30 compat data mapping
  - Updated Electron 28 and 29 compat data mapping
3.33.2 - 2023-10-30
3.33.1 - 2023-10-20
3.33.0 - 2023-10-01
3.32.2 - 2023-09-07
3.32.1 - 2023-08-18
3.32.0 - 2023-07-27
3.31.1 - 2023-07-06
3.31.0 - 2023-06-11
3.30.2 - 2023-05-06
3.30.1 - 2023-04-13
3.30.0 - 2023-04-03
3.29.1 - 2023-03-13
3.29.0 - 2023-02-26
3.28.0 - 2023-02-13
3.27.2 - 2023-01-18
3.27.1 - 2022-12-29
3.27.0 - 2022-12-25
3.26.1 - 2022-11-13
3.26.0 - 2022-10-23
3.25.5 - 2022-10-03
3.25.4 - 2022-10-02
3.25.3 - 2022-09-25
3.25.2 - 2022-09-18
3.25.1 - 2022-09-07
3.25.0 - 2022-08-24
3.24.1 - 2022-07-29
3.24.0 - 2022-07-25
3.23.5 - 2022-07-17
3.23.4 - 2022-07-09
3.23.3 - 2022-06-25
3.23.2 - 2022-06-20
3.23.1 - 2022-06-14
3.23.0 - 2022-06-13
3.22.8 - 2022-06-01
3.22.7 - 2022-05-24
3.22.6 - 2022-05-22
3.22.5 - 2022-05-10
3.22.4 - 2022-05-02
3.22.3 - 2022-04-28
3.22.2 - 2022-04-21
3.22.1 - 2022-04-19
3.22.0 - 2022-04-15
3.21.1 - 2022-02-16
3.21.0 - 2022-02-01
3.20.3 - 2022-01-15
3.20.2 - 2022-01-01
3.20.1 - 2021-12-23
3.20.0 - 2021-12-15
3.19.3 - 2021-12-06
3.19.2 - 2021-11-29
3.19.1 - 2021-11-02
3.19.0 - 2021-10-25
3.18.3 - 2021-10-12
3.18.2 - 2021-10-05
3.18.1 - 2021-09-26
3.18.0 - 2021-09-19
3.17.3 - 2021-09-09
3.17.2 - 2021-09-02
3.17.1 - 2021-09-01
3.17.0 - 2021-09-01
3.16.4 - 2021-08-29
3.16.3 - 2021-08-24
3.16.2 - 2021-08-17
3.16.1 - 2021-08-08
3.16.0 - 2021-07-30
3.15.2 - 2021-06-29
3.15.1 - 2021-06-22
3.15.0 - 2021-06-20
3.14.0 - 2021-06-05
3.13.1 - 2021-05-29

from core-js GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade core-js from 3.13.1 to 3.38.0. See this package in npm: core-js See this project in Snyk: https://app.snyk.io/org/strivingwang/project/459bcc26-7692-4155-85c5-2e2fae41b3a2?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade core-js from 3.13.1 to 3.38.0 #195

[Snyk] Upgrade core-js from 3.13.1 to 3.38.0 #195

larkinwang20 commented Sep 2, 2024

[Snyk] Upgrade core-js from 3.13.1 to 3.38.0 #195

Are you sure you want to change the base?

[Snyk] Upgrade core-js from 3.13.1 to 3.38.0 #195

Conversation

larkinwang20 commented Sep 2, 2024

Snyk has created this PR to upgrade core-js from 3.13.1 to 3.38.0.

Issues fixed by the recommended upgrade: