build(deps): bump the npm_and_yarn group across 6 directories with 5 updates #471

dependabot · 2024-05-30T20:52:20Z

Bumps the npm_and_yarn group with 1 update in the / directory: next.
Bumps the npm_and_yarn group with 1 update in the /docs.yonode.org directory: next.
Bumps the npm_and_yarn group with 2 updates in the /packages/yonode-templates/typescript/MySQL/Sequelize/NoAuth directory: semver and mysql2.
Bumps the npm_and_yarn group with 1 update in the /packages/yonode-templates/typescript/MySQL/TypeOrm/noAuth directory: mysql2.
Bumps the npm_and_yarn group with 1 update in the /packages/yonode-templates/typescript/PostgreSQL/TypeOrm/noAuth directory: mysql2.
Bumps the npm_and_yarn group with 1 update in the /yonode.org directory: next.

Updates next from 13.5.1 to 14.1.1

Commits

5f59ee5 v14.1.1
f48b90b even more
7f789f4 more timeout
ab71c4c update timeout
75f60d9 update trigger release workflow
74b3f0f Server Action tests (#62655)
a6946b6 Backport metadata fixes (#62663)
4002f4b Fix draft mode invariant (#62121)
7dbf6f8 fix: babel usage with next/image (#61835)
3efc842 Fix next/server apit push alias for ESM pkg (#61721)
Additional commits viewable in compare view

Updates postcss from 8.4.14 to 8.4.31

Release notes

Sourced from postcss's releases.

8.4.31

Fixed \r parsing to fix CVE-2023-44270.

8.4.30

Improved source map performance (by @romainmenke).

8.4.29

Fixed Node#source.offset (by @idoros).

Fixed docs (by @coliff).

8.4.28

Fixed Root.source.end for better source map (by @romainmenke).

Fixed Result.root types when process() has no parser.

8.4.27

Fixed Container clone methods types.

8.4.26

Fixed clone methods types.

8.4.25

Improve stringify performance (by @romainmenke).

Fixed docs (by @vikaskaliramna07).

8.4.24

Fixed Plugin types.

8.4.23

Fixed warnings in TypeDoc.

8.4.22

Fixed TypeScript support with node16 (by @remcohaszing).

8.4.21

Fixed Input#error types (by @hudochenkov).

8.4.20

Fixed source map generation for childless at-rules like @layer.

8.4.19

Fixed whitespace preserving after AST transformations (by @romainmenke).

8.4.18

Fixed an error on absolute: true with empty sourceContent (by @KingSora).

8.4.17

Fixed Node.before() unexpected behavior (by @romainmenke).

Added TOC to docs (by @muddv).

8.4.16

... (truncated)

Changelog

Sourced from postcss's changelog.

8.4.31

Fixed \r parsing to fix CVE-2023-44270.

8.4.30

Improved source map performance (by Romain Menke).

8.4.29

Fixed Node#source.offset (by Ido Rosenthal).

Fixed docs (by Christian Oliff).

8.4.28

Fixed Root.source.end for better source map (by Romain Menke).

Fixed Result.root types when process() has no parser.

8.4.27

Fixed Container clone methods types.

8.4.26

Fixed clone methods types.

8.4.25

Improve stringify performance (by Romain Menke).

Fixed docs (by @vikaskaliramna07).

8.4.24

Fixed Plugin types.

8.4.23

Fixed warnings in TypeDoc.

8.4.22

Fixed TypeScript support with node16 (by Remco Haszing).

8.4.21

Fixed Input#error types (by Aleks Hudochenkov).

8.4.20

Fixed source map generation for childless at-rules like @layer.

8.4.19

Fixed whitespace preserving after AST transformations (by Romain Menke).

8.4.18

Fixed an error on absolute: true with empty sourceContent (by Rene Haas).

8.4.17

Fixed Node.before() unexpected behavior (by Romain Menke).

Added TOC to docs (by Mikhail Dedov).

8.4.16

... (truncated)

Commits

90208de Release 8.4.31 version
58cc860 Fix carrier return parsing
4fff8e4 Improve pnpm test output
cd43ed1 Update dependencies
caa916b Update dependencies
8972f76 Typo
11a5286 Typo
45c5501 Release 8.4.30 version
bc3c341 Update linter
b2be58a Merge pull request #1881 from romainmenke/improve-sourcemap-performance--phil...
Additional commits viewable in compare view

Updates zod from 3.21.4 to 3.22.4

Release notes

Sourced from zod's releases.

v3.22.4

Commits:

d931ea3f0f15a6ae64f5f68e3c03912dffb2269d Lint

8e634bd600093b7161487bed705279c892395118 Fix prettier

4018d88f0e94992b2987428c4fda387b99ae2a53 docs: add @sanity-typed/zod to ecosystem (#2731)

15ba5a4d4cb5be5af23771de0ba1346b4ba20a0e docs: add zod-sandbox to README ecosystem links (#2707)

699ccae13b875d4fcadac268fd789c93b6ce8aef Export jsdoc with @deprecated when building (#2717)

dfe3719eae250ab3eca2d276da6c292867899cc6 Fix sanity-typed links (#2840)

cd7991e04a550868bfcb5b5d46e5eb5bc7edf5f3 fix ulid regex (#2225)

7cb4ba2f85dd6b28290dda5de80ed54dfd2a793c Remove stalebot

9340fd51e48576a75adc919bff65dbc4a5d4c99b Lazy emojiRegex

e7a9b9b3033991be6b4225f1be21da39c250bbb0 3.22.4

v3.22.3

Commits:

1e23990bcdd33d1e81b31e40e77a031fcfd87ce1 Commit

9bd3879b482f139fd03d5025813ee66a04195cdd docs: remove obsolete text about readonly types (#2676)

f59be093ec21430d9f32bbcb628d7e39116adf34 clarify datetime ISO 8601 (#2673)

64dcc8e2b16febe48fa8e3c82c47c92643e6c9e3 Update sponsors

18115a8f128680b4526df58ce96deab7dce93b93 Formatting

28c19273658b164c53c149785fa7a8187c428ad4 Update sponsors

ad2ee9ccf723c4388158ff6b8669c2a6cdc85643 2718 Updated Custom Schemas documentation example to use type narrowing (#2778)

ae0f7a2c15e7741ee1b23c03a3bfb9acebd86551 docs: update ref to discriminated-unions docs (#2485)

2ba00fe2377f4d53947a84b8cdb314a63bbd6dd4 [2609] fix ReDoS vulnerability in email regex (#2824)

1e61d76cdec05de9271fc0df58798ddf9ce94923 3.22.3

v3.22.2

Commits:

13d9e6bda286cbd4c1b177171273695d8309e5de Fix lint

0d49f10b3c25a8e4cbb6534cc0773b195c56d06d docs: add typeschema to ecosystem (#2626)

8e4af7b56df6f2e3daf0dd825b986f1d963025ce X to Zod: add app.quicktype.io (#2668)

792b3ef0d41c144cd10641c6966b98dae1222d82 Fix superrefine types

v3.22.1

Commits:

Fix handing of this in ZodFunction schemas. The parse logic for function schemas now requires the Reflect API.
const methodObject = z.object({
  property: z.number(),
  method: z.function().args(z.string()).returns(z.number()),
});
const methodInstance = {
  property: 3,
  method: function (s: string) {
    return s.length + this.property;
</tr></table> 

... (truncated)

Commits

e7a9b9b 3.22.4
9340fd5 Lazy emojiRegex
7cb4ba2 Remove stalebot
cd7991e fix ulid regex (#2225)
dfe3719 Fix sanity-typed links (#2840)
699ccae Export jsdoc with @deprecated when building (#2717)
15ba5a4 docs: add zod-sandbox to README ecosystem links (#2707)
4018d88 docs: add @sanity-typed/zod to ecosystem (#2731)
8e634bd Fix prettier
d931ea3 Lint
Additional commits viewable in compare view

Updates next from 13.0.6 to 14.1.1

Commits

5f59ee5 v14.1.1
f48b90b even more
7f789f4 more timeout
ab71c4c update timeout
75f60d9 update trigger release workflow
74b3f0f Server Action tests (#62655)
a6946b6 Backport metadata fixes (#62663)
4002f4b Fix draft mode invariant (#62121)
7dbf6f8 fix: babel usage with next/image (#61835)
3efc842 Fix next/server apit push alias for ESM pkg (#61721)
Additional commits viewable in compare view

Updates semver from 7.6.0 to 7.6.2

Release notes

Sourced from semver's releases.

v7.6.2

7.6.2 (2024-05-09)

Bug Fixes

6466ba9 #713 lru: use map.delete() directly (#713) (@negezor, @lukekarrys)

v7.6.1

7.6.1 (2024-05-04)

Bug Fixes

c570a34 #704 linting: no-unused-vars (@wraithgar)

ad8ff11 #704 use internal cache implementation (@mbtools)

ac9b357 #682 typo in compareBuild debug message (#682) (@mbtools)

Dependencies

988a8de #709 uninstall lru-cache (#709)

3fabe4d #704 remove lru-cache

Chores

dd09b60 #705 bump @npmcli/template-oss to 4.22.0 (@lukekarrys)

ec49cdc #701 chore: chore: postinstall for dependabot template-oss PR (@lukekarrys)

b236c3d #696 add benchmarks (#696) (@H4ad)

692451b #688 various improvements to README (#688) (@mbtools)

5feeb7f #705 postinstall for dependabot template-oss PR (@lukekarrys)

074156f #701 bump @npmcli/template-oss from 4.21.3 to 4.21.4 (@dependabot[bot])

Changelog

Sourced from semver's changelog.

7.6.2 (2024-05-09)

Bug Fixes

6466ba9 #713 lru: use map.delete() directly (#713) (@negezor, @lukekarrys)

7.6.1 (2024-05-04)

Bug Fixes

c570a34 #704 linting: no-unused-vars (@wraithgar)

ad8ff11 #704 use internal cache implementation (@mbtools)

ac9b357 #682 typo in compareBuild debug message (#682) (@mbtools)

Dependencies

988a8de #709 uninstall lru-cache (#709)

3fabe4d #704 remove lru-cache

Chores

dd09b60 #705 bump @npmcli/template-oss to 4.22.0 (@lukekarrys)

ec49cdc #701 chore: chore: postinstall for dependabot template-oss PR (@lukekarrys)

b236c3d #696 add benchmarks (#696) (@H4ad)

692451b #688 various improvements to README (#688) (@mbtools)

5feeb7f #705 postinstall for dependabot template-oss PR (@lukekarrys)

074156f #701 bump @npmcli/template-oss from 4.21.3 to 4.21.4 (@dependabot[bot])

Commits

eb1380b chore: release 7.6.2 (#714)
6466ba9 fix(lru): use map.delete() directly (#713)
d777418 chore: release 7.6.1 (#706)
988a8de deps: uninstall lru-cache (#709)
5feeb7f chore: postinstall for dependabot template-oss PR
dd09b60 chore: bump @npmcli/template-oss to 4.22.0
c570a34 fix(linting): no-unused-vars
ad8ff11 fix: use internal cache implementation
3fabe4d deps: remove lru-cache
ec49cdc chore: chore: chore: postinstall for dependabot template-oss PR
Additional commits viewable in compare view

Updates mysql2 from 3.9.7 to 3.9.8

Release notes

Sourced from mysql2's releases.

v3.9.8

3.9.8 (2024-05-26)

Bug Fixes

security: sanitize fields and tables when using nestTables (#2702) (efe3db5)

support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2704) (2e03694)

typings: typo from jonServerPublicKey to onServerPublicKey (#2699) (8b5f691)

Changelog

Sourced from mysql2's changelog.

3.9.8 (2024-05-26)

Bug Fixes

security: sanitize fields and tables when using nestTables (#2702) (efe3db5)

support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2704) (2e03694)

typings: typo from jonServerPublicKey to onServerPublicKey (#2699) (8b5f691)

Commits

f637d3f chore(master): release 3.9.8 (#2700)
efe3db5 fix(security): sanitize fields and tables when using nestTables (#2702)
2e03694 fix: support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2...
8b5f691 fix(typings): typo from jonServerPublicKey to onServerPublicKey (#2699)
5c75802 build(deps-dev): bump tsx from 4.10.5 to 4.11.0 in /website (#2695)
179769f build(deps): bump @easyops-cn/docusaurus-search-local in /website (#2696)
56289e2 build(deps-dev): bump poku from 1.12.1 to 1.13.0 (#2698)
b029308 build(deps-dev): bump poku from 1.12.1 to 1.13.0 in /website (#2697)
539acb8 build(deps): bump lucide-react from 0.378.0 to 0.379.0 in /website (#2693)
dc80580 build(deps-dev): bump @typescript-eslint/eslint-plugin from 7.9.0 to 7.10.0 i...
Additional commits viewable in compare view

Updates mysql2 from 3.9.7 to 3.9.8

Release notes

Sourced from mysql2's releases.

v3.9.8

3.9.8 (2024-05-26)

Bug Fixes

security: sanitize fields and tables when using nestTables (#2702) (efe3db5)

support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2704) (2e03694)

typings: typo from jonServerPublicKey to onServerPublicKey (#2699) (8b5f691)

Changelog

Sourced from mysql2's changelog.

3.9.8 (2024-05-26)

Bug Fixes

security: sanitize fields and tables when using nestTables (#2702) (efe3db5)

support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2704) (2e03694)

typings: typo from jonServerPublicKey to onServerPublicKey (#2699) (8b5f691)

Commits

f637d3f chore(master): release 3.9.8 (#2700)
efe3db5 fix(security): sanitize fields and tables when using nestTables (#2702)
2e03694 fix: support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2...
8b5f691 fix(typings): typo from jonServerPublicKey to onServerPublicKey (#2699)
5c75802 build(deps-dev): bump tsx from 4.10.5 to 4.11.0 in /website (#2695)
179769f build(deps): bump @easyops-cn/docusaurus-search-local in /website (#2696)
56289e2 build(deps-dev): bump poku from 1.12.1 to 1.13.0 (#2698)
b029308 build(deps-dev): bump poku from 1.12.1 to 1.13.0 in /website (#2697)
539acb8 build(deps): bump lucide-react from 0.378.0 to 0.379.0 in /website (#2693)
dc80580 build(deps-dev): bump @typescript-eslint/eslint-plugin from 7.9.0 to 7.10.0 i...
Additional commits viewable in compare view

Updates mysql2 from 3.9.7 to 3.10.0

Release notes

Sourced from mysql2's releases.

v3.9.8

3.9.8 (2024-05-26)

Bug Fixes

security: sanitize fields and tables when using nestTables (#2702) (efe3db5)

support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2704) (2e03694)

typings: typo from jonServerPublicKey to onServerPublicKey (#2699) (8b5f691)

Changelog

Sourced from mysql2's changelog.

3.9.8 (2024-05-26)

Bug Fixes

security: sanitize fields and tables when using nestTables (#2702) (efe3db5)

support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2704) (2e03694)

typings: typo from jonServerPublicKey to onServerPublicKey (#2699) (8b5f691)

Commits

f637d3f chore(master): release 3.9.8 (#2700)
efe3db5 fix(security): sanitize fields and tables when using nestTables (#2702)
2e03694 fix: support deno + caching_sha2_password FULL_AUTHENTICATION_PACKET flow (#2...
8b5f691 fix(typings): typo from jonServerPublicKey to onServerPublicKey (#2699)
5c75802 build(deps-dev): bump tsx from 4.10.5 to 4.11.0 in /website (#2695)
179769f build(deps): bump @easyops-cn/docusaurus-search-local in /website (#2696)
56289e2 build(deps-dev): bump poku from 1.12.1 to 1.13.0 (#2698)
b029308 build(deps-dev): bump poku from 1.12.1 to 1.13.0 in /website (#2697)
539acb8 build(deps): bump lucide-react from 0.378.0 to 0.379.0 in /website (#2693)
dc80580 build(deps-dev): bump @typescript-eslint/eslint-plugin from 7.9.0 to 7.10.0 i...
Additional commits viewable in compare view

Updates next from 13.3.1 to 14.1.1

Commits

5f59ee5 v14.1.1
f48b90b even more
7f789f4 more timeout
ab71c4c update timeout
75f60d9 update trigger release workflow
74b3f0f Server Action tests (#62655)
a6946b6 Backport metadata fixes (#62663)
4002f4b Fix draft mode invariant (#62121)
7dbf6f8 fix: babel usage with next/image (#61835)
3efc842 Fix next/server apit push alias for ESM pkg (#61721)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

