build(deps): bump the npm_and_yarn group across 1 directory with 20 updates #2

dependabot · 2024-06-18T00:36:26Z

Bumps the npm_and_yarn group with 16 updates in the / directory:

Package	From	To
nunjucks	`3.2.3`	`3.2.4`
openzeppelin-solidity	`2.2.0`	`4.8.1`
apollo-server-core	`3.10.3`	`3.13.0`
debug	`2.6.9`	`4.3.4`
eth-gas-reporter	`0.2.25`	`0.2.27`
browserify-sign	`4.2.1`	`4.2.3`
cookiejar	`2.1.3`	`2.1.4`
decode-uri-component	`0.2.0`	`0.2.2`
es5-ext	`0.10.62`	`0.10.64`
express	`4.17.1`	`4.19.2`
semver	`5.7.1`	`7.6.2`
truffle	`5.6.3`	`5.11.5`
get-func-name	`2.0.0`	`2.0.2`
got	`9.6.0`	`12.1.0`
web3	`1.7.4`	`1.10.4`
http-cache-semantics	`4.1.0`	`4.1.1`

Updates nunjucks from 3.2.3 to 3.2.4

Release notes

Sourced from nunjucks's releases.

v3.2.4

What's Changed

fix: html encode backslashes if used with escape filter or autoescape by @fdintino in mozilla/nunjucks#1437. Fixes CVE-2023-2142 ([bugzilla #1825980](https://bugzilla.mozilla.org/show_bug.cgi?id=1825980))

Full Changelog: mozilla/nunjucks@v3.2.3...v3.2.4

Changelog

Sourced from nunjucks's changelog.

3.2.4 (Apr 13 2023)

HTML encode backslashes when expressions are passed through the escape filter (including when this is done automatically with autoescape). Merge of #1437.

Commits

86a77f4 Release v3.2.4
ec16d21 fix: html encode backslashes if used with escape filter or autoescape (#1437)
See full diff in compare view

Updates openzeppelin-solidity from 2.2.0 to 4.8.1

Release notes

Sourced from openzeppelin-solidity's releases.

v4.8.1

ERC4626: Use staticcall instead of call when fetching underlying ERC-20 decimals. (#3943)

v4.8.0

Note Don't miss the section on Breaking changes at the end.

TimelockController: Added a new admin constructor parameter that is assigned the admin role instead of the deployer account. (#3722)

Initializable: add internal functions _getInitializedVersion and _isInitializing (#3598)

ERC165Checker: add supportsERC165InterfaceUnchecked for consulting individual interfaces without the full ERC165 protocol. (#3339)

Address: optimize functionCall by calling functionCallWithValue directly. (#3468)

Address: optimize functionCall functions by checking contract size only if there is no returned data. (#3469)

Governor: make the relay function payable, and add support for EOA payments. (#3730)

GovernorCompatibilityBravo: remove unused using statements. (#3506)

ERC20: optimize _transfer, _mint and _burn by using unchecked arithmetic when possible. (#3513)

ERC20Votes, ERC721Votes: optimize getPastVotes for looking up recent checkpoints. (#3673)

ERC20FlashMint: add an internal _flashFee function for overriding. (#3551)

ERC4626: use the same decimals() as the underlying asset by default (if available). (#3639)

ERC4626: add internal _initialConvertToShares and _initialConvertToAssets functions to customize empty vaults behavior. (#3639)

ERC721: optimize transfers by making approval clearing implicit instead of emitting an event. (#3481)

ERC721: optimize burn by making approval clearing implicit instead of emitting an event. (#3538)

ERC721: Fix balance accounting when a custom _beforeTokenTransfer hook results in a transfer of the token under consideration. (#3611)

ERC721: use unchecked arithmetic for balance updates. (#3524)

ERC721Consecutive: Implementation of EIP-2309 that allows batch minting of ERC721 tokens during construction. (#3311)

ReentrancyGuard: Reduce code size impact of the modifier by using internal functions. (#3515)

SafeCast: optimize downcasting of signed integers. (#3565)

ECDSA: Remove redundant check on the v value. (#3591)

VestingWallet: add releasable getters. (#3580)

VestingWallet: remove unused library Math.sol. (#3605)

VestingWallet: make constructor payable. (#3665)

Create2: optimize address computation by using assembly instead of abi.encodePacked. (#3600)

Clones: optimized the assembly to use only the scratch space during deployments, and optimized predictDeterministicAddress to use fewer operations. (#3640)

Checkpoints: Use procedural generation to support multiple key/value lengths. (#3589)

Checkpoints: Add new lookup mechanisms. (#3589)

Arrays: Add unsafeAccess functions that allow reading and writing to an element in a storage array bypassing Solidity's "out-of-bounds" check. (#3589)

Strings: optimize toString. (#3573)

Ownable2Step: extension of Ownable that makes the ownership transfers a two step process. (#3620)

Math and SignedMath: optimize function max by using > instead of >=. (#3679)

Math: Add log2, log10 and log256. (#3670)

Arbitrum: Update the vendored arbitrum contracts to match the nitro upgrade. (#3692)

Breaking changes

ERC721: In order to add support for batch minting via ERC721Consecutive it was necessary to make a minor breaking change in the internal interface of ERC721. Namely, the hooks _beforeTokenTransfer and _afterTokenTransfer have one additional argument that may need to be added to overrides:
 function _beforeTokenTransfer(
     address from,
     address to,
     uint256 tokenId,
</tr></table> 

... (truncated)

Changelog

Sourced from openzeppelin-solidity's changelog.

4.8.1 (2023-01-12)

ERC4626: Use staticcall instead of call when fetching underlying ERC-20 decimals. (#3943)

4.8.0 (2022-11-08)

TimelockController: Added a new admin constructor parameter that is assigned the admin role instead of the deployer account. (#3722)

Initializable: add internal functions _getInitializedVersion and _isInitializing (#3598)

ERC165Checker: add supportsERC165InterfaceUnchecked for consulting individual interfaces without the full ERC165 protocol. (#3339)

Address: optimize functionCall by calling functionCallWithValue directly. (#3468)

Address: optimize functionCall functions by checking contract size only if there is no returned data. (#3469)

Governor: make the relay function payable, and add support for EOA payments. (#3730)

GovernorCompatibilityBravo: remove unused using statements. (#3506)

ERC20: optimize _transfer, _mint and _burn by using unchecked arithmetic when possible. (#3513)

ERC20Votes, ERC721Votes: optimize getPastVotes for looking up recent checkpoints. (#3673)

ERC20FlashMint: add an internal _flashFee function for overriding. (#3551)

ERC4626: use the same decimals() as the underlying asset by default (if available). (#3639)

ERC4626: add internal _initialConvertToShares and _initialConvertToAssets functions to customize empty vaults behavior. (#3639)

ERC721: optimize transfers by making approval clearing implicit instead of emitting an event. (#3481)

ERC721: optimize burn by making approval clearing implicit instead of emitting an event. (#3538)

ERC721: Fix balance accounting when a custom _beforeTokenTransfer hook results in a transfer of the token under consideration. (#3611)

ERC721: use unchecked arithmetic for balance updates. (#3524)

ERC721Consecutive: Implementation of EIP-2309 that allows batch minting of ERC721 tokens during construction. (#3311)

ReentrancyGuard: Reduce code size impact of the modifier by using internal functions. (#3515)

SafeCast: optimize downcasting of signed integers. (#3565)

ECDSA: Remove redundant check on the v value. (#3591)

VestingWallet: add releasable getters. (#3580)

VestingWallet: remove unused library Math.sol. (#3605)

VestingWallet: make constructor payable. (#3665)

Create2: optimize address computation by using assembly instead of abi.encodePacked. (#3600)

Clones: optimized the assembly to use only the scratch space during deployments, and optimized predictDeterministicAddress to use fewer operations. (#3640)

Checkpoints: Use procedural generation to support multiple key/value lengths. (#3589)

Checkpoints: Add new lookup mechanisms. (#3589)

Arrays: Add unsafeAccess functions that allow reading and writing to an element in a storage array bypassing Solidity's "out-of-bounds" check. (#3589)

Strings: optimize toString. (#3573)

Ownable2Step: extension of Ownable that makes the ownership transfers a two step process. (#3620)

Math and SignedMath: optimize function max by using > instead of >=. (#3679)

Math: Add log2, log10 and log256. (#3670)

Arbitrum: Update the vendored arbitrum contracts to match the nitro upgrade. (#3692)

Breaking changes

ERC721: In order to add support for batch minting via ERC721Consecutive it was necessary to make a minor breaking change in the internal interface of ERC721. Namely, the hooks _beforeTokenTransfer and _afterTokenTransfer have one additional argument that may need to be added to overrides:
 function _beforeTokenTransfer(
     address from,
     address to,
     uint256 tokenId,
+    uint256 batchSize
</tr></table> 

... (truncated)

Commits

0457042 4.8.1
1dfccff Add docs on non-stability of internal function use (#3952)
472b996 Add explicit permissions to docs workflow
cd50a86 Use a staticcall to fetch ERC20.decimals in ERC4626 (#3943)
873a01b Fix governance tutorial contract (#3948)
011a0fb Add documentation about the security of overrides (#3725)
4e5b119 Improve documentation of Initializable getters (#3861)
3e97221 Add ERC-4626 Upgrade Note (#3849)
fad1172 Add Ownable2Step to the docs (#3836)
53eb531 Improve some NatSpec (#3809)
Additional commits viewable in compare view

Updates apollo-server-core from 3.10.3 to 3.13.0

Commits

f93284e Release
4745ebe Rename option from disableValidation to dangerouslyDisableValidation
11f5981 Add disableValidation option to apollo-server-core
ea2e2c3 Release
1dd45b8 get CI passing
d38b43b Merge pull request from GHSA-j5g3-5c8r-7qfx
fac578a Release
8554050 Update protobuf (version-3) (#7412)
6247d96 Release
538151b Release
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by apollo-bot, a new releaser for apollo-server-core since your current version.

Updates debug from 2.6.9 to 4.3.4

Release notes

Sourced from debug's releases.

4.3.4

What's Changed

Add section about configuring JS console to show debug messages by @gitname in debug-js/debug#866

Replace deprecated String.prototype.substr() by @CommanderRoot in debug-js/debug#876

New Contributors

@gitname made their first contribution in debug-js/debug#866

@CommanderRoot made their first contribution in debug-js/debug#876

Full Changelog: debug-js/debug@4.3.3...4.3.4

4.3.3

Patch Release 4.3.3

This is a documentation-only release. Further, the repository was transferred. Please see notes below.

Migrates repository from https://github.com/visionmedia/debug to https://github.com/debug-js/debug. Please see notes below as to why this change was made.

Updates repository maintainership information

Updates the copyright (no license terms change has been made)

Removes accidental epizeuxis (#828)

Adds README section regarding usage in child procs (#850)

Thank you to @taylor1791 and @kristofkalocsai for their contributions.

Repository Migration Information

I've formatted this as a FAQ, please feel free to open an issue for any additional question and I'll add the response here.

Q: What impact will this have on me?

In most cases, you shouldn't notice any change.

The only exception I can think of is if you pull code directly from https://github.com/visionmedia/debug, e.g. via a "debug": "visionmedia/debug"-type version entry in your package.json - in which case, you should still be fine due to the automatic redirection Github sets up, but you should also update any references as soon as possible.

Q: What are the security implications of this change?

If you pull code directly from the old URL, you should update the URL to https://github.com/debug-js/debug as soon as possible. The old organization has many approved owners and thus a new repository could (in theory) be created at the old URL, circumventing Github's automatic redirect that is in place now and serving malicious code. I (@qix-) also wouldn't have access to that repository, so while I don't think it would happen, it's still something to consider.

Even in such a case, however, the officially released package on npm (debug) would not be affected. That package is still very much under control (even more than it used to be).

Q: What should I do if I encounter an issue related to the migration?

Search the issues first to see if someone has already reported it, and then open a new issue if someone has not.

Q: Why was this done as a 'patch' release? Isn't this breaking?

No, it shouldn't be breaking. The package on npm shouldn't be affected (aside from this patch release) and any references to the old repository should automatically redirect.

Thus, according to all of the "APIs" (loosely put) involved, nothing should have broken.

... (truncated)

Commits

da66c86 4.3.4
9b33412 replace deprecated String.prototype.substr() (#876)
c0805cc add section about configuring JS console to show debug messages (#866)
043d3cd 4.3.3
4079aae update license and more maintainership information
19b36c0 update repository location + maintainership information
f851b00 adds README section regarding usage in child procs (#850)
d177f2b Remove accidental epizeuxis
e47f96d 4.3.2
1e9d38c cache enabled status per-logger (#799)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by qix, a new releaser for debug since your current version.

Updates eth-gas-reporter from 0.2.25 to 0.2.27

Release notes

Sourced from eth-gas-reporter's releases.

v0.2.27

What's Changed

Remove @ethersproject/abi, use ethers.utils by @cgewecke in cgewecke/eth-gas-reporter#301

Full Changelog: cgewecke/eth-gas-reporter@v0.2.26...v0.2.27

v0.2.26

What's Changed

Update Mocha to v10 by @frangio in cgewecke/eth-gas-reporter#295

Bump ethers version by @ChristopherDedominici in cgewecke/eth-gas-reporter#296

Remove unused request package by @ChristopherDedominici in cgewecke/eth-gas-reporter#297

Replace request-promise-native with axios by @cgewecke in cgewecke/eth-gas-reporter#299

New Contributors

@ChristopherDedominici made their first contribution in cgewecke/eth-gas-reporter#296

Full Changelog: cgewecke/eth-gas-reporter@v0.2.2...v0.2.26

Changelog

Sourced from eth-gas-reporter's changelog.

0.2.27 / 2023-09-30

Remove @ethersproject/abi, use ethers.utils instead (cgewecke/eth-gas-reporter#301)

0.2.26 / 2023-09-29

Replace request-promise-native with axios / avoid default price API calls (cgewecke/eth-gas-reporter#299)

Remove request package (cgewecke/eth-gas-reporter#297)

Bump ethers version (cgewecke/eth-gas-reporter#296)

Update Mocha to v10 (cgewecke/eth-gas-reporter#295)

0.2.23 / 2021-11-26

Add notes to README about missing price data & remote data fetching race condition

Add support for multiple gas price tokens (BNB, MATIC, AVAX, HR, MOVR) (cgewecke/eth-gas-reporter#251)

Make @codechecks/client peer dep optional (cgewecke/eth-gas-reporter#257)

Update @solidity-parser/parser to 0.14.0 (cgewecke/eth-gas-reporter#261)

0.2.22 / 2021-03-04

Update @solidity-parser/parser to ^0.12.0 (support Panic keyword in catch blocks) (cgewecke/eth-gas-reporter#243)

0.2.21 / 2021-02-16

Fix missing truffle migration deployments data (cgewecke/eth-gas-reporter#240)

Upgrade solidity-parser/parser to 0.11.1 (cgewecke/eth-gas-reporter#239)

0.2.20 / 2020-12-01

Add support for remote contracts data pre-loading (hardhat-gas-reporter feature)

0.2.19 / 2020-10-29

Delegate contract loading/parsing to artifactor & make optional (#227)

0.2.18 / 2020-10-13

Support multiple codechecks reports per CI run

Add CI error threshold options: maxMethodDiff, maxDeploymentDiff

Add async collection methods for BuidlerEVM

Update solidity-parser/parser to 0.8.0 (contribution: @vicnaum)

Update dev deps / use Node 12 in CI

0.2.17 / 2020-04-13

Use @solidity-parser/parser for better solc 0.6.x parsing

Upgrade Mocha to ^7.1.1 (to remove minimist vuln warning)

Stop crashing when parser or ABI Encoder fails

Update @ethersproject/abi to ^5.0.0-beta.146 (and unpin)

... (truncated)

Commits

See full diff in compare view

Updates browserify-sign from 4.2.1 to 4.2.3

Changelog

Sourced from browserify-sign's changelog.

v4.2.3 - 2024-03-05

Commits

[patch] widen support to 0.12 9247adf

[patch] drop minimum node support to v1 4d0ee49

[Dev Deps] update aud, npmignore, tape 87f3a35

[actions] remove redundant finisher 37a4758

[Deps] pin hash-base to ~3.0, due to a breaking change 9e2bf12

[Deps] update parse-asn1 [f427270`](browserify/browserify-sign@f427270)

[Deps] update elliptic fb261ce

[Deps] pin elliptic due to a breaking change 168e16f

v4.2.2 - 2023-10-25

Fixed

[Tests] log when openssl doesn't support cipher [#37](https://github.com/crypto-browserify/browserify-sign/issues/37)

Commits

Only apps should have lockfiles 09a8995

[eslint] switch to eslint 83fe463

[meta] add npmignore and auto-changelog 4418183

[meta] fix package.json indentation 9ac5a5e

[Tests] migrate from travis to github actions d845d85

[Fix] sign: throw on unsupported padding scheme 8767739

[Fix] properly check the upper bound for DSA signatures 85994cd

[Tests] handle openSSL not supporting a scheme f5f17c2

[Deps] update bn.js, browserify-rsa, elliptic, parse-asn1, readable-stream, safe-buffer a67d0eb

[Dev Deps] update nyc, standard, tape cc5350b

[Tests] always run coverage; downgrade nyc 75ce1d5

[meta] add safe-publish-latest dcf49ce

[Tests] add npm run posttest 75dd8fd

[Dev Deps] update tape 3aec038

[Tests] skip unsupported schemes 703c83e

[Tests] node < 6 lacks array includes 3aa43cf

[Dev Deps] fix eslint range 98d4e0d

Commits

bf2c3ec v4.2.3
9247adf [patch] widen support to 0.12
f427270 [Deps] update `parse-asn1
87f3a35 [Dev Deps] update aud, npmignore, tape
fb261ce [Deps] update elliptic
4d0ee49 [patch] drop minimum node support to v1
9e2bf12 [Deps] pin hash-base to ~3.0, due to a breaking change
168e16f [Deps] pin elliptic due to a breaking change
37a4758 [actions] remove redundant finisher
4af5a90 v4.2.2
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for browserify-sign since your current version.

Updates cookiejar from 2.1.3 to 2.1.4

Commits

See full diff in compare view

Updates decode-uri-component from 0.2.0 to 0.2.2

Release notes

Sourced from decode-uri-component's releases.

v0.2.2

Prevent overwriting previously decoded tokens 980e0bf

SamVerschueren/decode-uri-component@v0.2.1...v0.2.2

v0.2.1

Switch to GitHub workflows 76abc93

Fix issue where decode throws - fixes #6 746ca5d

Update license (#1) 486d7e2

Tidelift tasks a650457

Meta tweaks 66e1c28

SamVerschueren/decode-uri-component@v0.2.0...v0.2.1

Commits

a0eea46 0.2.2
980e0bf Prevent overwriting previously decoded tokens
3c8a373 0.2.1
76abc93 Switch to GitHub workflows
746ca5d Fix issue where decode throws - fixes #6
486d7e2 Update license (#1)
a650457 Tidelift tasks
66e1c28 Meta tweaks
See full diff in compare view

Updates es5-ext from 0.10.62 to 0.10.64

Release notes

Sourced from es5-ext's releases.

0.10.64 (2024-02-27)

Bug Fixes

Revert update to postinstall script meant to fix Powershell issue, as it's a regression for some Linux terminals (c2e2bb9)

Comparison since last release

0.10.63 (2024-02-23)

Bug Fixes

Do not rely on problematic regex (3551cdd), addresses #201

Support ES2015+ function definitions in function#toStringTokens() (a52e957), addresses #021

Ensure postinstall script does not crash on Windows, fixes #181 (bf8ed79)

Maintenance Improvements

Simplify the manifest message (7855319)

Comparison since last release

Changelog

Sourced from es5-ext's changelog.

0.10.64 (2024-02-27)

Bug Fixes

Revert update to postinstall script meant to fix Powershell issue, as it's a regression for some Linux terminals (c2e2bb9)

0.10.63 (2024-02-23)

Bug Fixes

Do not rely on problematic regex (3551cdd), addresses #201

Support ES2015+ function definitions in function#toStringTokens() (a52e957), addresses #021

Ensure postinstall script does not crash on Windows, fixes #181 (bf8ed79)

Maintenance Improvements

Simplify the manifest message (7855319)

Commits

f76b03d chore: Release v0.10.64
2881acd chore: Bump dependencies
c2e2bb9 fix: Revert update meant to fix Powershell issue, as it's a regression
16f2b72 docs: Fix date in the changelog
de4e03c chore: Release v0.10.63
3fd53b7 chore: Upgrade lint-staged to v13
bf8ed79 chore: Ensure postinstall script does not crash on Windows
2cbbb07 chore: Bump dependencies
22d0416 chore: Bump LICENSE year
a52e957 fix: Support ES2015+ function definitions in function#toStringTokens()
Additional commits viewable in compare view

Updates flat from 4.1.1 to 5.0.2

Commits

e5ffd66 Release 5.0.2
fdb79d5 Update dependencies, refresh lockfile, format with standard.
e52185d Test against node 14 in CI.
0189cb1 Avoid arrow function syntax.
f25d3a1 Release 5.0.1
54cc7ad use standard formatting
779816e drop dependencies
2eea6d3 Bump lodash from 4.17.15 to 4.17.19
a61a554 Bump acorn from 7.1.0 to 7.4.0
20ef0ef Fix prototype pollution on unflatten
Additional commits viewable in compare view

Updates minimatch from 3.0.4 to 3.1.2

Commits

699c459 3.1.2
2f2b5ff fix: trim pattern
25d7c0d 3.1.1
55dda29 fix: treat nocase:true as always having magic
5e1fb8d 3.1.0
f8145c5 Add 'allowWindowsEscape' option
570e8b1 add publishConfig for v3 publishes
5b7cd33 3.0.6
20b4b56 [fix] revert all breaking syntax changes
2ff0388 document, expose, and test 'partial:true' option
Additional commits viewable in compare view

Updates express from 4.17.1 to 4.19.2

Release notes

Sourced from express's releases.

4.19.2

What's Changed

Improved fix for open redirect allow list bypass

Full Changelog: expressjs/express@4.19.1...4.19.2

4.19.1

What's Changed

Fix ci after location patch by @wesleytodd in expressjs/express#5552

fixed un-edited version in history.md for 4.19.0 by @wesleytodd in expressjs/express#5556

Full Changelog: expressjs/express@4.19.0...4.19.1

4.19.0

What's Changed

fix typo in release date by @UlisesGascon in expressjs/express#5527

docs: nominating @wesleytodd to be project captian by @wesleytodd in expressjs/express#5511

docs: loosen TC activity rules by @wesleytodd in expressjs/express#5510

Add note on how to update docs for new release by @crandmck in expressjs/express#5541

Prevent open redirect allow list bypass due to encodeurl

Release 4.19.0 by @wesleytodd in expressjs/express#5551

New Contributors

@crandmck made their first contribution in expressjs/express#5541

Full Changelog: expressjs/express@4.18.3...4.19.0

4.18.3

Main Changes

Fix routing requests without method

deps: [email protected]

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: [email protected]

Other Changes

Use https: protocol instead of deprecated git: protocol by @vcsjones in expressjs/express#5032

build: [email protected] and [email protected] by @abenhamdine in expressjs/express#5034

ci: update actions/checkout to v3 by @armujahid in expressjs/express#5027

test: remove unused function arguments in params by @raksbisht in expressjs/express#5124

Remove unused originalIndex from acceptParams by @raksbisht in expressjs/express#5119

Fixed typos by @raksbisht in expressjs/express#5117

examples: remove unused params by @raksbisht in expressjs/express#5113

fix: parameter str is not described in JSDoc by @raksbisht in expressjs/express#5130

fix: typos in History.md by @raksbisht in expressjs/express#5131

build : add [email protected] by @abenhamdine in expressjs/express#5028

test: remove unused function arguments in params by @raksbisht in expressjs/express#5137

... (truncated)

Changelog

Sourced from express's changelog.

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

Prevent open redirect allow list bypass due to encodeurl

deps: [email protected]

4.18.3 / 2024-02-29

Fix routing requests without method

deps: [email protected]

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: [email protected]

deps: [email protected]

Add partitioned option

4.18.2 / 2022-10-08

Fix regression routing a large stack in a single route

deps: [email protected]

deps: [email protected]

perf: remove unnecessary object clone

deps: [email protected]

4.18.1 / 2022-04-29

Fix hanging on large stack of sync routes

4.18.0 / 2022-04-25

Add "root" option to res.download

Allow options without filename in res.download

Deprecate string and non-integer arguments to res.status

Fix behavior of null/undefined as maxAge in res.cookie

Fix handling very large stacks of sync middleware

Ignore Object.prototype values in settings through app.set/app.get

... (truncated)

Commits

04bc627 4.19.2
da4d763 Improved fix for open redirect allow list bypass

…pdates Bumps the npm_and_yarn group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [nunjucks](https://github.com/mozilla/nunjucks) | `3.2.3` | `3.2.4` | | [openzeppelin-solidity](https://github.com/OpenZeppelin/openzeppelin-contracts) | `2.2.0` | `4.8.1` | | [apollo-server-core](https://github.com/apollographql/apollo-server/tree/HEAD/packages/apollo-server-core) | `3.10.3` | `3.13.0` | | [debug](https://github.com/debug-js/debug) | `2.6.9` | `4.3.4` | | [eth-gas-reporter](https://github.com/cgewecke/eth-gas-reporter) | `0.2.25` | `0.2.27` | | [browserify-sign](https://github.com/crypto-browserify/browserify-sign) | `4.2.1` | `4.2.3` | | [cookiejar](https://github.com/bmeck/node-cookiejar) | `2.1.3` | `2.1.4` | | [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component) | `0.2.0` | `0.2.2` | | [es5-ext](https://github.com/medikoo/es5-ext) | `0.10.62` | `0.10.64` | | [express](https://github.com/expressjs/express) | `4.17.1` | `4.19.2` | | [semver](https://github.com/npm/node-semver) | `5.7.1` | `7.6.2` | | [truffle](https://github.com/trufflesuite/truffle/tree/HEAD/packages/truffle) | `5.6.3` | `5.11.5` | | [get-func-name](https://github.com/chaijs/get-func-name) | `2.0.0` | `2.0.2` | | [got](https://github.com/sindresorhus/got) | `9.6.0` | `12.1.0` | | [web3](https://github.com/ChainSafe/web3.js) | `1.7.4` | `1.10.4` | | [http-cache-semantics](https://github.com/kornelski/http-cache-semantics) | `4.1.0` | `4.1.1` | Updates `nunjucks` from 3.2.3 to 3.2.4 - [Release notes](https://github.com/mozilla/nunjucks/releases) - [Changelog](https://github.com/mozilla/nunjucks/blob/master/CHANGELOG.md) - [Commits](mozilla/nunjucks@v3.2.3...v3.2.4) Updates `openzeppelin-solidity` from 2.2.0 to 4.8.1 - [Release notes](https://github.com/OpenZeppelin/openzeppelin-contracts/releases) - [Changelog](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md) - [Commits](OpenZeppelin/openzeppelin-contracts@v2.2.0...v4.8.1) Updates `apollo-server-core` from 3.10.3 to 3.13.0 - [Release notes](https://github.com/apollographql/apollo-server/releases) - [Commits](https://github.com/apollographql/apollo-server/commits/[email protected]/packages/apollo-server-core) Updates `debug` from 2.6.9 to 4.3.4 - [Release notes](https://github.com/debug-js/debug/releases) - [Commits](debug-js/debug@2.6.9...4.3.4) Updates `eth-gas-reporter` from 0.2.25 to 0.2.27 - [Release notes](https://github.com/cgewecke/eth-gas-reporter/releases) - [Changelog](https://github.com/cgewecke/eth-gas-reporter/blob/master/CHANGELOG.md) - [Commits](https://github.com/cgewecke/eth-gas-reporter/commits/v0.2.27) Updates `browserify-sign` from 4.2.1 to 4.2.3 - [Changelog](https://github.com/browserify/browserify-sign/blob/main/CHANGELOG.md) - [Commits](browserify/browserify-sign@v4.2.1...v4.2.3) Updates `cookiejar` from 2.1.3 to 2.1.4 - [Commits](https://github.com/bmeck/node-cookiejar/commits) Updates `decode-uri-component` from 0.2.0 to 0.2.2 - [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases) - [Commits](SamVerschueren/decode-uri-component@v0.2.0...v0.2.2) Updates `es5-ext` from 0.10.62 to 0.10.64 - [Release notes](https://github.com/medikoo/es5-ext/releases) - [Changelog](https://github.com/medikoo/es5-ext/blob/main/CHANGELOG.md) - [Commits](medikoo/es5-ext@v0.10.62...v0.10.64) Updates `flat` from 4.1.1 to 5.0.2 - [Release notes](https://github.com/hughsk/flat/releases) - [Commits](hughsk/flat@4.1.1...5.0.2) Updates `minimatch` from 3.0.4 to 3.1.2 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.0.4...v3.1.2) Updates `express` from 4.17.1 to 4.19.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.17.1...4.19.2) Updates `follow-redirects` from 1.15.2 to 1.15.6 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.2...v1.15.6) Updates `semver` from 5.7.1 to 7.6.2 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md) - [Commits](npm/node-semver@v5.7.1...v7.6.2) Updates `truffle` from 5.6.3 to 5.11.5 - [Release notes](https://github.com/trufflesuite/truffle/releases) - [Commits](https://github.com/trufflesuite/truffle/commits/[email protected]/packages/truffle) Updates `y18n` from 4.0.0 to 3.2.2 - [Release notes](https://github.com/yargs/y18n/releases) - [Changelog](https://github.com/yargs/y18n/blob/master/CHANGELOG.md) - [Commits](https://github.com/yargs/y18n/commits) Updates `get-func-name` from 2.0.0 to 2.0.2 - [Release notes](https://github.com/chaijs/get-func-name/releases) - [Commits](https://github.com/chaijs/get-func-name/commits/v2.0.2) Updates `got` from 9.6.0 to 12.1.0 - [Release notes](https://github.com/sindresorhus/got/releases) - [Commits](sindresorhus/got@v9.6.0...v12.1.0) Updates `web3` from 1.7.4 to 1.10.4 - [Release notes](https://github.com/ChainSafe/web3.js/releases) - [Changelog](https://github.com/web3/web3.js/blob/v1.10.4/CHANGELOG.md) - [Commits](web3/web3.js@v1.7.4...v1.10.4) Updates `http-cache-semantics` from 4.1.0 to 4.1.1 - [Commits](kornelski/http-cache-semantics@v4.1.0...v4.1.1) --- updated-dependencies: - dependency-name: nunjucks dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: openzeppelin-solidity dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: apollo-server-core dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: debug dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: eth-gas-reporter dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: browserify-sign dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: cookiejar dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: decode-uri-component dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: es5-ext dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: flat dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: minimatch dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: express dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: semver dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: truffle dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: y18n dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: get-func-name dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: got dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: web3 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: http-cache-semantics dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added the dependencies Pull requests that update a dependency file label Jun 18, 2024

dependabot bot mentioned this pull request Jun 18, 2024

build(deps): bump the npm_and_yarn group across 1 directory with 20 updates #1

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the npm_and_yarn group across 1 directory with 20 updates #2

build(deps): bump the npm_and_yarn group across 1 directory with 20 updates #2

dependabot bot commented on behalf of github Jun 18, 2024

build(deps): bump the npm_and_yarn group across 1 directory with 20 updates #2

Are you sure you want to change the base?

build(deps): bump the npm_and_yarn group across 1 directory with 20 updates #2

Conversation

dependabot bot commented on behalf of github Jun 18, 2024

v3.2.4

What's Changed

3.2.4 (Apr 13 2023)

v4.8.1

v4.8.0

Breaking changes

4.8.1 (2023-01-12)

4.8.0 (2022-11-08)

Breaking changes

4.3.4

What's Changed

New Contributors

4.3.3

Patch Release 4.3.3

Repository Migration Information

Q: What impact will this have on me?

Q: What are the security implications of this change?

Q: What should I do if I encounter an issue related to the migration?

Q: Why was this done as a 'patch' release? Isn't this breaking?

v0.2.27

What's Changed

v0.2.26

What's Changed

New Contributors

0.2.27 / 2023-09-30

0.2.26 / 2023-09-29

0.2.23 / 2021-11-26

0.2.22 / 2021-03-04

0.2.21 / 2021-02-16

0.2.20 / 2020-12-01

0.2.19 / 2020-10-29

0.2.18 / 2020-10-13

0.2.17 / 2020-04-13

v4.2.3 - 2024-03-05

Commits

v4.2.2 - 2023-10-25

Fixed

Commits

v0.2.2

v0.2.1

0.10.64 (2024-02-27)

Bug Fixes

0.10.63 (2024-02-23)

Bug Fixes

Maintenance Improvements

0.10.64 (2024-02-27)

Bug Fixes

0.10.63 (2024-02-23)

Bug Fixes

Maintenance Improvements

4.19.2

What's Changed

4.19.1

What's Changed

4.19.0

What's Changed

New Contributors

4.18.3

Main Changes

Other Changes

4.19.2 / 2024-03-25

4.19.1 / 2024-03-20

4.19.0 / 2024-03-20

4.18.3 / 2024-02-29

4.18.2 / 2022-10-08

4.18.1 / 2022-04-29

4.18.0 / 2022-04-25