chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates #517

dependabot · 2024-08-16T12:53:21Z

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package	From	To
@adobe/css-tools	`4.3.1`	`4.4.0`
@babel/traverse	`7.22.11`	`7.25.3`
braces	`3.0.2`	`3.0.3`
ejs	`3.1.9`	`3.1.10`
express	`4.18.2`	`4.19.2`
follow-redirects	`1.15.2`	`1.15.6`
tar	`6.1.15`	`6.2.1`

Updates @adobe/css-tools from 4.3.1 to 4.4.0

Changelog

Sourced from @adobe/css-tools's changelog.

4.4.0 / 2024-06-05

add support for @starting-style #319

4.3.3 / 2024-01-24

Update export property #271

4.3.2 / 2023-11-28

Fix redos vulnerability with specific crafted css string - CVE-2023-48631

Fix Problem parsing with :is() and nested :nth-child() #211

Commits

See full diff in compare view

Updates @babel/traverse from 7.22.11 to 7.25.3

Release notes

Sourced from @babel/traverse's releases.

v7.25.3 (2024-07-31)

🐛 Bug Fix

babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-traverse

#16699 Avoid validating visitors produced by traverse.visitors.merge (@nicolo-ribaudo)

🏠 Internal

babel-parser

#16688 Add @babel/types as a dependency of @babel/parser (@nicolo-ribaudo)

Committers: 2

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.25.2 (2024-07-30)

🐛 Bug Fix

babel-core, babel-traverse

#16695 Ensure that requeueComputedKeyAndDecorators is available (@nicolo-ribaudo)

Committers: 2

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

v7.25.1 (2024-07-28)

🐛 Bug Fix

babel-plugin-transform-function-name

#16683 fix: ensureFunctionName may be undefined (@liuxingbaoyu)

babel-plugin-transform-react-constant-elements

#16582 fix plugin-transform-react-constant-elements transform JSXFrament but not add JSXExpressionContainer (@keiseiTi)

babel-traverse

#16587 fix: fixed issue16583 + test (@nerodesu017)

🏠 Internal

#16663 Test eslint plugin against eslint 9 (@JLHwung)

Committers: 4

Adrian (@nerodesu017)

Huáng Jùnliàng (@JLHwung)

@keiseiTi

@liuxingbaoyu

v7.25.0 (2024-07-26)

Thanks @davidtaylorhq and @slatereax for your first PR!

You can find the release blog post with some highlights at https://babeljs.io/blog/2024/07/26/7.25.0.

👓 Spec Compliance

... (truncated)

Changelog

Sourced from @babel/traverse's changelog.

v7.25.3 (2024-07-31)

🐛 Bug Fix

babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-traverse

#16699 Avoid validating visitors produced by traverse.visitors.merge (@nicolo-ribaudo)

🏠 Internal

babel-parser

#16688 Add @babel/types as a dependency of @babel/parser (@nicolo-ribaudo)

v7.25.2 (2024-07-30)

🐛 Bug Fix

babel-core, babel-traverse

#16695 Ensure that requeueComputedKeyAndDecorators is available (@nicolo-ribaudo)

v7.25.1 (2024-07-28)

🐛 Bug Fix

babel-plugin-transform-function-name

#16683 fix: ensureFunctionName may be undefined (@liuxingbaoyu)

babel-plugin-transform-react-constant-elements

#16582 fix plugin-transform-react-constant-elements transform JSXFrament but not add JSXExpressionContainer (@keiseiTi)

babel-traverse

#16587 fix: fixed issue16583 + test (@nerodesu017)

🏠 Internal

#16663 Test eslint plugin against eslint 9 (@JLHwung)

v7.25.0 (2024-07-26)

👓 Spec Compliance

babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3

#16537 await using normative updates (@JLHwung)

babel-plugin-transform-typescript

#16602 Ensure enum members syntactically determinable to be strings do not get reverse mappings (@liuxingbaoyu)

🚀 New Feature

babel-helper-create-class-features-plugin, babel-helper-function-name, babel-helper-plugin-utils, babel-helper-wrap-function, babel-plugin-bugfix-safari-class-field-initializer-scope, babel-plugin-bugfix-safari-id-destructuring-collision-in-function-expression, babel-plugin-transform-classes, babel-plugin-transform-function-name, babel-preset-env, babel-traverse, babel-types

#16658 Move ensureFunctionName to NodePath.prototype (@nicolo-ribaudo)

babel-helper-hoist-variables, babel-helper-plugin-utils, babel-plugin-proposal-async-do-expressions, babel-plugin-transform-modules-systemjs, babel-traverse

#16644 Move hoistVariables to Scope.prototype (@nicolo-ribaudo)

babel-helper-create-class-features-plugin, babel-helper-module-transforms, babel-helper-plugin-utils, babel-helper-split-export-declaration, babel-plugin-transform-classes, babel-traverse, babel-types

#16645 Move splitExportDeclaration to NodePath.prototype (@nicolo-ribaudo)

babel-helper-create-class-features-plugin, babel-helper-environment-visitor, babel-helper-module-transforms, babel-helper-plugin-utils, babel-helper-remap-async-to-generator, babel-helper-replace-supers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-bugfix-v8-static-class-fields-redefine-readonly, babel-plugin-transform-async-generator-functions, babel-plugin-transform-classes, babel-traverse

#16649 Move environment-visitor helper into @babel/traverse (@nicolo-ribaudo)

babel-core, babel-parser

#16480 Expose wether a module has TLA or not as .extra.async (@nicolo-ribaudo)

babel-compat-data, babel-plugin-bugfix-safari-class-field-initializer-scope, babel-preset-env

#16569 Introduce bugfix-safari-class-field-initializer-scope (@davidtaylorhq)

babel-plugin-transform-block-scoping, babel-traverse, babel-types

#16551 Add NodePath#getAssignmentIdentifiers (@JLHwung)

babel-helper-import-to-platform-api, babel-plugin-proposal-json-modules

... (truncated)

Commits

787c7cd v7.25.3
992c6e0 Avoid validating visitors produced by traverse.visitors.merge (#16699)
44efb5f print @babel/traverse version on unknown AST types (#16701)
0f8f408 v7.25.2
6a15d7a Ensure that requeueComputedKeyAndDecorators is available (#16695)
2413d1a Add eslint-plugin-regexp (#16680)
6bfc823 v7.25.1
801d3cb fix: improve variable declarator removal (#16587)
d2e3ee2 v7.25.0
d364545 Move ensureFunctionName to NodePath.prototype (#16658)
Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits

d3f807d Version 3.1.10
9ee26dd Mocha TDD
e469741 Basic pollution protection
715e950 Merge pull request #756 from Jeffrey-mu/main
cabe314 Include advanced usage examples
29b076c Added header
11503c7 Merge branch 'main' of github.com:mde/ejs into main
7690404 Added security banner to README
f47d7ae Update SECURITY.md
828cea1 Update SECURITY.md
Additional commits viewable in compare view

Updates express from 4.18.2 to 4.19.2

Release notes

Sourced from express's releases.

4.19.2

What's Changed

Improved fix for open redirect allow list bypass

Full Changelog: expressjs/express@4.19.1...4.19.2

4.19.1

What's Changed

Fix ci after location patch by @wesleytodd in expressjs/express#5552

fixed un-edited version in history.md for 4.19.0 by @wesleytodd in expressjs/express#5556

Full Changelog: expressjs/express@4.19.0...4.19.1

4.19.0

What's Changed

fix typo in release date by @UlisesGascon in expressjs/express#5527

docs: nominating @wesleytodd to be project captian by @wesleytodd in expressjs/express#5511

docs: loosen TC activity rules by @wesleytodd in expressjs/express#5510

Add note on how to update docs for new release by @crandmck in expressjs/express#5541

Prevent open redirect allow list bypass due to encodeurl

Release 4.19.0 by @wesleytodd in expressjs/express#5551

New Contributors

@crandmck made their first contribution in expressjs/express#5541

Full Changelog: expressjs/express@4.18.3...4.19.0

4.18.3

Main Changes

Fix routing requests without method

deps: body-parser@1.20.2

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: raw-body@2.5.2

Other Changes

Use https: protocol instead of deprecated git: protocol by @vcsjones in expressjs/express#5032

build: Node.js@16.18 and Node.js@18.12 by @abenhamdine in expressjs/express#5034

ci: update actions/checkout to v3 by @armujahid in expressjs/express#5027

test: remove unused function arguments in params by @raksbisht in expressjs/express#5124

Remove unused originalIndex from acceptParams by @raksbisht in expressjs/express#5119

Fixed typos by @raksbisht in expressjs/express#5117

examples: remove unused params by @raksbisht in expressjs/express#5113

fix: parameter str is not described in JSDoc by @raksbisht in expressjs/express#5130

fix: typos in History.md by @raksbisht in expressjs/express#5131

build : add Node.js@19.7 by @abenhamdine in expressjs/express#5028

test: remove unused function arguments in params by @raksbisht in expressjs/express#5137

... (truncated)

Changelog

Sourced from express's changelog.

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

Prevent open redirect allow list bypass due to encodeurl

deps: cookie@0.6.0

4.18.3 / 2024-02-29

Fix routing requests without method

deps: body-parser@1.20.2

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: raw-body@2.5.2

deps: cookie@0.6.0

Add partitioned option

Commits

04bc627 4.19.2
da4d763 Improved fix for open redirect allow list bypass
4f0f6cc 4.19.1
a003cfa Allow passing non-strings to res.location with new encoding handling checks f...
a1fa90f fixed un-edited version in history.md for 4.19.0
11f2b1d build: fix build due to inconsistent supertest behavior in older versions
084e365 4.19.0
0867302 Prevent open redirect allow list bypass due to encodeurl
567c9c6 Add note on how to update docs for new release (#5541)
69a4cf2 deps: cookie@0.6.0
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.

Updates follow-redirects from 1.15.2 to 1.15.6

Commits

35a517c Release version 1.15.6 of the npm package.
c4f847f Drop Proxy-Authorization across hosts.
8526b4a Use GitHub for disclosure.
b1677ce Release version 1.15.5 of the npm package.
d8914f7 Preserve fragment in responseUrl.
6585820 Release version 1.15.4 of the npm package.
7a6567e Disallow bracketed hostnames.
05629af Prefer native URL instead of deprecated url.parse.
1cba8e8 Prefer native URL instead of legacy url.resolve.
72bc2a4 Simplify _processResponse error handling.
Additional commits viewable in compare view

Updates tar from 6.1.15 to 6.2.1

Changelog

Sourced from tar's changelog.

Changelog

7.4

Deprecate onentry in favor of onReadEntry for clarity.

7.3

Add onWriteEntry option

7.2

DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

Update minipass to v7.1.0

Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

Rewrite in TypeScript, provide ESM and CommonJS hybrid interface

Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.

Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.

Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

6.2

Add support for brotli compression

Add maxDepth option to prevent extraction into excessively deep folders.

6.1

remove dead link to benchmarks (#313) (@yetzt)

add examples/explanation of using tar.t (@isaacs)

ensure close event is emited after stream has ended (@webark)

... (truncated)

Commits

bef7b1e 6.2.1
fe8cd57 prevent extraction in excessively deep subfolders
fe7ebfd remove security.md
5bc9d40 6.2.0
fe1ef5e changelog 6.2
e483220 get rid of npm lint stuff
689928a ci that works outside of npm org
db6f539 file inference improvements for .tbr and .tgz
336fa8f refactor: dry and other pr comments
eeba222 chore: lint fixes
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

…dates Bumps the npm_and_yarn group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@adobe/css-tools](https://github.com/adobe/css-tools) | `4.3.1` | `4.4.0` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.22.11` | `7.25.3` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [ejs](https://github.com/mde/ejs) | `3.1.9` | `3.1.10` | | [express](https://github.com/expressjs/express) | `4.18.2` | `4.19.2` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.2` | `1.15.6` | | [tar](https://github.com/isaacs/node-tar) | `6.1.15` | `6.2.1` | Updates `@adobe/css-tools` from 4.3.1 to 4.4.0 - [Changelog](https://github.com/adobe/css-tools/blob/main/History.md) - [Commits](https://github.com/adobe/css-tools/commits) Updates `@babel/traverse` from 7.22.11 to 7.25.3 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.25.3/packages/babel-traverse) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `ejs` from 3.1.9 to 3.1.10 - [Release notes](https://github.com/mde/ejs/releases) - [Commits](mde/ejs@v3.1.9...v3.1.10) Updates `express` from 4.18.2 to 4.19.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.18.2...4.19.2) Updates `follow-redirects` from 1.15.2 to 1.15.6 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.2...v1.15.6) Updates `tar` from 6.1.15 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.1.15...v6.2.1) --- updated-dependencies: - dependency-name: "@adobe/css-tools" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ejs dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot requested a review from a team as a code owner August 16, 2024 12:53

dependabot bot added the dependencies Pull requests that update a dependency file label Aug 16, 2024

dependabot bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-9281ea16ff branch from cac8196 to d5619c2 Compare August 21, 2024 11:34

dependabot bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-9281ea16ff branch from d5619c2 to 3450ff2 Compare August 21, 2024 11:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates #517

chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates #517

dependabot bot commented on behalf of github Aug 16, 2024 •

edited

Loading

chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates #517

Are you sure you want to change the base?

chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates #517

Conversation

dependabot bot commented on behalf of github Aug 16, 2024 • edited Loading

4.4.0 / 2024-06-05

4.3.3 / 2024-01-24

4.3.2 / 2023-11-28

v7.25.3 (2024-07-31)

🐛 Bug Fix

🏠 Internal

Committers: 2

v7.25.2 (2024-07-30)

🐛 Bug Fix

Committers: 2

v7.25.1 (2024-07-28)

🐛 Bug Fix

🏠 Internal

Committers: 4

v7.25.0 (2024-07-26)

👓 Spec Compliance

v7.25.3 (2024-07-31)

🐛 Bug Fix

🏠 Internal

v7.25.2 (2024-07-30)

🐛 Bug Fix

v7.25.1 (2024-07-28)

🐛 Bug Fix

🏠 Internal

v7.25.0 (2024-07-26)

👓 Spec Compliance

🚀 New Feature

v3.1.10

4.19.2

What's Changed

4.19.1

What's Changed

4.19.0

What's Changed

New Contributors

4.18.3

Main Changes

Other Changes

4.19.2 / 2024-03-25

4.19.1 / 2024-03-20

4.19.0 / 2024-03-20

4.18.3 / 2024-02-29

Changelog

7.4

7.3

7.2

7.1

7.0

6.2

6.1

dependabot bot commented on behalf of github Aug 16, 2024 •

edited

Loading