…updates Bumps the npm_and_yarn group with 1 update in the / directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 1 update in the /docs.yonode.org directory: [next](https://github.com/vercel/next.js). Bumps the npm_and_yarn group with 2 updates in the /packages/yonode-templates/typescript/MySQL/Sequelize/NoAuth directory: [semver](https://github.com/npm/node-semver) and [mysql2](https://github.com/sidorares/node-mysql2). Bumps the npm_and_yarn group with 1 update in the /packages/yonode-templates/typescript/MySQL/TypeOrm/noAuth directory: [mysql2](https://github.com/sidorares/node-mysql2). Bumps the npm_and_yarn group with 1 update in the /packages/yonode-templates/typescript/PostgreSQL/TypeOrm/noAuth directory: [mysql2](https://github.com/sidorares/node-mysql2). Bumps the npm_and_yarn group with 1 update in the /yonode.org directory: [next](https://github.com/vercel/next.js). Updates `next` from 13.5.1 to 14.1.1 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v13.5.1...v14.1.1) Updates `postcss` from 8.4.14 to 8.4.31 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.14...8.4.31) Updates `zod` from 3.21.4 to 3.22.4 - [Release notes](https://github.com/colinhacks/zod/releases) - [Changelog](https://github.com/colinhacks/zod/blob/main/CHANGELOG.md) - [Commits](colinhacks/zod@v3.21.4...v3.22.4) Updates `next` from 13.0.6 to 14.1.1 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v13.5.1...v14.1.1) Updates `semver` from 7.6.0 to 7.6.2 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) - [Commits](npm/node-semver@v7.6.0...v7.6.2) Updates `mysql2` from 3.9.7 to 3.9.8 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](sidorares/node-mysql2@v3.9.7...v3.9.8) Updates `mysql2` from 3.9.7 to 3.9.8 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](sidorares/node-mysql2@v3.9.7...v3.9.8) Updates `mysql2` from 3.9.7 to 3.10.0 - [Release notes](https://github.com/sidorares/node-mysql2/releases) - [Changelog](https://github.com/sidorares/node-mysql2/blob/master/Changelog.md) - [Commits](sidorares/node-mysql2@v3.9.7...v3.9.8) Updates `next` from 13.3.1 to 14.1.1 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v13.5.1...v14.1.1) --- updated-dependencies: - dependency-name: next dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: postcss dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: zod dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: semver dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: mysql2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mysql2 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mysql2 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: next dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2024-05-30T20:53:03Z

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/eslint-config-next@13.3.1	unsafe Transitive: environment, eval, filesystem	`+124`	14.5 MB	vercel-release-bot
npm/eslint@8.39.0	filesystem Transitive: environment, eval, shell, unsafe	`+68`	10 MB	eslintbot
npm/framer-motion@10.12.4	environment	`0`	2.05 MB	popmotion
npm/next-contentlayer@0.3.2	environment, unsafe Transitive: eval, filesystem, network, shell	`+145`	46.8 MB	schickling
npm/next-seo@6.0.0	None	`0`	464 kB	garymeehan
npm/next@13.3.1	environment, filesystem, network, shell, unsafe	`+8`	46.6 MB	vercel-release-bot
npm/nextra-theme-docs@2.13.2	Transitive: environment, eval, filesystem, network, shell	`+152`	66.4 MB	quietshu
npm/react-dom@18.2.0	environment	`+2`	4.52 MB	gnoff
npm/react-icons@4.8.0	None	`0`	55.7 MB	kamijin_fanta
npm/react-remove-scroll@2.5.5	Transitive: environment	`+6`	147 kB	kashey
npm/react@18.2.0	environment	`+2`	337 kB	gnoff

🚮 Removed packages: npm/@types/chalk@2.2.0, npm/@types/cookie-parser@1.4.6, npm/@types/cors@2.8.17, npm/@types/dotenv@8.2.0, npm/@types/express-rate-limit@6.0.0, npm/@types/express@4.17.21, npm/@types/helmet@4.0.0, npm/@types/joi@17.2.3, npm/@types/jsonwebtoken@9.0.5, npm/@types/morgan@1.9.9, npm/@types/node@16.18.82, npm/@types/nodemailer@6.4.14, npm/@types/uuidv4@5.0.0, npm/bcrypt@5.1.1, npm/cookie-parser@1.4.6, npm/cors@2.8.5, npm/dotenv@16.4.4, npm/express-async-handler@1.2.0, npm/express-rate-limit@7.1.5, npm/express@4.19.2, npm/helmet@7.1.0, npm/joi@17.12.1, npm/jsonwebtoken@9.0.2, npm/mongodb@5.9.2, npm/morgan@1.10.0, npm/nodemailer@6.9.9, npm/nodemon@3.0.3, npm/pg@8.11.3, npm/reflect-metadata@0.1.14, npm/tsx@4.7.1, npm/typeorm@0.3.20, npm/typescript@4.5.2, npm/uuidv4@6.2.13, npm/yonode@0.5.6

View full report↗︎

socket-security · 2024-05-30T20:53:06Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source
Install scripts	npm/protobufjs@7.2.3	Install script: postinstall Source: `node scripts/postinstall`	`yonode.org/package.json` `yonode.org/pnpm-lock.yaml`
Install scripts	npm/protobufjs@6.11.3	Install script: postinstall Source: `node scripts/postinstall`	`yonode.org/package.json` `yonode.org/pnpm-lock.yaml`
Telemetry	npm/next@13.3.1	Note: Can be disabled by setting the environment variable NEXT_TELEMETRY_DISABLED=1 . See https://nextjs.org/telemetry for more information	`yonode.org/package.json` `yonode.org/pnpm-lock.yaml`

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

What is telemetry?

This package contains telemetry which tracks how it is used.

Most telemetry comes with settings to disable it. Consider disabling telemetry if you do not want to be tracked.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore npm/protobufjs@7.2.3
@SocketSecurity ignore npm/protobufjs@6.11.3
@SocketSecurity ignore npm/next@13.3.1

dependabot bot added the dependencies Pull requests that update a dependency file label May 30, 2024

dependabot bot mentioned this pull request May 30, 2024

build(deps): bump the npm_and_yarn group across 5 directories with 5 updates #470

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the npm_and_yarn group across 6 directories with 5 updates #471

build(deps): bump the npm_and_yarn group across 6 directories with 5 updates #471

Uh oh!

dependabot bot commented on behalf of github May 30, 2024 •

edited

Loading

Uh oh!

socket-security bot commented May 30, 2024

Uh oh!

socket-security bot commented May 30, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

build(deps): bump the npm_and_yarn group across 6 directories with 5 updates #471

Are you sure you want to change the base?

build(deps): bump the npm_and_yarn group across 6 directories with 5 updates #471

Uh oh!

Conversation

dependabot bot commented on behalf of github May 30, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

8.4.31

8.4.30

8.4.29

8.4.28

8.4.27

8.4.26

8.4.25

8.4.24

8.4.23

8.4.22

8.4.21

8.4.20

8.4.19

8.4.18

8.4.17

8.4.16

8.4.31

8.4.30

8.4.29

8.4.28

8.4.27

8.4.26

8.4.25

8.4.24

8.4.23

8.4.22

8.4.21

8.4.20

8.4.19

8.4.18

8.4.17

8.4.16

v3.22.4

Commits:

v3.22.3

Commits:

v3.22.2

Commits:

v3.22.1

Commits:

v7.6.2

7.6.2 (2024-05-09)

Bug Fixes

v7.6.1

7.6.1 (2024-05-04)

Bug Fixes

Dependencies

Chores

7.6.2 (2024-05-09)

Bug Fixes

7.6.1 (2024-05-04)

Bug Fixes

Dependencies

Chores

v3.9.8

3.9.8 (2024-05-26)

Bug Fixes

3.9.8 (2024-05-26)

Bug Fixes

v3.9.8

3.9.8 (2024-05-26)

Bug Fixes

3.9.8 (2024-05-26)

Bug Fixes

v3.9.8

3.9.8 (2024-05-26)

Bug Fixes

3.9.8 (2024-05-26)

Bug Fixes

Uh oh!

socket-security bot commented May 30, 2024

Uh oh!

socket-security bot commented May 30, 2024

dependabot bot commented on behalf of github May 30, 2024 •

edited

Loading