[Snyk] Upgrade: , , govuk-frontend, , applicationinsights, axios, joi, prom-client, redis #291

muyinatech · 2024-09-18T11:51:04Z

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

@azure/msal-common
from 14.13.0 to 14.14.1 | 3 versions ahead of your current version | a month ago
on 2024-08-13
@azure/msal-node
from 2.10.0 to 2.13.0 | 4 versions ahead of your current version | a month ago
on 2024-08-13
govuk-frontend
from 5.2.0 to 5.5.0 | 5 versions ahead of your current version | a month ago
on 2024-08-09
@ministryofjustice/frontend
from 2.1.1 to 2.2.0 | 3 versions ahead of your current version | 2 months ago
on 2024-07-31
applicationinsights
from 2.9.5 to 2.9.6 | 1 version ahead of your current version | a month ago
on 2024-08-15
axios
from 1.7.4 to 1.7.5 | 1 version ahead of your current version | a month ago
on 2024-08-23
joi
from 17.13.0 to 17.13.3 | 3 versions ahead of your current version | 3 months ago
on 2024-06-19
prom-client
from 15.1.0 to 15.1.3 | 3 versions ahead of your current version | 3 months ago
on 2024-06-27
redis
from 4.6.13 to 4.7.0 | 3 versions ahead of your current version | 2 months ago
on 2024-07-29

Release notes

Package name: @azure/msal-common

14.14.1 - 2024-08-13
14.14.1

Tue, 13 Aug 2024 23:25:08 GMT

Patches
- Add retryError to PerformanceEvent #7216 ([email protected])
- Add PerformanceEvent for PopupTokenHelper #7216 ([email protected])
- Bump eslint-config-msal to v0.0.0 (beachball)
- Bump msal-test-utils to v0.0.1 (beachball)
14.14.0 - 2024-07-23
14.14.0

Tue, 23 Jul 2024 14:19:34 GMT

Minor changes
- Track MSAL SKU for broker flows #7182 ([email protected])
- Track MSAL node SKU for broker flows #7213 ([email protected])
- Bump eslint-config-msal to v0.0.0 (beachball)
- Bump msal-test-utils to v0.0.1 (beachball)
14.13.1 - 2024-07-16
14.13.0 - 2024-07-01

from @azure/msal-common GitHub release notes

Package name: @azure/msal-node

2.13.0 - 2024-08-13
2.13.0

Tue, 13 Aug 2024 23:25:05 GMT

Minor changes
- Added file-based detection for Azure Arc ([email protected])
- Bump @ azure/msal-common to v14.14.1 (beachball)
- Bump eslint-config-msal to v0.0.0 (beachball)
Patches
- Send the error template back when theres an error response ([email protected])
- clientSecret can now (once again) be provided as undefined #7209 ([email protected])
2.12.0 - 2024-07-23
2.12.0

Tue, 23 Jul 2024 14:19:34 GMT

Minor changes
- Track MSAL node SKU for broker flows #7213 ([email protected])
- Bump @ azure/msal-common to v14.14.0 (beachball)
- Bump eslint-config-msal to v0.0.0 (beachball)
2.11.1 - 2024-07-16
2.11.0 - 2024-07-12
2.10.0 - 2024-07-01

from @azure/msal-node GitHub release notes

Package name: govuk-frontend

5.5.0 - 2024-08-09
This release includes an updated list of organisations and brand colours. We’ve also added a new feature to stop long words from ‘breaking out’ of components.

To install this version with npm, run npm install [email protected]. You can also find more information about how to stay up to date in our documentation.

New features

We've updated the list of organisations and brand colours included in Frontend

We've overhauled the list of organisations and organisation brand colours that are shipped with GOV.UK Frontend.

The previous list was outdated and had not kept up with changes to the machinery of government. We’ve updated the list to:
- add all current government departments and their brand colours
- add variants of brand colours that meet a 4.5:1 contrast ratio against white, where required
- provide warnings if defunct organisations are still being referenced in your Sass code
To enable these changes, set the feature flag variable $govuk-new-organisation-colours to true before you import GOV.UK Frontend in your Sass files:
```
// application.scss
$govuk-new-organisation-colours: true;
@ import "govuk-frontend/all";
```
You can also silence warnings about defunct organisations by adding organisation-colours to the $govuk-suppressed-warnings setting.

We introduced this change in pull request #3407: Update organisation colours.

Stop long words breaking out of components with govuk-!-text-break-word

We've added a new override class to help display long words with no obvious break points when the space is too narrow to display them on one line. An example of a long word might be an email address entered by a user.

Wrapping the content with the govuk-!-text-break-word class forces words that are too long for the parent element to break onto a new line.
```
A confirmation email will be sent to <span class="govuk-!-text-break-word">arthur_phillip_dent.42@peoplepersonalitydivision.siriuscyberneticscorporation.corp</span>.
```
Sass users can also use the govuk-text-break-word mixin.

We introduced this change in pull request #5159: Add break-word typography helper.

Recommended changes

Update the $websafe parameter on the govuk-organisation-colour function

The govuk-organisation-colour Sass function's $websafe parameter has been renamed to $contrast-safe.

This is to more accurately describe the functionality of the parameter.

The old parameter name will stop working in the next major version of GOV.UK Frontend.

We introduced this change in pull request #3407: Update organisation colours.

Fixes

We've made fixes to GOV.UK Frontend in the following pull requests:
5.4.1 - 2024-07-12
To install this version with npm, run npm install [email protected]. You can also find more information about how to stay up to date in our documentation.

Recommended changes

Update Breadcrumbs to use nav and aria-label

We've made changes to the Breadcrumbs component to improve how it appears to screen readers.

We've changed the wrapping element to use the nav tag to expose it as a navigational landmark, and added an aria-label attribute to differentiate it as breadcrumb navigation.

This change was introduced in pull request #4995: Update Breadcrumb component to improve screen reader accessibility.

Fixes

We've made fixes to GOV.UK Frontend in the following pull requests:
5.4.0 - 2024-05-17
To install this version with npm, run npm install [email protected]. You can also find more information about how to stay up to date in our documentation.

This release includes new features to help you include only the components your service uses. Doing this can help reduce the size of the JavaScript and CSS files sent to users, improving their experience.

New features

Create individual components with createAll

We've added a new createAll function that lets you initialise specific components in the same way that initAll does.

The createAll function will:
- find all elements in the page with the corresponding data-module attribute
- instantiate a component object for each element
- catch errors and log them in the console
- return an array of all the successfully instantiated component objects.
import { createAll, Button, Checkboxes } from 'govuk-frontend'

createAll(Button)
createAll(Checkboxes)

You can also pass a config object and a scope within which to search for elements.

You can find out more about how to use the createAll function in our documentation.

This change was introduced in pull request #4975: Add createAll function to initialise individual components.

Use tabular numbers easily with govuk-!-font-tabular-numbers

We've added a new override class for tabular number styling: govuk-!-font-tabular-numbers.

Using tabular numbers can make it easier for users to read numbers intended for comparison to one another, or for numbers that dynamically update.

It was previously only possible to use tabular numbers by using the govuk-font-tabular-numbers Sass mixin.

This change was introduced in pull request #4973: Add override class for tabular numbers.

Deprecated features

Importing layers using all files

You'll see a warning when compiling your Sass if you import any of our layers using the all file. Importing using the all files is deprecated, and we’ll remove them in the next major release.

In your import statements, use a trailing /index rather than /all to load GOV.UK Frontend's files.
For example:
- @ import "govuk/index"; instead of @ import "govuk/all";;
- @ import "govuk/<PATH>/index"; instead of @ import "govuk/<PATH>/all";;
You do not need /index at the end of each import path if you’re using Dart Sass, LibSass 3.6.0 or higher, or Ruby Sass 3.6.0 or higher.

This change was introduced in pull request #4955: Rename all files to index for our Sass entry points.

Fixes

We've made fixes to GOV.UK Frontend in the following pull requests:
- #4942: Remove duplicate errorMessage argument for the password input component - thanks to Tim South for contributing this change
- #4961: Fix tree-shaking when importing govuk-frontend
- #4963: Fix input value not being set if the value was '0' – thanks to @ dwp-dmitri-algazin for reporting this issue
- #4971: Fix Error Summary component outputting list HTML when no errorList is provided
- #442: Update content to streamline installation info
- #438: Split up the 'Import CSS, assets and JavaScript' page
5.3.1 - 2024-04-19
To install this version with npm, run npm install [email protected]. You can also find more information about how to stay up to date in our documentation.

Fixes

We've made fixes to GOV.UK Frontend in the following pull requests:
5.3.0 - 2024-03-26
To install this version with npm, run npm install [email protected]. You can also find more information about how to stay up to date in our documentation.

New features

Use the Password input component to help users accessibly enter passwords

The Password input component allows users to choose:
- whether their passwords are visible or not
- to enter their passwords in plain text
This helps users use longer and more complex passwords without needing to remember what they've already typed.

This change was introduced in pull request #4442: Create password input component. Thanks to @ andysellick for the original contribution.

Recommended changes

Update the HTML for the Character count component

We've updated the HTML for the Character count component. The component wrapper data-module="govuk-character-count" and its form group class="govuk-form-group" are now combined as the same <div>. The hint text used as the count message now appears directly after the <textarea>.

If you're not using Nunjucks macros, then you should:
- move all classes and attributes from the form group <div> to the component wrapper <div>
- remove the opening <div> and closing </div> tags used by the form group
- check the count message is now directly after the <textarea>
The following example shows some HTML and the difference once it’s updated.

HTML before:
```
<div class="govuk-character-count" data-module="govuk-character-count" data-maxlength="100">
  <div class="govuk-form-group">
    
  </div>
  
</div>
```
HTML after:
```
<div class="govuk-form-group govuk-character-count" data-module="govuk-character-count" data-maxlength="100">
  
</div>
```
Check your changes against the Character count example in the Design System to make sure you’ve correctly implemented them.

This change was introduced in pull request #4566: Use Character count formGroup as module wrapper.

Remove redundant role attributes from elements

We've made minor changes to the HTML of the page template, as well as the header, footer and pagination components.

You can update your HTML to remove the role attribute from some elements. These include the:
- main role on the main element in the template
- banner role on the header element in the Header component
- contentinfo role on the footer element in the Footer component
- navigation role on the nav element in the Pagination component
These roles were present to support legacy browsers, such as older versions of Internet Explorer. GOV.UK Frontend no longer supports these browsers, so you can now remove these roles.

You do not need to change anything if you're using the Nunjucks versions of the page template or these components,

This change was introduced in pull request #4854: Remove redundant role attributes.

Fixes

We've fixed an upstream issue in the cssnano npm package that caused elements with transparency to render incorrectly in Internet Explorer 11. This affected the pre-compiled CSS files in the GOV.UK Frontend npm package and GitHub releases for versions 5.0, 5.1 and 5.2. This was fixed in:
- #1573: feat: add preset and plugin options for browserslist in the cssnano repository
- #4829: Bump the postcss group with 2 updates
We've made fixes to GOV.UK Frontend in the following pull requests:
5.2.0 - 2024-02-21
In this release, we’ve adjusted our responsive type scale, which is available behind a feature flag. The type scale change is to make text easier to read on smaller screens. We’ve also deprecated the useTudorCrown parameter.

To install this version with npm, run npm install [email protected]. You can also find more information about how to stay up to date in our documentation.

New features

We've adjusted our responsive type scale

We've made the following adjustments to our responsive type scale:
- point 16 now returns 16px across all screen sizes
- point 19 now returns 19px across all screen sizes
- point 24 remains as 24px on large screens
- point 24 now returns 21px on small screens instead of 18px and has a line height 25px instead of 20px
- point 27 remains as 27px on large screens
- point 27 now returns 21px on small screens instead of 18px and has a line height 25px instead of 20px
- point 36 remains as 27px on large screens
- point 36 now returns 27px on small screens instead of 24px and has a line height 30px instead of 25px
To enable these changes, set the feature flag variable $govuk-new-typography-scale to true before you import GOV.UK Frontend in your Sass files:
```
// application.scss
$govuk-new-typography-scale: true;
@ import "govuk-frontend/all";
```
If your service uses custom elements made using GOV.UK Frontend, test your service against the new typography scale to assess if you need to make any adjustments.

You can read more on upgrading your service to the new type scale in our upgrade guide.

This change was introduced in pull request #2421: Adjust the responsive type scale

Insert custom HTML into component form group wrappers

You can now insert custom HTML into form group wrappers for all components with form fields.
```
govukInput({
  formGroup: {
    beforeInput: {
      html: "example"
    },
    afterInput: {
      html: "example"
    },
  }
})
```
This change was introduced in pull request #4567: Add beforeInput(s) and beforeInput(s) options to form groups.

Deprecated features

Stop using the useTudorCrown parameter in the Heading component

The rollout for the revised GOV.UK logo has started and the Tudor crown logo is now shown by default. We’ve deprecated the useTudorCrown parameter and will remove it in the next major release.

You can now remove the useTudorCrown parameter, along with any other adjustments made to display the Tudor crown logo in your service.

This change was introduced in pull request #4740: Make Tudor Crown logo the default

Fixes

We've made fixes to GOV.UK Frontend in the following pull requests:
- #4768: Fix z-index of inputs in Radios and Checkboxes component
- #4784: Fix LibSass calc() compatibility in Radios and Checkboxes

from govuk-frontend GitHub release notes

Package name: @ministryofjustice/frontend

2.2.0 - 2024-07-31
2.2.0 (2024-07-31)

You can find out how to stay up-to-date with new releases.

New feature: use the date picker component to help users select dates

The date picker component enables users to:
- select a date from the calendar view
- also enter a date using a text input
- identify available dates
2.1.3 - 2024-05-07
2.1.3 (2024-05-07)

Bug Fixes
- package.json & package-lock.json to reduce vulnerabilities (#592) (d815589)
2.1.2 - 2024-03-13
2.1.2 (2024-03-13)

Bug Fixes
- filter toggle button: ensure button appears (#581) (fbe6407)
2.1.1 - 2024-02-19
2.1.1 (2024-02-19)

Bug Fixes
- sortable-table: support mixed content and floating values (e4f9e69), closes #559

from @ministryofjustice/frontend GitHub release notes

Package name: axios

1.7.5 - 2024-08-23
Release notes:

Bug Fixes
- adapter: fix undefined reference to hasBrowserEnv (#6572) (7004707)
- core: add the missed implementation of AxiosError#status property; (#6573) (6700a8a)
- core: fix ReferenceError: navigator is not defined for custom environments; (#6567) (fed1a4b)
- fetch: fix credentials handling in Cloudflare workers (#6533) (550d885)
Contributors to this release
1.7.4 - 2024-08-13
Release notes:

Bug Fixes
- sec: CVE-2024-39338 (#6539) (#6543) (6b6b605)
- sec: disregard protocol-relative URL to remediate SSRF (#6539) (07a661a)
Contributors to this release
- Lev Pachmanov
- Đỗ Trọng Hải

from axios GitHub release notes

Package name: joi

17.13.3 - 2024-06-19
17.13.3
17.13.2 - 2024-06-19
17.13.2
17.13.1 - 2024-05-02
17.13.1
17.13.0 - 2024-04-23
17.13.0

from joi GitHub release notes

Package name: prom-client

15.1.3 - 2024-06-27
What's Changed
- Improve error message on labels by @ leftieFriele in #633
New Contributors
- @ leftieFriele made their first contribution in #633
- @ korengal made their first contribution in #636
Full Changelog: v15.1.2...v15.1.3
15.1.2 - 2024-04-16
What's Changed
- Enable bun.js by catching NotImplemented errorby @ owlcode in #624
- Add Registry.PROMETHEUS_CONTENT_TYPE and Registry.OPENMETRICS_CONTENT_TYPE constants to the TypeScript types by @ SimenB in #626
- Correctly read and set contentType top level export by @ SimenB in #625
New Contributors
- @ owlcode made their first contribution in #624
Full Changelog: v15.1.1...v15.1.2
15.1.1 - 2024-03-26
What's Changed
- perf: improve the memory usage of histogram by @ xsbchen in #606
- fix: avoid updating exemplar values during subsequent metric changes by @ psimk in #620
New Contributors
- @ glensc made their first contribution in #604
- @ xsbchen made their first contribution in #606
- @ psimk made their first contribution in #620
Full Changelog: v15.1.0...v15.1.1
15.1.0 - 2023-12-15
Changed
- remove unnecessary loop from osMemoryHeapLinux
- Improve performance of hashObject by using pre-sorted array of label names
- Fix type of collectDefaultMetrics.metricsList
Added
- Allow Pushgateway to now require job names for compatibility with Gravel Gateway.
- Allow histogram.startTime() to be used with exemplars.
New Contributors
- @ Connormiha made their first contribution in #592
- @ yosiat made their first contribution in #596
- @ geofholbrook made their first contribution in #597
- @ Pigrabbit made their first contribution in #593
Full Changelog: v15.0.0...v15.1.0

from prom-client GitHub release notes

Package name: redis

4.7.0 - 2024-07-29
Enhancements
- Upgrade @ redis/client from 1.5.16 to 1.6.0
- Upgrade @ redis/json from 1.0.6 to 1.0.7
- Upgrade @ redis/search from 1.1.6 to 1.2.0
- Upgrade @ redis/time-series from 1.0.5 to 1.1.0
4.6.15 - 2024-07-02
Enhancements
- Upgrade @ redis/client from 1.5.16 to 1.5.17
4.6.14 - 2024-05-16
Enhancements
- Upgrade @ redis/client from 1.5.14 to 1.5.16
4.6.13 - 2024-02-05

from redis GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade: - @azure/msal-common from 14.13.0 to 14.14.1. See this package in npm: https://www.npmjs.com/package/@azure/msal-common - @azure/msal-node from 2.10.0 to 2.13.0. See this package in npm: https://www.npmjs.com/package/@azure/msal-node - govuk-frontend from 5.2.0 to 5.5.0. See this package in npm: https://www.npmjs.com/package/govuk-frontend - @ministryofjustice/frontend from 2.1.1 to 2.2.0. See this package in npm: https://www.npmjs.com/package/@ministryofjustice/frontend - applicationinsights from 2.9.5 to 2.9.6. See this package in npm: https://www.npmjs.com/package/applicationinsights - axios from 1.7.4 to 1.7.5. See this package in npm: https://www.npmjs.com/package/axios - joi from 17.13.0 to 17.13.3. See this package in npm: https://www.npmjs.com/package/joi - prom-client from 15.1.0 to 15.1.3. See this package in npm: https://www.npmjs.com/package/prom-client - redis from 4.6.13 to 4.7.0. See this package in npm: https://www.npmjs.com/package/redis See this project in Snyk: https://app.snyk.io/org/tanovellino/project/44a5dd0b-21d5-4c80-81e2-56c897479301?utm_source=github&utm_medium=referral&page=upgrade-pr

muyinatech · 2024-09-20T13:52:48Z

package.json

-    "@azure/msal-node": "^2.10.0",
-    "@ministryofjustice/frontend": "^2.1.1",
+    "@azure/msal-common": "^14.14.1",
+    "@azure/msal-node": "^2.13.0",


Upgrade to msal-node v2.13.0 breaks the application with the following error:-

[Node] TypeError: Cannot read properties of undefined (reading 'LogLevel') [Node] at Object.<anonymous> (/Users/.../Projects/laa-crime-equinity-historical-data-frontend/dist/server/auth/authConfig.js:27:43) [Node] at Module._compile (node:internal/modules/cjs/loader:1376:14) [Node] at Module._extensions..js (node:internal/modules/cjs/loader:1435:10) [Node] at Module.load (node:internal/modules/cjs/loader:1207:32) [Node] at Module._load (node:internal/modules/cjs/loader:1023:12) [Node] at Module.require (node:internal/modules/cjs/loader:1235:19) [Node] at Module.patchedRequire (/Users/.../Projects/laa-crime-equinity-historical-data-frontend/node_modules/diagnostic-channel/dist/src/patchRequire.js:16:46) [Node] at Hook._require.Module.require (/Users/.../Projects/laa-crime-equinity-historical-data-frontend/node_modules/require-in-the-middle/index.js:188:39) [Node] at require (node:internal/modules/helpers:176:18) [Node] at Object.<anonymous> (/Users/.../Projects/laa-crime-equinity-historical-data-frontend/dist/server/auth/authProvider.js:31:22)

Need to investigate this before upgrading library.

muyinatech · 2024-09-20T14:07:04Z

Closing as msal-node upgrade requires further investigation. Added comments to JIRA ticket:- https://dsdmoj.atlassian.net/browse/EMP-544

muyinatech commented Sep 20, 2024

View reviewed changes

muyinatech closed this Sep 20, 2024

muyinatech reopened this Sep 20, 2024

muyinatech closed this Sep 20, 2024

muyinatech deleted the snyk-upgrade-d2e129b96ac753fe314039c3a32fab5f branch November 5, 2024 17:05

[Snyk] Upgrade: , , govuk-frontend, , applicationinsights, axios, joi, prom-client, redis #291

[Snyk] Upgrade: , , govuk-frontend, , applicationinsights, axios, joi, prom-client, redis #291

Conversation

muyinatech commented Sep 18, 2024

Snyk has created this PR to upgrade multiple dependencies.

14.14.1

Patches

14.14.0

Minor changes

2.13.0

Minor changes

Patches

2.12.0

Minor changes

New features

We've updated the list of organisations and brand colours included in Frontend

Stop long words breaking out of components with govuk-!-text-break-word

Recommended changes

Update the $websafe parameter on the govuk-organisation-colour function

Fixes

Recommended changes

Update Breadcrumbs to use nav and aria-label

Fixes

New features

Create individual components with createAll

Use tabular numbers easily with govuk-!-font-tabular-numbers

Deprecated features

Importing layers using all files

Fixes

Fixes

New features

Use the Password input component to help users accessibly enter passwords

Recommended changes

Update the HTML for the Character count component

Remove redundant role attributes from elements

Fixes

New features

We've adjusted our responsive type scale

Insert custom HTML into component form group wrappers

Deprecated features

Stop using the useTudorCrown parameter in the Heading component

Fixes

2.2.0 (2024-07-31)

New feature: use the date picker component to help users select dates

2.1.3 (2024-05-07)

Bug Fixes

2.1.2 (2024-03-13)

Bug Fixes

2.1.1 (2024-02-19)

Bug Fixes

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

Changed

Added

New Contributors

Enhancements

Enhancements

Enhancements

muyinatech Sep 20, 2024 • edited Loading

Choose a reason for hiding this comment

muyinatech commented Sep 20, 2024

Stop long words breaking out of components with `govuk-!-text-break-word`

Update the `$websafe` parameter on the `govuk-organisation-colour` function

Update Breadcrumbs to use `nav` and `aria-label`

Create individual components with `createAll`

Use tabular numbers easily with `govuk-!-font-tabular-numbers`

Importing layers using `all` files

Remove redundant `role` attributes from elements

Stop using the `useTudorCrown` parameter in the Heading component

muyinatech Sep 20, 2024 •

edited

Loading