build(deps): bump the npm_and_yarn group across 2 directories with 5 updates by dependabot[bot] · Pull Request #4 · canopy1/sst

dependabot · 2024-03-07T18:59:02Z

Bumps the npm_and_yarn group with 3 updates in the / directory: vite, undici and fast-jwt.
Bumps the npm_and_yarn group with 2 updates in the /examples/standard-nextjs directory: next and postcss.

Updates vite from 2.9.15 to 2.9.17

Changelog

Sourced from vite's changelog.

2.9.17 (2024-01-19)

fix: port #15653 to v3 (#15655) (0cd769c), closes #15653 #15655

2.9.16 (2023-05-26)

fix: port #13348 to v2, fs.deny with leading double slash (#13350) (7d8100a), closes #13348 #13350

Commits

3441f12 release: v2.9.17
0cd769c fix: port #15653 to v3 (#15655)
ea814d7 release: v2.9.16
7d8100a fix: port #13348 to v2, fs.deny with leading double slash (#13350)
See full diff in compare view

Updates undici from 5.12.0 to 5.28.3

Release notes

Sourced from undici's releases.

v5.28.3

⚠️ Security Release ⚠️

Fixes:

CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch

Full Changelog: nodejs/undici@v5.28.2...v5.28.3

v5.28.2

What's Changed

fix: remove optional chainning for compatible with Nodejs12 and below by @bugb in nodejs/undici#2470

fix: remove node: prefix by @tsctx in nodejs/undici#2471

perf: avoid Headers initialization by @tsctx in nodejs/undici#2468

fix: handle SharedArrayBuffer correctly by @tsctx in nodejs/undici#2466

fix: Add null type to signal in RequestInit by @gebsh in nodejs/undici#2455

fix: correctly handle data URL with hashes. by @tsctx in nodejs/undici#2475

fix: check response for timinginfo allow flag by @ToshB in nodejs/undici#2477

Make call to onBodySent conditional in RetryHandler by @MzUgM in nodejs/undici#2478

refactor: better integrity check by @tsctx in nodejs/undici#2462

fix: Added support for inline URL username:password proxy auth by @matt-way in nodejs/undici#2473

build(deps-dev): bump jsdom from 22.1.0 to 23.0.0 by @dependabot in nodejs/undici#2472

build(deps-dev): bump sinon from 16.1.3 to 17.0.1 by @dependabot in nodejs/undici#2405

build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 by @dependabot in nodejs/undici#2396

build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 by @dependabot in nodejs/undici#2395

build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 by @dependabot in nodejs/undici#2392

build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 by @dependabot in nodejs/undici#2389

build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 by @dependabot in nodejs/undici#2302

New Contributors

@bugb made their first contribution in nodejs/undici#2470

@gebsh made their first contribution in nodejs/undici#2455

@ToshB made their first contribution in nodejs/undici#2477

@MzUgM made their first contribution in nodejs/undici#2478

@matt-way made their first contribution in nodejs/undici#2473

Full Changelog: nodejs/undici@v5.28.1...v5.28.2

v5.28.1

What's Changed

perf: Improve normalizeMethod by @tsctx in nodejs/undici#2456

fix: dispatch error handling by @ronag in nodejs/undici#2459

perf(request): optimize if headers are given by @tsctx in nodejs/undici#2454

Full Changelog: nodejs/undici@v5.28.0...v5.28.1

v5.28.0

What's Changed

fix(parseHeaders): util.parseHeaders handle correctly array of buffer… by @mdoria12 in nodejs/undici#2398

... (truncated)

Commits

e71cb4c Bumped v5.28.3
20c65b8 Fix tests for Node.js v20.11.0 (#2618)
8ec52cd Fix tests for Node.js v21 (#2609)
d3aa574 Merge pull request from GHSA-3787-6prv-h9w3
9a14e5f Bumped v5.28.2
fcdfe87 build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 (#2302)
169c157 build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 (#2389)
9788177 build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 (#2392)
1f6d159 build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 (#2395)
a393a86 build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 (#2396)
Additional commits viewable in compare view

Updates fast-jwt from 3.1.1 to 3.3.2

Release notes

Sourced from fast-jwt's releases.

v3.3.2

What's Changed

[OPTIC-RELEASE-AUTOMATION] release/v3.3.1 by @optic-release-automation in nearform/fast-jwt#390

fix: add missingRequiredClaim to TokenValidationErrorCode by @TimLehner in nearform/fast-jwt#403

fix(typescript): fix typescript type DecodedJwt by @qoomon in nearform/fast-jwt#407

New Contributors

@TimLehner made their first contribution in nearform/fast-jwt#403

@qoomon made their first contribution in nearform/fast-jwt#407

Full Changelog: nearform/fast-jwt@v3.3.1...v3.3.2

v3.3.1

What's Changed

[OPTIC-RELEASE-AUTOMATION] release/v3.3.0 by @optic-release-automation in nearform/fast-jwt#382

fix: removed pre publish step by @williamlines in nearform/fast-jwt#385

Full Changelog: nearform/fast-jwt@v3.3.0...v3.3.1

v3.3.0

What's Changed

[OPTIC-RELEASE-AUTOMATION] release/v3.2.0 by @optic-release-automation in nearform/fast-jwt#367

chore(deps-dev): bump tsd from 0.28.1 to 0.29.0 by @dependabot in nearform/fast-jwt#371

chore: drop support for Node 14 by @simoneb in nearform/fast-jwt#378

perf: use node: prefix to bypass require.cache call for builtins by @Fdawgs in nearform/fast-jwt#375

Allow expiresIn to be a string by @felixmosh in nearform/fast-jwt#376

New Contributors

@Fdawgs made their first contribution in nearform/fast-jwt#375

@felixmosh made their first contribution in nearform/fast-jwt#376

Full Changelog: nearform/fast-jwt@v3.2.0...v3.3.0

v3.2.0

What's Changed

[OPTIC-RELEASE-AUTOMATION] release/v3.1.1 by @optic-release-automation in nearform/fast-jwt#345

chore(deps-dev): bump @sinonjs/fake-timers from 10.2.0 to 11.0.0 by @dependabot in nearform/fast-jwt#346

chore: update dependabot config by @williamlines in nearform/fast-jwt#349

chore(deps-dev): bump prettier from 2.8.8 to 3.0.0 by @dependabot in nearform/fast-jwt#353

support notBefore and expiresIn as strings by @relvao in nearform/fast-jwt#364

New Contributors

@williamlines made their first contribution in nearform/fast-jwt#349

@relvao made their first contribution in nearform/fast-jwt#364

Full Changelog: nearform/fast-jwt@v3.1.1...v3.2.0

Commits

6604166 Release v3.3.2
15a6e92 Merge pull request from GHSA-c2ff-88x2-x9pg
a5ef39b fix(typescript): fix typescript type DecodedJwt (#407)
4d8c66f fix: add missingRequiredClaim to TokenValidationErrorCode (#403)
52e94dd Release v3.3.1 (#390)
05b02d7 fix: removed pre publish step (#385)
0fd4664 Release v3.3.0 (#382)
7b3d317 Allow expiresIn to be a string (#376)
f836ce1 perf: use node: prefix to bypass require.cache call for builtins (#375)
6e5242b chore: drop support for Node 14 (#378)
Additional commits viewable in compare view

Updates next from 13.5.3 to 14.1.3

Release notes

Sourced from next's releases.

v14.1.2

Note: this is a backport release for critical bug fixes -- this does not include all pending features/changes on canary

Core Changes

Fix sitemap generateSitemaps support for string id (#61088)

Fix: generateSitemaps in production giving 404 (#62212)

Fix redirect under suspense boundary with basePath (#62597)

Fix: Add stricter check for "use server" exports (#62821)

ensure server action errors notify rejection handlers (#61588)

make router restore action resilient to a missing tree (#62098)

build: remove sentry from the externals list #61194

Reduce memory/cache overhead from over loader processing #62005

Credits

Huge thanks to @huozhi, @shuding, @Ethan-Arrowood, @styfle, @ijjk, @ztanner, @balazsorban44, @kdy1, and @williamli for helping!

v14.1.2-canary.7

Core Changes

remove reducer unit tests: #62766

Documentation Changes

Update sitemap.mdx: #62809

Credits

Huge thanks to @ztanner and @devr77 for helping!

v14.1.2-canary.6

Core Changes

fix: Add stricter check for "use server" exports: #62821

fix(next-core): throw on invalid metadata handler: #62829

Revert "Add experimental config for navigation raf test (#62668)": #62834

Revert "refactor(analysis): rust based page-static-info, deprecate js parse interface in next-swc": #62838

Example Changes

Fix with-supertokens example: #62817

Credits

Huge thanks to @shuding, @kwonoj, @ijjk, and @timneutkens for helping!

v14.1.2-canary.5

Core Changes

... (truncated)

Commits

fc38ee1 v14.1.3
85a5c4d fix type
4b059bc Upgrade to latest @edge-runtime packages (#62955)
b10a610 Fix output: export with custom distDir (#62064)
960b738 Migrate locale redirect handling to router-server (#62606)
2f210d4 update release workflow
f564dee v14.1.2
a85519e Fix sitemap generateSitemaps support for string id (#61088)
0a2d775 Fix: generateSitemaps in production giving 404 (#62212)
400b57c Fix redirect under suspense boundary with basePath (#62597)
Additional commits viewable in compare view

Updates postcss from 8.4.30 to 8.4.35

Release notes

Sourced from postcss's releases.

8.4.35

Avoid ! in node.parent.nodes type.

Allow to pass undefined to node adding method to simplify types.

8.4.34

Fixed AtRule#nodes type (by @tim-we).

Cleaned up code (by @DrKiraDmitry).

8.4.33

Fixed NoWorkResult behavior difference with normal mode (by @romainmenke).

Fixed NoWorkResult usage conditions (by @ahmdammarr).

8.4.32

Fixed postcss().process() types (by @ferreira-tb).

8.4.31

Fixed \r parsing to fix CVE-2023-44270.

Changelog

Sourced from postcss's changelog.

8.4.35

Avoid ! in node.parent.nodes type.

Allow to pass undefined to node adding method to simplify types.

8.4.34

Fixed AtRule#nodes type (by Tim Weißenfels).

Cleaned up code (by Dmitry Kirillov).

8.4.33

Fixed NoWorkResult behavior difference with normal mode (by Romain Menke).

Fixed NoWorkResult usage conditions (by @ahmdammarr).

8.4.32

Fixed postcss().process() types (by Andrew Ferreira).

8.4.31

Fixed \r parsing to fix CVE-2023-44270.

Commits

edda95e Release 8.4.35 version
612f360 Merge pull request #1924 from postcss/refactor/types
5e7449f Fix node.parent.nodes type
65075df Allow to pass undefined to adding methods to simplify type check
477b3bb Release 8.4.34 version
25af117 Update dependencies
bb0314a Merge pull request #1922 from tim-we/improve-at-rule-types
9dd5a93 Fix at-rule test
8322d11 Fix visitor test
ee7fcd4 Fix Document#nodes
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…updates Bumps the npm_and_yarn group with 3 updates in the / directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite), [undici](https://github.com/nodejs/undici) and [fast-jwt](https://github.com/nearform/fast-jwt). Bumps the npm_and_yarn group with 2 updates in the /examples/standard-nextjs directory: [next](https://github.com/vercel/next.js) and [postcss](https://github.com/postcss/postcss). Updates `vite` from 2.9.15 to 2.9.17 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/v2.9.17/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v2.9.17/packages/vite) Updates `undici` from 5.12.0 to 5.28.3 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.12.0...v5.28.3) Updates `fast-jwt` from 3.1.1 to 3.3.2 - [Release notes](https://github.com/nearform/fast-jwt/releases) - [Changelog](https://github.com/nearform/fast-jwt/blob/master/CHANGELOG.md) - [Commits](nearform/fast-jwt@v3.1.1...v3.3.2) Updates `next` from 13.5.3 to 14.1.3 - [Release notes](https://github.com/vercel/next.js/releases) - [Changelog](https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v13.5.3...v14.1.3) Updates `postcss` from 8.4.30 to 8.4.35 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.4.30...8.4.35) --- updated-dependencies: - dependency-name: vite dependency-type: direct:development dependency-group: npm_and_yarn-security-group - dependency-name: undici dependency-type: direct:production dependency-group: npm_and_yarn-security-group - dependency-name: fast-jwt dependency-type: direct:production dependency-group: npm_and_yarn-security-group - dependency-name: next dependency-type: direct:production dependency-group: npm_and_yarn-security-group - dependency-name: postcss dependency-type: direct:development dependency-group: npm_and_yarn-security-group ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2024-03-24T02:16:12Z

Superseded by #5.

dependabot Bot added the dependencies Pull requests that update a dependency file label Mar 7, 2024

dependabot Bot closed this Mar 24, 2024

dependabot Bot deleted the dependabot/npm_and_yarn/npm_and_yarn-security-group-5d1be12d4d branch March 24, 2024 02:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the npm_and_yarn group across 2 directories with 5 updates#4

build(deps): bump the npm_and_yarn group across 2 directories with 5 updates#4
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/npm_and_yarn-security-group-5d1be12d4d

dependabot Bot commented on behalf of github Mar 7, 2024

Uh oh!

dependabot Bot commented on behalf of github Mar 24, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Mar 7, 2024

2.9.17 (2024-01-19)

2.9.16 (2023-05-26)

v5.28.3

⚠️ Security Release ⚠️

v5.28.2

What's Changed

New Contributors

v5.28.1

What's Changed

v5.28.0

What's Changed

v3.3.2

What's Changed

New Contributors

v3.3.1

What's Changed

v3.3.0

What's Changed

New Contributors

v3.2.0

What's Changed

New Contributors

v14.1.2

Core Changes

Credits

v14.1.2-canary.7

Core Changes

Documentation Changes

Credits

v14.1.2-canary.6

Core Changes

Example Changes

Credits

v14.1.2-canary.5

Core Changes

8.4.35

8.4.34

8.4.33

8.4.32

8.4.31

8.4.35

8.4.34

8.4.33

8.4.32

8.4.31

Uh oh!

dependabot Bot commented on behalf of github Mar 24, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants