Skip to content

Update all dependencies#143

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all
Open

Update all dependencies#143
renovate[bot] wants to merge 1 commit intomainfrom
renovate/all

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate Bot commented May 1, 2024

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Age Adoption Passing Confidence
actions/checkout action major v4.1.7v6.0.2 age adoption passing confidence
actions/setup-node action major v4.0.3v6.4.0 age adoption passing confidence
actions/upload-artifact action major v4.4.0v7.0.1 age adoption passing confidence
axios (source) dependencies minor 1.7.71.15.2 age adoption passing confidence
babel-jest (source) devDependencies major ^29.0.0^30.0.0 age adoption passing confidence
babel-loader devDependencies major ^9.0.0^10.0.0 age adoption passing confidence
eslint (source) devDependencies major 9.10.010.2.1 age adoption passing confidence
eslint-plugin-jest devDependencies major ^28.8.3^29.0.0 age adoption passing confidence
github/codeql-action action major v3.26.6v4.35.2 age adoption passing confidence
jest (source) devDependencies major ^29.0.0^30.0.0 age adoption passing confidence
jest-environment-jsdom (source) devDependencies major ^29.3.1^30.0.0 age adoption passing confidence
nock devDependencies major ^13.0.0^14.0.0 age adoption passing confidence
node uses-with major 18.x24.x age adoption passing confidence
ossf/scorecard-action action patch v2.4.0v2.4.3 age adoption passing confidence
step-security/harden-runner action minor v2.9.1v2.19.0 age adoption passing confidence
webpack-cli (source) devDependencies major ^5.0.0^7.0.0 age adoption passing confidence

Release Notes

actions/checkout (actions/checkout)

v6.0.2

Compare Source

v6.0.1

Compare Source

v6-beta

Compare Source

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v6.0.0

Compare Source

v6

Compare Source

v5.0.1

Compare Source

What's Changed

Full Changelog: actions/checkout@v5...v5.0.1

v5.0.0

Compare Source

What's Changed
⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

v5

Compare Source

v4.3.1

Compare Source

What's Changed

Full Changelog: actions/checkout@v4...v4.3.1

v4.3.0

Compare Source

What's Changed
New Contributors

Full Changelog: actions/checkout@v4...v4.3.0

v4.2.2

Compare Source

v4.2.1

Compare Source

v4.2.0

Compare Source

actions/setup-node (actions/setup-node)

v6.4.0

Compare Source

v6.3.0

Compare Source

What's Changed

Enhancements:

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:
Bug fixes:

New Contributors

Full Changelog: actions/setup-node@v6...v6.3.0

v6.2.0

Compare Source

v6.1.0

Compare Source

What's Changed

Enhancement:
Dependency updates:
Documentation update:

Full Changelog: actions/setup-node@v6...v6.1.0

v6.0.0

Compare Source

What's Changed

Breaking Changes

Dependency Upgrades

Full Changelog: actions/setup-node@v5...v6.0.0

v6

Compare Source

v5

Compare Source

v5.0.0

Compare Source

What's Changed
Breaking Changes

This update, introduces automatic caching when a valid packageManager field is present in your package.json. This aims to improve workflow performance and make dependency management more seamless.
To disable this automatic caching, set package-manager-cache: false

steps:
- uses: actions/checkout@v5
- uses: actions/setup-node@v5
  with:
    package-manager-cache: false

Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. See Release Notes

Dependency Upgrades
New Contributors

Full Changelog: actions/setup-node@v4...v5.0.0

v4.4.0

Compare Source

What's Changed
Bug fixes:
Enhancement:
Dependency update:
New Contributors

Full Changelogactions/setup-node@v4...v4.4.0

v4.3.0

Compare Source

What's Changed
Dependency updates
New Contributors

Full Changelog: actions/setup-node@v4...v4.3.0

v4.2.0

Compare Source

What's Changed
New Contributors

Full Changelog: actions/setup-node@v4...v4.2.0

v4.1.0

Compare Source

What's Changed
  • Resolve High Security Alerts by upgrading Dependencies by @​aparnajyothi-y in #​1132
  • Upgrade IA Publish by @​Jcambass in #​1134
  • Revise isGhes logic by @​jww3 in #​1148
  • Add architecture to cache key by @​pengx17 in #​843
    This addresses issues with caching by adding the architecture (arch) to the cache key, ensuring that cache keys are accurate to prevent conflicts.
    Note: This change may break previous cache keys as they will no longer be compatible with the new format.
New Contributors

Full Changelog: actions/setup-node@v4...v4.1.0

v4.0.4

Compare Source

What's Changed
Documentation changes:
New Contributors

Full Changelog: actions/setup-node@v4...v4.0.4

actions/upload-artifact (actions/upload-artifact)

v7.0.1

Compare Source

What's Changed

Full Changelog: actions/upload-artifact@v7...v7.0.1

v7.0.0

Compare Source

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v6...v7.0.0

v7

Compare Source

v6

Compare Source

v6.0.0

Compare Source

v5

Compare Source

v5.0.0

Compare Source

v4.6.2

Compare Source

What's Changed

  • Update to use artifact 2.3.2 package & prepare for new upload-artifact release by @​salmanmkc in #​685

New Contributors

Full Changelog: actions/upload-artifact@v4...v4.6.2

v4.6.1

Compare Source

What's Changed

Full Changelog: actions/upload-artifact@v4...v4.6.1

v4.6.0

Compare Source

What's Changed

Full Changelog: actions/upload-artifact@v4...v4.6.0

v4.5.0

Compare Source

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v4.4.3...v4.5.0

v4.4.3

Compare Source

What's Changed

Full Changelog: actions/upload-artifact@v4.4.2...v4.4.3

v4.4.2

Compare Source

What's Changed

  • Bump @actions/artifact to 2.1.11 by @​robherley in #​627
    • Includes fix for relative symlinks not resolving properly

Full Changelog: actions/upload-artifact@v4.4.1...v4.4.2

v4.4.1

Compare Source

What's Changed

New Contributors

Full Changelog: actions/upload-artifact@v4.4.0...v4.4.1

axios/axios (axios)

v1.15.2

Compare Source

This release delivers prototype-pollution hardening for the Node HTTP adapter, adds an opt-in allowedSocketPaths allowlist to mitigate SSRF via Unix domain sockets, fixes a keep-alive socket memory leak, and ships supply-chain hardening across CI and security docs.

🔒 Security Fixes

  • Prototype Pollution Hardening (HTTP Adapter): Hardened the Node HTTP adapter and resolveConfig/mergeConfig/validator paths to read only own properties and use null-prototype config objects, preventing polluted auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser from influencing requests. (#​10779)
  • SSRF via socketPath: Rejects non-string socketPath values and adds an opt-in allowedSocketPaths config option to restrict permitted Unix domain socket paths, returning AxiosError ERR_BAD_OPTION_VALUE on mismatch. (#​10777)
  • Supply-chain Hardening: Added .npmrc with ignore-scripts=true, lockfile lint CI, non-blocking reproducible build diff, scoped CODEOWNERS, expanded SECURITY.md/THREATMODEL.md with provenance verification (npm audit signatures), 60-day resolution policy, and maintainer incident-response runbook. (#​10776)

🚀 New Features

  • allowedSocketPaths Config Option: New request config option (and TypeScript types) to allowlist Unix domain socket paths used by the Node http adapter; backwards compatible when unset. (#​10777)

🐛 Bug Fixes

  • Keep-alive Socket Memory Leak: Installs a single per-socket error listener tracking the active request via kAxiosSocketListener/kAxiosCurrentReq, eliminating per-request listener accumulation, MaxListenersExceededWarning, and linear heap growth under concurrent or long-running keep-alive workloads (fixes #​10780). (#​10788)

🔧 Maintenance & Chores

  • Changelog: Updated CHANGELOG.md with v1.15.1 release notes. (#​10781)

Full Changelog

v1.15.1

Compare Source

v1.15.0

Compare Source

Bug Fixes
Features
  • fomdata: added support for spec-compliant FormData & Blob types; (#​5316) (6ac574e)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.2.6 (2023-01-28)

Bug Fixes
  • headers: added missed Authorization accessor; (#​5502) (342c0ba)
  • types: fixed CommonRequestHeadersList & CommonResponseHeadersList types to be private in commonJS; (#​5503) (5a3d0a3)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.2.5 (2023-01-26)

Bug Fixes
  • types: fixed AxiosHeaders to handle spread syntax by making all methods non-enumerable; (#​5499) (580f1e8)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.2.4 (2023-01-22)

Bug Fixes
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

1.2.3 (2023-01-10)

Bug Fixes
  • types: fixed AxiosRequestConfig header interface by refactoring it to RawAxiosRequestConfig; (#​5420) (0811963)
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

[1.2.2] - 2022-12-29

Fixed
Chores
  • chore(ci): set conventional-changelog header config #​5406
  • chore(ci): fix automatic contributors resolving #​5403
  • chore(ci): improved logging for the contributors list generator #​5398
  • chore(ci): fix release action #​5397
  • chore(ci): fix version bump script by adding bump argument for target version #​5393
  • chore(deps): bump decode-uri-component from 0.2.0 to 0.2.2 #​5342
  • chore(ci): GitHub Actions Release script #​5384
  • chore(ci): release scripts #​5364
Contributors to this release

[1.2.1] - 2022-12-05

Changed
  • feat(exports): export mergeConfig #​5151
Fixed
  • fix(CancelledError): include config #​4922
  • fix(general): removing multiple/trailing/leading whitespace #​5022
  • fix(headers): decompression for responses without Content-Length header #​5306
  • fix(webWorker): exception to sending form data in web worker #​5139
Refactors
  • refactor(types): AxiosProgressEvent.event type to any #​5308
  • refactor(types): add missing types for static AxiosError.from method #​4956
Chores
  • chore(docs): remove README link to non-existent upgrade guide #​5307
  • chore(docs): typo in issue template name #​5159
Contributors to this release
PRs

⚠️ Critical vulnerability fix. See https://security.snyk.io/vuln/SNYK-JS-AXIOS-6032459

[1.2.0] - 2022-11-10

Changed
  • changed: refactored module exports #​5162
  • change: re-added support for loading Axios with require('axios').default #​5225
Fixed
  • fix: improve AxiosHeaders class #​5224
  • fix: TypeScript type definitions for commonjs #​5196
  • fix: type definition of use method on AxiosInterceptorManager to match the the README #​5071
  • fix: __dirname is not defined in the sandbox #​5269
  • fix: AxiosError.toJSON method to avoid circular references #​5247
  • fix: Z_BUF_ERROR when content-encoding is set but the response body is empty #​5250
Refactors
  • refactor: allowing adapters to be loaded by name #​5277
Chores
  • chore: force CI restart #​5243
  • chore: update ECOSYSTEM.md #​5077
  • chore: update get/index.html #​5116
  • chore: update Sandbox UI/UX #​5205
  • chore:(actions): remove git credentials after checkout #​5235
  • chore(actions): bump actions/dependency-review-action from 2 to 3 #​5266
  • chore(packages): bump loader-utils from 1.4.1 to 1.4.2 #​5295
  • chore(packages): bump engine.io from 6.2.0 to 6.2.1 #​5294
  • chore(packages): bump socket.io-parser from 4.0.4 to 4.0.5 #​5241
  • chore(packages): bump loader-utils from 1.4.0 to 1.4.1 #​5245
  • chore(docs): update Resources links in README #​5119
  • chore(docs): update the link for JSON url #​5265
  • chore(docs): fix broken links #​5218
  • chore(docs): update

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, on day 1 of the month (* 0-3 1 * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot force-pushed the renovate/all branch 5 times, most recently from b79ef52 to 8c5f716 Compare May 8, 2024 21:33
@renovate renovate Bot force-pushed the renovate/all branch 2 times, most recently from d4fc78e to cd9ae26 Compare May 13, 2024 14:04
@renovate renovate Bot force-pushed the renovate/all branch 6 times, most recently from c2adb71 to 0be4468 Compare May 22, 2024 04:45
@renovate renovate Bot force-pushed the renovate/all branch 3 times, most recently from 878cb4e to 45c41c3 Compare June 4, 2024 15:50
@renovate renovate Bot force-pushed the renovate/all branch 4 times, most recently from 7c24ab9 to 754b37b Compare June 13, 2024 15:01
@renovate renovate Bot force-pushed the renovate/all branch 2 times, most recently from cb667d2 to 1cef6b1 Compare June 28, 2024 18:37
@renovate renovate Bot force-pushed the renovate/all branch 3 times, most recently from 02ff060 to 5fb1779 Compare July 12, 2024 09:40
@renovate renovate Bot force-pushed the renovate/all branch 3 times, most recently from b7a40a4 to 4335087 Compare July 19, 2024 16:23
@renovate renovate Bot force-pushed the renovate/all branch 3 times, most recently from a5044c8 to 456be18 Compare August 23, 2024 22:14
@renovate renovate Bot force-pushed the renovate/all branch 4 times, most recently from 1adb661 to f67768f Compare August 31, 2024 22:15
@renovate renovate Bot changed the title Update all dependencies chore(deps): update all dependencies Sep 6, 2024
@renovate renovate Bot changed the title chore(deps): update all dependencies chore(deps): update all dependencies - autoclosed Sep 10, 2024
@renovate renovate Bot closed this Sep 10, 2024
@renovate renovate Bot deleted the renovate/all branch September 10, 2024 21:14
@renovate renovate Bot restored the renovate/all branch September 11, 2024 00:10
@renovate renovate Bot changed the title chore(deps): update all dependencies - autoclosed chore(deps): update all dependencies Sep 11, 2024
@renovate renovate Bot reopened this Sep 11, 2024
@renovate renovate Bot changed the title chore(deps): update all dependencies chore(deps): update step-security/harden-runner action to v2.10.0 Sep 11, 2024
@renovate renovate Bot changed the title chore(deps): update step-security/harden-runner action to v2.10.0 chore(deps): update step-security/harden-runner action to v2.10.1 Sep 11, 2024
@renovate renovate Bot changed the title chore(deps): update step-security/harden-runner action to v2.10.1 chore(deps): update all dependencies Sep 13, 2024
@renovate renovate Bot force-pushed the renovate/all branch 3 times, most recently from 9c1f931 to fe3f0ae Compare September 19, 2024 14:39
@renovate renovate Bot force-pushed the renovate/all branch 4 times, most recently from 09c4b11 to fd147a6 Compare September 25, 2024 18:38
@renovate renovate Bot force-pushed the renovate/all branch 2 times, most recently from 29b6525 to e586429 Compare October 3, 2024 21:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants