Skip to content

Bump the npm_and_yarn group with 9 updates #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Bump the npm_and_yarn group with 9 updates #3

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Sep 10, 2024

Bumps the npm_and_yarn group with 9 updates:

Package From To
async 2.1.4 2.6.4
bignum 0.12.5 0.13.1
debug 2.5.1 2.6.9
express 4.14.0 4.20.0
jsonwebtoken 7.4.3 9.0.2
minimist 1.2.0 1.2.6
moment 2.17.1 2.29.4
node-lmdb 0.4.12 0.9.7
redis 2.8.0 4.7.0

Updates async from 2.1.4 to 2.6.4

Release notes

Sourced from async's releases.

v2.3.0

  • Added support for ES2017 async functions. Wherever you can pass a Node-style/CPS function that uses a callback, you can also pass an async function. Previously, you had to wrap async functions with asyncify. The caveat is that it will only work if async functions are supported natively in your environment, transpiled implementations can't be detected. (#1386, #1390)

v2.2.0

  • Added groupBy, and the Series/Limit equivalents, analogous to _.groupBy (#1364)
  • Fixed transform bug when callback was not passed (#1381)

v2.1.5

  • Fix auto bug when function names collided with Array.prototype (#1358)
  • Improve some error messages (#1349)
  • Avoid stack overflow case in queue
  • Fixed an issue in some, every and find where processing would continue after the result was determined.
  • Cleanup implementations of some, every and find
Changelog

Sourced from async's changelog.

v2.6.4

  • Fix potential prototype pollution exploit (#1828)

v2.6.3

  • Updated lodash to squelch a security warning (#1675)

v2.6.2

  • Updated lodash to squelch a security warning (#1620)

v2.6.1

  • Updated lodash to prevent npm audit warnings. (#1532, #1533)
  • Made async-es more optimized for webpack users (#1517)
  • Fixed a stack overflow with large collections and a synchronous iterator (#1514)
  • Various small fixes/chores (#1505, #1511, #1527, #1530)

v2.6.0

  • Added missing aliases for many methods. Previously, you could not (e.g.) require('async/find') or use async.anyLimit. (#1483)
  • Improved queue performance. (#1448, #1454)
  • Add missing sourcemap (#1452, #1453)
  • Various doc updates (#1448, #1471, #1483)

v2.5.0

  • Added concatLimit, the Limit equivalent of concat (#1426, #1430)
  • concat improvements: it now preserves order, handles falsy values and the iteratee callback takes a variable number of arguments (#1437, #1436)
  • Fixed an issue in queue where there was a size discrepancy between workersList().length and running() (#1428, #1429)
  • Various doc fixes (#1422, #1424)

v2.4.1

  • Fixed a bug preventing functions wrapped with timeout() from being re-used. (#1418, #1419)

v2.4.0

  • Added tryEach, for running async functions in parallel, where you only expect one to succeed. (#1365, #687)
  • Improved performance, most notably in parallel and waterfall (#1395)
  • Added queue.remove(), for removing items in a queue (#1397, #1391)
  • Fixed using eval, preventing Async from running in pages with Content Security Policy (#1404, #1403)
  • Fixed errors thrown in an asyncifyed function's callback being caught by the underlying Promise (#1408)
  • Fixed timing of queue.empty() (#1367)
  • Various doc fixes (#1314, #1394, #1412)

v2.3.0

  • Added support for ES2017 async functions. Wherever you can pass a Node-style/CPS function that uses a callback, you can also pass an async function. Previously, you had to wrap async functions with asyncify. The caveat is that it will only work if async functions are supported natively in your environment, transpiled implementations can't be detected. (#1386, #1390)
  • Small doc fix (#1392)

v2.2.0

  • Added groupBy, and the Series/Limit equivalents, analogous to _.groupBy (#1364)
  • Fixed transform bug when callback was not passed (#1381)
  • Added note about reflect to parallel docs (#1385)

v2.1.5

  • Fix auto bug when function names collided with Array.prototype (#1358)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by hargasinski, a new releaser for async since your current version.


Updates bignum from 0.12.5 to 0.13.1

Commits
Maintainer changes

This version was pushed to npm by rvagg, a new releaser for bignum since your current version.


Updates debug from 2.5.1 to 2.6.9

Release notes

Sourced from debug's releases.

2.6.9

Patches

  • Remove ReDoS regexp in %o formatter: #504

Credits

Huge thanks to @​zhuangya for their help!

release 2.6.7

No release notes provided.

release 2.6.6

No release notes provided.

release 2.6.5

No release notes provided.

release 2.6.4

No release notes provided.

release 2.6.3

No release notes provided.

release 2.6.2

No release notes provided.

release 2.6.1

No release notes provided.

release 2.6.0

No release notes provided.

release 2.5.2

No release notes provided.

Changelog

Sourced from debug's changelog.

2.6.9 / 2017-09-22

  • remove ReDoS regexp in %o formatter (#504)

2.6.8 / 2017-05-18

2.6.7 / 2017-05-16

2.6.5 / 2017-04-27

2.6.4 / 2017-04-20

2.6.3 / 2017-03-13

2.6.2 / 2017-03-10

2.6.1 / 2017-02-10

  • Fix: Module's export default syntax fix for IE8 Expected identifier error
  • Fix: Whitelist DEBUG_FD for values 1 and 2 only (#415, @​pi0)

... (truncated)

Commits

Updates express from 4.14.0 to 4.20.0

Release notes

Sourced from express's releases.

4.20.0

What's Changed

Important

  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect

Other Changes

New Contributors

Full Changelog: expressjs/express@4.19.1...4.20.0

... (truncated)

Changelog

Sourced from express's changelog.

4.20.0 / 2024-09-10

  • deps: serve-static@0.16.0
    • Remove link renderization in html while redirecting
  • deps: send@0.19.0
    • Remove link renderization in html while redirecting
  • deps: body-parser@0.6.0
    • add depth option to customize the depth level in the parser
    • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
  • Remove link renderization in html while using res.redirect
  • deps: path-to-regexp@0.1.10
    • Adds support for named matching groups in the routes using a regex
    • Adds backtracking protection to parameters without regexes defined
  • deps: encodeurl@~2.0.0
    • Removes encoding of \, |, and ^ to align better with URL spec
  • Deprecate passing options.maxAge and options.expires to res.clearCookie
    • Will be ignored in v5, clearCookie will set a cookie with an expires in the past to instruct clients to delete the cookie

4.19.2 / 2024-03-25

  • Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

  • Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

  • Prevent open redirect allow list bypass due to encodeurl
  • deps: cookie@0.6.0

4.18.3 / 2024-02-29

  • Fix routing requests without method
  • deps: body-parser@1.20.2
    • Fix strict json error message on Node.js 19+
    • deps: content-type@~1.0.5
    • deps: raw-body@2.5.2
  • deps: cookie@0.6.0
    • Add partitioned option

4.18.2 / 2022-10-08

  • Fix regression routing a large stack in a single route
  • deps: body-parser@1.20.1

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for express since your current version.


Updates jsonwebtoken from 7.4.3 to 9.0.2

Changelog

Sourced from jsonwebtoken's changelog.

9.0.2 - 2023-08-30

  • security: updating semver to 7.5.4 to resolve CVE-2022-25883, closes #921.
  • refactor: reduce library size by using lodash specific dependencies, closes #878.

9.0.1 - 2023-07-05

  • fix(stubs): allow decode method to be stubbed

9.0.0 - 2022-12-21

Breaking changes: See Migration from v8 to v9

Breaking changes

  • Removed support for Node versions 11 and below.
  • The verify() function no longer accepts unsigned tokens by default. ([834503079514b72264fd13023a3b8d648afd6a16]auth0/node-jsonwebtoken@8345030)
  • RSA key size must be 2048 bits or greater. ([ecdf6cc6073ea13a7e71df5fad043550f08d0fa6]auth0/node-jsonwebtoken@ecdf6cc)
  • Key types must be valid for the signing / verification algorithm

Security fixes

  • security: fixes Arbitrary File Write via verify function - CVE-2022-23529
  • security: fixes Insecure default algorithm in jwt.verify() could lead to signature validation bypass - CVE-2022-23540
  • security: fixes Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - CVE-2022-23541
  • security: fixes Unrestricted key type could lead to legacy keys usage - CVE-2022-23539

8.5.1 - 2019-03-18

Bug fix

Docs

8.5.0 - 2019-02-20

New Functionality

Test Improvements

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by charlesrea, a new releaser for jsonwebtoken since your current version.


Updates minimist from 1.2.0 to 1.2.6

Changelog

Sourced from minimist's changelog.

v1.2.6 - 2022-03-21

Commits

  • test from prototype pollution PR bc8ecee
  • isConstructorOrProto adapted from PR c2b9819
  • security notice for additional prototype pollution issue ef88b93

v1.2.5 - 2020-03-12

v1.2.4 - 2020-03-11

Commits

  • security notice 4cf1354
  • additional test for constructor prototype pollution 1043d21

v1.2.3 - 2020-03-10

Commits

  • more failing proto pollution tests 13c01a5
  • even more aggressive checks for protocol pollution 38a4d1c

v1.2.2 - 2020-03-10

Commits

v1.2.1 - 2020-03-10

Merged

Commits

Commits

Updates moment from 2.17.1 to 2.29.4

Changelog

Sourced from moment's changelog.

2.29.4

  • Release Jul 6, 2022
    • #6015 [bugfix] Fix ReDoS in preprocessRFC2822 regex

2.29.3 Full changelog

  • Release Apr 17, 2022
    • #5995 [bugfix] Remove const usage
    • #5990 misc: fix advisory link

2.29.2 See full changelog

  • Release Apr 3 2022

Address GHSA-8hfj-j24r-96c4

2.29.1 See full changelog

  • Release Oct 6, 2020

Updated deprecation message, bugfix in hi locale

2.29.0 See full changelog

  • Release Sept 22, 2020

New locales (es-mx, bn-bd). Minor bugfixes and locale improvements. More tests. Moment is in maintenance mode. Read more at this link: https://momentjs.com/docs/#/-project-status/

2.28.0 See full changelog

  • Release Sept 13, 2020

Fix bug where .format() modifies original instance, and locale updates

2.27.0 See full changelog

  • Release June 18, 2020

Added Turkmen locale, other locale improvements, slight TypeScript fixes

2.26.0 See full changelog

  • Release May 19, 2020

... (truncated)

Commits

Updates node-lmdb from 0.4.12 to 0.9.7

Commits
Maintainer changes

This version was pushed to npm by kriszyp, a new releaser for node-lmdb since your current version.


Updates redis from 2.8.0 to 4.7.0

Release notes

Sourced from redis's releases.

redis@4.7.0

Enhancements

  • Upgrade @redis/client from 1.5.16 to 1.6.0
  • Upgrade @redis/json from 1.0.6 to 1.0.7
  • Upgrade @redis/search from 1.1.6 to 1.2.0
  • Upgrade @redis/time-series from 1.0.5 to 1.1.0

redis@4.6.15

Enhancements

  • Upgrade @redis/client from 1.5.16 to 1.5.17

redis@4.6.14

Enhancements

  • Upgrade @redis/client from 1.5.14 to 1.5.16

redis@4.6.13

Enhancements

  • Upgrade @redis/client from 1.5.13 to 1.5.14

redis@4.6.12

Enhancements

  • Upgrade @redis/client from 1.5.12 to 1.5.13

redis@4.6.11

Enhancements

  • Upgrade @redis/client from 1.5.11 to 1.5.12
  • Upgrade @redis/graph from 1.1.0 to 1.1.1
  • Upgrade @redis/json from 1.1.5 to 1.1.6

redis@4.6.10

Fixes

  • Revert the minimum node version change
  • Upgrade @redis/client from 1.5.9 to 1.5.10
  • Upgrade @redis/search from 1.1.3 to 1.1.4
  • Upgrade @redis/json from 1.0.4 to 1.0.5

redis@4.6.9

Enhancements

  • Upgrade @redis/client from 1.5.9 to 1.5.10
  • Upgrade @redis/search from 1.1.3 to 1.1.4
  • Upgrade @redis/json from 1.0.4 to 1.0.5

redis@4.6.8

Enhancements

  • upgrade @redis/client from 1.5.8 to 1.5.9
  • upgrade @redis/time-series from 1.0.4 to 1.0.5

redis@4.6.7

Enhancements

  • upgrade @redis/client from 1.5.7 to 1.5.8

... (truncated)

Changelog

Sourced from redis's changelog.

Changelog

v4.0.2 - 13 Jan, 2022

Fixes

  • Fix v4 commands in legacy mode (#1820)
  • Fix EXISTS command reply (#1819)
  • Fix handler for "redis:invalidate" messages (#1798)
  • Fix "SEPARATOR" typo in RediSearch (#1823)

Enhancements

  • First release of @node-redis/bloom
  • Add support for Buffers
  • Enhance ASK and MOVED errors handler

v4.0.1 - 13 Dec, 2021

Fixes

  • Fix NOAUTH error when using authentication & database (#1681)
  • Allow to .quit() in PubSub mode (#1766)
  • Add an option to configurate name on a client (#1758)
  • Lowercase commands (client.hset) in legacyMode
  • Fix PubSub resubscribe (#1764)
  • Fix RedisSocketOptions type (#1741)

Enhancements

  • Add support for numbers and Buffers in HSET (#1738 #1739)
  • Export RedisClientType, RedisClusterType and some more types (#1673)
  • First release of @node-redis/time-series

v4.0.0 - 24 Nov, 2021

This version is a major change and refactor, adding modern JavaScript capabilities and multiple breaking changes. See the migration guide for tips on how to upgrade.

Breaking Changes

  • All functions return Promises by default
  • Dropped support for Node.js 10.x, the minimum supported Node.js version is now 12.x
  • createClient takes new and different arguments
  • The prefix, rename_commands configuration options to createClient have been removed
  • The enable_offline_queue configuration option is removed, executing commands on a closed client (without calling .connect() or after calling .disconnect()) will reject immediately
  • Login credentials are no longer saved when using .auth() directly

Features

  • Added support for Promises

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by leibale, a new releaser for redis since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group with 9 updates
05978c9 
Bumps the npm_and_yarn group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [async](https://github.com/caolan/async) | `2.1.4` | `2.6.4` |
| [bignum](https://github.com/justmoon/node-bignum) | `0.12.5` | `0.13.1` |
| [debug](https://github.com/debug-js/debug) | `2.5.1` | `2.6.9` |
| [express](https://github.com/expressjs/express) | `4.14.0` | `4.20.0` |
| [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken) | `7.4.3` | `9.0.2` |
| [minimist](https://github.com/minimistjs/minimist) | `1.2.0` | `1.2.6` |
| [moment](https://github.com/moment/moment) | `2.17.1` | `2.29.4` |
| [node-lmdb](https://github.com/Venemo/node-lmdb) | `0.4.12` | `0.9.7` |
| [redis](https://github.com/redis/node-redis) | `2.8.0` | `4.7.0` |


Updates `async` from 2.1.4 to 2.6.4
- [Release notes](https://github.com/caolan/async/releases)
- [Changelog](https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md)
- [Commits](caolan/async@v2.1.4...v2.6.4)

Updates `bignum` from 0.12.5 to 0.13.1
- [Commits](justmoon/node-bignum@v0.12.5...v0.13.1)

Updates `debug` from 2.5.1 to 2.6.9
- [Release notes](https://github.com/debug-js/debug/releases)
- [Changelog](https://github.com/debug-js/debug/blob/2.6.9/CHANGELOG.md)
- [Commits](debug-js/debug@2.5.1...2.6.9)

Updates `express` from 4.14.0 to 4.20.0
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@4.14.0...4.20.0)

Updates `jsonwebtoken` from 7.4.3 to 9.0.2
- [Changelog](https://github.com/auth0/node-jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jsonwebtoken@v7.4.3...v9.0.2)

Updates `minimist` from 1.2.0 to 1.2.6
- [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md)
- [Commits](minimistjs/minimist@v1.2.0...v1.2.6)

Updates `moment` from 2.17.1 to 2.29.4
- [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md)
- [Commits](moment/moment@2.17.1...2.29.4)

Updates `node-lmdb` from 0.4.12 to 0.9.7
- [Release notes](https://github.com/Venemo/node-lmdb/releases)
- [Commits](https://github.com/Venemo/node-lmdb/commits/v0.9.7)

Updates `redis` from 2.8.0 to 4.7.0
- [Release notes](https://github.com/redis/node-redis/releases)
- [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md)
- [Commits](https://github.com/redis/node-redis/compare/v.2.8.0...redis@4.7.0)

---
updated-dependencies:
- dependency-name: async
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: bignum
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: debug
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: express
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: jsonwebtoken
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: minimist
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: moment
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: node-lmdb
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: redis
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Sep 10, 2024
@dependabot dependabot bot mentioned this pull request Sep 10, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants