Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Upgrade: , , acorn, astring, data-uri-to-buffer, dotenv, glob-stream, preact, reflect-metadata, ws #2

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk] Upgrade: , , acorn, astring, data-uri-to-buffer, dotenv, glob-stream, preact, reflect-metadata, ws #2

wants to merge 1 commit into from

Conversation

organich
Copy link
Owner

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name Versions Released on

@jridgewell/trace-mapping
from 0.3.22 to 0.3.25 | 3 versions ahead of your current version | 6 months ago
on 2024-03-02
@jridgewell/gen-mapping
from 0.3.3 to 0.3.5 | 2 versions ahead of your current version | 6 months ago
on 2024-03-01
acorn
from 8.11.3 to 8.12.1 | 2 versions ahead of your current version | 2 months ago
on 2024-07-03
astring
from 1.8.6 to 1.9.0 | 1 version ahead of your current version | 21 days ago
on 2024-08-25
data-uri-to-buffer
from 6.0.1 to 6.0.2 | 1 version ahead of your current version | 7 months ago
on 2024-02-12
dotenv
from 16.4.1 to 16.4.5 | 4 versions ahead of your current version | 7 months ago
on 2024-02-20
glob-stream
from 8.0.0 to 8.0.2 | 2 versions ahead of your current version | 5 months ago
on 2024-04-08
preact
from 10.19.3 to 10.23.2 | 13 versions ahead of your current version | a month ago
on 2024-08-12
reflect-metadata
from 0.2.1 to 0.2.2 | 1 version ahead of your current version | 6 months ago
on 2024-03-29
ws
from 8.17.1 to 8.18.0 | 1 version ahead of your current version | 2 months ago
on 2024-07-03

Release notes
Package name: @jridgewell/trace-mapping from @jridgewell/trace-mapping GitHub release notes
Package name: @jridgewell/gen-mapping from @jridgewell/gen-mapping GitHub release notes
Package name: acorn
  • 8.12.1 - 2024-07-03

    Bug fixes

    Fix a regression that caused Acorn to no longer run on Node versions <8.10.

  • 8.12.0 - 2024-06-14

    New features

    Support ES2025 duplicate capture group names in regular expressions.

    Bug fixes

    Include VariableDeclarator in the AnyNode type so that walker objects can refer to it without getting a type error.

    Properly raise a parse error for invalid for/of statements using async as binding name.

    Properly recognize "use strict" when preceded by a string with an escaped newline.

    Mark the Parser constructor as protected, not private, so plugins can extend it without type errors.

    Fix a bug where some invalid delete expressions were let through when the operand was parenthesized and preserveParens was enabled.

    Properly normalize line endings in raw strings of invalid template tokens.

    Properly track line numbers for escaped newlines in strings.

    Fix a bug that broke line number accounting after a template literal with invalid escape sequences.

  • 8.11.3 - 2023-12-29

    Bug fixes

    Add Function and Class to the AggregateType type, so that they can be used in walkers without raising a type error.

    Make sure onToken get an import keyword token when parsing import.meta.

    Fix a bug where .loc.start could be undefined for new.target meta nodes.

from acorn GitHub release notes
Package name: astring from astring GitHub release notes
Package name: data-uri-to-buffer
  • 6.0.2 - 2024-02-12
  • 6.0.1 - 2023-09-30
from data-uri-to-buffer GitHub release notes
Package name: dotenv from dotenv GitHub release notes
Package name: glob-stream
  • 8.0.2 - 2024-04-08

    Bug Fixes

    • Avoid blowing the call stack when processing many files (#133) (bb21c9d)
    • Avoid following circular symlinks (#126) (cf8b197)
    • Only traverse directories that can match the glob base (#131) (8e74e21)
  • 8.0.1 - 2024-03-25

    Bug Fixes

    • Avoid pushing additional paths to queue when error occurs (#124) (8eaab85)
    • Traverse symlink folders (#122) (d49d9bd)
  • 8.0.0 - 2023-04-23

    ⚠ BREAKING CHANGES

    • Switch to streamx (#119)
    • Combine GlobStream & GlobReadable into unified API
    • Replace glob with anymatch & custom directory walk (#118)
    • Drop support for ordered globs (#115)

    Features

    • Combine GlobStream & GlobReadable into unified API (6aad264)
    • Replace glob with anymatch & custom directory walk (#118) (6aad264)
    • Switch to streamx (#119) (8d6b35c)

    Bug Fixes

    • Normalize cwd on windows (8d6b35c)
    • Properly handle glob-like characters in paths (#117) (872a957)
    • Resolve cwd to support relative cwd paths (8d6b35c)

    Miscellaneous Chores

from glob-stream GitHub release notes
Package name: preact from preact GitHub release notes
Package name: reflect-metadata from reflect-metadata GitHub release notes
Package name: ws
  • 8.18.0 - 2024-07-03

    Features

    • Added support for Blob (#2229).
  • 8.17.1 - 2024-06-16

    Bug fixes

    • Fixed a DoS vulnerability (#2231).

    A request with a number of headers exceeding theserver.maxHeadersCount
    threshold could be used to crash a ws server.

    const http = require('http');
    const WebSocket = require('ws');

    const wss = new WebSocket.Server({ port: 0 }, function () {
    const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
    const headers = {};
    let count = 0;

    for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break;

    <span class="pl-k">for</span> <span class="pl-kos">(</span><span class="pl-k">let</span> <span class="pl-s1">j</span> <span class="pl-c1">=</span> <span class="pl-c1">0</span><span class="pl-kos">;</span> <span class="pl-s1">j</span> <span class="pl-c1">&lt;</span> <span class="pl-s1">chars</span><span class="pl-kos">.</span><span class="pl-c1">length</span><span class="pl-kos">;</span> <span class="pl-s1">j</span><span class="pl-c1">++</span><span class="pl-kos">)</span> <span class="pl-kos">{</span>
  <span class="pl-k">const</span> <span class="pl-s1">key</span> <span class="pl-c1">=</span> <span class="pl-s1">chars</span><span class="pl-kos">[</span><span class="pl-s1">i</span><span class="pl-kos">]</span> <span class="pl-c1">+</span> <span class="pl-s1">chars</span><span class="pl-kos">[</span><span class="pl-s1">j</span><span class="pl-kos">]</span><span class="pl-kos">;</span>
  <span class="pl-s1">headers</span><span class="pl-kos">[</span><span class="pl-s1">key</span><span class="pl-kos">]</span> <span class="pl-c1">=</span> <span class="pl-s">'x'</span><span class="pl-kos">;</span>

  <span class="pl-k">if</span> <span class="pl-kos">(</span><span class="pl-c1">++</span><span class="pl-s1">count</span> <span class="pl-c1">===</span> <span class="pl-c1">2000</span><span class="pl-kos">)</span> <span class="pl-k">break</span><span class="pl-kos">;</span>
<span class="pl-kos">}</span>

    }

    headers.Connection = 'Upgrade';
    headers.Upgrade = 'websocket';
    headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ=='<span class="p...

@snyk-bot
fix: upgrade multiple dependencies with Snyk
cbbe252 
Snyk has created this PR to upgrade:
  - @jridgewell/trace-mapping from 0.3.22 to 0.3.25.
    See this package in npm: https://www.npmjs.com/package/@jridgewell/trace-mapping
  - @jridgewell/gen-mapping from 0.3.3 to 0.3.5.
    See this package in npm: https://www.npmjs.com/package/@jridgewell/gen-mapping
  - acorn from 8.11.3 to 8.12.1.
    See this package in npm: https://www.npmjs.com/package/acorn
  - astring from 1.8.6 to 1.9.0.
    See this package in npm: https://www.npmjs.com/package/astring
  - data-uri-to-buffer from 6.0.1 to 6.0.2.
    See this package in npm: https://www.npmjs.com/package/data-uri-to-buffer
  - dotenv from 16.4.1 to 16.4.5.
    See this package in npm: https://www.npmjs.com/package/dotenv
  - glob-stream from 8.0.0 to 8.0.2.
    See this package in npm: https://www.npmjs.com/package/glob-stream
  - preact from 10.19.3 to 10.23.2.
    See this package in npm: https://www.npmjs.com/package/preact
  - reflect-metadata from 0.2.1 to 0.2.2.
    See this package in npm: https://www.npmjs.com/package/reflect-metadata
  - ws from 8.17.1 to 8.18.0.
    See this package in npm: https://www.npmjs.com/package/ws

See this project in Snyk:
https://app.snyk.io/org/organich/project/92930878-01dd-4ea8-a902-57c4539fd95c?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@organich @snyk-bot