Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): bump the npm_and_yarn group across 1 directory with 13 updates #22

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore(deps): bump the npm_and_yarn group across 1 directory with 13 updates #22

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Feb 13, 2025

Bumps the npm_and_yarn group with 8 updates in the / directory:

Package From To
axios 1.4.0 1.7.4
react-pdf 7.0.1 7.7.3
postcss 8.4.23 8.5.2
vite 4.3.5 4.5.9
semver 6.3.0 6.3.1
@babel/traverse 7.21.5 7.26.8
braces 3.0.2 3.0.3
dompurify 2.4.9 2.5.8

Updates axios from 1.4.0 to 1.7.4

Release notes

Sourced from axios's releases.

Release v1.7.4

Release notes:

Bug Fixes

Contributors to this release

Release v1.7.3

Release notes:

Bug Fixes

  • adapter: fix progress event emitting; (#6518) (e3c76fc)
  • fetch: fix withCredentials request config (#6505) (85d4d0e)
  • xhr: return original config on errors from XHR adapter (#6515) (8966ee7)

Contributors to this release

Release v1.7.2

Release notes:

Bug Fixes

Contributors to this release

Release v1.7.1

Release notes:

Bug Fixes

  • fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#6410) (733f15f)

Contributors to this release

Release v1.7.0

Release notes:

Features

... (truncated)

Changelog

Sourced from axios's changelog.

1.7.4 (2024-08-13)

Bug Fixes

Contributors to this release

1.7.3 (2024-08-01)

Bug Fixes

  • adapter: fix progress event emitting; (#6518) (e3c76fc)
  • fetch: fix withCredentials request config (#6505) (85d4d0e)
  • xhr: return original config on errors from XHR adapter (#6515) (8966ee7)

Contributors to this release

1.7.2 (2024-05-21)

Bug Fixes

Contributors to this release

1.7.1 (2024-05-20)

Bug Fixes

  • fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#6410) (733f15f)

Contributors to this release

... (truncated)

Commits

Updates react-pdf from 7.0.1 to 7.7.3

Release notes

Sourced from react-pdf's releases.

v7.7.3

Bug fixes

v7.7.2

This version shipped an incorrect fix for a security vulnerability and thus has been deprecated.

Bug fixes

v7.7.1

Bug fixes

  • Fixed Outline, Page and Thumbnail components crashing when placed outside Document, but provided with pdf prop (#1709).
  • Fixed documentation for using vite-plugin-static-copy suggesting a solution that doesn't work on Windows.

v7.7.0

What's new?

  • Detect not memoized file and options props.

What's changed?

  • Updated documentation to make it clear SVG renderMode is deprecated and will be removed in the future.
  • Replaced tiny-warning with more popular (and equally tiny!) warning.

v7.6.0

What's new?

  • Improved developer experience by moving prop documentation to JSDoc. This means that you can now see descriptions, default values, and examples for all props in your IDE.
  • Improved documentation.

v7.5.1

What's new?

v7.5.0

What's new?

  • Exported PasswordResponses type to make it easier to create custom password prompts (#1615). Thanks, @​pstevovski!
  • Updated documentation on options prop and usage with Next.js.

Bug fixes

  • Fixed customTextRenderer not called on items outside of marked content (#1593, #1623).

... (truncated)

Commits
  • 1a69776 v7.7.3
  • 208f28d Force isEvalSupported to false
  • 8ca4d07 v7.7.2
  • 260295b Force isEvalSupported to true
  • 93b09c3 v7.7.1
  • f01d41e Bump eslint-config-wojtekmaj from 0.9.0 to 0.11.0
  • a9d0b52 Bump eslint from 8.37.0 to 8.56.0
  • 57eaaf7 Bump jsdom from 21.1.1 to 24.0.0
  • e339525 Fix Outline, Page and Thumbnail components crashing when placed outside Document
  • cf5327b Add missing linkService in DocumentContext in unit tests
  • Additional commits viewable in compare view

Updates postcss from 8.4.23 to 8.5.2

Release notes

Sourced from postcss's releases.

8.5.2

8.5.1

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@​romainmenke during his work on Stylelint added Input#document in additional to Input#css.

root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
                           //      color: green;
                           //    }
                           //    </style>"
root.source.input.css      //=> "p {
                           //      color: green;
                           //    }"

Thanks to Sponsors

This release was possible thanks to our community.

If your company wants to support the sustainability of front-end infrastructure or wants to give some love to PostCSS, you can join our supporters by:

8.4.49

8.4.48

  • Fixed position calculation in error/warnings methods (by @​romainmenke).

8.4.47

  • Removed debug code.

8.4.46

  • Fixed Cannot read properties of undefined (reading 'before').

8.4.45

  • Removed unnecessary fix which could lead to infinite loop.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.2

8.5.1

8.5 “Duke Alloces”

  • Added Input#document for sources like CSS-in-JS or HTML (by @​romainmenke).

8.4.49

8.4.48

  • Fixed position calculation in error/warnings methods (by @​romainmenke).

8.4.47

  • Removed debug code.

8.4.46

  • Fixed Cannot read properties of undefined (reading 'before').

8.4.45

  • Removed unnecessary fix which could lead to infinite loop.

8.4.44

  • Another way to fix markClean is not a function error.

8.4.43

  • Fixed markClean is not a function error.

8.4.42

  • Fixed CSS syntax error on long minified files (by @​varpstar).

8.4.41

8.4.40

  • Moved to getter/setter in nodes types to help Sass team (by @​nex3).

8.4.39

8.4.38

8.4.37

  • Fixed original.column are not numbers error in another case.

8.4.36

... (truncated)

Commits

Updates vite from 4.3.5 to 4.5.9

Release notes

Sourced from vite's releases.

v4.5.9

Please refer to CHANGELOG.md for details.

v4.5.8

Please refer to CHANGELOG.md for details.

v4.5.7

Please refer to CHANGELOG.md for details.

v4.5.6

This version contains a breaking change due to security fixes. See GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

v4.5.5

Please refer to CHANGELOG.md for details.

v4.5.4

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

4.5.9 (2025-01-21)

4.5.8 (2025-01-20)

4.5.7 (2025-01-20)

  • fix: crypto.getRandomValues is not available in old Node versions (#19237) (f4d3c46), closes #19237

4.5.6 (2025-01-20)

  • fix!: check host header to prevent DNS rebinding attacks and introduce server.allowedHosts (ef1049d)
  • fix!: default server.cors: false to disallow fetching from untrusted origins (07b36d5)
  • fix: verify token for HMR WebSocket connection (c065a77)

4.5.5 (2024-09-16)

4.5.4 (2024-09-16)

4.5.3 (2024-03-24)

4.5.2 (2024-01-19)

... (truncated)

Commits
  • edad4d2 release: v4.5.9
  • 8f63cd6 fix: allow CORS from loopback addresses by default (#19249)
  • 0bc52e0 fix: preview.allowedHosts with specific values was not respected (#19246)
  • 947f0c1 release: v4.5.8
  • 3680bad fix: try parse server.origin URL (#19241)
  • fe86acb release: v4.5.7
  • f4d3c46 fix: crypto.getRandomValues is not available in old Node versions (#19237)
  • 9e460f5 release: v4.5.6
  • ef1049d fix!: check host header to prevent DNS rebinding attacks and introduce `serve...
  • c065a77 fix: verify token for HMR WebSocket connection
  • Additional commits viewable in compare view

Updates semver from 6.3.0 to 6.3.1

Release notes

Sourced from semver's releases.

v6.3.1

6.3.1 (2023-07-10)

Bug Fixes

Changelog

Sourced from semver's changelog.

6.3.1 (2023-07-10)

Bug Fixes

6.2.0

  • Coerce numbers to strings when passed to semver.coerce()
  • Add rtl option to coerce from right to left

6.1.3

  • Handle X-ranges properly in includePrerelease mode

6.1.2

  • Do not throw when testing invalid version strings

6.1.1

  • Add options support for semver.coerce()
  • Handle undefined version passed to Range.test

6.1.0

  • Add semver.compareBuild function
  • Support * in semver.intersects

6.0

  • Fix intersects logic.

    This is technically a bug fix, but since it is also a change to behavior that may require users updating their code, it is marked as a major version increment.

5.7

  • Add minVersion method

5.6

  • Move boolean loose param to an options object, with backwards-compatibility protection.
  • Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.


Updates @babel/traverse from 7.21.5 to 7.26.8

Release notes

Sourced from @​babel/traverse's releases.

v7.26.8 (2025-02-08)

🏠 Internal

  • babel-preset-env
    • #17097 Update dependency babel-plugin-polyfill-corejs3 to ^0.11.0

v7.26.7 (2025-01-24)

Thanks @​branchseer and @​tquetano-netflix for your first PRs!

🐛 Bug Fix

  • babel-helpers, babel-preset-env, babel-runtime-corejs3
  • babel-plugin-transform-typeof-symbol
  • babel-parser
  • babel-core
  • babel-plugin-transform-typescript
  • babel-plugin-transform-typescript, babel-traverse, babel-types

Committers: 6

v7.26.6 (2025-01-13)

🐛 Bug Fix

  • babel-plugin-transform-nullish-coalescing-operator

Committers: 1

v7.26.5 (2025-01-10)

👓 Spec Compliance

🐛 Bug Fix

  • babel-plugin-transform-block-scoped-functions

... (truncated)

Changelog

Sourced from @​babel/traverse's changelog.

Changelog

Tags:

  • 💥 [Breaking Change]
  • 👓 [Spec Compliance]
  • 🚀 [New Feature]
  • 🐛 [Bug Fix]
  • 📝 [Documentation]
  • 🏠 [Internal]
  • 💅 [Polish]

Note: Gaps between patch versions are faulty, broken or test releases.

This file contains the changelog starting from v7.15.0.

v7.26.7 (2025-01-24)

🐛 Bug Fix

  • babel-helpers, babel-preset-env, babel-runtime-corejs3
  • babel-plugin-transform-typeof-symbol
  • babel-parser
  • babel-core
  • babel-plugin-transform-typescript
  • babel-plugin-transform-typescript, babel-traverse, babel-types

v7.26.6 (2025-01-13)

🐛 Bug Fix

  • babel-plugin-transform-nullish-coalescing-operator

v7.26.5 (2025-01-10)

👓 Spec Compliance

... (truncated)

Commits

Updates braces from 3.0.2 to 3.0.3

Commits

Updates dompurify from 2.4.9 to 2.5.8

Release notes

Sourced from dompurify's releases.

DOMPurify 2.5.8

DOMPurify 2.5.7

  • Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @​masatokinugawa
  • Removed the foreignObject element from the list of HTML entry-points, thanks @​masatokinugawa

DOMPurify 2.5.6

  • Fixed an issue with the execution logic of attribute hooks to prevent bypasses, thanks @​kevin-mizu
  • Fixed a minor problem with the bower file pointing to the wrong dist path
  • Updated several development dependencies

DOMPurify 2.5.5

  • Fixed a minor issue with the dist paths in bower.js, thanks @​HakumenNC
  • Fixed a minor issue with sanitizing HTML coming from copy&paste Word content, thanks @​kakao-bishop-cho

DOMPurify 2.5.4

  • Fixed a bug with latest isNaN checks affecting MSIE, thanks @​tulach
  • Fixed the tests for MSIE and fixed related test-runner

DOMPurify 2.5.3

  • Fixed several mXSS variations found by and thanks to @​kevin-mizu & @​Ry0taK
  • Added better configurability for comment scrubbing default behavior
  • Added better hardening against Prototype Pollution attacks, thanks @​kevin-mizu
  • Fixed some smaller issues in README and other documentation

DOMPurify 2.5.2

  • Addressed and fixed a mXSS variation found by @​kevin-mizu
  • Addressed and fixed a mXSS variation found by Adam Kues of Assetnote
  • Updated tests for older Safari and Chrome versions

DOMPurify 2.5.1

  • Fixed an mXSS sanitizer bypass reported by @​icesfont
  • Added new code to track element nesting depth
  • Added new code to enforce a maximum nesting depth of 255
  • Added coverage tests and necessary clobbering protections

Note that this is a security release and should be upgraded to immediately. Please also note that further releases may follow as the underlying vulnerability is apparently new and further variations may be discovered.

DOMPurify 2.5.0

  • Added new setting SAFE_FOR_XML to enable better control over comment scrubbing
  • Updated the LICENSE file to show the accurate year number
  • Updated several build and test dependencies
Commits

Updates esbuild from 0.17.18 to 0.18.20

Release notes

Sourced from esbuild's releases.

v0.18.20

  • Support advanced CSS @import rules (#953, #3137)

    CSS @import statements have been extended to allow additional trailing tokens after the import path. These tokens sort of make the imported file behave as if it were wrapped in a @layer, @supports, and/or @media rule. Here are some examples:

    @import url(foo.css);
@import url(foo.css) layer;
@import url(foo.css) layer(bar);
@import url(foo.css) layer(bar) supports(display: flex);
@import url(foo.css) layer(bar) supports(display: flex) print;
@import url(foo.css) layer(bar) print;
@import url(foo.css) supports(display: flex);
@import url(foo.css) supports(display: flex) print;
@import url(foo.css) print;

    You can read more about this advanced syntax here. With this release, esbuild will now bundle @import rules with these trailing tokens and will wrap the imported files in the corresponding rules. Note that this now means a given imported file can potentially appear in multiple places in the bundle. However, esbuild will still only load it once (e.g. on-load plugins will only run once per file, not once per import).

v0.18.19

  • Implement composes from CSS modules (#20)

    This release implements the composes annotation from the CSS modules specification. It provides a way for class selectors to reference other class selectors (assuming you are using the local-css loader). And with the from syntax, this can even work with local names across CSS files. For example:

    // app.js
import { submit } from './style.css'
const div = document.createElement('div')
div.className = submit
document.body.appendChild(div)
    /* style.css */
.button {
  composes: pulse from "anim.css";
  display: inline-block;
}
.submit {
  composes: button;
  font-weight: bold;
}
    /* anim.css */
@keyframes pulse {
  from, to { opacity: 1 }
  50% { opacity: 0.5 }
}

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.18.20

  • Support advanced CSS @import rules (#953, #3137)

    CSS @import statements have been extended to allow additional trailing tokens after the import path. These tokens sort of make the imported file behave as if it were wrapped in a @layer, @supports, and/or @media rule. Here are some examples:

    @import url(foo.css);
@import url(foo.css) layer;
@import url(foo.css) layer(bar);
@import url(foo.css) layer(bar) supports(display: flex);
@import url(foo.css) layer(bar) supports(display: flex) print;
@import url(foo.css) layer(bar) print;
@import url(foo.css) supports(display: flex);
@import url(foo.css) supports(display: flex) print;
@import url(foo.css) print;

    You can read more about this advanced syntax here. With this release, esbuild will now bundle @import rules with these trailing tokens and will wrap the imported files in the corresponding rules. Note that this now means a given imported file can potentially appear in multiple places in the bundle. However, esbuild will still only load it once (e.g. on-load plugins will only run once per file, not once per import).

0.18.19

  • Implement composes from CSS modules (#20)

    This release implements the composes annotation from the CSS modules specification. It provides a way for class selectors to reference other class selectors (assuming you are using the local-css loader). And with the from syntax, this can even work with local names across CSS files. For example:

    // app.js
import { submit } from './style.css'
const div = document.createElement('div')
div.className = submit
document.body.appendChild(div)
    /* style.css */
.button {
  composes: pulse from "anim.css";
  display: inline-block;
}
.submit {
  composes: button;
  font-weight: bold;
}
    /* anim.css */
@keyframes pulse {
  from, to { opacity: 1 }

... (truncated)

Commits
  • 22f0818 publish 0.18.20 to npm
  • 89b98d9 css: test coverage for some external test cases
  • 4bb897f fix #953, fix #3137: advanced css @import syntax
  • 6892b1b css: change ast format for @import conditions
  • d770d53 remove unnecessary file slice.go
  • 0e5b5fb add test-e2e-yarn
  • e08ee89 publish 0.18.19 to npm
  • d2bc26c css: attempt to warn about undefined composes
  • a0910fd fix #20: implement composes from css modules
  • a470f0a css: a basic implementation of local composes
  • Additional commits viewable in compare view

Updates follow-redirects from 1.15.2 to 1.15.9

Commits
  • e4e55c7 Release version 1.15.9 of the npm package.
  • 31a1abf Attempt much more gentle detection.
  • d2aaa97 Fix url field.
  • 62558f0 Release version 1.15.8 of the npm package.
  • a8d1cee Return subtlety.
  • 458ca8e Fix native URL test for Node 20.
  • ca49e44 Handle KeepAlive connections in tests.
  • f3711d7 Test on Node 20 and 22.
  • fda0faf Fix typo.
  • 760757f Release version 1.15.7 of the npm package.
  • Additional commits viewable in compare view

Updates pdfjs-dist from 3.6.172 to 3.11.174

Release notes

Sourced from pdfjs-dist's releases.

v3.11.174

This release primarily features accessibility improvements for the annotation editor and fixes for the type definitions.

Changes since v3.10.111

@dependabot
chore(deps): bump the npm_and_yarn group across 1 directory with 13 u…
3f3f7a8 
…pdates

Bumps the npm_and_yarn group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [axios](https://github.com/axios/axios) | `1.4.0` | `1.7.4` |
| [react-pdf](https://github.com/wojtekmaj/react-pdf/tree/HEAD/packages/react-pdf) | `7.0.1` | `7.7.3` |
| [postcss](https://github.com/postcss/postcss) | `8.4.23` | `8.5.2` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `4.3.5` | `4.5.9` |
| [semver](https://github.com/npm/node-semver) | `6.3.0` | `6.3.1` |
| [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) | `7.21.5` | `7.26.8` |
| [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` |
| [dompurify](https://github.com/cure53/DOMPurify) | `2.4.9` | `2.5.8` |



Updates `axios` from 1.4.0 to 1.7.4
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.4.0...v1.7.4)

Updates `react-pdf` from 7.0.1 to 7.7.3
- [Release notes](https://github.com/wojtekmaj/react-pdf/releases)
- [Commits](https://github.com/wojtekmaj/react-pdf/commits/v7.7.3/packages/react-pdf)

Updates `postcss` from 8.4.23 to 8.5.2
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.4.23...8.5.2)

Updates `vite` from 4.3.5 to 4.5.9
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v4.5.9/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v4.5.9/packages/vite)

Updates `semver` from 6.3.0 to 6.3.1
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/v6.3.1/CHANGELOG.md)
- [Commits](npm/node-semver@v6.3.0...v6.3.1)

Updates `@babel/traverse` from 7.21.5 to 7.26.8
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.26.8/packages/babel-traverse)

Updates `braces` from 3.0.2 to 3.0.3
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)

Updates `dompurify` from 2.4.9 to 2.5.8
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@2.4.9...2.5.8)

Updates `esbuild` from 0.17.18 to 0.18.20
- [Release notes](https://github.com/evanw/esbuild/releases)
- [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG-2023.md)
- [Commits](evanw/esbuild@v0.17.18...v0.18.20)

Updates `follow-redirects` from 1.15.2 to 1.15.9
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.2...v1.15.9)

Updates `pdfjs-dist` from 3.6.172 to 3.11.174
- [Release notes](https://github.com/mozilla/pdf.js/releases)
- [Commits](mozilla/pdf.js@v3.6.172...v3.11.174)

Updates `rollup` from 3.21.6 to 3.29.5
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v3.21.6...v3.29.5)

Updates `tar` from 6.1.15 to 6.2.1
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.1.15...v6.2.1)

---
updated-dependencies:
- dependency-name: axios
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: react-pdf
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: postcss
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: semver
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: "@babel/traverse"
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: dompurify
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: esbuild
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: follow-redirects
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: pdfjs-dist
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Feb 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants