🤖 Dependency update #175
Closed
🤖 Dependency update #175
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
12.18.3->18.15.014.14.28->18.15.1017.0.2->18.0.295.0.0->5.0.45.1.7->5.1.260.21.1->1.3.41.12.0->2.0.712.18.3->17.2.07.20.0->8.36.018.2.1->19.0.47.2.0->8.8.02.22.1->2.27.524.1.3->27.2.16.4.1->6.7.13.3.1->4.2.17.22.0->7.32.226.6.3->29.5.010.0.6->12.1.012.20.1->18.15.02.2.1->2.8.72.2.1->2.8.715.7.2->15.8.117.0.1->18.2.05.0.3->5.1.017.0.1->18.2.011.3.1->14.2.31.3.2->3.0.25.2.1->5.3.94.1.5->5.0.2GitHub Vulnerability Alerts
CVE-2021-39178
Impact
next.config.jsfile hasimages.domainsarray assignedimages.domainsallows user-provided SVGnext.config.jsfile hasimages.loaderassigned to something other than defaultPatches
Next.js v11.1.1
CVE-2022-23646
Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the
next.config.jsfile must have animages.domainsarray assigned and the image host assigned inimages.domainsmust allow user-provided SVG. If thenext.config.jsfile hasimages.loaderassigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, changenext.config.jsto use a differentloader configurationother than the default.Impact
next.config.jsfile has images.domains array assignednext.config.jsfile has images.loader assigned to something other than defaultPatches
Next.js 12.1.0
Workarounds
Change
next.config.jsto use a different loader configuration other than the default, for example:Or if you want to use the
loaderprop on the component, you can usecustom:Release Notes
nodejs/node
v18.15.0: 2023-03-07, Version 18.15.0 'Hydrogen' (LTS), @BethGriggs prepared by @juanarbolCompare Source
Notable Changes
63563f8a7a] - doc,lib,src,test: rename --test-coverage (Colin Ihrig) #4601728a775b32f] - test_runner: add initial code coverage support (Colin Ihrig) #460174d50db14b3] - (SEMVER-MINOR) test_runner: add reporters (Moshe Atlow) #45712643545ab79] - (SEMVER-MINOR) fs: add statfs() functions (Colin Ihrig) #46358110ead9abb] - (SEMVER-MINOR) vm: expose cachedDataRejected for vm.compileFunction (Anna Henningsen) #4632002632b42cf] - (SEMVER-MINOR) v8: support gc profile (theanarkh) #46255f09b838408] - (SEMVER-MINOR) src,lib: add constrainedMemory API for process (theanarkh) #46218cb5bb12422] - (SEMVER-MINOR) buffer: add isAscii method (Yagiz Nizipli) #46046Commits
6f91c8e2ae] - benchmark: add trailing commas (Antoine du Hamel) #46370d0b9be21eb] - benchmark: remove buffer benchmarks redundancy (Brian White) #457356468f30d0d] - benchmark: introduce benchmark combination filtering (Brian White) #45735cb5bb12422] - (SEMVER-MINOR) buffer: add isAscii method (Yagiz Nizipli) #46046ec61bb04c0] - build: export more OpenSSL symbols on Windows (Mohamed Akram) #454867bae4333ce] - build: fix MSVC 2022 Release compilation (Vladimir Morozov (REDMOND)) #462280f5f2d4470] - crypto: includehmac.hincrypto_util.h(Adam Langley) #4627991ece4161b] - crypto: avoid hang when no algorithm available (Richard Lau) #46237492fc95bdf] - deps: V8: cherry-pick90be99f(Michaël Zasso) #46646732c77e3d9] - deps: update acorn to 8.8.2 (Node.js GitHub Bot) #463638582f99ffb] - deps: update to uvwasi 0.0.15 (Colin Ihrig) #462535453cd9940] - deps: V8: cherry-pickbf0bd48(Michaël Zasso) #459083ea53c5dc8] - deps: V8: cherry-pickc875e86(sepehrst) #46501c04808de4b] - doc: correct thesedcommand for macOS in release process docs (Juan José) #463978113220690] - doc: pass string totextEncoder.encodeas input (Deokjin Kim) #46421129dccf5d2] - doc: add tip for session.post function (theanarkh) #46354919e581732] - doc: add documentation for socket.destroySoon() (Luigi Pinca) #46337fc15ac95a5] - doc: fix commit message using test instead of deps (Tony Gorez) #46313d153a93200] - doc: add v8 fast api contribution guidelines (Yagiz Nizipli) #46199dbf082d082] - doc: fix small typo error (0xflotus) #4618694421b4cfe] - doc: mark some parameters as optional in webstreams (Deokjin Kim) #462695adb743511] - doc: update output of example inevents.getEventListeners(Deokjin Kim) #4626863563f8a7a] - doc,lib,src,test: rename --test-coverage (Colin Ihrig) #460174e88c7c813] - esm: delete preload mock test (Geoffrey Booth) #46402643545ab79] - (SEMVER-MINOR) fs: add statfs() functions (Colin Ihrig) #463585019b5473f] - http: res.setHeaders first implementation (Marco Ippolito) #4610976622c4c60] - inspector: allow opening inspector whenNODE_V8_COVERAGEis set (Moshe Atlow) #4611392f0747e03] - meta: update AUTHORS (Node.js GitHub Bot) #46399795251bc6f] - meta: update AUTHORS (Node.js GitHub Bot) #463038865424c31] - meta: add .mailmap entry (Rich Trott) #463035ed679407b] - meta: move evanlucas to emeritus (Evan Lucas) #46274403df210ac] - module: move test reporter loading (Geoffrey Booth) #459232f7319e387] - readline: fix detection of carriage return (Antoine du Hamel) #4630673a8f46c4d] - Revert "src: let http2 streams end after session close" (Santiago Gimeno) #4672130d783f91a] - src: stop tracing agent before shutting down libuv (Santiago Gimeno) #463801508d90fda] - src: get rid of fp arithmetic in ParseIPv4Host (Tobias Nießen) #46326bdb793a082] - src: use UNREACHABLE instead of CHECK(falsy) (Tobias Nießen) #46317116a33649b] - src: add support for ETW stack walking (José Dapena Paz) #46203b06298c98e] - src: refactor EndsInANumber in node_url.cc and adds IsIPv4NumberValid (Miguel Teixeira) #4622726f41b041c] - src: fix c++ exception on bad command line arg (Ben Noordhuis) #4629014da89f41a] - src: remove unreachable UNREACHABLE (Tobias Nießen) #4628118c4dd004b] - src: replace custom ASCII validation with simdutf one (Anna Henningsen) #46271cde375510f] - src: replace unreachable code with static_assert (Tobias Nießen) #46250f389b2f3fc] - src: use explicit C++17 fallthrough (Tobias Nießen) #462518adaa1333c] - src: use CreateEnvironment instead of inlining its code where possible (Anna Henningsen) #45886f09b838408] - (SEMVER-MINOR) src,lib: add constrainedMemory API for process (theanarkh) #4621863e92eae63] - stream: remove brandchecks from stream duplexify (Debadree Chatterjee) #463153acfe9bf92] - stream: fix readable stream as async iterator function (Erick Wendel) #46147de64315ccb] - test: fix WPT title when no META title is present (Filip Skokan) #46804162e3400ff] - test: fix default WPT titles (Filip Skokan) #467785f422c4d70] - test: add WPTRunner support for variants and generating WPT reports (Filip Skokan) #464984f5aff2557] - test: fix tap parser fails if a test logs a number (Pulkit Gupta) #4605632b020cf84] - test: fix tap escaping with and without --test (Pulkit Gupta) #46311f2bba1bcdb] - test: add trailing commas intest/node-api(Antoine du Hamel) #46384f2ebe66fda] - test: add trailing commas intest/message(Antoine du Hamel) #46372ed564a9985] - test: add trailing commas intest/pseudo-tty(Antoine du Hamel) #46371e4437dd409] - test: set common.bits to 64 for loong64 (Shi Pujin) #453839d40aef736] - test: s390x zlib test case fixes (Adam Majer) #46367ed3fb52716] - test: fix logInTimeout is not function (theanarkh) #46348d05b0771be] - test: avoid trying to call sysctl directly (Adam Majer) #46366041aac3bbd] - test: avoid left behind child processes (Richard Lau) #46276837ddcb322] - test: add failing test for readline with carriage return (Alec Mev) #4607575b8db41c6] - test: reducefs-write-optional-paramsflakiness (LiviaMedeiros) #46238c0d3fdaf63] - test,crypto: add CFRG curve vectors to wrap/unwrap tests (Filip Skokan) #46406f328f7b15e] - test,crypto: update WebCryptoAPI WPT (Filip Skokan) #462671ef3c53e24] - test_runner: better handle async bootstrap errors (Colin Ihrig) #467200a690efb76] - test_runner: adddescribe.onlyandit.onlyshorthands (Richie McColl) #4660428a1317efe] - test_runner: bootstrap reporters before running tests (Moshe Atlow) #46737cd3aaa8fac] - test_runner: emit test-only diagnostic warning (Richie McColl) #46540c19fa45a65] - test_runner: centralize CLI option handling (Colin Ihrig) #467070898145e37] - test_runner: display skipped tests in spec reporter output (Richie McColl) #46651894d7117fa] - test_runner: parse non-ascii character correctly (Mert Can Altın) #457365b3c606626] - test_runner: flatten TAP output when running using--test(Moshe Atlow) #46440391ff0dba4] - test_runner: allow nesting test within describe (Moshe Atlow) #46544ba784e87b4] - test_runner: fix missing test diagnostics (Moshe Atlow) #46450c5f16fb5fb] - test_runner: top-level diagnostics not ommited when running with --test (Pulkit Gupta) #4644128a775b32f] - test_runner: add initial code coverage support (Colin Ihrig) #460170d999e373a] - test_runner: make built in reporters internal (Colin Ihrig) #4609279f4b426fe] - test_runner: reportfilein test runner events (Moshe Atlow) #460304d50db14b3] - (SEMVER-MINOR) test_runner: add reporters (Moshe Atlow) #457125fdf374c74] - test_runner: avoid swallowing of asynchronously thrown errors (MURAKAMI Masahiko) #4526423b875806c] - test_runner: update comment to comply with eslint no-fallthrough rule (Antoine du Hamel) #4625800c5495aa3] - tools: update eslint to 8.33.0 (Node.js GitHub Bot) #4640037a6ce1120] - tools: update doc to unist-util-select@4.0.3 unist-util-visit@4.1.2 (Node.js GitHub Bot) #463641eaafc7db4] - tools: update lint-md-dependencies to rollup@3.12.0 (Node.js GitHub Bot) #46398a97774603b] - tools: require more trailing commas (Antoine du Hamel) #4634603e244a59b] - tools: update lint-md-dependencies (Node.js GitHub Bot) #4630260d714e0c3] - tools: allow icutrim.py to run on python2 (Michael Dawson) #46263b7950f50de] - tools: update eslint to 8.32.0 (Node.js GitHub Bot) #4625808bafc84f6] - url: refactor to use more primordials (Antoine du Hamel) #4596602632b42cf] - (SEMVER-MINOR) v8: support gc profile (theanarkh) #46255110ead9abb] - (SEMVER-MINOR) vm: expose cachedDataRejected for vm.compileFunction (Anna Henningsen) #46320v18.14.2: 2023-02-21, Version 18.14.2 'Hydrogen' (LTS), @MylesBorinsCompare Source
Notable Changes
f864bef32a] - deps: upgrade npm to 9.5.0 (npm team) #46673Commits
880a65d7ff] - build: deletesnapshot.blobfile from the project (Juan José Arboleda) #46626cbea56efda] - deps: update undici to 5.20.0 (Node.js GitHub Bot) #46711f864bef32a] - deps: upgrade npm to 9.5.0 (npm team) #46673648041d568] - deps: upgrade npm to 9.4.0 (npm team) #463535e1f213f3c] - deps: patch V8 to 10.2.154.26 (Michaël Zasso) #46446v18.14.1: 2023-02-16, Version 18.14.1 'Hydrogen' (LTS), @RafaelGSS prepared by @juanarbolCompare Source
This is a security release.
Notable Changes
The following CVEs are fixed in this release:
More detailed information on each of the vulnerabilities can be found in February 2023 Security Releases blog post.
This security release includes OpenSSL security updates as outlined in the recent
OpenSSL security advisory.
Commits
8393ebc72d] - build: build ICU with ICU_NO_USER_DATA_OVERRIDE (RafaelGSS) nodejs-private/node-private#379004e34d046] - crypto: clear OpenSSL error on invalid ca cert (RafaelGSS) #465725e0142a852] - deps: cherry-pick Windows ARM64 fix for openssl (Richard Lau) #46572f71fe278a6] - deps: update archs files for quictls/openssl-3.0.8+quic (RafaelGSS) #465722c6817e42b] - deps: upgrade openssl sources to quictls/openssl-3.0.8+quic (RafaelGSS) #46572f0afa0bfe5] - deps: update undici to 5.19.1 (Node.js GitHub Bot) #46634c26a34c13e] - deps: update undici to 5.18.0 (Node.js GitHub Bot) #46634db93ee4a15] - deps: update undici to 5.17.1 (Node.js GitHub Bot) #46634b4e49fb02c] - deps: update undici to 5.16.0 (Node.js GitHub Bot) #4663490994e6a2c] - deps: update undici to 5.15.1 (Node.js GitHub Bot) #4663400302fc7ac] - deps: update undici to 5.15.0 (Node.js GitHub Bot) #466340e3b796cc5] - lib: makeRequireFunction patch when experimental policy (RafaelGSS) nodejs-private/node-private#3717cccd5565f] - policy: makeRequireFunction on mainModule.require (RafaelGSS) nodejs-private/node-private#371v18.14.0: 2023-02-02, Version 18.14.0 'Hydrogen' (LTS), @BethGriggs prepared by @juanarbolCompare Source
Notable changes
Updated npm to 9.3.1
Based on the list of guidelines we've established on integrating
npmandnode,here is a grouped list of the breaking changes with the reasoning as to why they
fit within the guidelines linked above. Note that all the breaking changes were
made in 9.0.0.
All subsequent minor and patch releases after
npm@9.0.0do not contain anybreaking changes.
Engines
npmis now compatible with the following semver range for node:^14.17.0 || ^16.13.0 || >=18.0.0Filesystem
npmwill no longer attempt to modify ownership of files it creates.Auth
registry found in a config file is no longer supported and will throw errors.
Login
sso,saml&legacyhave been consolidated into"legacy".auth-typedefaults to"web"loginandadduserare now separate commands that send different data to the registry.auth-typeconfig valueswebandlegacyonly try their respective methods,npm no longer tries them all and waits to see which one doesn't fail.
Tarball Packing
npm packnow follows a strict order of operations when applying ignore rules.If a
filesarray is present in thepackage.json, then rules in.gitignoreand
.npmignorefiles from the root will be ignored.Display/Debug/Timing Info
HEADinstead ofmasteras the default ref.timinghas been removed as a value for--loglevel.--timingwill show timing information regardless of--loglevel, except when--silent.--timingflag,npmnow writes timing data to a filealongside the debug log data, respecting the
logs-diroption and fallingback to
<CACHE>/_logs/dir, instead of directly inside the cache directory.will create a uniquely named
<ID>-timing.jsonfile, with the<ID>portionbeing the same as the debug log.
npmnow outputs some json errors on stdout. Previouslynpmwould outputall json formatted errors on stderr, making it difficult to parse as the
stderr stream usually has logs already written to it.
Config/Command Deprecations or Removals
--install-strategy.npm config setwill no longer accept deprecated or invalid config options.install-linksconfig defaults to"true".node-versionconfig has been removed.npm-versionconfig has been removed.npm accesssubcommands have been renamed.npm birthdayhas been removed.npm set-scripthas been removed.npm binhas been removed (usenpxornpm execto execute binaries).Other notable changes
Commits
1352f08778] - assert: removeassert.snapshot(Moshe Atlow) #461124ee3238643] - async_hooks: refactor to usevalidateObject(Deokjin Kim) [#46004](https://Configuration
📅 Schedule: Branch creation - "before 5am on monday" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate. View repository job log here.