[Snyk] Upgrade @headlessui/vue from 1.7.14 to 1.7.16 #4
Conversation
Snyk has created this PR to upgrade @headlessui/vue from 1.7.14 to 1.7.16. See this package in npm: https://www.npmjs.com/package/@headlessui/vue See this project in Snyk: https://app.snyk.io/org/naiba666/project/4490bc03-2ac8-46a7-b81b-cef5a9d38e2a?utm_source=github&utm_medium=referral&page=upgrade-pr
|
This PR has Quantification details
Why proper sizing of changes matters
Optimal pull request sizes drive a better predictable PR flow as they strike a
What can I do to optimize my changes
How to interpret the change counts in git diff output
Was this comment helpful? 👍 :ok_hand: :thumbsdown: (Email) |
Vulnerable Libraries (7)
More info on how to fix Vulnerable Libraries in JavaScript. 👉 Go to the dashboard for detailed results. 📥 Happy? Share your feedback with us. |
|
New and removed dependencies detected. Learn more about Socket for GitHub ↗︎
🚮 Removed packages: npm/@headlessui/[email protected], npm/@sentry/[email protected] |
|
🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎ To accept the risk, merge this PR and you will not be notified again. Next stepsWhat is a chronological version anomaly?Semantic versions published out of chronological order. This could either indicate dependency confusion or a patched vulnerability. What is new author?A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package. Scrutinize new collaborator additions to packages because they now have the ability to publish code into your dependency tree. Packages should avoid frequent or unnecessary additions or changes to publishing rights. What's wrong with minified code?This package contains minified code. This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code. In many cases minified code is harmless, however minified code can be used to hide a supply chain attack. Consider not shipping minified code on npm. What is environment variable access?Package accesses environment variables, which may be a sign of credential stuffing or data theft. Packages should be clear about which environment variables they access, and care should be taken to ensure they only access environment variables they claim to. What is network access?This module accesses the network. Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. What does no tests mean?Package does not have any tests. This is a strong signal of a poorly maintained or low quality package. Add tests and publish a new version of the package. Consumers may look for an alternative package with better testing. What's wrong with long strings?Contains long string literals, which may be a sign of obfuscated or packed code. Avoid publishing or consuming obfuscated or bundled code. It makes dependencies difficult to audit and undermines the module resolution system. What are unpopular packages?This package is not very popular. Unpopular packages may have less maintenance and contain other problems. Take a deeper look at the dependencyTake a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev. Remove the packageIf you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency. Mark a package as acceptable riskTo ignore an alert, reply with a comment starting with
|
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to upgrade @headlessui/vue from 1.7.14 to 1.7.16.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
Release notes
Package name: @headlessui/vue
-
1.7.16 - 2023-08-17
- Fix form elements for uncontrolled
- Use correct value when resetting
- Render
- Disable smooth scrolling when opening/closing
- Don't assume
- Improve SSR of the
- Fix incorrectly focused
- Improve resetting values when using the
- Prevent scrolling when focusing a tab (#2674)
-
1.7.15 - 2023-07-27
- Ensure the caret is in a consistent position when syncing the
- Improve "outside click" behaviour in combination with 3rd party libraries (#2572)
- Improve performance of
- Ensure IME works on Android devices (#2580)
- Calculate
- Submit form on
-
1.7.14 - 2023-06-01
from @headlessui/vue GitHub release notesFixed
<Listbox multiple>and<Combobox multiple>(#2626)<Listbox multiple>and<Combobox multiple>(#2626)<MainTreeNode />inPopoverGroupcomponent only (#2634)Dialogcomponents on iOS (#2635)<Tab />components are available when setting the next index (#2642)Disclosurecomponent (#2645)ComboboxInputcomponent on page load (#2654)nullableprop on theComboboxcomponent (#2660)Fixed
Combobox.Inputvalue (#2568)Comboboxcomponent (#2574)aria-expandedpurely based on the open/closed state (#2610)Entereven if no submit-like button was found (#2613)Commit messages
Package name: @headlessui/vue
Compare
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
🧐 View latest project report
🛠 Adjust upgrade PR settings
🔕 Ignore this dependency or unsubscribe from future upgrade PRs