Update dependency browserify to v12 (master)

[appcues-wss]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
browserify	^4.2.0 -> ^12.0.0

By merging this PR, the below vulnerabilities will be automatically resolved:

Severity	CVSS Score	CVE
Critical	9.8	CVE-2015-8857
Critical	9.8	CVE-2016-10541
Critical	9.8	CVE-2021-42740
High	7.5	CVE-2015-8858
High	7.5	CVE-2015-8858
Medium	5.1	WS-2018-0075

---

Release Notes

browserify/browserify (browserify)

v12.0.0

Compare Source

Node support changes: now testing against the latest node (currently 4.2.1).
node 0.8 is no longer supported, and iojs isn't actively tested.

Stream3 everywhere! Everything has been updated to use streams3.

Sourcemaps charset now uses an = instead of a :. This fixes certain issues
with Chinese characters in sourcemaps. See #​753.

module-deps has been updated to fix root transforms on symlinked modules. See
https://github.com/substack/module-deps/pull/99.

stream-http, the module that provides http support, dropped IE8 support. If
you depend on this, see https://github.com/jhiesey/stream-http#ie8-note.

Removed builtins and commondir – both unused dependencies.

v11.2.0

Compare Source

When bundleExternal is set to false, process and buffer are now correctly excluded. Also, using --igv via the CLI now works. That also means that --bare and --node actually insert __filename and __dirname.

https://github.com/substack/node-browserify/pull/1361

v11.1.0

Compare Source

adds a '.' to extensions if it wasn't added

https://github.com/substack/node-browserify/pull/1380

v11.0.1

Compare Source

The callback form of bundle() uses the returned output stream instead of the
pipeline so that the 'end' event will fire on the bundle instance.

https://github.com/substack/watchify/pull/249#issuecomment-126061169

v11.0.0

Compare Source

streams3

The readable-stream dependency was updated to ^2.0.0. This package is inserted into bundles as require('stream'). Bundles will now get the latest streams implementation from io.js/node.js core, instead of an old version from node.js 0.11.x. Go forth and stream ALL THE DATA without fear!

shiny new HTTP package

John Hiesey rewrote the http-browserify package
to create stream-http, an implemention of http that supports streaming in modern browsers. Before v11.0.0, in most situations when you used http.get or http.request, the entire request would buffer in memory until the download was complete, and a single 'data' event was emitted with the entire response as a string.

stream-http uses the Fetch API and various browser-specific XHR extensions to make binary streaming http requests work in as many browsers as possible.

The following browsers support true streaming, where only a small amount of the request has to be held in memory at once:

• Chrome >= 43 (using the fetch api)
• Firefox >= 9 (using moz-chunked-arraybuffer responseType with XHR)

The following browsers support pseudo-streaming, where the data is available before the request finishes, but the entire response must be held in memory:

• Safari >= 5
• IE >= 10
• Most other Webkit-based browsers, including the default Android browser

Older browsers will work, without streaming support. There is no support for IE6 or IE7.

Compared to http-browserify, it is not necessary to set options.responseType. The responseType property of the XHR object will be set automatically depending on what features are detected in the browser (although see options.mode in the readme to see how you can optimize this choice manually).

The response is a streams3 stream, so all data is passed as Buffers, unlike the variable types provided by the 'data' event in http-browserify. This behavior tries to mimic the node core http module as closely as possible.

• #​1327

If you're brave, go ahead and give v11.0.0 a try today!

v10.2.6

Compare Source

uses the non-sync version of fs.realpath

v10.2.5

Compare Source

fixes an issue with symlinked files executing multiple times

https://github.com/substack/node-browserify/issues/1063
https://github.com/substack/node-browserify/pull/1318

v10.2.4

Compare Source

fixes requiring an entry from another entry

remove unused dep "deep-equal" and unused file "lib/_exclude.js"

https://github.com/substack/node-browserify/pull/1268

v10.2.3

Compare Source

fixes an errant space in the --no-browser-field flag alias
that kept it from working

https://github.com/substack/node-browserify/issues/1286

v10.2.1

Compare Source

housekeeping - removed unused code

https://github.com/substack/node-browserify/pull/1273

v10.2.0

Compare Source

remove unnecessary "isDedupe" json check. this was a hack-fix for watchify <=2.4.

https://github.com/substack/node-browserify/pull/1244

fixes for the "noParse" path matcher.

https://github.com/substack/node-browserify/pull/1257

add syntax check cache. this speeds up rebuilds (like when using watchify).

https://github.com/substack/node-browserify/pull/1253

update to browser-pack@^5.0.0 - includes several fixes related to source maps.

https://github.com/substack/node-browserify/pull/1259

v10.1.3

Compare Source

Replace jsonstream with JSONStream

https://github.com/substack/node-browserify/pull/1252

v10.1.2

Compare Source

Replace JSONStream with jsonstream
Update deps to avoid jsonstream npm case problems

https://github.com/substack/node-browserify/pull/1247
browserify/browserify@1ca71e23

v10.1.1

Compare Source

ensures that entry paths are always full paths

https://github.com/substack/node-browserify/pull/1248

v10.1.0

Compare Source

adds --no-browser-field and opts.browserField = false behavior to turn off
the package.json browser field. This is useful if you want to make a bundle with
a target of node or some environment with shimmed node primitives.

A new alias --node sets --no-browser-field and --bare.

https://github.com/substack/node-browserify/pull/1240

v10.0.0

Compare Source

Possibly Breaking Change

The ‘process’ dependency was updated to ~0.11.0, this module is inserted into bundles as the ‘process’ global/dependency.
Previously, an unhandled error thrown in a ‘process.nextTick’ task would prevent any subsequent tasks from running, forever.
The task queue now recovers from this condition, but may do so on a future browser tick.
As part of this update, ‘process.nextTick’ now accepts variadic arguments, passed to the task, added to io.js in 1.8.1.

• #​1231
• defunctzombie/node-process#38
• iojs/io.js#1077

Other changes

• Escapes JavaScript-unsafe characters from JSON. #​1211
• Removes ‘-v’ shortcut for ‘--version’ (conflicted with watchify) #​1222
• Updated ‘defined’, ‘punycode’, ‘module-deps’, and ‘xtend’ dependencies to reduce install size #​1230

v9.0.8

Compare Source

makes .require({ expose: 'name' }) and require('name') work at the same time

https://github.com/substack/node-browserify/issues/850
https://github.com/substack/node-browserify/pull/1202

v9.0.7

Compare Source

fixes an issue with catching error events on the b.bundle() stream

https://github.com/substack/node-browserify/issues/1194
https://github.com/substack/node-browserify/pull/1195

v9.0.6

Compare Source

republishing 9.0.5 in an attempt to satisfy npm.

v9.0.5

Compare Source

sets the stream returned by bundle() to be readable-only

https://github.com/substack/node-browserify/pull/1187#issuecomment-89044008

v9.0.4

Compare Source

handles the colon better for drive paths and improves the test suite for windows
users

https://github.com/substack/node-browserify/pull/1182
https://github.com/substack/node-browserify/pull/1183

v9.0.3

Compare Source

fixes a problem with deduping for json files.

This caused problems for running bundle() multiple times on the same instance
with caching turned on, which people reported encountering using watchify.

https://github.com/substack/node-browserify/issues/1101
https://github.com/substack/watchify/issues/143

v9.0.2

Compare Source

fixes a bug where transforms in opts.transform were getting run twice

https://github.com/substack/node-browserify/issues/1124
https://github.com/substack/node-browserify/pull/1128

v9.0.1

Compare Source

fixes exposed files persisting across bundles

https://github.com/substack/node-browserify/pull/1030

v9.0.0

Compare Source

updates browser-pack which uses umd 3.0.0.
This sligtly changes how --standalone $name works.

https://github.com/substack/browser-pack/pull/49
https://github.com/substack/node-browserify/pull/1105

Also some tidying up around handling expose that module-deps can do now:

https://github.com/substack/node-browserify/pull/1077

and some fixes to regressions involving the 'package' event:

https://github.com/substack/node-resolve/issues/69

Upstream changes in resolve/browser-resolve mean that require('foo/bar') works
better with the package.json browser field. You can do something like:

{
  "browser": { "./bar": "whatever.js" }
}

v8.1.3

Compare Source

uses / instead of \ for source map url separators on windows
https://github.com/substack/node-browserify/pull/1096

v8.1.2

Compare Source

resolves mappings from the browser field for externals

https://github.com/substack/node-browserify/pull/1100

v8.1.1

Compare Source

fixes an issue with resolving exposed packages relative to the basedir

https://github.com/substack/node-browserify/pull/1059
https://github.com/substack/node-browserify/issues/1039
https://github.com/daiweilu/browserify-broken-require

v8.1.0

Compare Source

use [email protected], which fixes a bug in assert.deepEqual related to argument ordering,
and ensures assert.deepEqual continues working in Chrome 40 and Firefox 35.

use [email protected], which adds process.umask() and a faster process.nextTick()
implementation.

https://github.com/substack/node-browserify/pull/1018
https://github.com/substack/node-browserify/pull/1041

v8.0.3

Compare Source

passes opts.debug through to insert-module-globals so that is can insert inline
source maps for its modifications

v8.0.2

Compare Source

ensures that transforms always execute in the order they were added

https://github.com/substack/node-browserify/pull/1043

v8.0.1

Compare Source

fixes some file path leaks in deduped deps

https://github.com/substack/node-browserify/pull/994
https://github.com/substack/node-browserify/issues/951

v8.0.0

Compare Source

In previous releases, the deduping logic was over-zealous about how it handled
module references for duplicates. The prior behavior would detect when the
dependency tree of a module matched an existing module in addition to having the
exact same source code to share an instance. This was originally designed to
support libraries like threejs that internally use instanceof checks that
don't usually work very well across multiple packages. This feature didn't pan
out and didn't work very well in practice.

Later, a better way of deduping emerged after some unrelated tweaks to
browser-pack to support source introspection for webworkers. The reflection form
of deduping using implicit arguments is now the only kind.

The deduping instance feature resulted in this bug:
https://github.com/substack/node-browserify/issues/1027
which created very surprising results when duplicate files were in use.

v7.1.0

Compare Source

uses the new [email protected], which passes node's own buffer test suite

https://github.com/substack/node-browserify/pull/1040

v7.0.3

Compare Source

allows modules to be bundled with local paths and exposed at the same time

https://github.com/substack/node-browserify/pull/1033

v7.0.2

Compare Source

fixes the global transform getting added each re-bundle

https://github.com/substack/node-browserify/issues/1026

v7.0.1

Compare Source

fixes rebundling (used by watchify) when transforming

https://github.com/substack/node-browserify/issues/1012

also fixes https://github.com/substack/node-browserify/issues/1015

v7.0.0

Compare Source

• Upgrade events to v3.x. EventEmitter instances now have an off() method. require('events').once can be used to react to an event being emitted with async/await syntax. (#​1839)
• Upgrade path-browserify to v1.x. (#​1838)
• Upgrade stream-browserify to v3.x. require('stream') now matches the Node.js 10+ API. (#​1970)
• Upgrade util to v0.12. Most notably, util.promisify and util.callbackify are finally available by default in browserify. (#​1844)
• Add JSON syntax checking. Syntax errors in .json files will now fail to bundle. (#​1700)

v6.3.4

Compare Source

fixes a bug setting placeholder filenames on stream inputs to be properly unique

v6.3.3

Compare Source

fixes an issue with the expose property when opts.fullPaths is enabled

This issue commonly crops up in watchify.

https://github.com/substack/node-browserify/pull/991
https://github.com/substack/node-browserify/issues/850

v6.3.2

Compare Source

updates regexps that test for absolute and relative paths to work better on
windows

https://github.com/substack/node-browserify/pull/948

v6.3.1

Compare Source

fixes ignoreTransform for the case where transforms were given in package.json
as an array

https://github.com/substack/node-browserify/pull/966

v6.3.0

Compare Source

add empty stub for the http2 builtin module.

https://github.com/browserify/browserify/pull/1913

update license text to remove references to code that is no longer included.

https://github.com/browserify/browserify/pull/1906

add more tests for folder resolution.

https://github.com/browserify/browserify/pull/1139

v6.2.0

Compare Source

update the browser versions of vm-browserify and string_decoder.

string_decoder updates to the Node 8+ API.
vm-browserify replaces an unlicensed dependency by an MIT one.

https://github.com/browserify/browserify/pull/1829

v6.1.2

Compare Source

fixes the behavior for multiple external bundles

https://github.com/substack/node-browserify/issues/933

v6.1.1

Compare Source

add empty stub for the perf_hooks builtin module.

https://github.com/browserify/browserify/pull/1815

v6.1.0

Compare Source

add bare and node options to the API, same as the --bare and --node CLI arguments.

https://github.com/browserify/browserify/pull/1804

v6.0.3

Compare Source

fixes a bug where module insert-module-globals would trigger too soon and
conflict with other transforms

https://github.com/substack/node-browserify/issues/867
https://github.com/substack/node-browserify/issues/895
https://github.com/substack/node-browserify/issues/855

v6.0.2

Compare Source

upgrades process to 0.8.0
https://github.com/substack/node-browserify/pull/906

v6.0.1

Compare Source

respects opts.expose in require()
https://github.com/substack/node-browserify/pull/907

v6.0.0

Compare Source

add --preserve-symlinks option from Node 6.3

https://github.com/browserify/browserify/pull/1742
https://github.com/browserify/browserify/pull/1801

update the browser version of events to 2.0.0—this version adds methods like prependListener that were introduced in recent node versions, but it is also twice the size of events v1.x (2KB instead of 1KB).

https://github.com/browserify/browserify/pull/1803

Dynamically calculate __dirname and __filename when --node is passed

https://github.com/browserify/browserify/pull/1725

upgrade module-deps, see https://github.com/browserify/module-deps/releases/tag/v6.0.0

browserify/browserify@e5e1ec8

v5.13.1

Compare Source

bails early if opts.basedir is not the correct type
https://github.com/substack/node-browserify/pull/927

v5.13.0

Compare Source

exposes global browserify options to transforms under opts._flagshttps://github.com/substack/node-browserify/pull/9100

v5.12.2

Compare Source

fixes the array form of b.external()
https://github.com/substack/node-browserify/issues/930

v5.12.1

Compare Source

dedupe deps when fullPaths is on
https://github.com/substack/node-browserify/pull/917
and fixes the crypto tests

v5.12.0

Compare Source

adds back the array form for add() and require(), with extra places to add
options

v5.11.2

Compare Source

fixes ignore for relative paths
in https://github.com/substack/node-browserify/issues/896

v5.11.1

Compare Source

fixes exports across resets, which caused issues for watchify with exports
https://github.com/substack/node-browserify/pull/892

v5.11.0

Compare Source

adds an implicit dependency on the original module during dedupe
https://github.com/substack/node-browserify/pull/880

v5.10.1

Compare Source

fixes the command-line client to properly ignore paths that don't match a glob
https://github.com/substack/node-browserify/pull/866

v5.10.0

Compare Source

adds back support for .external(b) on a browserify instance b
that was dropped on the v5 refactor

v5.9.3

Compare Source

buffers the record pipeline phase to start outputting after the first tick
so that user plugins can capture and modify recorder output

v5.9.2

Compare Source

fixes a bug with using --ignore to exclude node_modules packages on the command-line

https://github.com/substack/node-browserify/pull/845

v5.9.1

Compare Source

improves the detection for --ignore

v5.9.0

Compare Source

fixes bug with builtins that load json files (the 'constants' module),
new 'json' pipeline label

https://github.com/substack/module-deps/issues/46

v5.8.0

Compare Source

allow optional extensions in bin/args

v5.7.0

Compare Source

re-instates transforms after a reset and fixes exposing the transform events
properly

v5.6.1

Compare Source

makes stream entry files deterministic

v5.6.0

Compare Source

adds 'package' events from module-deps when a package.json file is read

v5.5.0

Compare Source

adds back the 'bundle' event and copies over options correctly to reset()

v5.4.2

Compare Source

adds a note about derequire in standalone mode to the readme

v5.4.1

Compare Source

fixes an error with basedir resolving plugins from names

v5.4.0

Compare Source

also allows opts.plugin from the constructor like transform

v5.3.0

Compare Source

passes .file on stream inputs through to transforms
https://github.com/substack/node-browserify/issues/744

v5.2.1

Compare Source

sets require() for streams to not just be entry files

v5.2.0

Compare Source

create parent directories if they do not exist when --outfile /x/y/z/bundle.js is used

https://github.com/browserify/browserify/pull/995

add regression test for object rest spread syntax

https://github.com/browserify/browserify/pull/1798

v5.1.1

Compare Source

updates --list to always print file paths

v5.1.0

Compare Source

restore support for node < 4.0 until we can decide on a support schedule

v5.0.8

Compare Source

fixes using debug and standalone at the same time
https://github.com/substack/node-browserify/issues/750

v5.0.7

Compare Source

fixes command-line versions of -u and -x
https://github.com/substack/node-browserify/issues/821

v5.0.6

Compare Source

test for --bare

v5.0.5

Compare Source

fix for detectGlobals, --bare
https://github.com/substack/node-browserify/issues/803

v5.0.4

Compare Source

fixes --no-bundle-external with globals

https://github.com/substack/node-browserify/issues/828

v5.0.3

Compare Source

upgrades insert-module-globals to fix
https://github.com/substack/node-browserify/issues/834

v5.0.2

Compare Source

fixes the changelog link https://github.com/substack/node-browserify/pull/835

v5.0.1

Compare Source

adds an untracked test

v5.0.0

Compare Source

fixed repository url in package.json.

browserify/browserify@5ec19ee

update module-deps to 5.0.0, which enables requiring modules in backtick-enclosed strings.

https://github.com/browserify/browserify/pull/1785

dropped testing in node 0.10 and 0.12, set supported node versions to >=4

https://github.com/browserify/browserify/pull/1743
https://github.com/browserify/browserify/pull/1793

add support for passing arrays to the exclude and ignore methods.

https://github.com/browserify/browserify/pull/1769

v4.2.3

Compare Source

reverts 4.2.2 due to breaking some existing use-cases

v4.2.2

Compare Source

fixes a bug applying transforms to symlinked files by resolving the realpath
first https://github.com/substack/node-browserify/pull/831

v4.2.1

Compare Source

SECURITY NOTICE

Make sure your installation of browserify is using [email protected] or
later. there was a security vulnerability where a malicious file could
execute code when browserified.

The vulnerability involves breaking out of Function(), which was used to
check syntax for more informative errors. In node 0.10, Function() seems
to be implemented in terms of eval(), so malicious code can execute even
if the function returned by Function() was never called. node 0.11 does
not appear to be vulnerable.

Thanks to Cal Leeming [[email protected]]
for discovering and disclosing this bug!

---

• If you want to rebase/retry this PR, check this box