build(deps): bump the npm_and_yarn group across 1 directory with 17 updates by dependabot[bot] · Pull Request #1 · trunkmak/discord.js

dependabot · 2024-07-10T17:14:12Z

Bumps the npm_and_yarn group with 16 updates in the / directory:

Package	From	To
next	`13.3.4`	`14.1.1`
sharp	`0.32.1`	`0.32.6`
undici	`5.22.0`	`5.28.4`
ws	`8.13.0`	`8.17.1`
vite	`4.3.4`	`4.5.3`
@grpc/grpc-js	`1.8.14`	`1.10.10`
braces	`3.0.2`	`3.0.3`
ejs	`3.1.9`	`3.1.10`
express	`4.18.2`	`4.19.2`
fast-loops	`1.1.3`	`1.1.4`
get-func-name	`2.0.0`	`2.0.2`
protobufjs	`6.11.3`	`6.11.4`
semver	`5.7.1`	`5.7.2`
tar	`6.1.14`	`6.2.1`
word-wrap	`1.2.3`	`1.2.5`
zod	`3.21.4`	`3.23.8`

Updates next from 13.3.4 to 14.1.1

Commits

5f59ee5 v14.1.1
f48b90b even more
7f789f4 more timeout
ab71c4c update timeout
75f60d9 update trigger release workflow
74b3f0f Server Action tests (#62655)
a6946b6 Backport metadata fixes (#62663)
4002f4b Fix draft mode invariant (#62121)
7dbf6f8 fix: babel usage with next/image (#61835)
3efc842 Fix next/server apit push alias for ESM pkg (#61721)
Additional commits viewable in compare view

Updates sharp from 0.32.1 to 0.32.6

Changelog

Sourced from sharp's changelog.

v0.32.6 - 18th September 2023

Upgrade to libvips v8.14.5 for upstream bug fixes.

Ensure composite tile images are fully decoded (regression in 0.32.0). #3767

Ensure withMetadata can add ICC profiles to RGB16 output. #3773

Ensure withMetadata does not reduce 16-bit images to 8-bit (regression in 0.32.5). #3773

TypeScript: Add definitions for block and unblock. #3799 @ldrick

v0.32.5 - 15th August 2023

Upgrade to libvips v8.14.4 for upstream bug fixes.

TypeScript: Add missing WebpPresetEnum to definitions. #3748 @pilotso11

Ensure compilation using musl v1.2.4. #3755 @kleisauke

Ensure resize with a fit of inside respects 90/270 degree rotation. #3756

TypeScript: Ensure minSize property of WebpOptions is boolean. #3758 @sho-xizz

Ensure withMetadata adds default sRGB profile. #3761

v0.32.4 - 21st July 2023

Upgrade to libvips v8.14.3 for upstream bug fixes.

Expose ability to (un)block low-level libvips operations by name.

Prebuilt binaries: restore support for tile-based output. #3581

v0.32.3 - 14th July 2023

... (truncated)

Commits

eefaa99 Release v0.32.6
dbce6fa Upgrade to libvips v8.14.5
af0fcb3 Docs: changelog for #3799
c6f54e5 Bump devDeps
846563e TypeScript: add definitions for block and unblock (#3799)
9c217ab Ensure withMetadata can add RGB16 profiles #3773
e7381e5 Alternative fix for 4340d60, uses existing StaySequential
4340d60 Ensure composite tile images fully decoded #3767
7f64d46 Docs: add missing returns property to raw
67e927b Docs: ensure all functions include method signature #3777
Additional commits viewable in compare view

Updates undici from 5.22.0 to 5.28.4

Release notes

Sourced from undici's releases.

v5.28.4

⚠️ Security Release ⚠️

Fixes GHSA-m4v8-wqvr-p9f7 CVE-2024-30260

Fixes GHSA-9qxr-qj54-h672 CVE-2024-30261

Full Changelog: nodejs/undici@v5.28.3...v5.28.4

v5.28.3

⚠️ Security Release ⚠️

Fixes:

CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch

Full Changelog: nodejs/undici@v5.28.2...v5.28.3

v5.28.2

What's Changed

fix: remove optional chainning for compatible with Nodejs12 and below by @bugb in nodejs/undici#2470

fix: remove node: prefix by @tsctx in nodejs/undici#2471

perf: avoid Headers initialization by @tsctx in nodejs/undici#2468

fix: handle SharedArrayBuffer correctly by @tsctx in nodejs/undici#2466

fix: Add null type to signal in RequestInit by @gebsh in nodejs/undici#2455

fix: correctly handle data URL with hashes. by @tsctx in nodejs/undici#2475

fix: check response for timinginfo allow flag by @ToshB in nodejs/undici#2477

Make call to onBodySent conditional in RetryHandler by @MzUgM in nodejs/undici#2478

refactor: better integrity check by @tsctx in nodejs/undici#2462

fix: Added support for inline URL username:password proxy auth by @matt-way in nodejs/undici#2473

build(deps-dev): bump jsdom from 22.1.0 to 23.0.0 by @dependabot in nodejs/undici#2472

build(deps-dev): bump sinon from 16.1.3 to 17.0.1 by @dependabot in nodejs/undici#2405

build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 by @dependabot in nodejs/undici#2396

build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 by @dependabot in nodejs/undici#2395

build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 by @dependabot in nodejs/undici#2392

build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 by @dependabot in nodejs/undici#2389

build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 by @dependabot in nodejs/undici#2302

New Contributors

@bugb made their first contribution in nodejs/undici#2470

@gebsh made their first contribution in nodejs/undici#2455

@ToshB made their first contribution in nodejs/undici#2477

@MzUgM made their first contribution in nodejs/undici#2478

@matt-way made their first contribution in nodejs/undici#2473

Full Changelog: nodejs/undici@v5.28.1...v5.28.2

v5.28.1

What's Changed

perf: Improve normalizeMethod by @tsctx in nodejs/undici#2456

fix: dispatch error handling by @ronag in nodejs/undici#2459

... (truncated)

Commits

fb98306 Bumped v5.28.4
2b39440 Merge pull request from GHSA-9qxr-qj54-h672
64e3402 Merge pull request from GHSA-m4v8-wqvr-p9f7
723c4e7 Revert "build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 (#2389)"
0e9d54b skip failing test due to Node.js changes
e71cb4c Bumped v5.28.3
20c65b8 Fix tests for Node.js v20.11.0 (#2618)
8ec52cd Fix tests for Node.js v21 (#2609)
d3aa574 Merge pull request from GHSA-3787-6prv-h9w3
9a14e5f Bumped v5.28.2
Additional commits viewable in compare view

Updates ws from 8.13.0 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.
const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});
The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits

3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
934c9d6 [ci] Test on node 22
1817bac [ci] Do not test on node 21
96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
Additional commits viewable in compare view

Updates vite from 4.3.4 to 4.5.3

Changelog

Sourced from vite's changelog.

4.5.3 (2024-03-24)

fix: fs.deny with globs with directories (#16250) (96a7f3a), closes #16250

4.5.2 (2024-01-19)

fix: fs deny for case insensitive systems (#15653) (eeec23b), closes #15653

4.5.1 (2023-12-04)

fix: backport #15223, proxy html path should be encoded (#15226) (41bb354), closes #15223 #15226

4.5.0 (2023-10-18)

feat: backport mdx as known js source (#14560) (#14670) (45595ef), closes #14560 #14670

feat: scan .marko files (#14669) (ed7bdc5), closes #14669

feat(ssr): backport ssr.resolve.conditions and ssr.resolve.externalConditions (#14498) (#14668) (520139c), closes #14498 #14668

4.4.11 (2023-10-05)

revert: "fix: use string manipulation instead of regex to inject esbuild helpers (54e1275), closes #14094

4.4.10 (2023-10-03)

fix: add source map to Web Workers (fix #14216) (#14217) (df6f32f), closes #14216 #14217

fix: handle errors during hasWorkspacePackageJSON function (#14394) (6f6e5de), closes #14394

fix: handle sourcemap correctly when multiple line import exists (#14232) (218861f), closes #14232

fix: if host is specified check whether it is valid (#14013) (b1b816a), closes #14013

fix: include vite/types/* in exports field (#14296) (40e99a1), closes #14296

fix: initWasm options should be optional (#14152) (119c074), closes #14152

fix: restore builtins list (f8b9adb)

fix: use string manipulation instead of regex to inject esbuild helpers (#14094) (128ad8f), closes #14094

fix: ws never connects after restarting server if server.hmr.server is set (#14127) (441642e), closes #14127

fix(analysis): warnings for dynamic imports that use static template literals (#14458) (0c6d289), closes #14458

fix(cli): convert special base (#14283) (d4bc0fb), closes #14283

fix(css): remove pure css chunk sourcemap (#14290) (cd7e033), closes #14290

fix(css): reset render cache on renderStart (#14326) (d334b3d), closes #14326

fix(glob): trigger HMR for glob in a package (#14117) (0f582bf), closes #14117

fix(import-analysis): preserve importedUrls import order (#14465) (269aa43), closes #14465

fix(manifest): preserve pure css chunk assets (#14297) (3d63ae6), closes #14297

... (truncated)

Commits

aac695e release: v4.5.3
96a7f3a fix: fs.deny with globs with directories (#16250)
d0360c1 release: v4.5.2
eeec23b fix: fs deny for case insensitive systems (#15653)
c075115 release: v4.5.1
41bb354 fix: backport #15223, proxy html path should be encoded (#15226)
055d2b8 release: v4.5.0
ed7bdc5 feat: scan .marko files (#14669)
45595ef feat: backport mdx as known js source (#14560) (#14670)
520139c feat(ssr): backport ssr.resolve.conditions and ssr.resolve.externalConditions...
Additional commits viewable in compare view

Updates @grpc/grpc-js from 1.8.14 to 1.10.10

Release notes

Sourced from @grpc/grpc-js's releases.

@grpc/grpc-js 1.10.10

Various improvements to handling of keepalive timers (#2760 by @davidfiala)

Fix a bug causing unary response client requests to hang when unexpectedly receiving multiple messages (#2772)

Fix a bug causing some requests to fail when making requests through a local proxy (#2746 contributed by @mjameswh, backported in #2777)

Fix handling of URL-encoded user credentials in proxy configuration (#2761 contributed by @brendan-myers, backported in #2777)

Fix missing client-side handling of the grpc.max_send_message_length channel option (#2779)

@grpc/grpc-js 1.10.9

Avoid buffering significantly more than grpc.max_receive_message_size per received message.

@grpc/grpc-js 1.10.8

Fix a bug that caused channels with unix: targets to not reconnect after the channel goes idle (#2750)

@grpc/grpc-js 1.10.7

Improve reporting of HTTP error codes (#2723)

Update dependency on @grpc/proto-loader to the latest version (#2732)

@grpc/grpc-js 1.10.6

Fix a bug that could cause a server to sometimes send the status early (#2708)

@grpc/grpc-js 1.10.5

Resolve exception when Error.stackTraceLimit is undefined (#2701 contributed by @davidfiala)

Call configured checkServerIdentity when grpc.ssl_target_name_override is set (#2704)

Add more information to DEADLINE_EXCEEDED error details strings (#2692)

@grpc/grpc-js 1.10.4

Fix a bug that caused server interceptors to crash when using partially-populated ResponderBuilder and ListenerBuilder objects (#2696)

Avoid sending RST_STREAM from the client when the server has already finished its side of the stream (#2695)

@grpc/grpc-js 1.10.3

Revert client reconnection changes in #2680 (#2691)

@grpc/grpc-js 1.10.2

Implement server connection idle timeouts and improve channelz performance (#2677 contributed by @AVVS)

Fix a bug that caused clients to automatically reconnect even when there were no active requests (#2680)

Modify order of server call events to more closely match pre-1.10.x behavior (#2683)

@grpc/grpc-js 1.10.1

Fix a bug causing channels using the round_robin LB policy to fail to reconnect after a connection drops (#2667)

@grpc/grpc-js-xds 1.10.1

Update dependency on @grpc/proto-loader to the latest version (#2732)

@grpc/grpc-js-xds 1.10.0

Implement gRFC A52: gRPC xDS Custom Load Balancer Configuration (#2555)

Implement gRFC A42: xDS Ring Hash LB Policy (#2568)

Note: This feature is not compatible with Node 14 or below. To disable it in those versions, set the environment variable GRPC_XDS_EXPERIMENTAL_ENABLE_RING_HASH=false.

Implement the xDS part of gRFC A62: pick_first: sticky TRANSIENT_FAILURE and address order randomization (Currently experimental, enabled by environment variable GRPC_EXPERIMENTAL_PICKFIRST_LB_CONFIG) (#2572)

@grpc/grpc-js 1.10.0

... (truncated)

Commits

c934257 Merge pull request #2778 from murgatroid99/grpc-js_1.10.10
3c55b5b Merge pull request #2777 from murgatroid99/grpc-js_1.10_backports
97c4cda Merge pull request #2779 from murgatroid99/grpc-js_max_send_message_size_fix
42844cf grpc-js: Re-add client-side max send message size checking
cbab4e5 grpc-js: Bump to 1.10.10
5ae5514 fix: add decoding for url encoded user credentials
e759029 HTTP CONNECT: handle early server packets
5c0226d Merge pull request #2760 from davidfiala/@grpc/grpc-js@1.10.x
52fe8e9 Merge pull request #2772 from murgatroid99/grpc-js_cardinality_error_hang
674f4e3 Merge pull request from GHSA-7v5v-9h63-cj86
Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits

d3f807d Version 3.1.10
9ee26dd Mocha TDD
e469741 Basic pollution protection
715e950 Merge pull request #756 from Jeffrey-mu/main
cabe314 Include advanced usage examples
29b076c Added header
11503c7 Merge branch 'main' of github.com:mde/ejs into main
7690404 Added security banner to README
f47d7ae Update SECURITY.md
828cea1 Update SECURITY.md
Additional commits viewable in compare view

Updates express from 4.18.2 to 4.19.2

Release notes

Sourced from express's releases.

4.19.2

What's Changed

Improved fix for open redirect allow list bypass

Full Changelog: expressjs/express@4.19.1...4.19.2

4.19.1

What's Changed

Fix ci after location patch by @wesleytodd in expressjs/express#5552

fixed un-edited version in history.md for 4.19.0 by @wesleytodd in expressjs/express#5556

Full Changelog: expressjs/express@4.19.0...4.19.1

4.19.0

What's Changed

fix typo in release date by @UlisesGascon in expressjs/express#5527

docs: nominating @wesleytodd to be project captian by @wesleytodd in expressjs/express#5511

docs: loosen TC activity rules by @wesleytodd in expressjs/express#5510

Add note on how to update docs for new release by @crandmck in expressjs/express#5541

Prevent open redirect allow list bypass due to encodeurl

Release 4.19.0 by @wesleytodd in expressjs/express#5551

New Contributors

@crandmck made their first contribution in expressjs/express#5541

Full Changelog: expressjs/express@4.18.3...4.19.0

4.18.3

Main Changes

Fix routing requests without method

deps: body-parser@1.20.2

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: raw-body@2.5.2

Other Changes

Use https: protocol instead of deprecated git: protocol by @vcsjones in expressjs/express#5032

build: Node.js@16.18 and Node.js@18.12 by @abenhamdine in expressjs/express#5034

ci: update actions/checkout to v3 by @armujahid in expressjs/express#5027

test: remove unused function arguments in params by @raksbisht in expressjs/express#5124

Remove unused originalIndex from acceptParams by @raksbisht in expressjs/express#5119

Fixed typos by @raksbisht in expressjs/express#5117

examples: remove unused params by @raksbisht in expressjs/express#5113

fix: parameter str is not described in JSDoc by @raksbisht in expressjs/express#5130

fix: typos in History.md by @raksbisht in expressjs/express#5131

build : add Node.js@19.7 by @abenhamdine in expressjs/express#5028

test: remove unused function arguments in params by @raksbisht in expressjs/express#5137

... (truncated)

Changelog

Sourced from express's changelog.

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

Prevent open redirect allow list bypass due to encodeurl

deps: cookie@0.6.0

4.18.3 / 2024-02-29

Fix routing requests without method

deps: body-parser@1.20.2

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: raw-body@2.5.2

deps: cookie@0.6.0

Add partitioned option

Commits

04bc627 4.19.2
da4d763 Improved fix for open redirect allow list bypass
4f0f6cc 4.19.1
a003cfa Allow passing non-strings to res.location with new encoding handling checks f...
a1fa90f fixed un-edited version in history.md for 4.19.0
11f2b1d build: fix build due to inconsistent supertest behavior in older versions
084e365 4.19.0
0867302 Prevent open redirect allow list bypass due to encodeurl
567c9c6 Add note on how to update docs for new release (#5541)
69a4cf2 deps: cookie@0.6.0
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.

Updates fast-loops from 1.1.3 to 1.1.4

Commits

See full diff in compare view

Updates get-func-name from 2.0.0 to 2.0.2

Release notes

Sourced from get-func-name's releases.

v2.0.2

What's Changed

Revert previous changes that shipped this as an ES module.

Full Changelog: https://github.com/chaijs/get-func-name/commits/v2.0.2

v2.0.1

What's Changed

Fix GHSA-4q6p-r6v2-jvc5

Full Changelog: https://github.com/chaijs/get-func-name/commits/v2.0.1

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by keithamus, a new releaser for get-func-name since your current version.

Updates postcss from 8.4.14 to 8.4.23

Release notes

Sourced from postcss's releases.

8.4.23

Fixed warnings in TypeDoc.

8.4.22

Fixed TypeScript support with node16 (by @remcohaszing).

8.4.21

Fixed Input#error types (by @hudochenkov).

8.4.20

Fixed source map generation for childless at-rules like @layer.

8.4.19

Fixed whitespace preserving after AST transformations (by @romainmenke).

8.4.18

Fixed an error on absolute: true with empty sourceContent (by @KingSora).

8.4.17

Fixed Node.before() unexpected behavior (by @romainmenke).

Added TOC to docs (by @muddv).

8.4.16

Fixed Root AST migration.

8.4.15

Fixed AST normalization after using custom parser with old PostCSS AST.

Changelog

Sourced from postcss's changelog.

8.4.23

Fixed warnings in TypeDoc.

8.4.22

Fixed TypeScript support with node16 (by Remco Haszing).

8.4.21

Fixed Input#error types (by Aleks Hudochenkov).

8.4.20

Fixed source map generation for childless at-rules like @layer.

8.4.19

Fixed whitespace preserving after AST transformations (by Romain Menke).

8.4.18

Fixed an error on absolute: true with empty sourceContent (by Rene Haas).

8.4.17

Fixed Node.before() unexpected behavior (by Romain Menke).

Added TOC to docs (by Mikhail Dedov).

8.4.16

Fixed Root AST migration.

8.4.15

Fixed AST normalization after using custom parser with old PostCSS AST.

Commits

aa9e03e Release 8.4.23 version
691b299 Fix TSDocs
8190234 Update dependencies
5f8dbdb Move to Node.js 20 on CI
7de4860 Release 8.4.22 version
a9a157a Merge pull request #1815 from remcohaszing/fix-types
98de266 Revert unwanted changes
4947e3b Fix broken test
bda836a Remove intermediate classes for default exports
d33810c Merge branch 'main' into fix-types
Additional commits viewable in compare view

Updates protobufjs from 6.11.3 to 6.11.4

Commits

See full diff in compare view

Updates semver from 5.7.1 to 5.7.2

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

2f8fd41 #585 better handling of whitespace (#585) (@joaomoreno, @lukekarrys)

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

2f8fd41 #585 better handling of whitespace (#585) (@joaomoreno, @lukekarrys)

5.7

Add minVersion method

5.6

Move boolean loose param to an options object, with backwards-compatibility protection.

Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

Add version coercion capabilities

5.4

Add intersection checking

5.3

Add minSatisfying method

5.2

Add prerelease(v) that returns prerelease components

5.1

Add Backus-Naur for ranges

Remove excessively cute inspection methods

5.0

Remove AMD/Browserified build artifacts

Fix ltr and gtr when using the * range

Fix for range * with a prerelease identifier

Commits

f8cc313 chore: release 5.7.2
2f8fd41 fix: better handling of whitespace (#585)
deb5ad5 chore: @npmcli/template-oss@4.16.0
See full diff in compare view

Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.

Updates tar from 6.1.14 to 6.2.1

Changelog

Sourced from tar's changelog.

Changelog

7.4

Deprecate onentry in favor of onReadEntry for clarity.

7.3

Add onWriteEntry option

7.2

DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

Update minipass to v7.1.0

Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

Rewrite in TypeScript, provide ESM and CommonJS hybrid interface

Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.

Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.

Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

6.2

Add support for brotli compression

Add maxDepth option to prevent extraction into excessively deep folders.

6.1

remove dead link to benchmarks (#313) (@yetzt)

add examples/explanation of using tar.t (@isaacs)

ensure close event is emited after stream has ended (@webark)

... (truncated)

Commits

bef7b1e 6.2.1
fe8cd57 prevent e...
Description has been truncated

…pdates Bumps the npm_and_yarn group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [next](https://github.com/vercel/next.js) | `13.3.4` | `14.1.1` | | [sharp](https://github.com/lovell/sharp) | `0.32.1` | `0.32.6` | | [undici](https://github.com/nodejs/undici) | `5.22.0` | `5.28.4` | | [ws](https://github.com/websockets/ws) | `8.13.0` | `8.17.1` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `4.3.4` | `4.5.3` | | [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.8.14` | `1.10.10` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [ejs](https://github.com/mde/ejs) | `3.1.9` | `3.1.10` | | [express](https://github.com/expressjs/express) | `4.18.2` | `4.19.2` | | [fast-loops](https://github.com/robinweser/fast-loops) | `1.1.3` | `1.1.4` | | [get-func-name](https://github.com/chaijs/get-func-name) | `2.0.0` | `2.0.2` | | [protobufjs](https://github.com/protobufjs/protobuf.js) | `6.11.3` | `6.11.4` | | [semver](https://github.com/npm/node-semver) | `5.7.1` | `5.7.2` | | [tar](https://github.com/isaacs/node-tar) | `6.1.14` | `6.2.1` | | [word-wrap](https://github.com/jonschlinkert/word-wrap) | `1.2.3` | `1.2.5` | | [zod](https://github.com/colinhacks/zod) | `3.21.4` | `3.23.8` | Updates `next` from 13.3.4 to 14.1.1 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v13.3.4...v14.1.1) Updates `sharp` from 0.32.1 to 0.32.6 - [Release notes](https://github.com/lovell/sharp/releases) - [Changelog](https://github.com/lovell/sharp/blob/main/docs/changelog.md) - [Commits](lovell/sharp@v0.32.1...v0.32.6) Updates `undici` from 5.22.0 to 5.28.4 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.22.0...v5.28.4) Updates `ws` from 8.13.0 to 8.17.1 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.13.0...8.17.1) Updates `vite` from 4.3.4 to 4.5.3 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v4.5.3/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v4.5.3/packages/vite) Updates `@grpc/grpc-js` from 1.8.14 to 1.10.10 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/grpc-js@1.8.14...@grpc/grpc-js@1.10.10) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `ejs` from 3.1.9 to 3.1.10 - [Release notes](https://github.com/mde/ejs/releases) - [Commits](mde/ejs@v3.1.9...v3.1.10) Updates `express` from 4.18.2 to 4.19.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.18.2...4.19.2) Updates `fast-loops` from 1.1.3 to 1.1.4 - [Commits](https://github.com/robinweser/fast-loops/commits) Updates `get-func-name` from 2.0.0 to 2.0.2 - [Release notes](https://github.com/chaijs/get-func-name/releases) - [Commits](https://github.com/chaijs/get-func-name/commits/v2.0.2) Updates `postcss` from 8.4.14 to 8.4.23 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.14...8.4.23) Updates `protobufjs` from 6.11.3 to 6.11.4 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](https://github.com/protobufjs/protobuf.js/commits) Updates `semver` from 5.7.1 to 5.7.2 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md) - [Commits](npm/node-semver@v5.7.1...v5.7.2) Updates `tar` from 6.1.14 to 6.2.1 - [Release notes](https://github.com/isaacs/node-tar/releases) - [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md) - [Commits](isaacs/node-tar@v6.1.14...v6.2.1) Updates `word-wrap` from 1.2.3 to 1.2.5 - [Release notes](https://github.com/jonschlinkert/word-wrap/releases) - [Commits](jonschlinkert/word-wrap@1.2.3...1.2.5) Updates `zod` from 3.21.4 to 3.23.8 - [Release notes](https://github.com/colinhacks/zod/releases) - [Changelog](https://github.com/colinhacks/zod/blob/main/CHANGELOG.md) - [Commits](colinhacks/zod@v3.21.4...v3.23.8) --- updated-dependencies: - dependency-name: next dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: sharp dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: undici dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ws dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: vite dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@grpc/grpc-js" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ejs dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-loops dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: get-func-name dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: postcss dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: protobufjs dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: semver dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: tar dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: word-wrap dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: zod dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added the dependencies Pull requests that update a dependency file label Jul 10, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the npm_and_yarn group across 1 directory with 17 updates#1

build(deps): bump the npm_and_yarn group across 1 directory with 17 updates#1
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-880ade80c7

dependabot bot commented on behalf of github Jul 10, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Jul 10, 2024

v0.32.6 - 18th September 2023

v0.32.5 - 15th August 2023

v0.32.4 - 21st July 2023

v0.32.3 - 14th July 2023

v5.28.4

⚠️ Security Release ⚠️

v5.28.3

⚠️ Security Release ⚠️

v5.28.2

What's Changed

New Contributors

v5.28.1

What's Changed

8.17.1

Bug fixes

4.5.3 (2024-03-24)

4.5.2 (2024-01-19)

4.5.1 (2023-12-04)

4.5.0 (2023-10-18)

4.4.11 (2023-10-05)

4.4.10 (2023-10-03)

@​grpc/grpc-js 1.10.10

@​grpc/grpc-js 1.10.9

@​grpc/grpc-js 1.10.8

@​grpc/grpc-js 1.10.7

@​grpc/grpc-js 1.10.6

@​grpc/grpc-js 1.10.5

@​grpc/grpc-js 1.10.4

@​grpc/grpc-js 1.10.3

@​grpc/grpc-js 1.10.2

@​grpc/grpc-js 1.10.1

@​grpc/grpc-js-xds 1.10.1

@​grpc/grpc-js-xds 1.10.0

@​grpc/grpc-js 1.10.0

v3.1.10

4.19.2

What's Changed

4.19.1

What's Changed

4.19.0

What's Changed

New Contributors

4.18.3

Main Changes

Other Changes

4.19.2 / 2024-03-25

4.19.1 / 2024-03-20

4.19.0 / 2024-03-20

4.18.3 / 2024-02-29

v2.0.2

What's Changed

v2.0.1

What's Changed

8.4.23

8.4.22

8.4.21

8.4.20

8.4.19

8.4.18

8.4.17

8.4.16

8.4.15

8.4.23

8.4.22

8.4.21

8.4.20

8.4.19

8.4.18

8.4.17

8.4.16

8.4.15

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

5.7.2 (2023-07-10)

Bug Fixes

5.7

5.6

`@grpc/grpc-js` 1.10.10

`@grpc/grpc-js` 1.10.9

`@grpc/grpc-js` 1.10.8

`@grpc/grpc-js` 1.10.7

`@grpc/grpc-js` 1.10.6

`@grpc/grpc-js` 1.10.5

`@grpc/grpc-js` 1.10.4

`@grpc/grpc-js` 1.10.3

`@grpc/grpc-js` 1.10.2

`@grpc/grpc-js` 1.10.1

`@grpc/grpc-js-xds` 1.10.1

`@grpc/grpc-js-xds` 1.10.0

`@grpc/grpc-js` 1.10.0