Bump the npm_and_yarn group across 2 directories with 21 updates

[dependabot]

Bumps the npm_and_yarn group with 18 updates in the / directory:

Package	From	To
debug	2.6.8	2.6.9
diff	3.2.0	3.5.0
extend	3.0.1	3.0.2
handlebars	4.0.10	4.7.8
hosted-git-info	2.4.2	2.8.9
js-yaml	3.8.4	3.14.1
lodash	4.17.4	4.17.21
minimatch	3.0.4	3.1.2
nwmatcher	1.4.0	1.4.4
path-parse	1.0.5	1.0.7
qs	6.4.0	6.4.1
semver	5.3.0	5.7.2
sshpk	1.13.1	1.18.0
stringstream	0.0.5	0.0.6
tmpl	1.0.4	1.0.5
ua-parser-js	0.7.12	0.7.37
y18n	3.2.1	3.2.2
yargs-parser	5.0.0	5.0.1

Bumps the npm_and_yarn group with 12 updates in the /examples/web directory:

Package	From	To
extend	3.0.1	3.0.2
hosted-git-info	2.4.2	2.8.9
lodash	4.17.4	4.17.21
minimatch	3.0.4	3.1.2
semver	5.3.0	5.7.2
sshpk	1.13.1	1.18.0
stringstream	0.0.5	0.0.6
ua-parser-js	0.7.12	0.7.37
y18n	3.2.1	3.2.2
browserify-sign	4.0.4	4.2.3
express	4.15.3	4.19.2
fsevents	1.1.2	1.2.13

Updates debug from 2.6.8 to 2.6.9

Release notes

Sourced from debug's releases.

2.6.9

Patches

• Remove ReDoS regexp in %o formatter: #504

Credits

Huge thanks to @​zhuangya for their help!

Changelog

Sourced from debug's changelog.

2.6.9 / 2017-09-22

• remove ReDoS regexp in %o formatter (#504)

Commits

• 13abeae Release 2.6.9
• f53962e remove ReDoS regexp in %o formatter (#504)
• See full diff in compare view

Updates diff from 3.2.0 to 3.5.0

Changelog

Sourced from diff's changelog.

v3.5.0 - March 4th, 2018

• Omit redundant slice in join method of diffArrays - 1023590
• Support patches with empty lines - fb0f208
• Accept a custom JSON replacer function for JSON diffing - 69c7f0a
• Optimize parch header parser - 2aec429
• Fix typos - e89c832

Commits

v3.4.0 - October 7th, 2017

• #183 - Feature request: ability to specify a custom equality checker for diffArrays
• #173 - Bug: diffArrays gives wrong result on array of booleans
• #158 - diffArrays will not compare the empty string in array?
• comparator for custom equality checks - 30e141e
• count oldLines and newLines when there are conflicts - 53bf384
• Fix: diffArrays can compare falsey items - 9e24284
• Docs: Replace grunt with npm test - 00e2f94

Commits

v3.3.1 - September 3rd, 2017

• #141 - Cannot apply patch because my file delimiter is "/r/n" instead of "/n"
• #192 - Fix: Bad merge when adding new files (#189)
• correct spelling mistake - 21fa478

Commits

v3.3.0 - July 5th, 2017

• #114 - /patch/merge not exported
• Gracefully accept invalid newStart in hunks, same as patch(1) does. - d8a3635
• Use regex rather than starts/ends with for parsePatch - 6cab62c
• Add browser flag - e64f674
• refactor: simplified code a bit more - 8f8e0f2
• refactor: simplified code a bit - b094a6f
• fix: some corrections re ignoreCase option - 3c78fd0
• ignoreCase option - 3cbfbb5
• Sanitize filename while parsing patches - 2fe8129
• Added better installation methods - aced50b
• Simple export of functionality - 8690f31

Commits

Commits

• e9ab948 v3.5.0
• b73884c Update release notes
• 8953021 Update release notes
• 1023590 Omit redundant slice in join method of diffArrays
• c72ef4a Add missing test coverage
• b9ef24f Support patches with empty lines
• 10aaabb Support patches with empty lines
• 196d3aa Support patches with empty lines
• e24d789 Support patches with empty lines
• 8616a02 Support patches with empty lines
• Additional commits viewable in compare view

Updates extend from 3.0.1 to 3.0.2

Changelog

Sourced from extend's changelog.

3.0.2 / 2018-07-19

• [Fix] Prevent merging __proto__ property (#48)
• [Dev Deps] update eslint, @ljharb/eslint-config, tape
• [Tests] up to node v10.7, v9.11, v8.11, v7.10, v6.14, v4.9; use nvm install-latest-npm

Commits

• 8d106d2 v3.0.2
• e97091f [Dev Deps] update tape
• e841aac [Tests] up to node v10.7
• 0e68e71 [Fix] Prevent merging proto property
• a689700 Only apps should have lockfiles
• f13c1c4 [Dev Deps] update eslint, @ljharb/eslint-config, tape
• f3570fe [Tests] up to node v10.0, v9.11, v8.11, v7.10, v6.14, v4.9; use...
• See full diff in compare view

Updates handlebars from 4.0.10 to 4.7.8

Release notes

Sourced from handlebars's releases.

v4.7.8

• Make library compatible with workers (#1894) - 3d3796c
• Don't rely on Node.js global object (#1776) - 2954e7e
• Fix compiling of each block params in strict mode (#1855) - 30dbf04
• Fix rollup warning when importing Handlebars as ESM - 03d387b
• Fix bundler issue with webpack 5 (#1862) - c6c6bbb
• Use https instead of git for mustache submodule - 88ac068

Commits

Changelog

Sourced from handlebars's changelog.

v4.7.8 - July 27th, 2023

• Make library compatible with workers (#1894) - 3d3796c
• Don't rely on Node.js global object (#1776) - 2954e7e
• Fix compiling of each block params in strict mode (#1855) - 30dbf04
• Fix rollup warning when importing Handlebars as ESM - 03d387b
• Fix bundler issue with webpack 5 (#1862) - c6c6bbb
• Use https instead of git for mustache submodule - 88ac068

Commits

v4.7.7 - February 15th, 2021

• fix weird error in integration tests - eb860c0
• fix: check prototype property access in strict-mode (#1736) - b6d3de7
• fix: escape property names in compat mode (#1736) - f058970
• refactor: In spec tests, use expectTemplate over equals and shouldThrow (#1683) - 77825f8
• chore: start testing on Node.js 12 and 13 - 3789a30

(POSSIBLY) BREAKING CHANGES:

• the changes from version 4.6.0 now also apply in when using the compile-option "strict: true". Access to prototype properties is forbidden completely by default, specific properties or methods can be allowed via runtime-options. See #1633 for details. If you are using Handlebars as documented, you should not be accessing prototype properties from your template anyway, so the changes should not be a problem for you. Only the use of undocumented features can break your build.

That is why we only bump the patch version despite mentioning breaking changes.

Commits

v4.7.6 - April 3rd, 2020

Chore/Housekeeping:

• #1672 - Switch cmd parser to latest minimist (@​dougwilson

Compatibility notes:

• Restored Node.js compatibility

Commits

v4.7.5 - April 2nd, 2020

Chore/Housekeeping:

• Node.js version support has been changed to v6+ Reverted in 4.7.6

Compatibility notes:

... (truncated)

Commits

• 8dc3d25 v4.7.8
• 668c4fb Fix browser tests in CI pipeline
• c65c6cc Test on Node 18
• 3d3796c Make library compatible with workers
• 075b354 Fix sync issue with npm lock-file
• 30dbf04 Fix compiling of each block params in strict mode
• e3a5448 Fix bundler issue with webpack 5
• 8e23642 Fix integration-tests issue with npm >= 7
• 88ac068 use https instead of git for mustache submodule
• c68bc08 Fix typo
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by jaylinski, a new releaser for handlebars since your current version.

Updates hosted-git-info from 2.4.2 to 2.8.9

Changelog

Sourced from hosted-git-info's changelog.

2.8.9 (2021-04-07)

Bug Fixes

• backport regex fix from #76 (29adfe5), closes #84

2.8.8 (2020-02-29)

Bug Fixes

• #61 & #65 addressing issues w/ url.URL implmentation which regressed node 6 support (5038b18), closes #66

2.8.7 (2020-02-26)

Bug Fixes

• Do not attempt to use url.URL when unavailable (2d0bb66), closes #61 #62
• Do not pass scp-style URLs to the WhatWG url.URL (f2cdfcf), closes #60

2.8.6 (2020-02-25)

2.8.5 (2019-10-07)

Bug Fixes

• updated pathmatch for gitlab (e8325b5), closes #51
• updated pathmatch for gitlab (ffe056f)

2.8.4 (2019-08-12)

... (truncated)

Commits

• 8d4b369 chore(release): 2.8.9
• 29adfe5 fix: backport regex fix from #76
• afeaefd chore(release): 2.8.8
• 5038b18 fix: #61 & #65 addressing issues w/ url.URL implmentation which regressed nod...
• 7440afa chore(release): 2.8.7
• 2d0bb66 fix: Do not attempt to use url.URL when unavailable
• f2cdfcf fix: Do not pass scp-style URLs to the WhatWG url.URL
• e1b83df chore(release): 2.8.6
• ff259a6 Ensure passwords in hosted Git URLs are correctly escaped
• 624fd6f chore(release): 2.8.5
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by nlf, a new releaser for hosted-git-info since your current version.

Updates js-yaml from 3.8.4 to 3.14.1

Changelog

Sourced from js-yaml's changelog.

[3.14.1] - 2020-12-07

Security

• Fix possible code execution in (already unsafe) .load() (in &anchor).

[3.14.0] - 2020-05-22

Changed

• Support safe/loadAll(input, options) variant of call.
• CI: drop outdated nodejs versions.
• Dev deps bump.

Fixed

• Quote = in plain scalars #519.
• Check the node type for !<?> tag in case user manually specifies it.
• Verify that there are no null-bytes in input.
• Fix wrong quote position when writing condensed flow, #526.

[3.13.1] - 2019-04-05

Security

• Fix possible code execution in (already unsafe) .load(), #480.

[3.13.0] - 2019-03-20

Security

• Security fix: safeLoad() can hang when arrays with nested refs used as key. Now throws exception for nested arrays. #475.

[3.12.2] - 2019-02-26

Fixed

• Fix noArrayIndent option for root level, #468.

[3.12.1] - 2019-01-05

Added

• Added noArrayIndent option, #432.

[3.12.0] - 2018-06-02

Changed

• Support arrow functions without a block statement, #421.

[3.11.0] - 2018-03-05

Added

• Add arrow functions suport for !!js/function.

Fixed

• Fix dump in bin/octal/hex formats for negative integers, #399.

... (truncated)

Commits

• 37caaad 3.14.1 released
• 094c0f7 dist rebuild
• 9586ebe Avoid calling hasOwnProperty of user-controlled objects
• 34e5072 3.14.0 released
• 7b25c83 Browser files rebuild
• 6f73473 Dev deps bump
• 0c29349 Travis-CI: drop old nodejs versions
• 10be97e fix(loader): Add support for safe/loadAll(input, options)
• d6983dd Fix issue #526: wrong quote position writing condensed flow (#527)
• 93fbf7d fix issue 526 (wrong quote position writing condensed flow)
• Additional commits viewable in compare view

Updates lodash from 4.17.4 to 4.17.21

Commits

• f299b52 Bump to v4.17.21
• c4847eb Improve performance of toNumber, trim and trimEnd on large input strings
• 3469357 Prevent command injection through _.template's variable option
• ded9bc6 Bump to v4.17.20.
• 63150ef Documentation fixes.
• 00f0f62 test.js: Remove trailing comma.
• 846e434 Temporarily use a custom fork of lodash-cli.
• 5d046f3 Re-enable Travis tests on 4.17 branch.
• aa816b3 Remove /npm-package.
• d7fbc52 Bump to v4.17.19
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by bnjmnt4n, a new releaser for lodash since your current version.

Updates minimatch from 3.0.4 to 3.1.2

Commits

• 699c459 3.1.2
• 2f2b5ff fix: trim pattern
• 25d7c0d 3.1.1
• 55dda29 fix: treat nocase:true as always having magic
• 5e1fb8d 3.1.0
• f8145c5 Add 'allowWindowsEscape' option
• 570e8b1 add publishConfig for v3 publishes
• 5b7cd33 3.0.6
• 20b4b56 [fix] revert all breaking syntax changes
• 2ff0388 document, expose, and test 'partial:true' option
• Additional commits viewable in compare view

Updates nwmatcher from 1.4.0 to 1.4.4

Release notes

Sourced from nwmatcher's releases.

A fast CSS selector engine and matcher

This release has correction/fixes for the following behaviours:

• fixed DOM walking to avoid using unsupported DOM methods on non 'Elements' nodes
• improved DOM walking performances in JS only versions using the native traversal API

A fast CSS selector engine and matcher

This release has correction/fixes for the following behaviours:

• always use case sensitive match for class attributes selectors to mimic browsers behaviour
• removed attribute mapping (XHTML_TABLE) used for case sensitive match in XML documents
• always use case sensitive match for class attributes selectors in XML documents

specifications amended due to bug submitted by @​zirro whatwg/html@97ca4ed

Commits

• See full diff in compare view

Updates path-parse from 1.0.5 to 1.0.7

Commits

• See full diff in compare view

Updates qs from 6.4.0 to 6.4.1

Changelog

Sourced from qs's changelog.

6.4.1

• [Fix] parse: ignore __proto__ keys (#428)
• [Fix] fix for an impossible situation: when the formatter is called with a non-string value
• [Fix] use safer-buffer instead of Buffer constructor
• [Fix] utils.merge: avoid a crash with a null target and an array source
• [Fix] utils.merge: avoid a crash with a null target and a truthy non-array source
• [Fix] stringify: fix a crash with strictNullHandling and a custom filter/serializeDate (#279)
• [Fix] utils: merge: fix crash when source is a truthy primitive & no options are provided
• [Fix] when parseArrays is false, properly handle keys ending in []
• [Robustness] stringify: avoid relying on a global undefined (#427)
• [Refactor] use cached Array.isArray
• [Refactor] stringify: Avoid arr = arr.concat(...), push to the existing instance (#269)
• [readme] remove travis badge; add github actions/codecov badges; update URLs
• [Docs] Clarify the need for "arrayLimit" option
• [meta] fix README.md (#399)
• [meta] Clean up license text so it’s properly detected as BSD-3-Clause
• [meta] add FUNDING.yml
• [actions] backport actions from main
• [Tests] remove nonexistent tape option
• [Dev Deps] backport from main

Commits

• 486aa46 v6.4.1
• 727ef5d [Fix] parse: ignore __proto__ keys (#428)
• cd1874e [Robustness] stringify: avoid relying on a global undefined (#427)
• 45e987c [readme] remove travis badge; add github actions/codecov badges; update URLs
• 90a3bce [meta] fix README.md (#399)
• 9566d25 [Fix] fix for an impossible situation: when the formatter is called with a no...
• 74227ef Clean up license text so it’s properly detected as BSD-3-Clause
• 35dfb22 [actions] backport actions from main
• 7d4670f [Dev Deps] backport from main
• 0485440 [Fix] use safer-buffer instead of Buffer constructor
• Additional commits viewable in compare view

Updates semver from 5.3.0 to 5.7.2

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

• 2f8fd41 #585 better handling of whitespace (#585) (@​joaomoreno, @​lukekarrys)

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

• 2f8fd41 #585 better handling of whitespace (#585) (@​joaomoreno, @​lukekarrys)

5.7

• Add minVersion method

5.6

• Move boolean loose param to an options object, with backwards-compatibility protection.
• Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

• Add version coercion capabilities

5.4

• Add intersection checking

5.3

• Add minSatisfying method

5.2

• Add prerelease(v) that returns prerelease components

5.1

• Add Backus-Naur for ranges
• Remove excessively cute inspection methods

5.0

• Remove AMD/Browserified build artifacts
• Fix ltr and gtr when using the * range
• Fix for range * with a prerelease identifier

Commits

• f8cc313 chore: release 5.7.2
• 2f8fd41 fix: better handling of whitespace (#585)
• deb5ad5 chore: @​npmcli/template-oss@​4.16.0
• c83c18c 5.7.1
• 956e228 Correct typo in README
• 8055dda 5.7.0
• 604e73d auto-publishing scripts
• bed01e2 remove the nomin comments, since we don't minify any more anyway
• 9cb68f1 document parse method
• 38d42ca 5.7 changelog
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.

Updates sshpk from 1.13.1 to 1.18.0

Release notes

Sourced from sshpk's releases.

v1.16.1

• Fixes for #60 (correctly encoding certificates with expiry dates >=2050), #62 (accepting PKCS#8 EC private keys with missing public key parts)

v1.16.0

• Add support for SPKI fingerprints, PuTTY PPK format (public-key only for now), PKCS#8 PBKDF2 encrypted private keys
• Fix for #48

v1.15.2

• New API for accessing x509 extensions in certificates
• Fixes for #52, #50

v1.14.1

• Remove all remaining usage of jodid25519 (abandoned dep)
• Add support for DNSSEC key format
• Add support for Ed25519 keys in PEM format (according to draft-curdle-pkix)
• Fixes for X.509 encoding issues (asn.1 NULLs in RSA certs, cert string type mangling)
• Performance issues parsing long SSH public keys

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by bahamat, a new releaser for sshpk since your current version.

Updates stringstream from 0.0.5 to 0.0.6

Commits

• fee31c5 0.0.6
• 2f4a9d4 Merge pull request #9 from mhart/fix-buffer-constructor-vuln
• afbc744 Ensure data is not a number in Buffer constructor
• See full diff in compare view

Updates tmpl from 1.0.4 to 1.0.5

Commits

• See full diff in compare view

Updates ua-parser-js from 0.7.12 to 0.7.37

Release notes

Sourced from ua-parser-js's releases.

v0.7.37

Version 0.7.37

• Fix misidentified WebView token as device model
• Increase UA_MAX_LENGTH to 500
• Add new browser: Alipay, Klarna, Smart Lenovo Browser, Vivo Browser
• Add new device: Ulefone
• Improve device detection: Realme, Xiaomi Redmi
• Rename browser: Avant, Baidu, Samsung Internet, Sogou Explorer, Sogou Mobile, WeChat

Changelog

Sourced from ua-parser-js's changelog.

Version 0.7.37

• Fix misidentified WebView token as device model
• Increase UA_MAX_LENGTH to 500
• Add new browser: Alipay, Klarna, Smart Lenovo Browser, Vivo Browser
• Add new device: Ulefone
• Improve device detection: Realme, Xiaomi Redmi
• Rename browser: Avant, Baidu, Samsung Internet, Sogou Explorer, Sogou Mobile, WeChat

Version 0.7.36 / 1.0.36

• Add new browser: Snapchat
• Add new devices: Infinix, Tecno
• Improve device detection: Amazon Fire TV, Xiaomi POCO
• Improve OS detection: iOS

Version 0.7.35 / 1.0.35

• Fix result from user-supplied user-agent being altered
• Add new browser: Heytap, TikTok
• Add new engine: LibWeb
• Add new OS: SerenityOS
• Improve browser detection: Yandex
• Improve device detection: iPhone, Amazon Echo
• Improve OS detection: iOS

Version 0.7.34 / 1.0.34

• Fix Sharp Mobile detected as Huawei Tablet
• Fix IE8 bug
• Add new devices : Kobo e-Reader, Apple Watch, and some new SmartTV devices
• Add new OS : watchOS
• Improve browser detection : Kakao, Naver, Brave
• Improve device detection : Oculus, iPad
• Improve OS detection : Chrome OS
• Using navigator.userAgentData as fallback for device.type & os.name

Version 0.7.33 / 1.0.33

• Add new browser : Cobalt
• Identify Macintosh as an Apple device
• Fix ReDoS vulnerability

Version 0.7.32 / 1.0.32

• Add new browser : DuckDuckGo, Huawei Browser, LinkedIn
• Add new OS : HarmonyOS
• Add some Huawei models
• Add Sharp Aquos TV
• Improve detection Xiaomi Mi CC9
• Fix Sony Xperia 1 III misidentified as Acer tablet
• Fix Detect Sony BRAVIA as SmartTV
• Fix Detect Xiaomi Mi TV as SmartTV

... (truncated)

Commits

• d30ad46 Bump version 0.7.37
• 5302e2d Update changelog
• f3de7b7 Backport - Improve browser detection: WeChat (cherry picked from commit 17f0c...
• c41100e Backport - Improve browser detection: unified name for Baidu (cherry picked f...
• 23c5d77 Backport - Improve browser detection: remove unnecessary extra space in "Avan...
• e3d5f76 Backport - Improve browser detection: rename "Samsung Browser" to "Samsung In...
• 02af42f Backport - Fix #682 - Add new browser: Smart Lenovo Browser (cherry picked fr...
• 57d1ac0 Backport - Fix #683 - change MetaSr into Sogou Explorer (+add Sogou Mobile) (...
• ea2c829 Backport - Fix misidentified WebView token as device model - found in #681 (c...
• 3b896d5 Backport - Fix #681 - Add new browser: Vivo Browser (cherry picked from commi...
• Additional commits viewable in compare view

Updates y18n from 3.2.1 to 3.2.2

Release notes

Sourced from y18n's releases.

y18n y18n-v4.0.3

Bug Fixes

• release: 4.x.x should not enforce Node 10 (#126) (1e21a53)

y18n y18n-v4.0.2

Bug Fixes

• security: ensure entry exists for backport (#120) (b22c0df)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by oss-bot, a new releaser for y18n since your current version.

Updates yargs-parser from 5.0.0 to 5.0.1

Changelog

Sourced from yargs-parser's changelog.

5.0.0 (2017-02-18)

Bug Fixes

• environment variables should take precedence over config file (#81) (76cee1f)

BREAKING CHANGES

• environment variables will now override config files (args, env, config-file, config-object)

5.0.1 (2021-03-10)

Bug Fixes

• security: address GHSA-p9pc-299p-vxgp (#362) (1c417bd)

4.2.1 (2017-01-02)

Bug Fixes

• flatten/duplicate regression (#75) (68d68a0)

4.2.0 (2016-12-01)

Bug Fixes

• inner objects in configs had their keys appended to top-level key when dot-notation was disabled (#72) (0b1b5f9)

Features

• allow multiple arrays to be provided, rather than always combining (#71) (0f0fb2d)

4.1.0 (2016-11-07)

... (truncated)

Commits

• eab6c03 chore: release 5.0.1 (#363)
• 1c417bd fix(security): address GHSA-p9pc-299p-vxgp (#362)
• e93a345 chore: mark release in commit history (#361)
• ee15863 chore: push new package version
• 4774207 fix: back-porting prototype fixes for really old version (#271)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by oss-bot, a new releaser for yargs-parser since your current version.

Updates extend from 3.0.1 to 3.0.2

Changelog

Sourced from extend's changelog.

3.0.2 / 2018-07-19

• [Fix] Prevent merging __proto__ property (#48)
• [Dev Deps] update eslint, @ljharb/eslint-config, tape
• [Tests] up to node v10.7, v9.11, v8.11, v7.10, v6.14, v4.9; use nvm install-latest-npm

Commits

• 8d106d2 v3.0.2
• e97091f [Dev Deps] update tape
• e841aac [Tests] up to node v10.7
• 0e68e71 [Fix] Prevent merging proto property
• a689700 Only apps should have lockfiles
• f13c1c4 [Dev Deps] update eslint, @ljharb/eslint-config, tape
• f3570fe [Tests] up to node v10.0, v9.11, v8.11, v7.10, v6.14, v4.9; use...
• See full diff in compare view

Updates hosted-git-info from 2.4.2 to 2.8.9

Changelog

Sourced from hosted-git-info's changelog.

2.8.9 (2021-04-07)

Bug Fixes

• backport regex fix from #76 (29adfe5), closes #84

2.8.8 (2020-02-29)

Bug Fixes

• #61 & #65 addressing issues w/ url.URL implmentation which regressed node 6 support (5038b18), closes #66

2.8.7 (2020-02-26)

Bug Fixes

• Do not attempt to use url.URL when unavailable (2d0bb66), closes #61 #62
• Do not pass scp-style URLs to the WhatWG url.URL (f2cdfcf), closes #60

2.8.6 (2020-02-25)

2.8.5 (2019-10-07)

Bug Fixes

• updated pathmatch for gitlab (e8325b5), closes #51
• updated pathmatch for gitlab (ffe056f)

2.8.4 (2019-08-12)

... (truncated)

Commits

• 8d4b369 chore(release): 2.8.9
• 29adfe5 fix: backport regex fix from #76
• afeaefd chore(release): 2.8.8
• 5038b18 fix: #61 & #65 addressing issues w/ url.URL implmentation which regressed nod...
• 7440afa chore(release): 2.8.7
• 2d0bb66 fix: Do not attempt to use url.URL when unavailable
• f2cdfcf fix: Do not pass scp-style URLs to the WhatWG url.URL
• e1b83df chore(release): 2.8.6
• ff259a6 Ensure passwords in hosted Git URLs are correctly escaped
• 624fd6f chore(release): 2.8.5
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by nlf, a new releaser for hosted-git-info since your current version.

Updates lodash from 4.17.4 to 4.17.21

Commits

• f299b52 Bump to v4.17.21
• c4847eb Improve performance of toNumber, trim and trimEnd on large input strings
• 3469357 Prevent command injection through _.template's variable option
• ded9bc6 Bump to v4.17.20.
• 63150ef Documentation fixes.
• 00f0f62 test.js: Remove trailing comma.
• 846e434 Temporarily use a custom fork of lodash-cli.
• 5d046f3 Re-enable Travis tests on 4.17 branch.
• aa816b3 Remove /npm-package.
• d7fbc52 Bump to v4.17.19
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by bnjmnt4n, a new releaser for lodash since your current version.

Updates minimatch from 3.0.4 to 3.1.2

Commits

• 699c459 3.1.2
• 2f2b5ff fix: trim pattern
• 25d7c0d 3.1.1
• 55dda29 fix: treat nocase:true as always having magic
• 5e1fb8d 3.1.0
• f8145c5 Add 'allowWindowsEscape' option
• 570e8b1 add publishConfig for v3 publishes
• 5b7cd33 3.0.6
• Description has been truncated

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/asn1.js@4.10.1	unsafe	+1	220 kB	indutny
npm/bn.js@5.2.1	None	0	99 kB	fanatid
npm/browserify-rsa@4.1.0	None	0	3.68 kB	cwmma
npm/define-data-property@1.1.4	None	+3	62.7 kB	ljharb
npm/elliptic@6.5.5	None	+2	216 kB	indutny
npm/get-intrinsic@1.2.4	eval	+5	127 kB	ljharb
npm/has-property-descriptors@1.0.2	None	+1	22.7 kB	ljharb
npm/hash-base@3.0.4	None	0	6.03 kB	dcousens
npm/parse-asn1@5.1.7	None	+4	81.1 kB	ljharb

🚮 Removed packages: npm/ajv@6.12.6, npm/async@2.6.4, npm/aws4@1.12.0, npm/combined-stream@1.0.8, npm/form-data@2.3.3, npm/har-validator@5.1.5, npm/oauth-sign@0.9.0, npm/punycode@2.3.1, npm/react-native-payments@0.2.0, npm/react-timer-mixin@0.13.4, npm/request@2.88.2, npm/rimraf@2.7.1, npm/tough-cookie@2.5.0

View full report↗︎

[socket-security]

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring: npm/express@4.19.2, npm/fsevents@1.2.13, npm/handlebars@4.7.8, npm/hash-base@3.0.4, npm/md5.js@1.3.5, npm/parse-asn1@5.1.7, npm/raw-body@2.5.2

View full report↗︎

Next steps

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

[legobeat]

@SocketSecurity ignore npm/md5.js@1.3.5
@SocketSecurity ignore npm/handlebars@4.7.8
@SocketSecurity ignore npm/hash-base@3.0.4
@SocketSecurity ignore npm/parse-asn1@5.1.7

new authors ok

[legobeat]

@SocketSecurity ignore npm/fsevents@1.2.13

native code, install scripts. known legacy that is better dropped but ok here.

[legobeat]

@SocketSecurity ignore npm/express@4.19.2

network access ok

[legobeat]

@SocketSecurity ignore npm/raw-body@2.5.2

network access ok

[legobeat]

Related

• chore: remove examples #10

[legobeat]

@dependabot merge