chore(deps): bump the npm_and_yarn group across 3 directories with 19 updates #6

dependabot · 2024-06-04T03:40:09Z

Bumps the npm_and_yarn group with 19 updates in the / directory:

Package	From	To
highlight.js	`9.18.5`	`10.4.1`
postcss	`7.0.35`	`8.4.31`
vite	`2.7.12`	`2.9.18`
@babel/traverse	`7.12.12`	`7.24.6`
apollo-server-core	`2.25.3`	`2.26.2`
browserify-sign	`4.2.1`	`4.2.3`
browserslist	`4.16.0`	`4.23.0`
decode-uri-component	`0.2.0`	`0.2.2`
eventsource	`1.1.0`	`1.1.2`
express	`4.17.2`	`4.19.2`
follow-redirects	`1.14.7`	`1.15.6`
http-cache-semantics	`4.1.0`	`4.1.1`
minimatch	`3.0.4`	`3.1.2`
node-fetch	`2.6.6`	`2.7.0`
prismjs	`1.26.0`	`1.29.0`
semver	`5.7.1`	`5.7.2`
terser	`4.8.0`	`4.8.1`
url-parse	`1.5.4`	`1.5.10`
word-wrap	`1.2.3`	`1.2.5`

Bumps the npm_and_yarn group with 1 update in the /packages/demo directory: highlight.js.
Bumps the npm_and_yarn group with 1 update in the /packages/docs directory: postcss.

Updates highlight.js from 9.18.5 to 10.4.1

Release notes

Sourced from highlight.js's releases.

10.4.1

Security fixes:

(fix) Exponential backtracking fixes for: Josh Goebel

cpp

handlebars

gams

perl

jboss-cli

r

erlang-repl

powershell

routeros

(fix) Polynomial backtracking fixes for: Josh Goebel

asciidoc

reasonml

latex

kotlin

gcode

d

aspectj

moonscript

coffeescript/livescript

csharp

scilab

crystal

elixir

basic

ebnf

ruby

fortran/irpf90

livecodeserver

yaml

x86asm

dsconfig

markdown

ruleslanguage

xquery

sqf

Very grateful to Michael Schmidt for all the help.

10.4.0 - November 2020

A largish release with many improvements and fixes from quite a few different contributors. Enjoy!

Deprecations:

... (truncated)

Changelog

Sourced from highlight.js's changelog.

Version 10.4.1 (tentative)

Security

(fix) Exponential backtracking fixes for: Josh Goebel

cpp

handlebars

gams

perl

jboss-cli

r

erlang-repl

powershell

routeros

(fix) Polynomial backtracking fixes for: Josh Goebel

asciidoc

reasonml

latex

kotlin

gcode

d

aspectj

moonscript

coffeescript/livescript

csharp

scilab

crystal

elixir

basic

ebnf

ruby

fortran/irpf90

livecodeserver

yaml

x86asm

dsconfig

markdown

ruleslanguage

xquery

sqf

Very grateful to Michael Schmidt for all the help.

Version 10.4.0

A largish release with many improvements and fixes from quite a few different contributors. Enjoy!

... (truncated)

Commits

e96b915 bump 10.4.1
065f65f chore(release) allow release script to handle production releases
68509fc chore(docs) bump SECURITY mention to 9.18.5
aa0fb85 chore(docs) Version 9 has reached EOL.
fb0a626 enh(ci): Add tests for polynomial regex issues
fa46dd1 fix(reasonml) fix poly backtracking issue
d496052 fix(latex) fix poly backtracking issue
d9f1cdb fix(javascript/typescript) fix poly backtracking issue
fdec037 fix(asciidoc) fix poly backtracking issue
02ca487 fix(kotlin) fix poly backtracking issue
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by joshgoebel, a new releaser for highlight.js since your current version.

Updates postcss from 7.0.35 to 8.4.31

Release notes

Sourced from postcss's releases.

8.4.31

Fixed \r parsing to fix CVE-2023-44270.

8.4.30

Improved source map performance (by @romainmenke).

8.4.29

Fixed Node#source.offset (by @idoros).

Fixed docs (by @coliff).

8.4.28

Fixed Root.source.end for better source map (by @romainmenke).

Fixed Result.root types when process() has no parser.

8.4.27

Fixed Container clone methods types.

8.4.26

Fixed clone methods types.

8.4.25

Improve stringify performance (by @romainmenke).

Fixed docs (by @vikaskaliramna07).

8.4.24

Fixed Plugin types.

8.4.23

Fixed warnings in TypeDoc.

8.4.22

Fixed TypeScript support with node16 (by @remcohaszing).

8.4.21

Fixed Input#error types (by @hudochenkov).

8.4.20

Fixed source map generation for childless at-rules like @layer.

8.4.19

Fixed whitespace preserving after AST transformations (by @romainmenke).

8.4.18

Fixed an error on absolute: true with empty sourceContent (by @KingSora).

8.4.17

Fixed Node.before() unexpected behavior (by @romainmenke).

Added TOC to docs (by @muddv).

8.4.16

... (truncated)

Changelog

Sourced from postcss's changelog.

8.4.31

Fixed \r parsing to fix CVE-2023-44270.

8.4.30

Improved source map performance (by Romain Menke).

8.4.29

Fixed Node#source.offset (by Ido Rosenthal).

Fixed docs (by Christian Oliff).

8.4.28

Fixed Root.source.end for better source map (by Romain Menke).

Fixed Result.root types when process() has no parser.

8.4.27

Fixed Container clone methods types.

8.4.26

Fixed clone methods types.

8.4.25

Improve stringify performance (by Romain Menke).

Fixed docs (by @vikaskaliramna07).

8.4.24

Fixed Plugin types.

8.4.23

Fixed warnings in TypeDoc.

8.4.22

Fixed TypeScript support with node16 (by Remco Haszing).

8.4.21

Fixed Input#error types (by Aleks Hudochenkov).

8.4.20

Fixed source map generation for childless at-rules like @layer.

8.4.19

Fixed whitespace preserving after AST transformations (by Romain Menke).

8.4.18

Fixed an error on absolute: true with empty sourceContent (by Rene Haas).

8.4.17

Fixed Node.before() unexpected behavior (by Romain Menke).

Added TOC to docs (by Mikhail Dedov).

8.4.16

... (truncated)

Commits

90208de Release 8.4.31 version
58cc860 Fix carrier return parsing
4fff8e4 Improve pnpm test output
cd43ed1 Update dependencies
caa916b Update dependencies
8972f76 Typo
11a5286 Typo
45c5501 Release 8.4.30 version
bc3c341 Update linter
b2be58a Merge pull request #1881 from romainmenke/improve-sourcemap-performance--phil...
Additional commits viewable in compare view

Updates vite from 2.7.12 to 2.9.18

Changelog

Sourced from vite's changelog.

2.9.18 (2024-03-24)

fix: port #15653 to v2 (#15657) (1f855dc), closes #15653 #15657

fix: port #16250 to v2 (#16254) (011bbca), closes #16250 #16254

release: v2.9.17 (bfc5649)

2.9.17 (2024-01-19)

fix: port #15653 to v2 (#15657) (1f855dc), closes #15653 #15657

2.9.16 (2023-05-26)

fix: port #13348 to v2, fs.deny with leading double slash (#13350) (7d8100a), closes #13348 #13350

2.9.15 (2022-08-12)

fix: backport make resolveConfig() concurrent safe (#9224) (#9229) (7f01a00), closes #9224 #9229

fix: fs serve only edit pathname (fixes #9148) (#9654) (521bb39), closes #9148 #9654

fix(ssr-manifest): check name before saving to ssrManifest (#9595) (e361a80), closes #9595

chore: narrow down rollup version (#9651) (ed8d6a7), closes #9651

2.9.14 (2022-07-08)

fix: backport #8979, re-encode url to prevent fs.allow bypass (fixes #8498) (#8990) (adb61c5), closes #8498 #8990

fix: reverts #8471 (da77dee), closes #8471

fix(css): backport #7746 (d4d89b9), closes #7746

fix(css): backport #8936 (#8977) (84ec02a), closes #8936 #8977

2.9.13 (2022-06-27)

fix: backport #8804, /@fs/ dir traversal with escaped chars (fixes #8498) (#8805) (e109d64), closes #8498 #8805

fix(wasm): support decoding data URL in Node < v16 (#8668) (1afc1c2), closes #8668

2.9.12 (2022-06-10)

fix: backport outdated optimized dep removed from module graph (#8534) (c0d6c60), closes #8534

... (truncated)

Commits

5936352 release: v2.9.18
011bbca fix: port #16250 to v2 (#16254)
bfc5649 release: v2.9.17
1f855dc fix: port #15653 to v2 (#15657)
ea814d7 release: v2.9.16
7d8100a fix: port #13348 to v2, fs.deny with leading double slash (#13350)
3a5543d release: v2.9.15
521bb39 fix: fs serve only edit pathname (fixes #9148) (#9654)
ed8d6a7 chore: narrow down rollup version (#9651)
e361a80 fix(ssr-manifest): check name before saving to ssrManifest (#9595)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by vitebot, a new releaser for vite since your current version.

Updates @babel/traverse from 7.12.12 to 7.24.6

Release notes

Sourced from @babel/traverse's releases.

v7.24.6 (2024-05-24)

Thanks @amjed-98, @blakewilson, @coelhucas, and @SukkaW for your first PRs!

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties

#16514 Fix source maps for private member expressions (@nicolo-ribaudo)

babel-core, babel-generator, babel-plugin-transform-modules-commonjs

#16515 Fix source maps for template literals (@nicolo-ribaudo)

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#16485 Support undecorated static accessor in anonymous classes (@JLHwung)

#16484 Fix decorator bare yield await (@JLHwung)

babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3

#16483 Fix: throw TypeError if addInitializer is called after finished (@JLHwung)

babel-parser, babel-plugin-transform-typescript

#16476 fix: Correctly parse cls.fn<C> = x (@liuxingbaoyu)

🏠 Internal

babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#16501 Generate helper metadata at build time (@nicolo-ribaudo)

babel-helpers

#16499 Add tsconfig.json for @babel/helpers/src/helpers (@nicolo-ribaudo)

babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#16495 Move all runtime helpers to individual files (@nicolo-ribaudo)

babel-parser, babel-traverse

#16482 Statically generate boilerplate for bitfield accessors (@nicolo-ribaudo)

Other

#16466 Migrate import assertions syntax (@JLHwung)

Committers: 9

Amjad Yahia Robeen Hassan (@amjed-98)

Babel Bot (@babel-bot)

Blake Wilson (@blakewilson)

Huáng Jùnliàng (@JLHwung)

Lucas Coelho (@coelhucas)

Nicolò Ribaudo (@nicolo-ribaudo)

Sukka (@SukkaW)

Zzzen (@Zzzen)

@liuxingbaoyu

v7.24.5 (2024-04-29)

Thanks @romgrk and @sossost for your first PRs!

🐛 Bug Fix

babel-plugin-transform-classes, babel-traverse

#16377 fix: TypeScript annotation affects output (@liuxingbaoyu)

babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3

#16440 Fix suppressed error order (@sossost)

#16408 Await nullish async disposable (@JLHwung)

... (truncated)

Changelog

Sourced from @babel/traverse's changelog.

v7.24.6 (2024-05-24)

🐛 Bug Fix

babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties

#16514 Fix source maps for private member expressions (@nicolo-ribaudo)

babel-core, babel-generator, babel-plugin-transform-modules-commonjs

#16515 Fix source maps for template literals (@nicolo-ribaudo)

babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators

#16485 Support undecorated static accessor in anonymous classes (@JLHwung)

#16484 Fix decorator bare yield await (@JLHwung)

babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3

#16483 Fix: throw TypeError if addInitializer is called after finished (@JLHwung)

babel-parser, babel-plugin-transform-typescript

#16476 fix: Correctly parse cls.fn<C> = x (@liuxingbaoyu)

🏠 Internal

babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#16501 Generate helper metadata at build time (@nicolo-ribaudo)

babel-helpers

#16499 Add tsconfig.json for @babel/helpers/src/helpers (@nicolo-ribaudo)

babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#16495 Move all runtime helpers to individual files (@nicolo-ribaudo)

babel-parser, babel-traverse

#16482 Statically generate boilerplate for bitfield accessors (@nicolo-ribaudo)

Other

#16466 Migrate import assertions syntax (@JLHwung)

v7.24.5 (2024-04-29)

🐛 Bug Fix

babel-plugin-transform-classes, babel-traverse

#16377 fix: TypeScript annotation affects output (@liuxingbaoyu)

babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3

#16440 Fix suppressed error order (@sossost)

#16408 Await nullish async disposable (@JLHwung)

💅 Polish

babel-parser

#16407 Recover from exported using declaration (@JLHwung)

🏠 Internal

Other

#16414 Relax ESLint peerDependency constraint to allow v9 (@liuxingbaoyu)

babel-parser

#16425 Improve @babel/parser AST types (@nicolo-ribaudo)

#16417 Always pass type argument to .startNode (@nicolo-ribaudo)

babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse

#16439 Make NodePath<T | U> distributive (@nicolo-ribaudo)

babel-plugin-proposal-partial-application, babel-types

#16421 Remove JSXNamespacedName from valid CallExpression args (@nicolo-ribaudo)

babel-plugin-transform-class-properties, babel-preset-env

... (truncated)

Commits

9630250 v7.24.6
1f010df Explicitly define NodePath.prototype.* (#16488)
6e3539b [babel 8] Publish .d.ts files for every package (#16416)
e37e64d Use eslint v9 (#16479)
3ff20b9 Statically generate boilerplate for bitfield accessors (#16482)
97c3eb1 Remove syntaxType option for record-and-tuple (parser&plugin) (#16458)
71c247a [babel 8] Require Node.js ^18.20.0 || ^20.10.0 || >=21.0.0 (#16457)
ddbea7d v7.24.5
e779cad fix: TypeScript annotation affects output (#16377)
ee48754 Use multiple TypeScript projects (#16430)
Additional commits viewable in compare view

Updates apollo-server-core from 2.25.3 to 2.26.2

Commits

8fbc66c Release
f016446 fixup tests missing graphRef
f0c84d4 Merge pull request from GHSA-j5g3-5c8r-7qfx
84852fc Release
a2b8fc6 Update dependency on graphql-upload fork to fix #7060
91de501 Release
ae444b2 Release
82d4498 Disable graphql-upload integration when it is not used (#6476)
See full diff in compare view

Updates browserify-sign from 4.2.1 to 4.2.3

Changelog

Sourced from browserify-sign's changelog.

v4.2.3 - 2024-03-05

Commits

[patch] widen support to 0.12 9247adf

[patch] drop minimum node support to v1 4d0ee49

[Dev Deps] update aud, npmignore, tape 87f3a35

[actions] remove redundant finisher 37a4758

[Deps] pin hash-base to ~3.0, due to a breaking change 9e2bf12

[Deps] update parse-asn1 [f427270`](browserify/browserify-sign@f427270)

[Deps] update elliptic fb261ce

[Deps] pin elliptic due to a breaking change 168e16f

v4.2.2 - 2023-10-25

Fixed

[Tests] log when openssl doesn't support cipher [#37](https://github.com/crypto-browserify/browserify-sign/issues/37)

Commits

Only apps should have lockfiles 09a8995

[eslint] switch to eslint 83fe463

[meta] add npmignore and auto-changelog 4418183

[meta] fix package.json indentation 9ac5a5e

[Tests] migrate from travis to github actions d845d85

[Fix] sign: throw on unsupported padding scheme 8767739

[Fix] properly check the upper bound for DSA signatures 85994cd

[Tests] handle openSSL not supporting a scheme f5f17c2

[Deps] update bn.js, browserify-rsa, elliptic, parse-asn1, readable-stream, safe-buffer a67d0eb

[Dev Deps] update nyc, standard, tape cc5350b

[Tests] always run coverage; downgrade nyc 75ce1d5

[meta] add safe-publish-latest dcf49ce

[Tests] add npm run posttest 75dd8fd

[Dev Deps] update tape 3aec038

[Tests] skip unsupported schemes 703c83e

[Tests] node < 6 lacks array includes 3aa43cf

[Dev Deps] fix eslint range 98d4e0d

Commits

bf2c3ec v4.2.3
9247adf [patch] widen support to 0.12
f427270 [Deps] update `parse-asn1
87f3a35 [Dev Deps] update aud, npmignore, tape
fb261ce [Deps] update elliptic
4d0ee49 [patch] drop minimum node support to v1
9e2bf12 [Deps] pin hash-base to ~3.0, due to a breaking change
168e16f [Deps] pin elliptic due to a breaking change
37a4758 [actions] remove redundant finisher
4af5a90 v4.2.2
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for browserify-sign since your current version.

Updates browserslist from 4.16.0 to 4.23.0

Release notes

Sourced from browserslist's releases.

4.23.0

Added BROWSERSLIST_ROOT_PATH (by @teleclimber).

Changelog

Sourced from browserslist's changelog.

4.23.0

Added BROWSERSLIST_ROOT_PATH (by @teleclimber).

4.22.3

Fixed white spaces support in supports query (@g-plane).

Fixed shared config like @company/package/browserslist-config (@boucodes).

4.22.2

Fixed idempotency in time queries with mobileToDesktop (by Aliaksei Sapach).

4.22.1

Updated Firefox ESR (by @lerkor).

4.22

Added fully supports query (by Ben Scott).

Added partially supports alias for supports query (by Ben Scott).

4.21.11

Added warning to --update-db to move to new CLI (by Ivan Vasilev).

Fixed docs (by Tatsunori Uchino).

4.21.10

Updated Firefox ESR.

4.21.9

Fixed Opera Mobile edge cases (by Steve Repsher).

4.21.8

Fixed supports query and mobileToDesktop (by Steve Repsher).

4.21.7

Fixed last queries for Android (by Steve Repsher).

4.21.6

Fixed time queries with mobileToDesktop (by Steve Repsher).

Fixed docs (by Tatsunori Uchino, Will Stone, and Dominik Pschenitschni).

4.21.5

Fixed running Browserslist in browser environment.

4.21.4

Updated Firefox ESR.

4.21.3

Improved unknown region and unknown feature error (by Alexander Chabin).

4.21.2

Updated Firefox ESR.

4.21.1

... (truncated)

Commits

a23d971 Release 4.23 version
61e7712 Update dependencies
2c313aa Add Github release workflow
3caf908 Update CI
b58ae05 feat: add BROWSERSLIST_ROOT_PATH (#819)
8ddc4d8 Update grammar definition file (#817)
65ad382 Release 4.22.3 version
0efec9b Add Node.js 21 to CI
aaf5f2b Update dependencies
a3ba90b Updated regex to have the option of adding an extension after @companyName bu...
Additional commits viewable in compare view

Updates decode-uri-component from 0.2.0 to 0.2.2

Release notes

Sourced from decode-uri-component's releases.

v0.2.2

Prevent overwriting previously decoded tokens 980e0bf

SamVerschueren/decode-uri-component@v0.2.1...v0.2.2

v0.2.1

Switch to GitHub workflows 76abc93

Fix issue where decode throws - fixes #6 746ca5d

Update license (#1) 486d7e2

Tidelift tasks a650457

Meta tweaks 66e1c28

SamVerschueren/decode-uri-component@v0.2.0...v0.2.1

Commits

a0eea46 0.2.2
980e0bf Prevent overwriting previously decoded tokens
3c8a373 0.2.1
76abc93 Switch to GitHub workflows
746ca5d Fix issue where decode throws - fixes #6
486d7e2 Update license (#1)
a650457 Tidelift tasks
66e1c28 Meta tweaks
See full diff in compare view

Updates eventsource from 1.1.0 to 1.1.2

Changelog

Sourced from eventsource's changelog.

1.1.2

Inline origin resolution, drops original dependency (#281 Espen Hovlandsdal)

1.1.1

Do not include authorization and cookie headers on redirect to different origin (#273 Espen Hovlandsdal)

Commits

0a8b85b 1.1.2
f99ae66 docs: update history for 1.1.2
06c9721 chore: rebuild polyfill
9494642 fix: inline origin resolution, drop original dependency (#281)
aa7a408 1.1.1
56d489e chore: rebuild polyfill
4a951e5 docs: update history for 1.1.1
f9f6416 fix: strip sensitive headers on redirect to different origin
See full diff in compare view

Updates express from 4.17.2 to 4.19.2

Release notes

Sourced from express's releases.

4.19.2

What's Changed

Improved fix for open redirect allow list bypass

Full Changelog: expressjs/express@4.19.1...4.19.2

4.19.1

What's Changed

Fix ci after location patch by @wesleytodd in expressjs/express#5552

fixed un-edited version in history.md for 4.19.0 by @wesleytodd in expressjs/express#5556

Full Changelog: expressjs/express@4.19.0...4.19.1

4.19.0

What's Changed

fix typo in release date by @UlisesGascon in expressjs/express#5527

docs: nominating @wesleytodd to be project captian by @wesleytodd in expressjs/express#5511

docs: loosen TC activity rules by @wesleytodd in expressjs/express#5510

Add note on how to update docs for new release by @crandmck in expressjs/express#5541

Prevent open redirect allow list bypass due to encodeurl

Release 4.19.0 by @wesleytodd in expressjs/express#5551

New Contributors

@crandmck made their first contribution in expressjs/express#5541

Full Changelog: expressjs/express@4.18.3...4.19.0

4.18.3

Main Changes

Fix routing requests without method

deps: [email protected]

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: [email protected]

Other Changes

Use https: protocol instead of deprecated git: protocol by @vcsjones in expressjs/express#5032

build: [email protected] and [email protected] by @abenhamdine in expressjs/express#5034

ci: update actions/checkout to v3 by @armujahid in expressjs/express#5027

test: remove unused function arguments in params by @raksbisht in expressjs/express#5124

Remove unused originalIndex from acceptParams by @raksbisht in expressjs/express#5119

Fixed typos by @raksbisht in expressjs/express#5117

examples: remove unused params by @raksbisht in expressjs/express#5113

fix: parameter str is not described in JSDoc by @raksbisht in expressjs/express#5130

fix: typos in History.md by @raksbisht in expressjs/express#5131

build : add [email protected] by @abenhamdine in expressjs/express#5028

test: remove unused function arguments in params by @raksbisht in expressjs/express#5137

... (truncated)

Changelog

Sourced from express's changelog.

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with...
Description has been truncated

… updates Bumps the npm_and_yarn group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [highlight.js](https://github.com/highlightjs/highlight.js) | `9.18.5` | `10.4.1` | | [postcss](https://github.com/postcss/postcss) | `7.0.35` | `8.4.31` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `2.7.12` | `2.9.18` | | [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.12.12` | `7.24.6` | | [apollo-server-core](https://github.com/apollographql/apollo-server/tree/HEAD/packages/apollo-server-core) | `2.25.3` | `2.26.2` | | [browserify-sign](https://github.com/crypto-browserify/browserify-sign) | `4.2.1` | `4.2.3` | | [browserslist](https://github.com/browserslist/browserslist) | `4.16.0` | `4.23.0` | | [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component) | `0.2.0` | `0.2.2` | | [eventsource](https://github.com/EventSource/eventsource) | `1.1.0` | `1.1.2` | | [express](https://github.com/expressjs/express) | `4.17.2` | `4.19.2` | | [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.14.7` | `1.15.6` | | [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.1.0` | `4.1.1` | | [minimatch](https://github.com/isaacs/minimatch) | `3.0.4` | `3.1.2` | | [node-fetch](https://github.com/node-fetch/node-fetch) | `2.6.6` | `2.7.0` | | [prismjs](https://github.com/PrismJS/prism) | `1.26.0` | `1.29.0` | | [semver](https://github.com/npm/node-semver) | `5.7.1` | `5.7.2` | | [terser](https://github.com/terser/terser) | `4.8.0` | `4.8.1` | | [url-parse](https://github.com/unshiftio/url-parse) | `1.5.4` | `1.5.10` | | [word-wrap](https://github.com/jonschlinkert/word-wrap) | `1.2.3` | `1.2.5` | Bumps the npm_and_yarn group with 1 update in the /packages/demo directory: [highlight.js](https://github.com/highlightjs/highlight.js). Bumps the npm_and_yarn group with 1 update in the /packages/docs directory: [postcss](https://github.com/postcss/postcss). Updates `highlight.js` from 9.18.5 to 10.4.1 - [Release notes](https://github.com/highlightjs/highlight.js/releases) - [Changelog](https://github.com/highlightjs/highlight.js/blob/main/CHANGES.md) - [Commits](highlightjs/highlight.js@9.18.5...10.4.1) Updates `postcss` from 7.0.35 to 8.4.31 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@7.0.35...8.4.31) Updates `vite` from 2.7.12 to 2.9.18 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v2.9.18/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v2.9.18/packages/vite) Updates `@babel/traverse` from 7.12.12 to 7.24.6 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.24.6/packages/babel-traverse) Updates `apollo-server-core` from 2.25.3 to 2.26.2 - [Release notes](https://github.com/apollographql/apollo-server/releases) - [Commits](https://github.com/apollographql/apollo-server/commits/[email protected]/packages/apollo-server-core) Updates `browserify-sign` from 4.2.1 to 4.2.3 - [Changelog](https://github.com/browserify/browserify-sign/blob/main/CHANGELOG.md) - [Commits](browserify/browserify-sign@v4.2.1...v4.2.3) Updates `browserslist` from 4.16.0 to 4.23.0 - [Release notes](https://github.com/browserslist/browserslist/releases) - [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md) - [Commits](browserslist/browserslist@4.16.0...4.23.0) Updates `decode-uri-component` from 0.2.0 to 0.2.2 - [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases) - [Commits](SamVerschueren/decode-uri-component@v0.2.0...v0.2.2) Updates `eventsource` from 1.1.0 to 1.1.2 - [Changelog](https://github.com/EventSource/eventsource/blob/master/HISTORY.md) - [Commits](EventSource/eventsource@v1.1.0...v1.1.2) Updates `express` from 4.17.2 to 4.19.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.17.2...4.19.2) Updates `follow-redirects` from 1.14.7 to 1.15.6 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.14.7...v1.15.6) Updates `http-cache-semantics` from 4.1.0 to 4.1.1 - [Commits](kornelski/http-cache-semantics@v4.1.0...v4.1.1) Updates `minimatch` from 3.0.4 to 3.1.2 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.0.4...v3.1.2) Updates `node-fetch` from 2.6.6 to 2.7.0 - [Release notes](https://github.com/node-fetch/node-fetch/releases) - [Commits](node-fetch/node-fetch@v2.6.6...v2.7.0) Updates `prismjs` from 1.26.0 to 1.29.0 - [Release notes](https://github.com/PrismJS/prism/releases) - [Changelog](https://github.com/PrismJS/prism/blob/master/CHANGELOG.md) - [Commits](PrismJS/prism@v1.26.0...v1.29.0) Updates `semver` from 5.7.1 to 5.7.2 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md) - [Commits](npm/node-semver@v5.7.1...v5.7.2) Updates `terser` from 4.8.0 to 4.8.1 - [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md) - [Commits](terser/terser@v4.8.0...v4.8.1) Updates `url-parse` from 1.5.4 to 1.5.10 - [Commits](unshiftio/url-parse@1.5.4...1.5.10) Updates `word-wrap` from 1.2.3 to 1.2.5 - [Release notes](https://github.com/jonschlinkert/word-wrap/releases) - [Commits](jonschlinkert/word-wrap@1.2.3...1.2.5) Updates `highlight.js` from 9.18.5 to 11.9.0 - [Release notes](https://github.com/highlightjs/highlight.js/releases) - [Changelog](https://github.com/highlightjs/highlight.js/blob/main/CHANGES.md) - [Commits](highlightjs/highlight.js@9.18.5...10.4.1) Updates `postcss` from 7.0.39 to 8.4.38 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@7.0.35...8.4.31) --- updated-dependencies: - dependency-name: highlight.js dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: postcss dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: vite dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@babel/traverse" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: apollo-server-core dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserify-sign dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserslist dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: decode-uri-component dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: eventsource dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: http-cache-semantics dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: node-fetch dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: prismjs dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: semver dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: terser dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: url-parse dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: word-wrap dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: highlight.js dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: postcss dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added the dependencies Pull requests that update a dependency file label Jun 4, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the npm_and_yarn group across 3 directories with 19 updates #6

chore(deps): bump the npm_and_yarn group across 3 directories with 19 updates #6

dependabot bot commented on behalf of github Jun 4, 2024

chore(deps): bump the npm_and_yarn group across 3 directories with 19 updates #6

Are you sure you want to change the base?

chore(deps): bump the npm_and_yarn group across 3 directories with 19 updates #6

Conversation

dependabot bot commented on behalf of github Jun 4, 2024

10.4.1

10.4.0 - November 2020

Version 10.4.1 (tentative)

Version 10.4.0

8.4.31

8.4.30

8.4.29

8.4.28

8.4.27

8.4.26

8.4.25

8.4.24

8.4.23

8.4.22

8.4.21

8.4.20

8.4.19

8.4.18

8.4.17

8.4.16

8.4.31

8.4.30

8.4.29

8.4.28

8.4.27

8.4.26

8.4.25

8.4.24

8.4.23

8.4.22

8.4.21

8.4.20

8.4.19

8.4.18

8.4.17

8.4.16

2.9.18 (2024-03-24)

2.9.17 (2024-01-19)

2.9.16 (2023-05-26)

2.9.15 (2022-08-12)

2.9.14 (2022-07-08)

2.9.13 (2022-06-27)

2.9.12 (2022-06-10)

v7.24.6 (2024-05-24)

🐛 Bug Fix

🏠 Internal

Committers: 9

v7.24.5 (2024-04-29)

🐛 Bug Fix

v7.24.6 (2024-05-24)

🐛 Bug Fix

🏠 Internal

v7.24.5 (2024-04-29)

🐛 Bug Fix

💅 Polish

🏠 Internal

v4.2.3 - 2024-03-05

Commits

v4.2.2 - 2023-10-25

Fixed

Commits

4.23.0

4.23.0

4.22.3

4.22.2

4.22.1

4.22

4.21.11

4.21.10

4.21.9

4.21.8

4.21.7

4.21.6

4.21.5

4.21.4