🚨 [security] Update stylelint 14.16.1 → 16.14.1 (major)

[depfu]

---

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

---

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ stylelint (14.16.1 → 16.14.1) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ postcss (8.4.21 → 8.5.2) · Repo · Changelog

Security Advisories 🚨

🚨 PostCSS line return parsing error

An issue was discovered in PostCSS before 8.4.31. It affects linters using PostCSS to parse external Cascading Style Sheets (CSS). There may be \r discrepancies, as demonstrated by @font-face{ font:(\r/*);} in a rule.

This vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being originally included in a comment.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ braces (indirect, 3.0.2 → 3.0.3) · Repo · Changelog

Security Advisories 🚨

🚨 Uncontrolled resource consumption in braces

The NPM package braces fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ debug (indirect, 4.3.4 → 4.4.0) · Repo · Changelog

Release Notes

4.4.0

Fixes (hopefully) the inefficient regex warnings in .enable().

Minor version as this is invariably going to break certain users who misuse the .enable() API and expected it to work with regexes, which was never supported nor documented. That's on you, sorry - that functionality won't be added back.

Full Changelog: 4.3.7...4.4.0

4.3.7

What's Changed

• Upgrade ms to version 2.1.3 by @realityking in #819

Full Changelog: 4.3.6...4.3.7

4.3.6

What's Changed

• Avoid using deprecated RegExp.$1 by @bluwy in #969

New Contributors

• @bluwy made their first contribution in #969

Full Changelog: 4.3.5...4.3.6

4.3.5

Patch

• cac39b1 Fix/debug depth (#926)

Thank you @calvintwr for the fix.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ fast-glob (indirect, 3.2.12 → 3.3.3) · Repo

Release Notes

3.3.3

Full Changelog: 3.3.2...3.3.3

💬 Common

• Refer to [email protected] to avoid annoying npm audit spam (#443, #444, #454, #456, #457, #461)

🐛 Bug fixes

• Apply absolute negative patterns to full path instead of file path (#441, thanks @webpro)

3.3.2

Full Changelog: 3.3.1...3.3.2

🐛 Bug fixes

• Handle square brackets as a special character on Windows in escape functions (#425)
• Keep escaping after brace expansion (#422)

3.3.1

Full Changelog: 3.3.0...3.3.1

This release fixes a regression for cases where the ignore option is used with a string (#403, #404).

The public interface of this package does not support a string as the value for the ignore option since 2018 year (release).

So, in the next major release, we will reintroduce method implementations that do not involve strings in the ignore option.

3.3.0

Full Changelog: 3.2.12...3.3.0

🚀 Improvements

Method aliases

New methods (glob, globSync, globStream) have been added in addition to the current methods (default import, sync, stream), which eliminate the need to rename the method when importing. In addition, an async alias has been added for the default import, which makes it possible to use this packet with ESM.

Method to convert paths to globs

A new method (convertPathToPattern) has been added in this release to convert a path to a pattern. The primary goal is to enable users to avoid processing Windows paths in each location where this package is used by utilities from third-party packages.

See more details in the pull request.

🐛 Bug fixes

• In the past, we mishandled patterns that contained slashes when the baseNameMatch option was enabled, which went against the documented behavior. (#312)
• Several problems with matching patterns that contain brace expansion have been resolved. The primary issue solved is when the pattern has duplicate slashes after it is expanded (#394), or the micromatch package does not correctly generate a regular expression (#365).
• All negative patterns will now have the dot option enabled when matching paths. Previously, the !**/* patterns did not exclude hidden files (start with a dot). (#343)
• The issue that led to duplicates in the results when overlapping or duplicate patterns were present among the patterns has been fixed. At the moment, we are only talking about leading dot. Other cases are not included. For example, running with the patterns ['./file.md', 'file.md', '*'] will now only include file.md once in the results. (#190)

📖 Documentation

A clarifying note has been added for the concurrency option, which provides more detailed information about the Thread Pool utilization.

⚙️ Infrastructure

• The benchmark in CI is now running on Node.js 20.
• The benchmark now uses the public package bencho instead of an in-house implementation. You may want to try this solution for your packages and provide feedback.

🥇 New Contributors

• @josh-hemphill made their first contribution in #383
• @mairaw made their first contribution in #401

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ fill-range (indirect, 7.0.1 → 7.1.1) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ flatted (indirect, 3.2.4 → 3.3.2) · Repo

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ html-tags (indirect, 3.2.0 → 3.3.1) · Repo

Release Notes

3.3.1

• Add search HTML element to type definitions (#12) 273706f

v3.3.0...v3.3.1

3.3.0

• Add search tag (#11) 213622b

v3.2.0...v3.3.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ known-css-properties (indirect, 0.26.0 → 0.35.0) · Repo

Release Notes

0.35.0

Update properties #180

• Chrome 127
• Chrome 128
• Chrome 129
• Chrome 129 android
• Chrome 130
• Firefox 128
• Firefox 129
• Firefox 130
• Firefox 131
• Firefox 131 android
• Samsung internet 26.0
• Safari 16.6
• ios safari 17.6
• Safari 17.6
• w3c 2024/10/8

0.34.0

What's Changed

• add missing properties by @Mouvedia in #174

New Contributors

• @Mouvedia made their first contribution in #174

Full Changelog: v0.33.0...v0.34.0

0.32.0

What's Changed

• Chrome 125
• Chrome 125 android
• Firefox 126
• Firefox 126 android
• ios safari 17.5
• w3c 2024/06/13

Full Changelog: v0.31.0...v0.32.0

0.31.0

What's Changed

• Chrome 123
• Chrome 124
• Chrome android 124
• Firefox 123
• Firefox 124
• Firefox 125
• Firefox android 125
• Samsung internet 25.0
• ios safari 17.4
• w3c 2024/05/09

Full Changelog: v0.30.0...v0.31.0

0.30.0

Update properties

• Chrome 119
• Firefox 119
• Chrome 120
• Firefox 120
• Chrome 121
• Firefox 121
• Chrome 122
• Firefox 122
• Samsung internet 23.0
• ios safari 17.3
• Safari 17.1
• w3c 2024/02/07

0.29.0

Update properties

• Safari 16.5
• Safari 17.0
• ios safari 17.0
• Chrome 116
• Chrome 117
• Chrome android 117
• Chrome 118
• Firefox 114
• Firefox 116
• Firefox 117
• Firefox 118
• Firefox android 118
• W3C data 2023/10/15

Update dependencies

• Update dependency globby to v13.2.2 by @renovate in #158
• Update dependency eslint to v8.51.0 by @renovate in #155

Full Changelog: v0.28.0...v0.29.0

0.28.0

• Chrome 111
• Chrome 112
• Chrome 113
• Chrome 114
• Chrome 114
• Chrome 115
• Firefox 111
• Firefox 112
• Firefox 113
• Firefox 115
• Chrome android 113
• Chrome android 114
• Firefox mobile 115
• Safari 16.4
• Samsung internet 22.0
• W3C data 2023/07/20

0.27.0

New properties

• Chrome 108
• Chrome 109
• Chrome 110
• Chrome android 110
• Firefox 107
• Firefox 108
• Firefox 109
• Firefox 110
• Firefox mobile 110
• Opera mobile 73
• Samsung internet 19.0
• W3C data 2023/02/19

Full Changelog: v0.26.0...v0.27.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ meow (indirect, 9.0.0 → 13.2.0) · Repo

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ micromatch (indirect, 4.0.5 → 4.0.8) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDoS) in micromatch

The NPM package micromatch prior to version 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persisted prior to #266. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ ms (indirect, 2.1.2 → 2.1.3) · Repo

Release Notes

2.1.3

Patches

• Rename zeit to vercel: #151
• Bump eslint from 4.12.1 to 4.18.2: #122
• Add prettier as a dev dependency: #135 #153
• Use GitHub Actions CI: #154

Credits

Huge thanks to @getsnoopy for helping!

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nanoid (indirect, 3.3.4 → 3.3.8) · Repo · Changelog

Security Advisories 🚨

🚨 Predictable results in nanoid generation when given non-integer values

When nanoid is called with a fractional value, there were a number of undesirable effects:

1. in browser and non-secure, the code infinite loops on while (size--)
2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.

Release Notes

3.3.8 (from changelog)

• Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

3.3.6 (from changelog)

• Fixed package.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ picocolors (indirect, 1.0.0 → 1.1.1) · Repo · Changelog

Release Notes

1.1.1

What's new?

• Moved TypeScript declarations to a d.ts file #82
• Reworked color detection algorithm to properly work with empty strings in NO_COLOR and FORCE_COLOR env variables #87
• Eliminated require() call to make the package compatible with some tools #87

1.1.0

What's new?

• Added bright color variants #55

1.0.1

What's new?

• Updated color detection mechanism to work properly on Vercel Edge Runtime #64
• Remove use of recursion to avoid possible stack overflow for very long inputs #56

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ postcss-resolve-nested-selector (indirect, 0.1.1 → 0.1.6)

Sorry, we couldn't find anything useful about this release.

↗️ source-map-js (indirect, 1.0.2 → 1.2.1) · Repo · Changelog

Release Notes

1.2.1

• Fix TS2306 “not a module” errors in type definitions (#16) @andersk

• Ensure null source is respected (#26) @dragomirtitian

• Improve ts declarations to be null-safe (#27) @dragomirtitian

1.2.0

Allow to pass options to SourceMapGenerator using SourceMapGenerator.fromSourceMap as second argument

var generator = sourceMap.SourceMapGenerator.fromSourceMap(new SourceMapConsumer(), {
  ignoreInvalidMapping: true,
});

• Add generator options to fromSourceMap (#22) @ai

1.1.0

Add ignoreInvalidMapping option to SourceMapGenerator. If enabled, source-map-js will not throw an error on the incorrect previous source map. Instead, it will print warnings and ignore broken mappings.

var generator = new sourceMap.SourceMapGenerator({
  file: "my-generated-javascript-file.js",
  sourceRoot: "http://example.com/app/js/",
  ignoreInvalidMapping: true,
});

• Do not throw an error since broken prev map is popular issue #20 (#20) @ai
• Add ignoreInvalidMapping option (#21) @7rulnik

1.0.3

• Use sourceContents when non-null, even if it's an empty string (#17) @bshepherdson

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ supports-hyperlinks (indirect, 2.3.0 → 3.2.0) · Repo

Release Notes

3.1.0

• Add support for Windows Terminal (#8) e161d1d

v3.0.0...v3.1.0

3.0.0

Breaking

• Require Node.js 14

Improvements

• Add TypeScript types (#21) a2546da

v2.3.0...v3.0.0

Does any of this look wrong? Please let us know.

Sorry, we couldn't find anything useful about this release.

↗️ table (indirect, 6.8.1 → 6.9.0) · Repo

Release Notes

6.9.0

6.9.0 (2024-12-03)

Bug Fixes

• allow readonly array input for table data (#218) (8b85bc8)

Features

• add sideeffects to package.json (#226) (9d26738)

6.8.2

6.8.2 (2024-03-26)

Bug Fixes

• Generate larger tables more quickly (#224) (1a39e0c)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 @​csstools/css-parser-algorithms (added, 3.0.4)

🆕 @​csstools/css-tokenizer (added, 3.0.3)

🆕 @​csstools/media-query-list-parser (added, 4.0.2)

🆕 @​dual-bundle/import-meta-resolve (added, 4.1.0)

🆕 @​keyv/serialize (added, 1.0.2)

🆕 base64-js (added, 1.5.1)

🆕 buffer (added, 6.0.3)

🆕 cacheable (added, 1.8.8)

🆕 fast-uri (added, 3.0.6)

🆕 hookified (added, 1.7.0)

🆕 ieee754 (added, 1.2.1)

🗑️ @​types/minimist (removed)

🗑️ @​types/normalize-package-data (removed)

🗑️ @​types/parse-json (removed)

🗑️ camelcase-keys (removed)

🗑️ hard-rejection (removed)

🗑️ map-obj (removed)

🗑️ min-indent (removed)

🗑️ minimist-options (removed)

🗑️ quick-lru (removed)

🗑️ read-pkg-up (removed)

🗑️ redent (removed)

🗑️ strip-indent (removed)

🗑️ trim-newlines (removed)

🗑️ v8-compile-cache (removed)

🗑️ yargs-parser (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 020d91a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[socket-security]

New, updated, and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/[email protected] 🔁 npm/[email protected]	None	+3	405 kB	ai
npm/[email protected] 🔁 npm/[email protected]	Transitive: eval, unsafe	+89	7.37 MB	hudochenkov, jeddy3, mattxwang, ...4 more

View full report↗︎