Bump the npm_and_yarn group across 2 directories with 8 updates #112

dependabot · 2024-11-09T15:42:31Z

Bumps the npm_and_yarn group with 7 updates in the /tgui directory:

Package	From	To
webpack	`5.91.0`	`5.94.0`
dompurify	`2.3.1`	`2.5.4`
axios	`1.7.2`	`1.7.4`
ws	`7.5.10`	`8.17.1`
terser	`5.31.1`	`5.31.2`
braces	`3.0.2`	`3.0.3`
micromatch	`4.0.4`	`4.0.8`

Bumps the npm_and_yarn group with 1 update in the /tools/autowiki directory: semver.

Updates webpack from 5.91.0 to 5.94.0

Release notes

Sourced from webpack's releases.

v5.94.0

Bug Fixes

Added runtime condition for harmony reexport checked

Handle properly data/http/https protocols in source maps

Make bigint optimistic when browserslist not found

Move @types/eslint-scope to dev deps

Related in asset stats is now always an array when no related found

Handle ASI for export declarations

Mangle destruction incorrect with export named default properly

Fixed unexpected asi generation with sequence expression

Fixed a lot of types

New Features

Added new external type "module-import"

Support webpackIgnore for new URL() construction

[CSS] @import pathinfo support

Security

Fixed DOM clobbering in auto public path

v5.93.0

Bug Fixes

Generate correct relative path to runtime chunks

Makes DefinePlugin quieter under default log level

Fixed mangle destructuring default in namespace import

Fixed consumption of eager shared modules for module federation

Strip slash for pretty regexp

Calculate correct contenthash for CSS generator options

New Features

Added the binary generator option for asset modules to explicitly keep source maps produced by loaders

Added the modern-module library value for tree shakable output

Added the overrideStrict option to override strict or non-strict mode for javascript modules

v5.92.1

Bug Fixes

Doesn't crash with an error when the css experiment is enabled and contenthash is used

v5.92.0

Bug Fixes

Correct tidle range's comutation for module federation

Consider runtime for pure expression dependency update hash

Return value in the subtractRuntime function for runtime logic

... (truncated)

Commits

eabf85d chore(release): 5.94.0
955e057 security: fix DOM clobbering in auto public path
9822387 test: fix
cbb86ed test: fix
5ac3d7f fix: unexpected asi generation with sequence expression
2411661 security: fix DOM clobbering in auto public path
b8c03d4 fix: unexpected asi generation with sequence expression
f46a03c revert: do not use heuristic fallback for "module-import"
60f1898 fix: do not use heuristic fallback for "module-import"
66306aa Revert "fix: module-import get fallback from externalsPresets"
Additional commits viewable in compare view

Updates dompurify from 2.3.1 to 2.5.4

Release notes

Sourced from dompurify's releases.

DOMPurify 2.5.4

Fixed a bug with latest isNaN checks affecting MSIE, thanks @tulach

Fixed the tests for MSIE and fixed related test-runner

DOMPurify 2.5.3

Fixed several mXSS variations found by and thanks to @kevin-mizu & @Ry0taK

Added better configurability for comment scrubbing default behavior

Added better hardening against Prototype Pollution attacks, thanks @kevin-mizu

Fixed some smaller issues in README and other documentation

DOMPurify 2.5.2

Addressed and fixed a mXSS variation found by @kevin-mizu

Addressed and fixed a mXSS variation found by Adam Kues of Assetnote

Updated tests for older Safari and Chrome versions

DOMPurify 2.5.1

Fixed an mXSS sanitizer bypass reported by @icesfont

Added new code to track element nesting depth

Added new code to enforce a maximum nesting depth of 255

Added coverage tests and necessary clobbering protections

Note that this is a security release and should be upgraded to immediately. Please also note that further releases may follow as the underlying vulnerability is apparently new and further variations may be discovered.

DOMPurify 2.5.0

Added new setting SAFE_FOR_XML to enable better control over comment scrubbing

Updated the LICENSE file to show the accurate year number

Updated several build and test dependencies

DOMPurify 2.4.9

Fixed another conditional bypass caused by Processing Instructions, thanks @Ry0taK

Fixed the regex for HTML Custom Element detection, thanks @AlekseySolovey3T

DOMPurify 2.4.8

Fixed two possible bypasses when sanitizing an XML document and later using it in HTML, thanks @Slonser

DOMPurify 2.4.7

Fixed a licensing issue spotted and reported by @george-thomas-hill

DOMPurify 2.4.6

Fixed a bypass in jsdom 22 in case the noframes element is permitted, thanks @leeN

DOMPurify 2.4.5

Fixed a problem with improper reset of custom HTML options, thanks @ammaraskar

DOMPurify 2.4.4

Added support for ALLOW_SELF_CLOSE_IN_ATTR flag, thanks @edg2s @AndreVirtimo

Added better support for shadowrootmode, thanks @mfreed7

DOMPurify 2.4.3

Final release that is compatible with MSIE10 & MSIE 11

... (truncated)

Commits

10c1261 docs: Updated README ever so slightly
1c92880 test: Fixed two more tests for MSIE11 and Edge 18
1401208 test: Fixed more tests for MSIE and Edge 18
2c6410a test: Fixed several new tests for MSIE11 and Edge 18
2c9bca9 test: Changed github config to include MSIE tests for 2.x
b188787 chore: Preparing 2.5.4 release
707b3d6 fix: Added a better for for the MSIE iNaN issue
62fe3be test: Attempting to get MSIE 11 back into the browser test array
f3a9710 fix: Fixed an issue with MSIE and no support for Number.isNaN
e1ddfc7 Merge branch '2.x' of github.com:cure53/DOMPurify into 2.x
Additional commits viewable in compare view

Updates axios from 1.7.2 to 1.7.4

Release notes

Sourced from axios's releases.

Release v1.7.4

Release notes:

Bug Fixes

sec: CVE-2024-39338 (#6539) (#6543) (6b6b605)

sec: disregard protocol-relative URL to remediate SSRF (#6539) (07a661a)

Contributors to this release

Lev Pachmanov

Đỗ Trọng Hải

Release v1.7.3

Release notes:

Bug Fixes

adapter: fix progress event emitting; (#6518) (e3c76fc)

fetch: fix withCredentials request config (#6505) (85d4d0e)

xhr: return original config on errors from XHR adapter (#6515) (8966ee7)

Contributors to this release

Dmitriy Mozgovoy

Valerii Sidorenko

prianYu

Changelog

Sourced from axios's changelog.

1.7.4 (2024-08-13)

Bug Fixes

sec: CVE-2024-39338 (#6539) (#6543) (6b6b605)

sec: disregard protocol-relative URL to remediate SSRF (#6539) (07a661a)

Contributors to this release

Lev Pachmanov

Đỗ Trọng Hải

1.7.3 (2024-08-01)

Bug Fixes

adapter: fix progress event emitting; (#6518) (e3c76fc)

fetch: fix withCredentials request config (#6505) (85d4d0e)

xhr: return original config on errors from XHR adapter (#6515) (8966ee7)

Contributors to this release

Dmitriy Mozgovoy

Valerii Sidorenko

prianYu

Commits

abd24a7 chore(release): v1.7.4 (#6544)
6b6b605 fix(sec): CVE-2024-39338 (#6539) (#6543)
07a661a fix(sec): disregard protocol-relative URL to remediate SSRF (#6539)
c6cce43 chore(release): v1.7.3 (#6521)
e3c76fc fix(adapter): fix progress event emitting; (#6518)
85d4d0e fix(fetch): fix withCredentials request config (#6505)
92cd8ed chore(github): update ISSUE_TEMPLATE.md (#6519)
8966ee7 fix(xhr): return original config on errors from XHR adapter (#6515)
See full diff in compare view

Updates ws from 7.5.10 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.
const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits

3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
934c9d6 [ci] Test on node 22
1817bac [ci] Do not test on node 21
96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
Additional commits viewable in compare view

Updates terser from 5.31.1 to 5.31.2

Changelog

Sourced from terser's changelog.

v5.31.2

drop_unused: scan variables in self-referential class declarations that contain side effects.

Don't add parens to arrow function when it's the default for an argument (#1540)

Update domprops (#1538)

Commits

856041a 5.31.2
1646f4f update changelog
f1f325f Update dependency acorn to v8.12.1 (#1543)
9862142 fix unpaired surrogates test
437be8b drop_unused: scan variables used by self-referential side-effectful class dec...
9083832 Bump braces from 3.0.2 to 3.0.3 (#1537)
cc7ac7c Don't add parens when arrow function is part of a default assign (#1540)
69f0b37 Update dependency acorn to v8.12.0 (#1534)
769d27a Add unadjustedMovement to domprops (#1538)
4a92862 update changelog
See full diff in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates micromatch from 4.0.4 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

this is basically v4.0.5, with some README updates

it is vulnerable to CVE-2024-4067

Updated braces to v3.0.3 to avoid CVE-2024-4068

does NOT break API compatibility

[4.0.6] - 2024-05-21

Added hasBraces to check if a pattern contains braces.

Fixes CVE-2024-4067

BREAKS API COMPATIBILITY

Should be labeled as a major release, but it's not.

[4.0.1 - 4.0.5]

[4.0.0] - 2019-03-20

Added

Adds support for options.onMatch. See the readme for details

Adds support for options.onIgnore. See the readme for details

Adds support for options.onResult. See the readme for details

Breaking changes

Require Node.js >= 8.6

Removed support for passing an array of brace patterns to micromatch.braces().

To strictly enforce closing brackets (for {, [, and (), you must now use strictBrackets=true instead of strictErrors.

cache - caching and all related options and methods have been removed

options.unixify was renamed to options.windows

options.nodupes Was removed. Duplicates are always removed by default. You can override this with custom behavior by using the onMatch, onResult and onIgnore functions.

options.snapdragon was removed, as snapdragon is no longer used.

options.sourcemap was removed, as snapdragon is no longer used, which provided sourcemap support.

[3.0.0] - 2017-04-11

Complete overhaul, with 36,000+ new unit tests validated against actual output generated by Bash and minimatch. More specifically, 35,000+ of the tests:

micromatch results are directly compared to bash results

in rare cases, when micromatch and bash disagree, micromatch's results are compared to minimatch's results

micromatch is much more accurate than minimatch, so there were cases where I had to make assumptions. I'll try to document these.

This refactor introduces a parser and compiler that are supersets of more granular parsers and compilers from other sub-modules. Each of these sub-modules has a singular responsibility and focuses on a certain type of matching that aligns with a specific part of the Bash "expansion" API.

These sub-modules work like plugins to seamlessly create the micromatch parser/compiler, so that strings are parsed in one pass, an AST is created, then a new string is generated by the compiler.

... (truncated)

Commits

8bd704e 4.0.8
a0e6841 run verb to generate README documentation
4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
814f5f7 lint
67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
113f2e3 fix: CVE numbers in CHANGELOG
d9dbd9a feat: updated CHANGELOG
2ab1315 fix: use actions/setup-node@v4
1406ea3 feat: rework test to work on macos with node 10,12 and 14
Additional commits viewable in compare view

Updates semver from 7.6.2 to 7.6.3

Release notes

Sourced from semver's releases.

v7.6.3

7.6.3 (2024-07-16)

Bug Fixes

73a3d79 #726 optimize Range parsing and formatting (#726) (@jviide)

Documentation

2975ece #719 fix extra backtick typo (#719) (@stdavis)

Changelog

Sourced from semver's changelog.

7.6.3 (2024-07-16)

Bug Fixes

73a3d79 #726 optimize Range parsing and formatting (#726) (@jviide)

Documentation

2975ece #719 fix extra backtick typo (#719) (@stdavis)

Commits

0a12d6c chore: release 7.6.3 (#720)
73a3d79 fix: optimize Range parsing and formatting (#726)
2975ece docs: fix extra backtick typo (#719)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 7 updates in the /tgui directory: | Package | From | To | | --- | --- | --- | | [webpack](https://github.com/webpack/webpack) | `5.91.0` | `5.94.0` | | [dompurify](https://github.com/cure53/DOMPurify) | `2.3.1` | `2.5.4` | | [axios](https://github.com/axios/axios) | `1.7.2` | `1.7.4` | | [ws](https://github.com/websockets/ws) | `7.5.10` | `8.17.1` | | [terser](https://github.com/terser/terser) | `5.31.1` | `5.31.2` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [micromatch](https://github.com/micromatch/micromatch) | `4.0.4` | `4.0.8` | Bumps the npm_and_yarn group with 1 update in the /tools/autowiki directory: [semver](https://github.com/npm/node-semver). Updates `webpack` from 5.91.0 to 5.94.0 - [Release notes](https://github.com/webpack/webpack/releases) - [Commits](webpack/webpack@v5.91.0...v5.94.0) Updates `dompurify` from 2.3.1 to 2.5.4 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@2.3.1...2.5.4) Updates `axios` from 1.7.2 to 1.7.4 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.7.2...v1.7.4) Updates `ws` from 7.5.10 to 8.17.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.10...8.17.1) Updates `terser` from 5.31.1 to 5.31.2 - [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md) - [Commits](terser/terser@v5.31.1...v5.31.2) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `micromatch` from 4.0.4 to 4.0.8 - [Release notes](https://github.com/micromatch/micromatch/releases) - [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md) - [Commits](micromatch/micromatch@4.0.4...4.0.8) Updates `semver` from 7.6.2 to 7.6.3 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) - [Commits](npm/node-semver@v7.6.2...v7.6.3) --- updated-dependencies: - dependency-name: webpack dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: dompurify dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: axios dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ws dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: terser dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: braces dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: micromatch dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: semver dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot · 2024-11-09T16:36:04Z

Dependabot can't parse your yarn.lock. Because of this, Dependabot cannot update this pull request.

github-actions · 2024-11-09T16:46:03Z

This pull request has conflicts, please resolve those before we can evaluate your pull request.

dependabot · 2024-11-09T17:12:48Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Nov 9, 2024

github-actions bot added TGUI Ужасный TGUI.. даже без смайлов Tools labels Nov 9, 2024

github-actions bot added the Merge Conflict label Nov 9, 2024

MysticalFaceLesS closed this Nov 9, 2024

dependabot bot deleted the dependabot/npm_and_yarn/tgui/npm_and_yarn-762fee7236 branch November 9, 2024 17:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 2 directories with 8 updates #112

Bump the npm_and_yarn group across 2 directories with 8 updates #112

dependabot bot commented on behalf of github Nov 9, 2024 •

edited

Loading

dependabot bot commented on behalf of github Nov 9, 2024

github-actions bot commented Nov 9, 2024

dependabot bot commented on behalf of github Nov 9, 2024

Bump the npm_and_yarn group across 2 directories with 8 updates #112

Bump the npm_and_yarn group across 2 directories with 8 updates #112

Conversation

dependabot bot commented on behalf of github Nov 9, 2024 • edited Loading

v5.94.0

Bug Fixes

New Features

Security

v5.93.0

Bug Fixes

New Features

v5.92.1

Bug Fixes

v5.92.0

Bug Fixes

DOMPurify 2.5.4

DOMPurify 2.5.3

DOMPurify 2.5.2

DOMPurify 2.5.1

DOMPurify 2.5.0

DOMPurify 2.4.9

DOMPurify 2.4.8

DOMPurify 2.4.7

DOMPurify 2.4.6

DOMPurify 2.4.5

DOMPurify 2.4.4

DOMPurify 2.4.3

Release v1.7.4

Release notes:

Bug Fixes

Contributors to this release

Release v1.7.3

Release notes:

Bug Fixes

Contributors to this release

1.7.4 (2024-08-13)

Bug Fixes

Contributors to this release

1.7.3 (2024-08-01)

Bug Fixes

Contributors to this release

8.17.1

Bug fixes

v5.31.2

4.0.8

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

[4.0.6] - 2024-05-21

[4.0.1 - 4.0.5]

[4.0.0] - 2019-03-20

Added

Breaking changes

[3.0.0] - 2017-04-11

v7.6.3

7.6.3 (2024-07-16)

Bug Fixes

Documentation

7.6.3 (2024-07-16)

Bug Fixes

Documentation

dependabot bot commented on behalf of github Nov 9, 2024

github-actions bot commented Nov 9, 2024

dependabot bot commented on behalf of github Nov 9, 2024

dependabot bot commented on behalf of github Nov 9, 2024 •

edited

Loading