Skip to content

chore(deps): bump the npm_and_yarn group with 15 updates#12

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-e4caae84dd
Open

chore(deps): bump the npm_and_yarn group with 15 updates#12
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/npm_and_yarn-e4caae84dd

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Feb 28, 2025

Bumps the npm_and_yarn group with 15 updates:

Package From To
nunjucks 3.2.3 3.2.4
xml2js 0.4.23 0.5.0
rollup 2.56.3 2.79.2
@babel/traverse 7.15.4 7.26.9
@xmldom/xmldom 0.7.4 0.7.13
ansi-regex 5.0.0 5.0.1
braces 3.0.2 3.0.3
fast-xml-parser 3.19.0 4.5.3
is-svg 4.3.1 5.1.0
json5 1.0.1 1.0.2
micromatch 4.0.4 4.0.8
minimatch 3.0.4 3.1.2
minimist 1.2.5 1.2.8
tough-cookie 4.0.0 4.1.4
ws 7.5.4 7.5.10

Updates nunjucks from 3.2.3 to 3.2.4

Release notes

Sourced from nunjucks's releases.

v3.2.4

What's Changed

Full Changelog: mozilla/nunjucks@v3.2.3...v3.2.4

Changelog

Sourced from nunjucks's changelog.

3.2.4 (Apr 13 2023)

  • HTML encode backslashes when expressions are passed through the escape filter (including when this is done automatically with autoescape). Merge of #1437.
Commits

Updates xml2js from 0.4.23 to 0.5.0

Commits

Updates rollup from 2.56.3 to 2.79.2

Release notes

Sourced from rollup's releases.

v.2.79.2

2.79.2

2024-09-26

Bug Fixes

  • Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

Changelog

Sourced from rollup's changelog.

2.79.2

2024-09-26

Bug Fixes

  • Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

3.29.5

2024-09-21

Bug Fixes

  • Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

4.22.4

2024-09-21

Bug Fixes

  • Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

4.22.3

2024-09-21

Bug Fixes

  • Ensure that mutations in modules without side effects are observed while properly handling transitive dependencies (#5669)

Pull Requests

4.22.2

... (truncated)

Commits

Updates @babel/traverse from 7.15.4 to 7.26.9

Release notes

Sourced from @​babel/traverse's releases.

v7.26.9 (2025-02-14)

🐛 Bug Fix

🏠 Internal

Committers: 5

v7.26.8 (2025-02-08)

🏠 Internal

  • babel-preset-env
    • #17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

v7.26.7 (2025-01-24)

Thanks @​branchseer and @​tquetano-netflix for your first PRs!

🐛 Bug Fix

  • babel-helpers, babel-preset-env, babel-runtime-corejs3
  • babel-plugin-transform-typeof-symbol
  • babel-parser
  • babel-core
  • babel-plugin-transform-typescript
  • babel-plugin-transform-typescript, babel-traverse, babel-types

Committers: 6

... (truncated)

Changelog

Sourced from @​babel/traverse's changelog.

v7.26.9 (2025-02-14)

🐛 Bug Fix

🏠 Internal

v7.26.7 (2025-01-24)

🐛 Bug Fix

  • babel-helpers, babel-preset-env, babel-runtime-corejs3
  • babel-plugin-transform-typeof-symbol
  • babel-parser
  • babel-core
  • babel-plugin-transform-typescript
  • babel-plugin-transform-typescript, babel-traverse, babel-types

v7.26.6 (2025-01-13)

🐛 Bug Fix

  • babel-plugin-transform-nullish-coalescing-operator

v7.26.5 (2025-01-10)

👓 Spec Compliance

🐛 Bug Fix

  • babel-plugin-transform-block-scoped-functions
  • babel-plugin-transform-typescript
  • babel-parser
  • babel-generator, babel-parser, babel-plugin-transform-flow-strip-types, babel-types

... (truncated)

Commits

Updates @xmldom/xmldom from 0.7.4 to 0.7.13

Release notes

Sourced from @​xmldom/xmldom's releases.

0.7.13

Commits

Fixed

Thank you, @​qtow, for your contributions

0.7.12

Commits

Fixed

Thank you, @​cjbarth, for your contributions

0.7.11

Commits

Fixed

Thank you, @​zorkow, for your contributions

0.7.10

commits

Fixed

Thank you, @​bulandent, for your contributions

0.7.9

Commits

Fixed

Thank you, @​edemaine, @​pedro-l9, for your contributions

0.7.8

... (truncated)

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.7.13

Fixed

Thank you, @​qtow, for your contributions

0.9.0-beta.9

Fixed

Chore

Thank you, @​cjbarth, @​shunkica, @​pmahend1, @​niklasl, for your contributions

0.8.9

Fixed

Thank you, @​cjbarth, for your contributions

0.7.12

Fixed

Thank you, @​cjbarth, for your contributions

0.9.0-beta.8

Fixed

... (truncated)

Commits

Updates ansi-regex from 5.0.0 to 5.0.1

Release notes

Sourced from ansi-regex's releases.

v5.0.1

Fixes (backport of 6.0.1 to v5)

This is a backport of the minor ReDos vulnerability in ansi-regex@<6.0.1, as requested in #38.

  • Fix ReDoS in certain cases (#37) You are only really affected if you run the regex on untrusted user input in a server context, which it's very unlikely anyone is doing, since this regex is mainly used in command-line tools.

CVE-2021-3807

https://github.com/chalk/ansi-regex/compare/v5.0.0..v5.0.1

Thank you @​yetingli for the patch and reproduction case!

Commits

Updates braces from 3.0.2 to 3.0.3

Commits

Updates fast-xml-parser from 3.19.0 to 4.5.3

Release notes

Sourced from fast-xml-parser's releases.

Summary update on all the previous releases from v4.2.4

  • Multiple minor fixes provided in the validator and parser
  • v6 is added for experimental use.
  • ignoreAttributes support function, and array of string or regex
  • Add support for parsing HTML numeric entities
  • v5 of the application is ESM module now. However, JS is also supported

Note: Release section in not updated frequently. Please check CHANGELOG or Tags for latest release information.

Security Fix

Update to this release if you use entity parsing in Fast XML Parser.

v4

  • Generating different combined, parser only, builder only, validator only browser bundles
  • Keeping cjs modules as they can be imported in cjs and esm modules both. Otherwise refer esm branch.

4.0.0-beta.8 / 2021-12-13

  • call tagValueProcessor for stop nodes

4.0.0-beta.7 / 2021-12-09

  • fix Validator bug when an attribute has no value but '=' only
  • XML Builder should suppress unpaired tags by default.
  • documents update for missing features
  • refactoring to use Object.assign
  • refactoring to remove repeated code

4.0.0-beta.6 / 2021-12-05

  • Support PI Tags processing
  • Support suppressBooleanAttributes by XML Builder for attributes with value true.

4.0.0-beta.5 / 2021-12-04

  • fix: when a tag with name "attributes"

4.0.0-beta.4 / 2021-12-02

  • Support HTML document parsing
  • skip stop nodes parsing when building the XML from JS object
  • Support external entites without DOCTYPE
  • update dev dependency: strnum v1.0.5 to fix long number issue

4.0.0-beta.3 / 2021-11-30

  • support global stopNodes expression like "*.stop"
  • support self-closing and paired unpaired tags
  • fix: CDATA should not be parsed.
  • Fix typings for XMLBuilder (#396)(By Anders Emil Salvesen)
  • supports XML entities, HTML entities, DOCTYPE entities

⚠️ 4.0.0-beta.2 / 2021-11-19

  • rename attrMap to attibutes in parser output when preserveOrder:true
  • supports unpairedTags

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

5.0.8 / 2025-02-27

  • fix parsing 0 if skiplike option is used.
    • updating strnum dependency

5.0.7 / 2025-02-25

  • fix (#724) typings for cjs.

5.0.6 / 2025-02-20

5.0.5 / 2025-02-20

  • fix parsing of string starting with 'e' or 'E' by updating strnum

5.0.4 / 2025-02-20

  • fix CLI to support all the versions of node js when displaying library version.
  • fix CJS import in v5
    • by fixing webpack config

5.0.3 / 2025-02-20

  • Using strnum ESM module
    • new fixes in strum may break your experience

5.0.2 / 2025-02-20

  • fix: include CommonJS resources in the npm package #714 (By Thomas Bouffard)
  • fix: move babel deps to dev deps

5.0.1 / 2025-02-19

  • fix syntax error for CLI command

5.0.0 / 2025-02-19

  • ESM support
    • no change in the functionality, syntax, APIs, options, or documentation.

4.5.2 / 2025-02-18

  • Fix null CDATA to comply with undefined behavior (#701) (By Matthieu BOHEAS)
  • Fix(performance): Update check for leaf node in saveTextToParentTag function in OrderedObjParser.js (#707) (By ...)
  • Fix: emit full JSON string from CLI when no output filename specified (#710) (By Matt Benson)

4.5.1 / 2024-12-15

  • Fix empty tag key name for v5 (#697). no impact on v4
  • Fixes entity parsing when used in strict mode (#699)

4.5.0 / 2024-09-03

  • feat #666: ignoreAttributes support function, and array of string or regex (By ArtemM)

4.4.1 / 2024-07-28

  • v5 fix: maximum length limit to currency value

... (truncated)

Commits

Updates is-svg from 4.3.1 to 5.1.0

Release notes

Sourced from is-svg's releases.

v5.1.0

  • Update dependencies 5be629e

sindresorhus/is-svg@v5.0.1...v5.1.0

v5.0.1

  • Fix detection of <SvG> cb5bef2

sindresorhus/is-svg@v5.0.0...v5.0.1

v5.0.0

Breaking

  • Require Node.js 14 d29071c
  • This package is now pure ESM. Please read this.
  • It no longer accepts a Buffer.
    • To migrate, simply call .toString() on the buffer before passing it in here.
  • It now strictly validates that the input is a string.

sindresorhus/is-svg@v4.4.0...v5.0.0

v4.4.0

  • Update fast-xml-parser dependency (#35) 98725ee

sindresorhus/is-svg@v4.3.2...v4.4.0

v4.3.2

  • Fix false-negative with linebreaks inside the SVG tag (#29) d46292d

sindresorhus/is-svg@v4.3.1...v4.3.2

Commits

Updates json5 from 1.0.1 to 1.0.2

Release notes

Sourced from json5's releases.

v1.0.2

  • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295). This has been backported to v1. (#298)
Changelog

Sourced from json5's changelog.

Unreleased [code, diff]

v2.2.3 [code, diff]

  • Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2 [code, diff]

  • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

v2.2.0 [code, diff]

  • New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

v2.1.3 [code, diff]

  • Fix: An out of memory bug when parsing numbers has been fixed. (#228, #229)

v2.1.2 [code, diff]

... (truncated)

Commits

Updates micromatch from 4.0.4 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

  • this is basically v4.0.5, with some README updates
  • it is vulnerable to CVE-2024-4067
  • Updated braces to v3.0.3 to avoid CVE-2024-4068
  • does NOT break API compatibility

[4.0.6] - 2024-05-21

  • Added hasBraces to check if a pattern contains braces.
  • Fixes CVE-2024-4067
  • BREAKS API COMPATIBILITY
  • Should be labeled as a major release, but it's not.

[4.0.1 - 4.0.5]

[4.0.0] - 2019-03-20

Added

  • Adds support for options.onMatch. See the readme for details
  • Adds support for options.onIgnore. See the readme for details
  • Adds support for options.onResult. See the readme for details

Breaking changes

  • Require Node.js >= 8.6
  • Removed support for passing an array of brace patterns to micromatch.braces().
  • To strictly enforce closing brackets (for {, [, and (), you must now use strictBrackets=true instead of strictErrors.
  • cache - caching and all related options and methods have been removed
  • options.unixify was renamed to options.windows
  • options.nodupes Was removed. Duplicates are always removed by default. You can override this with custom behavior by using the onMatch, onResult and onIgnore functions.
  • options.snapdragon was removed, as snapdragon is no longer used.
  • options.sourcemap was removed, as snapdragon is no longer used, which provided sourcemap support.

[3.0.0] - 2017-04-11

Complete overhaul, with 36,000+ new unit tests validated against actual output generated by Bash and minimatch. More specifically, 35,000+ of the tests:

  • micromatch results are directly compared to bash results
  • in rare cases, when micromatch and bash disagree, micromatch's results are compared to minimatch's results
  • micromatch is much more accurate than minimatch, so there were cases where I had to make assumptions. I'll try to document these.

This refactor introduces a parser and compiler that are supersets of more granular parsers and compilers from other sub-modules. Each of these sub-modules has a singular responsibility and focuses on a certain type of matching that aligns with a specific part of the Bash "expansion" API.

These sub-modules work like plugins to seamlessly create the micromatch parser/compiler, so that strings are parsed in one pass, an AST is created, then a new string is generated by the compiler.

... (truncated)

Commits

Updates minimatch from 3.0.4 to 3.1.2

Commits

Updates minimist from 1.2.5 to 1.2.8

Changelog

Sourced from minimist's changelog.

v1.2.8 - 2023-02-09

Merged

Fixed

Commits

  • Merge tag 'v0.2.3' a026794
  • [eslint] fix indentation and whitespace 5368ca4
  • [eslint] fix indentation and whitespace e5f5067
  • [eslint] more cleanup 62fde7d
  • [eslint] more cleanup 36ac5d0
  • [meta] add auto-changelog 73923d2
  • [actions] add reusable workflows d80727d
  • [eslint] add eslint; rules to enable later are warnings 48bc06a
  • [eslint] fix indentation 34b0f1c
  • [readme] rename and add badges 5df0fe4
  • [Dev Deps] switch from covert to nyc a48b128
  • [Dev Deps] update covert, tape; remove unnecessary tap f0fb958
  • [meta] create FUNDING.yml; add funding in package.json 3639e0c
  • [meta] use npmignore to autogenerate an npmignore file be2e038
  • Only apps should have lockfiles 282b570
  • isConstructorOrProto adapted from PR ef9153f
  • [Dev Deps] update @ljharb/eslint-config, aud 098873c
  • [Dev Deps] update @ljharb/eslint-config, aud 3124ed3
  • [meta] add safe-publish-latest 4b927de
  • [Tests] add aud in posttest b32d9bd
  • [meta] update repo URLs f9fdfc0
  • [actions] Avoid 0.6 tests due to build failures ba92fe6
  • [Dev Deps] update tape 950eaa7
  • [Dev Deps] add missing npmignore dev dep 3226afa
  • Merge tag 'v0.2.2' 980d7ac

v1.2.7 - 2022-10-10

Commits

... (truncated)

Commits

@dependabot
chore(deps): bump the npm_and_yarn group with 15 updates
9265b07 
Bumps the npm_and_yarn group with 15 updates:

| Package | From | To |
| --- | --- | --- |
| [nunjucks](https://github.com/mozilla/nunjucks) | `3.2.3` | `3.2.4` |
| [xml2js](https://github.com/Leonidas-from-XIV/node-xml2js) | `0.4.23` | `0.5.0` |
| [rollup](https://github.com/rollup/rollup) | `2.56.3` | `2.79.2` |
| [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.15.4` | `7.26.9` |
| [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.7.4` | `0.7.13` |
| [ansi-regex](https://github.com/chalk/ansi-regex) | `5.0.0` | `5.0.1` |
| [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` |
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `3.19.0` | `4.5.3` |
| [is-svg](https://github.com/sindresorhus/is-svg) | `4.3.1` | `5.1.0` |
| [json5](https://github.com/json5/json5) | `1.0.1` | `1.0.2` |
| [micromatch](https://github.com/micromatch/micromatch) | `4.0.4` | `4.0.8` |
| [minimatch](https://github.com/isaacs/minimatch) | `3.0.4` | `3.1.2` |
| [minimist](https://github.com/minimistjs/minimist) | `1.2.5` | `1.2.8` |
| [tough-cookie](https://github.com/salesforce/tough-cookie) | `4.0.0` | `4.1.4` |
| [ws](https://github.com/websockets/ws) | `7.5.4` | `7.5.10` |


Updates `nunjucks` from 3.2.3 to 3.2.4
- [Release notes](https://github.com/mozilla/nunjucks/releases)
- [Changelog](https://github.com/mozilla/nunjucks/blob/master/CHANGELOG.md)
- [Commits](mozilla/nunjucks@v3.2.3...v3.2.4)

Updates `xml2js` from 0.4.23 to 0.5.0
- [Commits](https://github.com/Leonidas-from-XIV/node-xml2js/commits/0.5.0)

Updates `rollup` from 2.56.3 to 2.79.2
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v2.56.3...v2.79.2)

Updates `@babel/traverse` from 7.15.4 to 7.26.9
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.26.9/packages/babel-traverse)

Updates `@xmldom/xmldom` from 0.7.4 to 0.7.13
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.7.4...0.7.13)

Updates `ansi-regex` from 5.0.0 to 5.0.1
- [Release notes](https://github.com/chalk/ansi-regex/releases)
- [Commits](chalk/ansi-regex@v5.0.0...v5.0.1)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `fast-xml-parser` from 3.19.0 to 4.5.3
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/commits)

Updates `is-svg` from 4.3.1 to 5.1.0
- [Release notes](https://github.com/sindresorhus/is-svg/releases)
- [Commits](sindresorhus/is-svg@v4.3.1...v5.1.0)

Updates `json5` from 1.0.1 to 1.0.2
- [Release notes](https://github.com/json5/json5/releases)
- [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md)
- [Commits](json5/json5@v1.0.1...v1.0.2)

Updates `micromatch` from 4.0.4 to 4.0.8
- [Release notes](https://github.com/micromatch/micromatch/releases)
- [Changelog](https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/micromatch@4.0.4...4.0.8)

Updates `minimatch` from 3.0.4 to 3.1.2
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.0.4...v3.1.2)

Updates `minimist` from 1.2.5 to 1.2.8
- [Changelog](https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md)
- [Commits](minimistjs/minimist@v1.2.5...v1.2.8)

Updates `tough-cookie` from 4.0.0 to 4.1.4
- [Release notes](https://github.com/salesforce/tough-cookie/releases)
- [Changelog](https://github.com/salesforce/tough-cookie/blob/master/CHANGELOG.md)
- [Commits](salesforce/tough-cookie@v4.0.0...v4.1.4)

Updates `ws` from 7.5.4 to 7.5.10
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@7.5.4...7.5.10)

---
updated-dependencies:
- dependency-name: nunjucks
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: xml2js
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: "@babel/traverse"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@xmldom/xmldom"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ansi-regex
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fast-xml-parser
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: is-svg
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: json5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: micromatch
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimatch
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: minimist
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tough-cookie
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Feb 28, 2025
This was referenced Feb 28, 2025
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants