Skip to content

Bump the npm_and_yarn group with 15 updates#416

Open
dependabot[bot] wants to merge 1 commit intostagefrom
dependabot/npm_and_yarn/npm_and_yarn-c69f659426
Open

Bump the npm_and_yarn group with 15 updates#416
dependabot[bot] wants to merge 1 commit intostagefrom
dependabot/npm_and_yarn/npm_and_yarn-c69f659426

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 1, 2024

Bumps the npm_and_yarn group with 16 updates:

Package From To
next 13.5.6 14.1.1
ws 7.5.9 8.17.1
ws 8.13.0 8.17.1
@crocswap-libs/sdk 0.2.75 1.0.5
@rainbow-me/rainbowkit 1.3.0 2.1.5
viem 1.19.15 2.21.1
wagmi 1.4.12 2.12.8
debug 3.2.7 2.6.9
braces 3.0.2 3.0.3
elliptic 6.5.4 6.5.7
web3-eth-abi 4.0.3 4.2.3
follow-redirects 1.15.5 1.15.6
micromatch 4.0.5 4.0.8
undici 5.26.5 5.28.4
vercel 33.1.0 37.2.1
web3-utils 4.0.3 4.3.1

Updates next from 13.5.6 to 14.1.1

Commits

Updates ws from 7.5.9 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

  • Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

  1. Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits
  • 3c56601 [dist] 8.17.1
  • e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 6a00029 [test] Increase code coverage
  • ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
  • b73b118 [dist] 8.17.0
  • 29694a5 [test] Use the highWaterMark variable
  • 934c9d6 [ci] Test on node 22
  • 1817bac [ci] Do not test on node 21
  • 96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
  • e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
  • Additional commits viewable in compare view

Updates ws from 8.13.0 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

  • Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

  1. Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits
  • 3c56601 [dist] 8.17.1
  • e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 6a00029 [test] Increase code coverage
  • ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
  • b73b118 [dist] 8.17.0
  • 29694a5 [test] Use the highWaterMark variable
  • 934c9d6 [ci] Test on node 22
  • 1817bac [ci] Do not test on node 21
  • 96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
  • e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
  • Additional commits viewable in compare view

Updates @crocswap-libs/sdk from 0.2.75 to 1.0.5

Commits

Updates @rainbow-me/rainbowkit from 1.3.0 to 2.1.5

Release notes

Sourced from @​rainbow-me/rainbowkit's releases.

@​rainbow-me/rainbowkit@​2.1.5

Patch Changes

  • c08f620: Added zh-HK and zh-TW locales for Traditional Chinese language support. You can also specify zh-Hans and zh-Hant locales to refer to the writing systems directly.

    Reference our guide to learn more about Localization.

  • 675f9dd: Added icon for Gnosis Chain

  • f65b5c4: Added icon for Celo chain

  • 9c36bfd: Added Kaia Wallet support with kaiaWallet wallet connector

@​rainbow-me/rainbowkit@​2.1.4

Patch Changes

  • 72fe07d: Added Binance Web3 Wallet support with binanceWallet wallet connector
  • b530c80: Added mobile support for zealWallet wallet connector
  • 7f6e36e: Added missing rdns property for some wallets. This allows them to be discoverable as an EIP-6963 connector.
  • 2eeb7b9: Improved the Safe Wallet app browser connection flow with a Safe button included by default in the wallet list
  • d02d73f: Resolved an issue where the Phantom wallet did not appear as an EIP-6963 connector.

@​rainbow-me/rainbowkit@​2.1.3

Patch Changes

  • 7b00be5: Added Seif Wallet support with seifWallet wallet connector
  • 23e33b9: Added mantle and mantleTestnet network support
  • 001a0a9: Resolved an issue in development where browser detection would throw an error if navigator.userAgent was unavailable in the browser.

@​rainbow-me/rainbowkit@​2.1.2

Patch Changes

  • 2180ddd: Added Nest Wallet support with nestWallet wallet connector

  • fea278a: The coinbaseWallet wallet connector now has a preference argument to control whether Smart Wallet is enabled and available for users. Preference based behavior is documented here.

    Smart Wallet will be enabled by default with all in early June, without a further upgrade.

    Developers can test Smart Wallet with sepolia and baseSepolia chains today by setting smartWalletOnly like so:

    import { coinbaseWallet } from "@rainbow-me/rainbowkit/wallets";
// Enable Coinbase Smart Wallet for testing
coinbaseWallet.preference = "smartWalletOnly";
// You must manually specify your wallet list with wallets in
// getDefaultConfig or connectorsForWallets to assign the preference
const config = getDefaultConfig({
/* ... */
wallets: [
{
groupName: "Popular",

... (truncated)

Changelog

Sourced from @​rainbow-me/rainbowkit's changelog.

2.1.5

Patch Changes

  • c08f620: Added zh-HK and zh-TW locales for Traditional Chinese language support. You can also specify zh-Hans and zh-Hant locales to refer to the writing systems directly.

    Reference our guide to learn more about Localization.

  • 675f9dd: Add icon for Gnosis Chain

  • f65b5c4: Add icon for Celo chain

  • 9c36bfd: Added Kaia Wallet support with kaiaWallet wallet connector

2.1.4

Patch Changes

  • b530c80: Added mobile support for zealWallet wallet connector
  • 7f6e36e: Added missing rdns property to some wallets. This helps them work with EIP-6963 connectors.
  • 2eeb7b9: Improved the Safe Wallet app browser connection flow with a Safe button included by default in the wallet list
  • 72fe07d: Added Binance Web3 Wallet support with binanceWallet wallet connector
  • d02d73f: Resolved an issue where the Phantom wallet did not appear as an EIP-6963 connector.

2.1.3

Patch Changes

  • 23e33b9: Added mantle and mantleTestnet network support
  • 7b00be5: Added Seif Wallet support with seifWallet wallet connector
  • 001a0a9: Resolved an issue in development where browser detection would throw an error if navigator.userAgent was unavailable in the browser.

2.1.2

Patch Changes

  • 2180ddd: Added Nest Wallet support with nestWallet wallet connector

  • fea278a: The coinbaseWallet wallet connector now has a preference argument to control whether Smart Wallet is enabled and available for users. Preference based behavior is documented here.

    Smart Wallet will be enabled by default with all in early June, without a further upgrade.

    Developers can test Smart Wallet with sepolia and baseSepolia chains today by setting smartWalletOnly like so:

    import { coinbaseWallet } from "@rainbow-me/rainbowkit/wallets";
// Enable Coinbase Smart Wallet for testing
coinbaseWallet.preference = "smartWalletOnly";
// You must manually specify your wallet list with wallets in
// getDefaultConfig or connectorsForWallets to assign the preference
const config = getDefaultConfig({

... (truncated)

Commits

Updates viem from 1.19.15 to 2.21.1

Release notes

Sourced from viem's releases.

viem@2.21.1

Patch Changes

viem@2.21.0

Minor Changes

  • #2665 2e05c52 Thanks @​jxom! - Added built-in support for Linea gas & fee estimations.

  • #2665 2e05c52 Thanks @​jxom! - Deprecated chain.fees.defaultPriorityFee, use chain.fees.maxPriorityFeePerGas instead.

Patch Changes

viem@2.20.1

Patch Changes

viem@2.20.0

Minor Changes

... (truncated)

Commits

Updates wagmi from 1.4.12 to 2.12.8

Release notes

Sourced from wagmi's releases.

wagmi@2.12.8

Patch Changes

wagmi@2.12.7

Patch Changes

wagmi@2.12.6

Patch Changes

wagmi@2.12.5

Patch Changes

wagmi@2.12.4

Patch Changes

wagmi@2.12.3

Patch Changes

@​wagmi/core@​2.12.2

Patch Changes

wagmi@2.12.2

Patch Changes

... (truncated)

Changelog

Sourced from wagmi's changelog.

2.12.8

Patch Changes

2.12.7

Patch Changes

2.12.6

Patch Changes

2.12.5

Patch Changes

2.12.4

Patch Changes

2.12.3

Patch Changes

2.12.2

Patch Changes

... (truncated)

Commits

Updates debug from 3.2.7 to 2.6.9

Changelog

Sourced from debug's changelog.

2.6.9 / 2017-09-22

  • remove ReDoS regexp in %o formatter (#504)

2.6.8 / 2017-05-18

2.6.7 / 2017-05-16

2.6.5 / 2017-04-27

2.6.4 / 2017-04-20

2.6.3 / 2017-03-13

2.6.2 / 2017-03-10

2.6.1 / 2017-02-10

  • Fix: Module's export default syntax fix for IE8 Expected identifier error
  • Fix: Whitelist DEBUG_FD for values 1 and 2 only (#415, @​pi0)

... (truncated)

Commits

Updates braces from 3.0.2 to 3.0.3

Commits

Updates elliptic from 6.5.4 to 6.5.7

Commits

Updates web3-eth-abi from 4.0.3 to 4.2.3

Release notes

Sourced from web3-eth-abi's releases.

v4.2.2

Added

web3-core

  • Added isMetaMaskProvider function to check if provider is metamask (#6534)

web3-types

  • Interface MetaMaskProvider added and is part of SupportedProviders (#6534)
  • gasPrice was added to Transaction1559UnsignedAPI type. (#6539)

Changed

web3

  • Dependencies updated

Fixed

web3-errors

  • Fixed grammar and spelling in transactionTimeoutHint (#6559)

web3-eth-contract

  • Will populate data for transactions in contract for metamask provider instead of input (#6534)

v4.2.1

Fixed

web3-eth-abi

  • Bug fix of ERR_UNSUPPORTED_DIR_IMPORT in ABI (#6535)

Changed

web3-eth-contract

  • Dependencies updated

web3-eth

  • Dependencies updated

web3-eth-ens

  • Dependencies updated

web3-eth-personal

... (truncated)

Changelog

Sourced from web3-eth-abi's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.2.0]

Released with 1.0.0-beta.37 code base.

[1.2.1]

Fixed

  • websocket dependency fixed (#2971, #2976)
  • requestOptions added to WebsocketProvider (#2979)
  • Node >= v8.0.0 support (#2938)

[1.2.2]

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by luu-alex, a new releaser for web3-eth-abi since your current version.


Updates follow-redirects from 1.15.5 to 1.15.6

Commits

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

  • this is basically v4.0.5, with some README updates
  • it is vulnerable to CVE-2024-4067
  • Updated braces to v3.0.3 to avoid CVE-2024-4068
  • does NOT break API compatibility

[4.0.6] - 2024-05-21

  • Added hasBraces to check if a pattern contains braces.
  • Fixes CVE-2024-4067
  • BREAKS API COMPATIBILITY
  • Should be labeled as a major release, but it's not.
Commits

Updates undici from 5.26.5 to 5.28.4

Release notes

Sourced from undici's releases.

v5.28.4

⚠️ Security Release ⚠️

Full Changelog: nodejs/undici@v5.28.3...v5.28.4

v5.28.3

⚠️ Security Release ⚠️

Fixes:

Full Changelog: nodejs/undici@v5.28.2...v5.28.3

v5.28.2

What's Changed

New Contributors

Full Changelog: nodejs/undici@v5.28.1...v5.28.2

v5.28.1

What's Changed

... (truncated)

Commits

Updates vercel from 33.1.0 to 37.2.1

Release notes

Sourced from vercel's releases.

vercel@37.2.1

Patch Changes

  • Fixes integration not found error when using vercel install (#12035)

vercel@37.2.0

Minor Changes

  • Add vc install and vc integration add commands (#12033)

Patch Changes

  • [cli] Remove existing metrics gathering behavior (#12026)

    • ...

    Description has been truncated

@dependabot
Bump the npm_and_yarn group with 15 updates
066e100 
Bumps the npm_and_yarn group with 16 updates:

| Package | From | To |
| --- | --- | --- |
| [next](https://github.com/vercel/next.js) | `13.5.6` | `14.1.1` |
| [ws](https://github.com/websockets/ws) | `7.5.9` | `8.17.1` |
| [ws](https://github.com/websockets/ws) | `8.13.0` | `8.17.1` |
| [@crocswap-libs/sdk](https://github.com/CrocSwap/sdk) | `0.2.75` | `1.0.5` |
| [@rainbow-me/rainbowkit](https://github.com/rainbow-me/rainbowkit/tree/HEAD/packages/rainbowkit) | `1.3.0` | `2.1.5` |
| [viem](https://github.com/wevm/viem) | `1.19.15` | `2.21.1` |
| [wagmi](https://github.com/wevm/wagmi/tree/HEAD/packages/react) | `1.4.12` | `2.12.8` |
| [debug](https://github.com/debug-js/debug) | `3.2.7` | `2.6.9` |
| [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` |
| [elliptic](https://github.com/indutny/elliptic) | `6.5.4` | `6.5.7` |
| [web3-eth-abi](https://github.com/ethereum/web3.js) | `4.0.3` | `4.2.3` |
| [follow-redirects](https://github.com/follow-redirects/follow-redirects) | `1.15.5` | `1.15.6` |
| [micromatch](https://github.com/micromatch/micromatch) | `4.0.5` | `4.0.8` |
| [undici](https://github.com/nodejs/undici) | `5.26.5` | `5.28.4` |
| [vercel](https://github.com/vercel/vercel/tree/HEAD/packages/cli) | `33.1.0` | `37.2.1` |
| [web3-utils](https://github.com/ChainSafe/web3.js) | `4.0.3` | `4.3.1` |


Updates `next` from 13.5.6 to 14.1.1
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v13.5.6...v14.1.1)

Updates `ws` from 7.5.9 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.9...8.17.1)

Updates `ws` from 8.13.0 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.9...8.17.1)

Updates `@crocswap-libs/sdk` from 0.2.75 to 1.0.5
- [Commits](https://github.com/CrocSwap/sdk/commits)

Updates `@rainbow-me/rainbowkit` from 1.3.0 to 2.1.5
- [Release notes](https://github.com/rainbow-me/rainbowkit/releases)
- [Changelog](https://github.com/rainbow-me/rainbowkit/blob/main/packages/rainbowkit/CHANGELOG.md)
- [Commits](https://github.com/rainbow-me/rainbowkit/commits/@rainbow-me/rainbowkit@2.1.5/packages/rainbowkit)

Updates `viem` from 1.19.15 to 2.21.1
- [Release notes](https://github.com/wevm/viem/releases)
- [Commits](https://github.com/wevm/viem/compare/viem@1.19.15...viem@2.21.1)

Updates `wagmi` from 1.4.12 to 2.12.8
- [Release notes](https://github.com/wevm/wagmi/releases)
- [Changelog](https://github.com/wevm/wagmi/blob/main/packages/react/CHANGELOG.md)
- [Commits](https://github.com/wevm/wagmi/commits/wagmi@2.12.8/packages/react)

Updates `debug` from 3.2.7 to 2.6.9
- [Release notes](https://github.com/debug-js/debug/releases)
- [Changelog](https://github.com/debug-js/debug/blob/2.6.9/CHANGELOG.md)
- [Commits](debug-js/debug@3.2.7...2.6.9)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `elliptic` from 6.5.4 to 6.5.7
- [Commits](indutny/elliptic@v6.5.4...v6.5.7)

Updates `web3-eth-abi` from 4.0.3 to 4.2.3
- [Release notes](https://github.com/ethereum/web3.js/releases)
- [Changelog](https://github.com/web3/web3.js/blob/4.x/CHANGELOG.md)
- [Commits](https://github.com/ethereum/web3.js/commits)

Updates `follow-redirects` from 1.15.5 to 1.15.6
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.5...v1.15.6)

Updates `micromatch` from 4.0.5 to 4.0.8
- [Release notes](https://github.com/micromatch/micromatch/releases)
- [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/micromatch@4.0.5...4.0.8)

Updates `undici` from 5.26.5 to 5.28.4
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.26.5...v5.28.4)

Updates `vercel` from 33.1.0 to 37.2.1
- [Release notes](https://github.com/vercel/vercel/releases)
- [Changelog](https://github.com/vercel/vercel/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/vercel/vercel/commits/vercel@37.2.1/packages/cli)

Updates `web3-utils` from 4.0.3 to 4.3.1
- [Release notes](https://github.com/ChainSafe/web3.js/releases)
- [Changelog](https://github.com/web3/web3.js/blob/4.x/CHANGELOG.md)
- [Commits](https://github.com/ChainSafe/web3.js/commits)

---
updated-dependencies:
- dependency-name: next
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@crocswap-libs/sdk"
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: "@rainbow-me/rainbowkit"
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: viem
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: wagmi
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: debug
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: elliptic
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: web3-eth-abi
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: micromatch
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vercel
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: web3-utils
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@cloudflare-workers-and-pages
Copy link

cloudflare-workers-and-pages bot commented Sep 1, 2024 •
edited
Loading

Deploying canto-v3 with  Cloudflare Pages  Cloudflare Pages

Latest commit: 066e100
Status:🚫  Build failed.

View logs

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Sep 1, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants