Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump datatables.net from 1.13.4 to 2.1.6 in /components #10883

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 9, 2024

Bumps datatables.net from 1.13.4 to 2.1.6.

Release notes

Sourced from datatables.net's releases.

1.13.11

DataTables 1.13.11

Commits
  • 24e77e7 Sync tag release - 2.1.6
  • 059f87f cfcb5d9c77fadc54f90ebe80edf0c8cc4c9b9b76 Release 2.1.6
  • 46394eb e714bd7e172e04941e2735cff85d7739075aa3be Fix: Handle sparse arrays more compe...
  • a9818fc dc0695eee40478a40aa4c3481704d3d718b65b87 Fix: -event i18n was bubbling if u...
  • 4b0c6e0 369001c7868ab47693b85bc0a42df1de18711c59 Fix: Server-side processing auto typ...
  • 82b7af4 Sync tag release - 2.1.5
  • c5d1afb d8c8900fbafa42a90aec216397ebf13095c10a20 Release 2.1.5
  • 1470279 e6d7805c8832066ecf8917d9f42e67bb74ba03a3 Fix: Add classes for cells (`-init c...
  • b1de1b4 ed2314c0cc69ceba50818ef16986764c0f1341c0 Build: Update SASS
  • 08bb8bd a3f4416739610faf030e6a76d2389bbe385a4a78 Test: Slightly better handling for l...
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [datatables.net](https://github.com/DataTables/Dist-DataTables) from 1.13.4 to 2.1.6.
- [Release notes](https://github.com/DataTables/Dist-DataTables/releases)
- [Commits](DataTables/Dist-DataTables@1.13.4...2.1.6)

---
updated-dependencies:
- dependency-name: datatables.net
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Sep 9, 2024
Copy link

dryrunsecurity bot commented Sep 9, 2024

DryRun Security Summary

The provided code changes update the datatables.net library from version 1.13.4 to 2.1.6 in the package.json and yarn.lock files, which is generally a positive change from an application security perspective, but requires thorough testing to ensure no regressions or vulnerabilities have been introduced.

Expand for full summary

Summary:

The provided code changes are focused on updating the dependencies in the project, specifically the datatables.net library. The key changes include updating the datatables.net dependency version from 1.13.4 to 2.1.6 in both the package.json and yarn.lock files.

From an application security perspective, these changes are generally positive as they address potential vulnerabilities and security issues that may have been present in the older version of the library. It's a common best practice to keep dependencies up-to-date to ensure the application is running on the latest stable and secure versions.

However, it's important to review the release notes and changelog for the new version of the datatables.net library to understand any security-related changes or fixes that have been made. Additionally, it's recommended to thoroughly test the application with the updated dependency to ensure that no regressions or vulnerabilities have been introduced.

Files Changed:

  1. components/package.json: This file has been updated to reflect the change in the datatables.net dependency version, from ^1.13.4 to ^2.1.6. This is a significant version update that may introduce breaking changes or new features.

  2. components/yarn.lock: This file has also been updated to reflect the change in the datatables.net dependency version, from 1.13.4 to 2.1.6. As with the package.json file, it's important to review the release notes and changelog for the new version to understand any security-related changes or fixes.

Code Analysis

We ran 9 analyzers against 2 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer Findings
Sensitive Files Analyzer 1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 23, 2024

Superseded by #10948.

@dependabot dependabot bot closed this Sep 23, 2024
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/components/dev/datatables.net-2.1.6 branch September 23, 2024 12:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants