Skip to content

build(deps): bump the npm_and_yarn group across 1 directory with 9 updates#1

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-security-group-d08b90a05d
Open

build(deps): bump the npm_and_yarn group across 1 directory with 9 updates#1
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-security-group-d08b90a05d

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Mar 15, 2024

Bumps the npm_and_yarn group with 7 updates in the / directory:

Package From To
debug 2.6.9 4.3.4
hardhat 2.3.3 2.22.1
mocha 7.2.0 10.3.0
follow-redirects 1.14.1 1.15.6
semver 5.7.1 5.7.2
minimatch 3.0.4 3.1.2
minimist 1.2.5 1.2.8

Updates debug from 2.6.9 to 4.3.4

Release notes

Sourced from debug's releases.

4.3.4

What's Changed

New Contributors

Full Changelog: debug-js/debug@4.3.3...4.3.4

4.3.3

Patch Release 4.3.3

This is a documentation-only release. Further, the repository was transferred. Please see notes below.

Thank you to @​taylor1791 and @​kristofkalocsai for their contributions.

Repository Migration Information

I've formatted this as a FAQ, please feel free to open an issue for any additional question and I'll add the response here.

Q: What impact will this have on me?

In most cases, you shouldn't notice any change.

The only exception I can think of is if you pull code directly from https://github.com/visionmedia/debug, e.g. via a "debug": "visionmedia/debug"-type version entry in your package.json - in which case, you should still be fine due to the automatic redirection Github sets up, but you should also update any references as soon as possible.

Q: What are the security implications of this change?

If you pull code directly from the old URL, you should update the URL to https://github.com/debug-js/debug as soon as possible. The old organization has many approved owners and thus a new repository could (in theory) be created at the old URL, circumventing Github's automatic redirect that is in place now and serving malicious code. I (@​qix-) also wouldn't have access to that repository, so while I don't think it would happen, it's still something to consider.

Even in such a case, however, the officially released package on npm (debug) would not be affected. That package is still very much under control (even more than it used to be).

Q: What should I do if I encounter an issue related to the migration?

Search the issues first to see if someone has already reported it, and then open a new issue if someone has not.

Q: Why was this done as a 'patch' release? Isn't this breaking?

No, it shouldn't be breaking. The package on npm shouldn't be affected (aside from this patch release) and any references to the old repository should automatically redirect.

Thus, according to all of the "APIs" (loosely put) involved, nothing should have broken.

... (truncated)

Commits
  • da66c86 4.3.4
  • 9b33412 replace deprecated String.prototype.substr() (#876)
  • c0805cc add section about configuring JS console to show debug messages (#866)
  • 043d3cd 4.3.3
  • 4079aae update license and more maintainership information
  • 19b36c0 update repository location + maintainership information
  • f851b00 adds README section regarding usage in child procs (#850)
  • d177f2b Remove accidental epizeuxis
  • e47f96d 4.3.2
  • 1e9d38c cache enabled status per-logger (#799)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by qix, a new releaser for debug since your current version.


Updates hardhat from 2.3.3 to 2.22.1

Release notes

Sourced from hardhat's releases.

Hardhat v2.22.1

This release updates the starter projects available through hardhat init to include Hardhat Ignition as the default deployment system.

Hardhat v2.22.0

This release sets Cancun as the default hardfork used by the Hardhat Network.

Hardhat v2.21.0 — Introducing EDR

This version of Hardhat marks the debut of EDR (Ethereum Development Runtime), our new Rust-based runtime that is a complete rewrite of the original TypeScript-based Hardhat Network. This release lays a new long-term foundation for Hardhat's evolution over the coming year.

There are no functional changes, but there are some performance improvements across the board, which we’ll continue to expand in future updates.

Given the significance of this internal change, there’s a possibility of bugs. If you encounter any problems specific to this version, please report them by opening an issue. You should be able to downgrade to v2.20.1 without losing functionality if needed.

solidity-coverage out-of-memory issues

The solidity-coverage plugin works by heavily instrumenting the code, which sometimes causes OOM (out-of-memory) issues. This new version of Hardhat can, in certain cases, make those problems more likely.

If you run into this, you can fix it by using Node.js’s --max-old-space-size flag:

NODE_OPTIONS="--max-old-space-size=8192" npx hardhat coverage

Dropping support for Node.js v16

As part of this release, we are dropping support for Node.js v16. This version of Node.js reached its end-of-life in September of last year. You can learn more about our support guarantees here.

Hardhat v2.20.1

This release fixes a bug when hardhat_setStorageAt was used in untouched addresses.

Hardhat v2.20.0 — Cancun

This release adds support for the upcoming cancun hardfork. This hardfork is not enabled by default; if you want to use it, then you have to enable it in your Hardhat config:

module.exports = {
  networks: {
    hardhat: {
      hardfork: "cancun",
    },
  },
}

Keep in mind that blob transactions are not supported yet. If you need this, please upvote or comment on this issue.

In addition, this release adds support for solc 0.8.24.

Hardhat v2.19.5

This release includes the following changes:

  • Notify users when a new Hardhat version is available

... (truncated)

Commits
  • a3ada90 Version Packages
  • 3ee20fc chore: bump edr version to 0.3.1
  • 0f0f470 test: fix assert.isDefined issue
  • 6694140 chore: loosen typescript peer dep for viem toolbox
  • 49f4ffe chore: bump the version of Ignition in toolboxes
  • 90c3f41 Add default tab for new combination
  • ac43eec remove ignition-core as peer dep
  • 4da8ba6 update boilerplate docs
  • 137ee9a docs: revert the change to project setup
  • 779c167 docs: clarify module file in deploying guide
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by kanej, a new releaser for hardhat since your current version.


Updates mocha from 7.2.0 to 10.3.0

Release notes

Sourced from mocha's releases.

v10.3.0

This is a stable release equivalent to v10.3.0-preminor.0.

What's Changed

New Contributors

Full Changelog: mochajs/mocha@v10.2.0...v10.3.0

v10.3.0-preminor.0

A test release tagged with next on npm, to test that we can do releases at all. See #5081 for context.

What's Changed

... (truncated)

Changelog

Sourced from mocha's changelog.

10.3.0 / 2024-02-08

This is a stable release equivalent to 10.30.0-prerelease.

10.3.0-prerelease / 2024-01-18

This is a prerelease version to test our ability to release. Other than removing or updating dependencies, it contains no intended user-facing changes.

🔩 Other

10.2.0 / 2022-12-11

🎉 Enhancements

  • #4945: API: add possibility to decorate ESM name before import (@​j0tunn)

🐛 Fixes

📖 Documentation

10.1.0 / 2022-10-16

🎉 Enhancements

🔩 Other

... (truncated)

Commits
  • a886829 chore: fix link in pull request template (#5091)
  • 53a4baf chore: remove unnecessary canvas dependency (#5069)
  • 1ebff45 chore: inline nyan reporter's write function (#5056)
  • 8812413 fix: add alt text to Built with Netlify badge (#5068)
  • 645469e docs: touchups to labels and a template title post-revamp (#5050)
  • 9f99178 docs: overhaul contributing and maintenance docs for end-of-year 2023 (#5038)
  • eca4fec docs: fix return jsdoc type of titlePath (#4886)
  • 060f77d docs: use mocha.js instead of mocha in the example run (#4927)
  • 4b60c1a docs: fix fragment ID for yargs.js extends docs (#4918)
  • b41e985 chore: remove stale workflow (#5029)
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by joshuakgoldberg, a new releaser for mocha since your current version.


Updates ansi-regex from 3.0.0 to 5.0.1

Release notes

Sourced from ansi-regex's releases.

v5.0.1

Fixes (backport of 6.0.1 to v5)

This is a backport of the minor ReDos vulnerability in ansi-regex@<6.0.1, as requested in #38.

  • Fix ReDoS in certain cases (#37) You are only really affected if you run the regex on untrusted user input in a server context, which it's very unlikely anyone is doing, since this regex is mainly used in command-line tools.

CVE-2021-3807

https://github.com/chalk/ansi-regex/compare/v5.0.0..v5.0.1

Thank you @​yetingli for the patch and reproduction case!

v5.0.0

Breaking

  • Require Node.js 8 166a0d5

Enhancements

  • Add TypeScript definition (#32) e77ea17

chalk/ansi-regex@v4.1.0...v5.0.0

v4.1.0

  • Support more escape code like links (#29) 96200bb

chalk/ansi-regex@v4.0.0...v4.1.0

Commits

Updates flat from 4.1.1 to 5.0.2

Commits
  • e5ffd66 Release 5.0.2
  • fdb79d5 Update dependencies, refresh lockfile, format with standard.
  • e52185d Test against node 14 in CI.
  • 0189cb1 Avoid arrow function syntax.
  • f25d3a1 Release 5.0.1
  • 54cc7ad use standard formatting
  • 779816e drop dependencies
  • 2eea6d3 Bump lodash from 4.17.15 to 4.17.19
  • a61a554 Bump acorn from 7.1.0 to 7.4.0
  • 20ef0ef Fix prototype pollution on unflatten
  • Additional commits viewable in compare view

Updates follow-redirects from 1.14.1 to 1.15.6

Commits
  • 35a517c Release version 1.15.6 of the npm package.
  • c4f847f Drop Proxy-Authorization across hosts.
  • 8526b4a Use GitHub for disclosure.
  • b1677ce Release version 1.15.5 of the npm package.
  • d8914f7 Preserve fragment in responseUrl.
  • 6585820 Release version 1.15.4 of the npm package.
  • 7a6567e Disallow bracketed hostnames.
  • 05629af Prefer native URL instead of deprecated url.parse.
  • 1cba8e8 Prefer native URL instead of legacy url.resolve.
  • 72bc2a4 Simplify _processResponse error handling.
  • Additional commits viewable in compare view

Updates semver from 5.7.1 to 5.7.2

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

5.7

  • Add minVersion method

5.6

  • Move boolean loose param to an options object, with backwards-compatibility protection.
  • Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

  • Add version coercion capabilities

5.4

  • Add intersection checking

5.3

  • Add minSatisfying method

5.2

  • Add prerelease(v) that returns prerelease components

5.1

  • Add Backus-Naur for ranges
  • Remove excessively cute inspection methods

5.0

  • Remove AMD/Browserified build artifacts
  • Fix ltr and gtr when using the * range
  • Fix for range * with a prerelease identifier
Commits
Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.


Updates minimatch from 3.0.4 to 3.1.2

Commits

Updates minimist from 1.2.5 to 1.2.8

Changelog

Sourced from minimist's changelog.

v1.2.8 - 2023-02-09

Merged

Fixed

Commits

  • Merge tag 'v0.2.3' a026794
  • [eslint] fix indentation and whitespace 5368ca4
  • [eslint] fix indentation and whitespace e5f5067
  • [eslint] more cleanup 62fde7d
  • [eslint] more cleanup 36ac5d0
  • [meta] add auto-changelog 73923d2
  • [actions] add reusable workflows d80727d
  • [eslint] add eslint; rules to enable later are warnings 48bc06a
  • [eslint] fix indentation 34b0f1c
  • [readme] rename and add badges 5df0fe4
  • [Dev Deps] switch from covert to nyc a48b128
  • [Dev Deps] update covert, tape; remove unnecessary tap f0fb958
  • [meta] create FUNDING.yml; add funding in package.json 3639e0c
  • [meta] use npmignore to autogenerate an npmignore file be2e038
  • Only apps should have lockfiles 282b570
  • isConstructorOrProto adapted from PR ef9153f
  • [Dev Deps] update @ljharb/eslint-config, aud 098873c
  • [Dev Deps] update @ljharb/eslint-config, aud 3124ed3
  • [meta] add safe-publish-latest 4b927de
  • [Tests] add aud in posttest b32d9bd
  • [meta] update repo URLs f9fdfc0
  • [actions] Avoid 0.6 tests due to build failures ba92fe6
  • [Dev Deps] update tape 950eaa7
  • [Dev Deps] add missing npmignore dev dep 3226afa
  • Merge tag 'v0.2.2' 980d7ac

v1.2.7 - 2022-10-10

Commits

... (truncated)

Commits
  • 6901ee2 v1.2.8
  • a026794 Merge tag 'v0.2.3'
  • c0b2661 v0.2.3
  • 63b8fee [Fix] Fix long option followed by single dash (#17)
  • 72239e6 [Tests] Remove duplicate test (#12)
  • 34b0f1c [eslint] fix indentation
  • 3226afa [Dev Deps] add missing npmignore dev dep
  • 098873c [Dev Deps] update @ljharb/eslint-config, aud
  • 9ec4d27 [Fix] Fix long option followed by single dash
  • ba92fe6 [actions] Avoid 0.6 tests due to build failures
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for minimist since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump the npm_and_yarn group across 1 directory with 9 up…
ea21359 
…dates

Bumps the npm_and_yarn group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [debug](https://github.com/debug-js/debug) | `2.6.9` | `4.3.4` |
| [hardhat](https://github.com/nomiclabs/hardhat) | `2.3.3` | `2.22.1` |
| [mocha](https://github.com/mochajs/mocha) | `7.2.0` | `10.3.0` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.14.1` | `1.15.6` |
| [semver](https://github.com/npm/node-semver) | `5.7.1` | `5.7.2` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.0.4` | `3.1.2` |
| [minimist](https://github.com/minimistjs/minimist) | `1.2.5` | `1.2.8` |


Updates `debug` from 2.6.9 to 4.3.4
- [Release notes](https://github.com/debug-js/debug/releases)
- [Commits](debug-js/debug@2.6.9...4.3.4)

Updates `hardhat` from 2.3.3 to 2.22.1
- [Release notes](https://github.com/nomiclabs/hardhat/releases)
- [Commits](https://github.com/nomiclabs/hardhat/compare/hardhat-core-v2.3.3...hardhat@2.22.1)

Updates `mocha` from 7.2.0 to 10.3.0
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
- [Commits](mochajs/mocha@v7.2.0...v10.3.0)

Updates `ansi-regex` from 3.0.0 to 5.0.1
- [Release notes](https://github.com/chalk/ansi-regex/releases)
- [Commits](chalk/ansi-regex@v3.0.0...v5.0.1)

Updates `flat` from 4.1.1 to 5.0.2
- [Release notes](https://github.com/hughsk/flat/releases)
- [Commits](hughsk/flat@4.1.1...5.0.2)

Updates `follow-redirects` from 1.14.1 to 1.15.6
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.14.1...v1.15.6)

Updates `semver` from 5.7.1 to 5.7.2
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md)
- [Commits](npm/node-semver@v5.7.1...v5.7.2)

Updates `minimatch` from 3.0.4 to 3.1.2
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.0.4...v3.1.2)

Updates `minimist` from 1.2.5 to 1.2.8
- [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md)
- [Commits](minimistjs/minimist@v1.2.5...v1.2.8)

---
updated-dependencies:
- dependency-name: debug
  dependency-type: indirect
  dependency-group: npm_and_yarn-security-group
- dependency-name: hardhat
  dependency-type: direct:development
  dependency-group: npm_and_yarn-security-group
- dependency-name: mocha
  dependency-type: direct:development
  dependency-group: npm_and_yarn-security-group
- dependency-name: ansi-regex
  dependency-type: indirect
  dependency-group: npm_and_yarn-security-group
- dependency-name: flat
  dependency-type: indirect
  dependency-group: npm_and_yarn-security-group
- dependency-name: follow-redirects
  dependency-type: indirect
  dependency-group: npm_and_yarn-security-group
- dependency-name: semver
  dependency-type: indirect
  dependency-group: npm_and_yarn-security-group
- dependency-name: minimatch
  dependency-type: indirect
  dependency-group: npm_and_yarn-security-group
- dependency-name: minimist
  dependency-type: indirect
  dependency-group: npm_and_yarn-security-group
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Mar 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants