Bump the npm_and_yarn group across 1 directory with 8 updates #534

dependabot · 2024-06-20T07:22:22Z

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package	From	To
pdfjs-dist	`3.9.179`	`4.2.67`
socket.io-client	`2.5.0`	`4.7.5`
tinymce	`5.10.9`	`7.2.0`
@dashersw/node-discover	`1.0.5`	`1.0.6`
braces	`3.0.2`	`3.0.3`
ws	`7.5.9`	`8.17.1`
engine.io	`3.6.1`	`3.6.2`
tar	`6.1.15`	`6.2.1`

Updates pdfjs-dist from 3.9.179 to 4.2.67

Commits

See full diff in compare view

Updates socket.io-client from 2.5.0 to 4.7.5

Release notes

Sourced from socket.io-client's releases.

4.7.5

Bug Fixes

discard acknowledgements upon disconnection (34cbfbb)

Links

Diff: socketio/socket.io-client@4.7.4...4.7.5

Server release: 4.7.5

engine.io-client@~6.5.2 (no change)

ws@~8.11.0 (no change)

4.7.4

There were some minor bug fixes on the server side, which mandate a client bump.

Links

Diff: socketio/socket.io-client@4.7.3...4.7.4

Server release: 4.7.4

engine.io-client@~6.5.2 (no change)

ws@~8.11.0 (no change)

4.7.3

Bug Fixes

improve compatibility with node16 module resolution (#1595) (605de78)

typings: accept string | undefined as init argument (5a3eafe)

typings: fix the type of the socket#id attribute (f9c16f2)

Links

Diff: socketio/socket.io-client@4.7.2...4.7.3

Server release: 4.7.3

engine.io-client@~6.5.2 (no change)

ws@~8.11.0 (no change)

4.7.2

Some bug fixes are included from the engine.io-client package:

webtransport: add proper framing (d55c39e)

webtransport: honor the binaryType attribute (8270e00)

Links

Diff: socketio/socket.io-client@4.7.1...4.7.2

Server release: 4.7.2

engine.io-client@~6.5.2 (diff)

ws@~8.11.0 (no change)

4.7.1

... (truncated)

Changelog

Sourced from socket.io-client's changelog.

4.7.5 (2024-03-14)

Bug Fixes

discard acknowledgements upon disconnection (34cbfbb)

Dependencies

engine.io-client@~6.5.2 (no change)

ws@~8.11.0 (no change)

4.7.4 (2024-01-12)

There were some minor bug fixes on the server side, which mandate a client bump.

Dependencies

engine.io-client@~6.5.2 (no change)

ws@~8.11.0 (no change)

4.7.3 (2024-01-03)

Bug Fixes

improve compatibility with node16 module resolution (#1595) (605de78)

typings: accept string | undefined as init argument (5a3eafe)

typings: fix the type of the socket#id attribute (f9c16f2)

Dependencies

engine.io-client@~6.5.2 (no change)

ws@~8.11.0 (no change)

4.7.2 (2023-08-02)

Some bug fixes are included from the engine.io-client package:

webtransport: add proper framing (d55c39e)

webtransport: honor the binaryType attribute (8270e00)

... (truncated)

Commits

4f6030f chore(release): 4.7.5
34cbfbb fix: discard acknowledgements upon disconnection
8cfea8c chore(release): 4.7.4
ca5d50e chore(release): 4.7.3
f9c16f2 fix(typings): fix the type of the socket#id attribute
b3f0cab ci: add Node.js 20 in the test matrix
5a3eafe fix(typings): accept string | undefined as init argument
605de78 fix: improve compatibility with node16 module resolution (#1595)
d00ccd2 ci: bump appiumVersion for Android tests in SauceLabs
928d76d chore(release): 4.7.2
Additional commits viewable in compare view

Updates tinymce from 5.10.9 to 7.2.0

Changelog

Sourced from tinymce's changelog.

7.2.0 - 2024-06-19

Added

Added options.debug API that logs the initial raw editor options to console. #TINY-10605

Added referrerpolicy as a valid attribute for an iframe element. #TINY-10374

New onInit and stretched properties to the HtmlPanel dialog component. #TINY-10900

Added support for querying the state of the mceTogglePlainTextPaste command. #TINY-10938

Added for option to dialog label components to improve accessibility. The value must be another component on the same dialog. #TINY-10971

Improved

Dialog slider components now emit an onChange event when using arrow keys. #TINY-10428

Accessibility for element path buttons, added tooltip to describe the button and removed incorrect aria-level attribute. #TINY-10891

Improve merging of inserted inline elements by removing nodes with redundant inheritable styles. #TINY-10869

Improved Find & Replace dialog accessibility by changing placeholders to labels. #TINY-10871

Changed

Replaced tiny branding logo with Build with TinyMCE text and logo. #TINY-11001

Fixed

Deleting in a div with preceeding br elements would sometimes throw errors. #TINY-10840

autoresize_bottom_margin was not reliably applied in some situations. #TINY-10793

Fixed cases where adding a newline around a br, table or img would not move the cursor to a new line. #TINY-10384

Focusing on contenteditable="true" element when using editable_root: false and inline mode causing selection to be shifted. #TINY-10820

Corrected the role attribute on listbox dialog components to combobox when there are no nested menu items. #TINY-10807

HTML entities that were double decoded in noscript elements caused an XSS vulnerability. #TINY-11019

It was possible to inject XSS HTML that was not matching the regexp when using the noneditable_regexp option. #TINY-11022

7.1.2 - 2024-06-05

Fixed

CSS color values set to transparent were incorrectly converted to '#000000`. #TINY-10916

7.1.1 - 2024-05-22

Fixed

Insert/Edit image dialog lost focus after the image upload completed. #TINY-10885

Deleting into a list from a paragraph that has an img tag could cause extra inline styles to be added. #TINY-10892

Resolved an issue where emojis configured with the emojiimages database were not loading correctly due to a broken CDN. #TINY-10878

Iframes in dialogs were not rendering rounded borders correctly. #TINY-10901

Autocompleter possible values are no longer capped at a length of 10. #TINY-10942

7.1.0 - 2024-05-08

Added

Parser support for math elements. #TINY-10809

New math-equation icon. #TINY-10804

Improved

Included itemprop, itemscope and itemtype as valid HTML5 attributes in the core schema. #TINY-9932

Notification accessibility improvements: added tooltips, keyboard navigation and shortcut to focus on notifications. #TINY-6925

... (truncated)

Commits

754e390 TINY-10860: Prepare for 7.2 release (#9715)
a9fb858 TINY-11019 & TINY-11022: Fixed issues with noscript encoding and noneditable_...
3fae00c TINY-10807: Use role="combobox" for flat ListBox components (#9665)
e7ef3b6 TINY-10871: replace placeholders with labels in Find & Replace dialog (#9689)
6ce11b6 TINY-10936: Merge release to main (#9685)
5fa376a TINY-11001: Replaced tiny branding logo (#9683)
c42efc2 TINY-10938: Added query command for paste as plaintext status. (#9651)
70cff12 TINY-10971: introduce optional label for property (#9681)
054671e TINY-10891: Add tooltips to element path (#9676)
465fbbe TINY-10869: Improve merging inserted nested inline elements (#9658)
Additional commits viewable in compare view

Updates @dashersw/node-discover from 1.0.5 to 1.0.6

Commits

See full diff in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates ws from 7.5.9 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.
const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits

3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
934c9d6 [ci] Test on node 22
1817bac [ci] Do not test on node 21
96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
Additional commits viewable in compare view

Updates engine.io from 3.6.1 to 3.6.2

Release notes

Sourced from engine.io's releases.

3.6.2

This release contains a bump of the ws dependency, which includes an important security fix.

Advisory: GHSA-3h5v-q93c-6h6q

Links

Diff: socketio/engine.io@3.6.1...3.6.2

Client release: -

ws@~7.5.10 (diff)

Changelog

Sourced from engine.io's changelog.

3.6.2 (2024-06-18)

This release contains a bump of the ws dependency, which includes an important security fix.

Advisory: GHSA-3h5v-q93c-6h6q

Dependencies

ws@~7.5.10 (diff)

6.5.4 (2023-11-09)

This release contains some minor changes which should improve the memory usage of the server, notably this.

Dependencies

ws@~8.11.0 (no change)

6.5.3 (2023-10-06)

Bug Fixes

improve compatibility with node16 module resolution (#689) (c6bf8c0)

webtransport: properly handle abruptly closed connections (ff1c861)

Dependencies

ws@~8.11.0 (no change)

6.5.2 (2023-08-01)

Bug Fixes

webtransport: add proper framing (a306db0)

Dependencies

ws@~8.11.0 (no change)

... (truncated)

Commits

b5e5b05 chore(release): 3.6.2
682d771 chore: bump ws to version 7.5.10
See full diff in compare view

Updates tar from 6.1.15 to 6.2.1

Changelog

Sourced from tar's changelog.

Changelog

7.4

Deprecate onentry in favor of onReadEntry for clarity.

7.3

Add onWriteEntry option

7.2

DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

Update minipass to v7.1.0

Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

Rewrite in TypeScript, provide ESM and CommonJS hybrid interface

Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.

Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.

Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

6.2

Add support for brotli compression

Add maxDepth option to prevent extraction into excessively deep folders.

6.1

remove dead link to benchmarks (#313) (@yetzt)

add examples/explanation of using tar.t (@isaacs)

ensure close event is emited after stream has ended (@webark)

... (truncated)

Commits

bef7b1e 6.2.1
fe8cd57 prevent extraction in excessively deep subfolders
fe7ebfd remove security.md
5bc9d40 6.2.0
fe1ef5e changelog 6.2
e483220 get rid of npm lint stuff
689928a ci that works outside of npm org
db6f539 file inference improvements for .tbr and .tgz
336fa8f refactor: dry and other pr comments
eeba222 chore: lint fixes
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [pdfjs-dist](https://github.com/mozilla/pdfjs-dist) | `3.9.179` | `4.2.67` | | [socket.io-client](https://github.com/socketio/socket.io-client) | `2.5.0` | `4.7.5` | | [tinymce](https://github.com/tinymce/tinymce/tree/HEAD/modules/tinymce) | `5.10.9` | `7.2.0` | | [@dashersw/node-discover](https://github.com/wankdanker/node-discover) | `1.0.5` | `1.0.6` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [ws](https://github.com/websockets/ws) | `7.5.9` | `8.17.1` | | [engine.io](https://github.com/socketio/engine.io) | `3.6.1` | `3.6.2` | | [tar](https://github.com/isaacs/node-tar) | `6.1.15` | `6.2.1` | Updates `pdfjs-dist` from 3.9.179 to 4.2.67 - [Commits](https://github.com/mozilla/pdfjs-dist/commits) Updates `socket.io-client` from 2.5.0 to 4.7.5 - [Release notes](https://github.com/socketio/socket.io-client/releases) - [Changelog](https://github.com/socketio/socket.io-client/blob/main/CHANGELOG.md) - [Commits](socketio/socket.io-client@2.5.0...4.7.5) Updates `tinymce` from 5.10.9 to 7.2.0 - [Changelog](https://github.com/tinymce/tinymce/blob/main/modules/tinymce/CHANGELOG.md) - [Commits](https://github.com/tinymce/tinymce/commits/7.2.0/modules/tinymce) Updates `@dashersw/node-discover` from 1.0.5 to 1.0.6 - [Commits](https://github.com/wankdanker/node-discover/commits) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `ws` from 7.5.9 to 8.17.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.5.9...8.17.1) Updates `engine.io` from 3.6.1 to 3.6.2 - [Release notes](https://github.com/socketio/engine.io/releases) - [Changelog](https://github.com/socketio/engine.io/blob/main/CHANGELOG.md) - [Commits](socketio/engine.io@3.6.1...3.6.2) Updates `tar` from 6.1.15 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.1.15...v6.2.1) --- updated-dependencies: - dependency-name: pdfjs-dist dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: socket.io-client dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: tinymce dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: "@dashersw/node-discover" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: engine.io dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2024-06-20T09:39:46Z

Superseded by #536.

dependabot bot added the dependencies Pull requests that update a dependency file label Jun 20, 2024

dependabot bot closed this Jun 20, 2024

dependabot bot deleted the dependabot/npm_and_yarn/npm_and_yarn-b2cd9c061d branch June 20, 2024 09:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 8 updates #534

Bump the npm_and_yarn group across 1 directory with 8 updates #534

dependabot bot commented on behalf of github Jun 20, 2024 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Jun 20, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Bump the npm_and_yarn group across 1 directory with 8 updates #534

Bump the npm_and_yarn group across 1 directory with 8 updates #534

Conversation

dependabot bot commented on behalf of github Jun 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

4.7.5

Bug Fixes

Links

4.7.4

Links

4.7.3

Bug Fixes

Links

4.7.2

Links

4.7.1

4.7.5 (2024-03-14)

Bug Fixes

Dependencies

4.7.4 (2024-01-12)

Dependencies

4.7.3 (2024-01-03)

Bug Fixes

Dependencies

4.7.2 (2023-08-02)

7.2.0 - 2024-06-19

Added

Improved

Changed

Fixed

7.1.2 - 2024-06-05

Fixed

7.1.1 - 2024-05-22

Fixed

7.1.0 - 2024-05-08

Added

Improved

8.17.1

Bug fixes

3.6.2

Links

3.6.2 (2024-06-18)

Dependencies

6.5.4 (2023-11-09)

Dependencies

6.5.3 (2023-10-06)

Bug Fixes

Dependencies

6.5.2 (2023-08-01)

Bug Fixes

Dependencies

Changelog

7.4

7.3

7.2

7.1

7.0

6.2

6.1

Uh oh!

dependabot bot commented on behalf of github Jun 20, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Jun 20, 2024 •

edited

Loading