Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[spec] Update graceful-fs: 4.1.15 → 4.2.11 (minor) #631

Open
wants to merge 33 commits into
base: master
Choose a base branch
from

Conversation

depfu[bot]
Copy link

@depfu depfu bot commented Mar 17, 2023

👉 This PR is queued up to get rebased by Depfu

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ graceful-fs (4.1.15 → 4.2.11) · Repo

Commits

See the full diff on Github. The new version differs by 55 commits:


Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

MarshallOfSound and others added 30 commits August 25, 2020 14:05
Bumps [terser](https://github.com/terser/terser) from 4.6.7 to 4.8.1.
- [Release notes](https://github.com/terser/terser/releases)
- [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md)
- [Commits](terser/terser@v4.6.7...v4.8.1)

---
updated-dependencies:
- dependency-name: terser
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.0.4 to 3.0.8.
- [Release notes](https://github.com/isaacs/minimatch/releases)
- [Commits](isaacs/minimatch@v3.0.4...v3.0.8)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
…atch-3.0.8

build(deps): bump minimatch from 3.0.4 to 3.0.8
Bumps [loader-utils](https://github.com/webpack/loader-utils) from 1.2.3 to 1.4.2.
- [Release notes](https://github.com/webpack/loader-utils/releases)
- [Changelog](https://github.com/webpack/loader-utils/blob/v1.4.2/CHANGELOG.md)
- [Commits](webpack/loader-utils@v1.2.3...v1.4.2)

---
updated-dependencies:
- dependency-name: loader-utils
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
…r-utils-1.4.2

build(deps): bump loader-utils from 1.2.3 to 1.4.2
Bumps [loader-utils](https://github.com/webpack/loader-utils) from 1.2.3 to 1.4.2.
- [Release notes](https://github.com/webpack/loader-utils/releases)
- [Changelog](https://github.com/webpack/loader-utils/blob/v1.4.2/CHANGELOG.md)
- [Commits](webpack/loader-utils@v1.2.3...v1.4.2)

---
updated-dependencies:
- dependency-name: loader-utils
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
…main/loader-utils-1.4.2

bump loader-utils from 1.2.3 to 1.4.2 in /spec-main
…r-4.8.1

build(deps): bump terser from 4.6.7 to 4.8.1
Bumps [ws](https://github.com/websockets/ws) from 6.2.1 to 6.2.2.
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@6.2.1...6.2.2)

---
updated-dependencies:
- dependency-name: ws
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.14 to 4.17.21.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.14...4.17.21)

---
updated-dependencies:
- dependency-name: lodash
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
…ws-6.2.2

build(deps-dev): bump ws from 6.2.1 to 6.2.2 in /spec
…lodash-4.17.21

build(deps): bump lodash from 4.17.14 to 4.17.21 in /spec
Bumps [ws](https://github.com/websockets/ws) from 7.2.1 to 7.4.6.
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.2.1...7.4.6)

---
updated-dependencies:
- dependency-name: ws
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>
…main/ws-7.4.6

build(deps-dev): bump ws from 7.2.1 to 7.4.6 in /spec-main
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.15 to 4.17.21.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.15...4.17.21)

---
updated-dependencies:
- dependency-name: lodash
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [tar](https://github.com/npm/node-tar) from 4.4.10 to 4.4.19.
- [Release notes](https://github.com/npm/node-tar/releases)
- [Changelog](https://github.com/npm/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v4.4.10...v4.4.19)

---
updated-dependencies:
- dependency-name: tar
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
…h-4.17.21

build(deps): bump lodash from 4.17.15 to 4.17.21
Bumps [decode-uri-component](https://github.com/SamVerschueren/decode-uri-component) from 0.2.0 to 0.2.2.
- [Release notes](https://github.com/SamVerschueren/decode-uri-component/releases)
- [Commits](SamVerschueren/decode-uri-component@v0.2.0...v0.2.2)

---
updated-dependencies:
- dependency-name: decode-uri-component
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
….4.19

build(deps): bump tar from 4.4.10 to 4.4.19
Bumps [express](https://github.com/expressjs/express) from 4.17.1 to 4.17.3.
- [Release notes](https://github.com/expressjs/express/releases)
- [Changelog](https://github.com/expressjs/express/blob/master/History.md)
- [Commits](expressjs/express@4.17.1...4.17.3)

---
updated-dependencies:
- dependency-name: express
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [qs](https://github.com/ljharb/qs) from 6.5.2 to 6.5.3.
- [Release notes](https://github.com/ljharb/qs/releases)
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.5.2...v6.5.3)

---
updated-dependencies:
- dependency-name: qs
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [qs](https://github.com/ljharb/qs) from 6.5.2 to 6.5.3.
- [Release notes](https://github.com/ljharb/qs/releases)
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.5.2...v6.5.3)

---
updated-dependencies:
- dependency-name: qs
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Bumps [json5](https://github.com/json5/json5) from 1.0.1 to 1.0.2.
- [Release notes](https://github.com/json5/json5/releases)
- [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md)
- [Commits](json5/json5@v1.0.1...v1.0.2)

---
updated-dependencies:
- dependency-name: json5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
…-1.0.2

build(deps): bump json5 from 1.0.1 to 1.0.2
…ss-4.17.3

build(deps-dev): bump express from 4.17.1 to 4.17.3
…e-uri-component-0.2.2

build(deps): bump decode-uri-component from 0.2.0 to 0.2.2
Bumps [json5](https://github.com/json5/json5) from 1.0.1 to 1.0.2.
- [Release notes](https://github.com/json5/json5/releases)
- [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md)
- [Commits](json5/json5@v1.0.1...v1.0.2)

---
updated-dependencies:
- dependency-name: json5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Kadir Selçuk and others added 3 commits January 7, 2023 09:06
…qs-6.5.3

build(deps): bump qs from 6.5.2 to 6.5.3 in /spec
…main/json5-1.0.2

build(deps): bump json5 from 1.0.1 to 1.0.2 in /spec-main
@depfu depfu bot added the depfu label Mar 17, 2023
@guardrails
Copy link

guardrails bot commented Mar 17, 2023

⚠️ We detected 14 security issues in this pull request:

Vulnerable Libraries (14)
Severity Details
High pkg:npm/[email protected]@3.0.0 (t) upgrade to: 6.0.1,5.0.1,4.1.1,3.0.1
Critical pkg:npm/[email protected]@1.0.0 (t) - no patch available
Medium pkg:npm/[email protected]@6.2.2 (t) - no patch available
High pkg:npm/[email protected]@0.0.8 (t) - no patch available
High pkg:npm/[email protected]@3.0.4 (t) upgrade to: 3.0.5
Critical pkg:npm/[email protected]@0.2.3 (t) upgrade to: 0.4.0
N/A pkg:npm/[email protected]@2.6.9 (t) upgrade to: 3.1.0
Medium pkg:npm/[email protected]@5.2.0 (t) - no patch available
Medium pkg:npm/[email protected]@6.10.2 (t) upgrade to: 6.12.3
High pkg:npm/[email protected]@0.0.10 (t) - no patch available
Medium pkg:npm/[email protected]@2.88.0 (t) - no patch available
High pkg:npm/[email protected]@11.1.1 (t) - no patch available
High pkg:npm/[email protected]@1.1.0 (t) upgrade to: 1.1.1
High pkg:npm/[email protected]@4.0.0 (t) upgrade to: 3.2.2,4.0.1,5.0.5

More info on how to fix Vulnerable Libraries in JavaScript.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

@depfu depfu bot changed the base branch from custom-error-pages to master April 21, 2023 12:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant