[Snyk] Upgrade: , , , ajv, glob, eslint, minimist, handlebars, jsdom, katex, moment, prettier, winston, yargs, workbox-cli #529

AnushaSalian · 2024-09-15T08:05:49Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

@babel/cli
from 7.20.7 to 7.24.8 | 20 versions ahead of your current version | 2 months ago
on 2024-07-11
@babel/core
from 7.20.12 to 7.25.2 | 41 versions ahead of your current version | 2 months ago
on 2024-07-30
@types/shelljs
from 0.8.11 to 0.8.15 | 4 versions ahead of your current version | 10 months ago
on 2023-11-07
ajv
from 8.12.0 to 8.17.1 | 5 versions ahead of your current version | 2 months ago
on 2024-07-12
glob
from 7.1.6 to 7.2.3 | 4 versions ahead of your current version | 2 years ago
on 2022-05-15
eslint
from 8.31.0 to 8.57.0 | 26 versions ahead of your current version | 7 months ago
on 2024-02-23
minimist
from 1.2.7 to 1.2.8 | 1 version ahead of your current version | 2 years ago
on 2023-02-09
handlebars
from 4.7.7 to 4.7.8 | 1 version ahead of your current version | a year ago
on 2023-08-01
jsdom
from 16.4.0 to 16.7.0 | 6 versions ahead of your current version | 3 years ago
on 2021-08-01
katex
from 0.16.4 to 0.16.11 | 7 versions ahead of your current version | 2 months ago
on 2024-07-02
moment
from 2.29.4 to 2.30.1 | 2 versions ahead of your current version | 9 months ago
on 2023-12-27
prettier
from 2.8.2 to 2.8.8 | 6 versions ahead of your current version | a year ago
on 2023-04-23
winston
from 3.8.2 to 3.14.2 | 10 versions ahead of your current version | a month ago
on 2024-08-14
yargs
from 17.6.2 to 17.7.2 | 3 versions ahead of your current version | a year ago
on 2023-04-27
workbox-cli
from 7.0.0 to 7.1.0 | 1 version ahead of your current version | 5 months ago
on 2024-04-23

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	646	Proof of Concept
Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	646	Proof of Concept
Unchecked Input for Loop Condition SNYK-JS-KATEX-6483836	646	No Known Exploit
Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	646	Proof of Concept
Cross-site Scripting (XSS) SNYK-JS-SERIALIZEJAVASCRIPT-6147607	646	Proof of Concept
Improper Control of Dynamically-Managed Code Resources SNYK-JS-EJS-6689533	646	No Known Exploit
Improper Encoding or Escaping of Output SNYK-JS-KATEX-6483831	646	No Known Exploit
Incomplete List of Disallowed Inputs SNYK-JS-KATEX-6483834	646	No Known Exploit
Unchecked Input for Loop Condition SNYK-JS-KATEX-6483835	646	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-WORDWRAP-3149973	646	Proof of Concept
Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962462	646	Proof of Concept

Release notes

Package name: @babel/cli

7.24.8 - 2024-07-11
v7.24.8 (2024-07-11)

Thanks @ H0onnn, @ jkup and @ SreeXD for your first pull requests!

👓 Spec Compliance
- babel-parser
  - #16567 Do not use strict mode in TS declare (@ liuxingbaoyu)
🐛 Bug Fix
- babel-generator
  - #16630 Correctly print parens around in in for heads (@ nicolo-ribaudo)
  - #16626 Fix printing of comments in await using (@ nicolo-ribaudo)
  - #16591 fix typescript code generation for yield expression inside type expre… (@ SreeXD)
- babel-parser
  - #16613 Disallow destructuring assignment in using declarations (@ H0onnn)
  - #16490 fix: do not add .value: undefined to regexp literals (@ liuxingbaoyu)
- babel-types
  - #16615 Remove boolean props from ObjectTypeInternalSlot visitor keys (@ nicolo-ribaudo)
- babel-plugin-transform-typescript
  - #16566 fix: Correctly handle export import x = (@ liuxingbaoyu)
💅 Polish
- babel-generator
  - #16625 Avoid unnecessary parens around async in for await (@ nicolo-ribaudo)
- babel-traverse
  - #16619 Avoid checking Scope.globals multiple times (@ liuxingbaoyu)
Committers: 9
- Amjad Yahia Robeen Hassan (@ amjed-98)
- Babel Bot (@ babel-bot)
- Huáng Jùnliàng (@ JLHwung)
- Jon Kuperman (@ jkup)
- Nagendran N (@ SreeXD)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- Sukka (@ SukkaW)
- @ H0onnn
- @ liuxingbaoyu
7.24.7 - 2024-06-05
v7.24.7 (2024-06-05)

🐛 Bug Fix
- babel-node
  - #16554 Allow extra flags in babel-node (@ nicolo-ribaudo)
- babel-traverse
  - #16522 fix: incorrect constantViolations with destructuring (@ liuxingbaoyu)
- babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management
  - #16524 fix: Transform using in switch correctly (@ liuxingbaoyu)
🏠 Internal
- babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  - #16525 Delete unused array helpers (@ blakewilson)
Committers: 7
- Amjad Yahia Robeen Hassan (@ amjed-98)
- Babel Bot (@ babel-bot)
- Blake Wilson (@ blakewilson)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- Sukka (@ SukkaW)
- @ liuxingbaoyu
7.24.6 - 2024-05-24
v7.24.6 (2024-05-24)

Thanks @ amjed-98, @ blakewilson, @ coelhucas, and @ SukkaW for your first PRs!

🐛 Bug Fix
- babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  - #16514 Fix source maps for private member expressions (@ nicolo-ribaudo)
- babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  - #16515 Fix source maps for template literals (@ nicolo-ribaudo)
- babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  - #16485 Support undecorated static accessor in anonymous classes (@ JLHwung)
  - #16484 Fix decorator bare yield await (@ JLHwung)
- babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
  - #16483 Fix: throw TypeError if addInitializer is called after finished (@ JLHwung)
- babel-parser, babel-plugin-transform-typescript
  - #16476 fix: Correctly parse cls.fn<C> = x (@ liuxingbaoyu)
🏠 Internal
- babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  - #16501 Generate helper metadata at build time (@ nicolo-ribaudo)
- babel-helpers
  - #16499 Add tsconfig.json for @ babel/helpers/src/helpers (@ nicolo-ribaudo)
- babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  - #16495 Move all runtime helpers to individual files (@ nicolo-ribaudo)
- babel-parser, babel-traverse
  - #16482 Statically generate boilerplate for bitfield accessors (@ nicolo-ribaudo)
- Other
  - #16466 Migrate import assertions syntax (@ JLHwung)
Committers: 9
- Amjad Yahia Robeen Hassan (@ amjed-98)
- Babel Bot (@ babel-bot)
- Blake Wilson (@ blakewilson)
- Huáng Jùnliàng (@ JLHwung)
- Lucas Coelho (@ coelhucas)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- Sukka (@ SukkaW)
- Zzzen (@ Zzzen)
- @ liuxingbaoyu
7.24.5 - 2024-04-29
v7.24.5 (2024-04-29)

Thanks @ romgrk and @ sossost for your first PRs!

🐛 Bug Fix
- babel-plugin-transform-classes, babel-traverse
  - #16377 fix: TypeScript annotation affects output (@ liuxingbaoyu)
- babel-helpers, babel-plugin-proposal-explicit-resource-management, babel-runtime-corejs3
  - #16440 Fix suppressed error order (@ sossost)
  - #16408 Await nullish async disposable (@ JLHwung)
💅 Polish
- babel-parser
  - #16407 Recover from exported using declaration (@ JLHwung)
🏠 Internal
- Other
  - #16414 Relax ESLint peerDependency constraint to allow v9 (@ liuxingbaoyu)
- babel-parser
  - #16425 Improve @ babel/parser AST types (@ nicolo-ribaudo)
  - #16417 Always pass type argument to .startNode (@ nicolo-ribaudo)
- babel-helper-create-class-features-plugin, babel-helper-member-expression-to-functions, babel-helper-module-transforms, babel-helper-split-export-declaration, babel-helper-wrap-function, babel-helpers, babel-plugin-bugfix-firefox-class-in-computed-class-key, babel-plugin-proposal-explicit-resource-management, babel-plugin-transform-block-scoping, babel-plugin-transform-destructuring, babel-plugin-transform-object-rest-spread, babel-plugin-transform-optional-chaining, babel-plugin-transform-parameters, babel-plugin-transform-private-property-in-object, babel-plugin-transform-react-jsx-self, babel-plugin-transform-typeof-symbol, babel-plugin-transform-typescript, babel-traverse
  - #16439 Make NodePath<T | U> distributive (@ nicolo-ribaudo)
- babel-plugin-proposal-partial-application, babel-types
  - #16421 Remove JSXNamespacedName from valid CallExpression args (@ nicolo-ribaudo)
- babel-plugin-transform-class-properties, babel-preset-env
  - #16406 Do not load unnecessary Babel 7 syntax plugins in Babel 8 (@ nicolo-ribaudo)
🏃‍♀️ Performance
- babel-helpers, babel-preset-env, babel-runtime-corejs3
  - #16357 Performance: improve objectWithoutPropertiesLoose on V8 (@ romgrk)
Committers: 6
- Babel Bot (@ babel-bot)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- Rom Grk (@ romgrk)
- @ liuxingbaoyu
- ynnsuis (@ sossost)
7.24.1 - 2024-03-19
7.23.9 - 2024-01-25
7.23.4 - 2023-11-20
7.23.0 - 2023-09-25
7.22.15 - 2023-09-04
7.22.10 - 2023-08-07
7.22.9 - 2023-07-12
7.22.6 - 2023-07-04
7.22.5 - 2023-06-08
7.21.5 - 2023-04-28
7.21.4-esm.4 - 2023-04-04
7.21.4-esm.3 - 2023-04-04
7.21.4-esm.2 - 2023-04-04
7.21.4-esm.1 - 2023-04-04
7.21.4-esm - 2023-04-04
7.21.0 - 2023-02-20
7.20.7 - 2022-12-22

from @babel/cli GitHub release notes

Package name: @babel/core

7.25.2 - 2024-07-30
v7.25.2 (2024-07-30)

🐛 Bug Fix
- babel-core, babel-traverse
  - #16695 Ensure that requeueComputedKeyAndDecorators is available (@ nicolo-ribaudo)
Committers: 2
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
7.24.9 - 2024-07-15
v7.24.9 (2024-07-15)

🐛 Bug Fix
- babel-core, babel-standalone
  - #16639 Avoid require() call in @ babel/standalone bundle (@ nicolo-ribaudo)
- babel-types
  - #16638 fix: provide legacy typings for TS < 4.1 (@ JLHwung)
💅 Polish
- babel-generator, babel-plugin-transform-optional-chaining
  - #16617 Avoid extra parens in TS as/satisfies (@ nicolo-ribaudo)
🏠 Internal
- babel-helper-module-transforms
  - #16629 Lazy top-level initializations for module transforms (@ guybedford)
Committers: 5
- Babel Bot (@ babel-bot)
- Guy Bedford (@ guybedford)
- Huáng Jùnliàng (@ JLHwung)
- Nicolò Ribaudo (@ nicolo-ribaudo)
- @ liuxingbaoyu
7.24.8 - 2024-07-11
7.24.7 - 2024-06-05
7.24.6 - 2024-05-24
7.24.5 - 2024-04-29
7.24.4 - 2024-04-03
7.24.3 - 2024-03-20
7.24.1 - 2024-03-19
7.24.0 - 2024-02-28
7.23.9 - 2024-01-25
7.23.7 - 2023-12-29
7.23.6 - 2023-12-11
7.23.5 - 2023-11-29
7.23.3 - 2023-11-09
7.23.2 - 2023-10-12
7.23.0 - 2023-09-25
7.22.20 - 2023-09-16
7.22.19 - 2023-09-14
7.22.18 - 2023-09-14
7.22.17 - 2023-09-08
7.22.15 - 2023-09-04
7.22.11 - 2023-08-24
7.22.10 - 2023-08-07
7.22.9 - 2023-07-12
7.22.8 - 2023-07-06
7.22.7 - 2023-07-06
7.22.6 - 2023-07-04
7.22.5 - 2023-06-08
7.22.1 - 2023-05-26
7.22.0 - 2023-05-26
7.21.8 - 2023-05-02
7.21.5 - 2023-04-28
7.21.4 - 2023-03-31
7.21.4-esm.4 - 2023-04-04
7.21.4-esm.3 - 2023-04-04
7.21.4-esm.2 - 2023-04-04
7.21.4-esm.1 - 2023-04-04
7.21.4-esm - 2023-04-04
7.21.3 - 2023-03-14
7.21.0 - 2023-02-20
7.20.12 - 2023-01-04

from @babel/core GitHub release notes

Package name: @types/shelljs

0.8.15 - 2023-11-07
0.8.14 - 2023-10-18
0.8.13 - 2023-09-25
0.8.12 - 2023-04-12
0.8.11 - 2022-01-13

from @types/shelljs GitHub release notes

Package name: ajv

8.17.1 - 2024-07-12
What's Changed
- bump version to 8.17.1 by @ jasoniangreen in #2472
Full Changelog: v8.17.0...v8.17.1

Plus everything in 8.17.0 which failed to release

The only functional change is to switch from uri-js (which is no longer supported), to fast-uri. This is the second attempt and the team on fast-uri have been really helpful addressing the issues we found last time.

Revert "Revert fast-uri change (#2444)" by @ gurgunday in #2448
fix: ignore new eslint error for @ typescript-eslint/no-extraneous-class by @ jasoniangreen in #2455
docs: clarify behaviour of addVocabulary by @ jasoniangreen in #2454
docs: refactor to improve legibility by @ blottn in #2432
Fix grammatical typo in managing-schemas.md by @ wetneb in #2305
docs: Fix broken strict-mode link by @ alexanderjsx in #2459
feat: add test for encoded refs and bump fast-uri by @ jasoniangreen in #2449
fix: changes for @ typescript-eslint/array-type rule by @ jasoniangreen in #2467
fixes #2217 - clarify custom keyword naming by @ jasoniangreen in #2457
8.16.0 - 2024-06-04
What's Changed
- Revert fast-uri change by @ jasoniangreen in #2444
Full Changelog: v8.15.0...v8.16.0
8.15.0 - 2024-06-03
What's Changed
- Replace uri-js with fast-uri by @ vixalien in #2415
- Bump to 8.15.0 by @ jasoniangreen in #2442
New Contributors
- @ vixalien made their first contribution in #2415
Full Changelog: v8.14.0...v8.15.0
8.14.0 - 2024-05-25
What's Changed
- readme: build badge by @ epoberezkin in #2424
- Update workflows by @ rotu in #2410
- docs: add warning to maxLength / minLength by @ jasoniangreen in #2428
- fix: broken link in docs warning by @ jasoniangreen in #2431
- compileAsync a schema with discriminator and $ref, fixes #2427 by @ jasoniangreen in #2433
- bump version to 8.14.0 for publishing by @ jasoniangreen in #2440
New Contributors
- @ rotu made their first contribution in #2410
Full Changelog: v8.13.0...v8.14.0
8.13.0 - 2024-04-29
- add named exports
- update dependencies
- update node.js
8.12.0 - 2023-01-03
- fix JTD serialisation (remove leading comma in objects with only optional properties) (#2190, @ piliugin-anton)
- empty JTD "values" schema (#2191)
- empty object to work with JTD utility type (#2158, @ erikbrinkman)
- fix JTD "discriminator" schema for objects with more than 8 properties (#2194)
- correctly narrow "number" type to "integer" (#2192, @ JacobLey)
- update Node.js versions in CI to 14, 16, 18 and 19

from ajv GitHub release notes

Package name: glob

7.2.3 - 2022-05-15
7.2.3
7.2.2 - 2022-05-13
7.2.2
7.2.0 - 2021-09-22
7.2.0
7.1.7 - 2021-05-06
7.1.7
7.1.6 - 2019-11-06
7.1.6

from glob GitHub release notes

Package name: eslint

8.57.0 - 2024-02-23
Features
- 1120b9b feat: Add loadESLint() API method for v8 (#18098) (Nicholas C. Zakas)
- dca7d0f feat: Enable eslint.config.mjs and eslint.config.cjs (#18066) (Nitin Kumar)
Bug Fixes
- 2196d97 fix: handle absolute file paths in FlatRuleTester (#18064) (Nitin Kumar)
- 69dd1d1 fix: Ensure config keys are printed for config errors (#18067) (Nitin Kumar)
- 9852a31 fix: deep merge behavior in flat config (#18065) (Nitin Kumar)
- 4c7e9b0 fix: allow circular references in config (#18056) (Milos Djermanovic)
Documentation
- 84922d0 docs: Show prerelease version in dropdown (#18139) (Nicholas C. Zakas)
- 5b8c363 docs: Switch to Ethical Ads (#18117) (Milos Djermanovic)
- 77dbfd9 docs: show NEXT in version selectors (#18052) (Milos Djermanovic)
Chores
- 1813aec chore: upgrade @ eslint/[email protected] (#18143) (Milos Djermanovic)
- 5c356bb chore: package.json update for @ eslint/js release (Jenkins)
- f4a1fe2 test: add more tests for ignoring files and directories (#18068) (Nitin Kumar)
- 42c0aef ci: Enable CI for v8.x branch (#18047) (Milos Djermanovic)
8.56.0 - 2023-12-15
Features
- 0dd9704 feat: Support custom severity when reporting unused disable directives (#17212) (Bryan Mishkin)
- 31a7e3f feat: fix no-restricted-properties false negatives with unknown objects (#17818) (Arka Pratim Chaudhuri)
Bug Fixes
- 7d5e5f6 fix: TypeError: fs.exists is not a function on read-only file system (#17846) (Francesco Trotta)
- 74739c8 fix: suggestion with invalid syntax in no-promise-executor-return rule (#17812) (Bryan Mishkin)
Documentation
- 9007719 docs: update link in ways-to-extend.md (#17839) (Amel SELMANE)
- 3a22236 docs: Update README (GitHub Actions Bot)
- 54c3ca6 docs: fix migration-guide example (#17829) (Tanuj Kanti)
- 4391b71 docs: check config comments in rule examples (#17815) (Francesco Trotta)
- fd28363 docs: remove mention about ESLint stylistic rules in readme (#17810) (Zwyx)
- 48ed5a6 docs: Update README (GitHub Actions Bot)
Chores
- ba6af85 chore: upgrade @ eslint/[email protected] (#17864) (Milos Djermanovic)

Snyk has created this PR to upgrade: - @babel/cli from 7.20.7 to 7.24.8. See this package in npm: https://www.npmjs.com/package/@babel/cli - @babel/core from 7.20.12 to 7.25.2. See this package in npm: https://www.npmjs.com/package/@babel/core - @types/shelljs from 0.8.11 to 0.8.15. See this package in npm: https://www.npmjs.com/package/@types/shelljs - ajv from 8.12.0 to 8.17.1. See this package in npm: https://www.npmjs.com/package/ajv - glob from 7.1.6 to 7.2.3. See this package in npm: https://www.npmjs.com/package/glob - eslint from 8.31.0 to 8.57.0. See this package in npm: https://www.npmjs.com/package/eslint - minimist from 1.2.7 to 1.2.8. See this package in npm: https://www.npmjs.com/package/minimist - handlebars from 4.7.7 to 4.7.8. See this package in npm: https://www.npmjs.com/package/handlebars - jsdom from 16.4.0 to 16.7.0. See this package in npm: https://www.npmjs.com/package/jsdom - katex from 0.16.4 to 0.16.11. See this package in npm: https://www.npmjs.com/package/katex - moment from 2.29.4 to 2.30.1. See this package in npm: https://www.npmjs.com/package/moment - prettier from 2.8.2 to 2.8.8. See this package in npm: https://www.npmjs.com/package/prettier - winston from 3.8.2 to 3.14.2. See this package in npm: https://www.npmjs.com/package/winston - yargs from 17.6.2 to 17.7.2. See this package in npm: https://www.npmjs.com/package/yargs - workbox-cli from 7.0.0 to 7.1.0. See this package in npm: https://www.npmjs.com/package/workbox-cli See this project in Snyk: https://app.snyk.io/org/anushasalian/project/e53fa273-8fc4-48d3-8bdf-56886cf7f09b?utm_source=github&utm_medium=referral&page=upgrade-pr

[Snyk] Upgrade: , , , ajv, glob, eslint, minimist, handlebars, jsdom, katex, moment, prettier, winston, yargs, workbox-cli #529

Are you sure you want to change the base?

[Snyk] Upgrade: , , , ajv, glob, eslint, minimist, handlebars, jsdom, katex, moment, prettier, winston, yargs, workbox-cli #529

Conversation

AnushaSalian commented Sep 15, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

v7.24.8 (2024-07-11)

👓 Spec Compliance

🐛 Bug Fix

💅 Polish

Committers: 9

v7.24.7 (2024-06-05)

🐛 Bug Fix

🏠 Internal

Committers: 7

v7.24.6 (2024-05-24)

🐛 Bug Fix

🏠 Internal

Committers: 9

v7.24.5 (2024-04-29)

🐛 Bug Fix

💅 Polish

🏠 Internal

🏃‍♀️ Performance

Committers: 6

v7.25.2 (2024-07-30)

🐛 Bug Fix

Committers: 2

v7.24.9 (2024-07-15)

🐛 Bug Fix

💅 Polish

🏠 Internal

Committers: 5

What's Changed

Plus everything in 8.17.0 which failed to release

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

Features

Bug Fixes

Documentation

Chores

Features

Bug Fixes

Documentation

Chores