Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): [security] bump highlight.js from 10.4.0 to 10.4.1 #1198

Merged

Conversation

dependabot-preview[bot]
Copy link
Contributor

Bumps highlight.js from 10.4.0 to 10.4.1. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

ReDOS vulnerabities: multiple grammars

Impact: Potential ReDOS vulnerabilities (exponential and polynomial RegEx backtracking)

oswasp:

> The Regular expression Denial of Service (ReDoS) is a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach extreme situations that cause them to work very slowly (exponentially related to input size). An attacker can then cause a program using a Regular Expression to enter these extreme situations and then hang for a very long time.

If are you are using Highlight.js to highlight user-provided data you are possibly vulnerable. On the client-side (in a browser or Electron environment) risks could include lengthy freezes or crashes... On the server-side infinite freezes could occur... effectively preventing users from accessing your app or service (ie, Denial of Service).

This is an issue with grammars shipped with the parser (and potentially 3rd party grammars also), not the parser itself. If you are using Highlight.js with any of the following grammars you are vulnerable. If you are using highlightAuto to detect the language (and have any of these grammars registered) you are vulnerable.

All versions prior to 10.4.1 are vulnerable, including version 9.18.5.

Grammars with exponential backtracking issues:

  • c-like (c, cpp, arduino)
  • handlebars (htmlbars)
  • gams
  • perl
  • jboss-cli
  • r

Affected versions: >= 9.0.0 < 10.4.1

Release notes

Sourced from highlight.js's releases.

10.4.1

Security fixes:

  • (fix) Exponential backtracking fixes for: Josh Goebel
    • cpp
    • handlebars
    • gams
    • perl
    • jboss-cli
    • r
    • erlang-repl
    • powershell
    • routeros
  • (fix) Polynomial backtracking fixes for: Josh Goebel
    • asciidoc
    • reasonml
    • latex
    • kotlin
    • gcode
    • d
    • aspectj
    • moonscript
    • coffeescript/livescript
    • csharp
    • scilab
    • crystal
    • elixir
    • basic
    • ebnf
    • ruby
    • fortran/irpf90
    • livecodeserver
    • yaml
    • x86asm
    • dsconfig
    • markdown
    • ruleslanguage
    • xquery
    • sqf

Very grateful to Michael Schmidt for all the help.

Changelog

Sourced from highlight.js's changelog.

Version 10.4.1 (tentative)

Security

  • (fix) Exponential backtracking fixes for: Josh Goebel
    • cpp
    • handlebars
    • gams
    • perl
    • jboss-cli
    • r
    • erlang-repl
    • powershell
    • routeros
  • (fix) Polynomial backtracking fixes for: Josh Goebel
    • asciidoc
    • reasonml
    • latex
    • kotlin
    • gcode
    • d
    • aspectj
    • moonscript
    • coffeescript/livescript
    • csharp
    • scilab
    • crystal
    • elixir
    • basic
    • ebnf
    • ruby
    • fortran/irpf90
    • livecodeserver
    • yaml
    • x86asm
    • dsconfig
    • markdown
    • ruleslanguage
    • xquery
    • sqf

Very grateful to Michael Schmidt for all the help.

Commits
  • e96b915 bump 10.4.1
  • 065f65f chore(release) allow release script to handle production releases
  • 68509fc chore(docs) bump SECURITY mention to 9.18.5
  • aa0fb85 chore(docs) Version 9 has reached EOL.
  • fb0a626 enh(ci): Add tests for polynomial regex issues
  • fa46dd1 fix(reasonml) fix poly backtracking issue
  • d496052 fix(latex) fix poly backtracking issue
  • d9f1cdb fix(javascript/typescript) fix poly backtracking issue
  • fdec037 fix(asciidoc) fix poly backtracking issue
  • 02ca487 fix(kotlin) fix poly backtracking issue
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by joshgoebel, a new releaser for highlight.js since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Automerge options (never/patch/minor, and dev/runtime dependencies)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

Bumps [highlight.js](https://github.com/highlightjs/highlight.js) from 10.4.0 to 10.4.1. **This update includes a security fix.**
- [Release notes](https://github.com/highlightjs/highlight.js/releases)
- [Changelog](https://github.com/highlightjs/highlight.js/blob/master/CHANGES.md)
- [Commits](highlightjs/highlight.js@10.4.0...10.4.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
@dependabot-preview dependabot-preview bot added dependencies Pull requests that update a dependency file security vulnerability Security vulnerability detected by WhiteSource labels Dec 4, 2020
@github-actions
Copy link

github-actions bot commented Dec 4, 2020

Deploy preview for chemicaltools-web ready!

✅ Preview
https://chemicaltools-web-rae9b46x3.vercel.app

Built with commit 5444c82.
This pull request is being automatically deployed with vercel-action

@njzjz
Copy link
Member

njzjz commented Dec 4, 2020

@dependabot squash and merge

@dependabot-preview dependabot-preview bot merged commit 90df3d9 into master Dec 4, 2020
@dependabot-preview dependabot-preview bot deleted the dependabot/npm_and_yarn/highlight.js-10.4.1 branch December 4, 2020 21:38
@github-actions
Copy link

github-actions bot commented Dec 7, 2020

🎉 This PR is included in version 3.1.152 🎉

The release is available on:

Your semantic-release bot 📦🚀

github-merge-queue bot pushed a commit that referenced this pull request Oct 9, 2023
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cordova-android](https://togithub.com/apache/cordova-android) |
[`^9.0.0` ->
`^12.0.0`](https://renovatebot.com/diffs/npm/cordova-android/9.1.0/12.0.1)
|
[![age](https://developer.mend.io/api/mc/badges/age/npm/cordova-android/12.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/cordova-android/12.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/cordova-android/9.1.0/12.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/cordova-android/9.1.0/12.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>apache/cordova-android (cordova-android)</summary>

###
[`v12.0.1`](https://togithub.com/apache/cordova-android/blob/HEAD/RELEASENOTES.md#1201-Aug-23-2023)

[Compare
Source](https://togithub.com/apache/cordova-android/compare/12.0.0...12.0.1)

- [GH-1632](https://togithub.com/apache/cordova-android/pull/1632)
fix(android): `monochrome` checks
- [GH-1649](https://togithub.com/apache/cordova-android/pull/1649)
chore: rebuild `package-lock` w/ lint corrections

###
[`v12.0.0`](https://togithub.com/apache/cordova-android/blob/HEAD/RELEASENOTES.md#1200-May-20-2023)

[Compare
Source](https://togithub.com/apache/cordova-android/compare/11.0.0...12.0.0)

**Breaking:**

- [GH-1605](https://togithub.com/apache/cordova-android/pull/1605) fix!:
Make `CoreAndroid` plugin instantiate on load
- [GH-1539](https://togithub.com/apache/cordova-android/pull/1539)
feat!: bump Gradle 7.6 & AGP 7.4.2
- [GH-1571](https://togithub.com/apache/cordova-android/pull/1571)
feat!: bump min SDK to 24
- [GH-1538](https://togithub.com/apache/cordova-android/pull/1538)
feat!: bump target sdk & build tools for SDK 33 support
- [GH-1540](https://togithub.com/apache/cordova-android/pull/1540)
feat!: bump node engine requirement `>=16.13.0`
- [GH-1597](https://togithub.com/apache/cordova-android/pull/1597)
deprecate: `CoreAndroid.getBuildConfigValue`
- [GH-1541](https://togithub.com/apache/cordova-android/pull/1541)
dep(npm)!: bump acceptable modules w/ rebuilt `package-lock`
- [GH-1566](https://togithub.com/apache/cordova-android/pull/1566)
dep(npm)!: bump `cordova-common@5.0.0`

**Features:**

- [GH-1602](https://togithub.com/apache/cordova-android/pull/1602) feat:
add `listTarget` api
- [GH-1574](https://togithub.com/apache/cordova-android/pull/1574) feat:
add plugin hooks for `WebViewClient.onRenderProcessGone`
- [GH-1594](https://togithub.com/apache/cordova-android/pull/1594) feat:
bump default `kotlin` to version 1.7.21
- [GH-1550](https://togithub.com/apache/cordova-android/pull/1550) feat:
add `monochrome` app icon support
- [GH-1589](https://togithub.com/apache/cordova-android/pull/1589) feat:
`InspectableWebview` preference
- [GH-1568](https://togithub.com/apache/cordova-android/pull/1568) feat:
bump `androidx.appcompat.appcompat` 1.6.1
- [GH-1567](https://togithub.com/apache/cordova-android/pull/1567) feat:
bump `androidx.webkit.webkit` 1.6.0
- [GH-1545](https://togithub.com/apache/cordova-android/pull/1545) feat:
bump `androidx.webkit.webkit` 1.5.0
- [GH-1547](https://togithub.com/apache/cordova-android/pull/1547) feat:
bump `com.google.gms.google-services` 4.3.15
- [GH-1546](https://togithub.com/apache/cordova-android/pull/1546) feat:
bump `androidx.core.core-splashscreen` 1.0.0
- [GH-1544](https://togithub.com/apache/cordova-android/pull/1544) feat:
bump `androidx.appcompat.appcompat` 1.5.1

**Fixes:**

- [GH-1606](https://togithub.com/apache/cordova-android/pull/1606) fix:
Gradle Args parsing
- [GH-1575](https://togithub.com/apache/cordova-android/pull/1575)
fix(`BuildHelper`): get package name from `ApplicationInfo`
- [GH-1595](https://togithub.com/apache/cordova-android/pull/1595)
fix(test): Native test namespace refactor
- [GH-1471](https://togithub.com/apache/cordova-android/pull/1471) fix:
`ANDROID_HOME` is the new default, to check first and give advice
- [GH-1573](https://togithub.com/apache/cordova-android/pull/1573)
fix([GH-1432](https://togithub.com/apache/cordova-android/issues/1432)):
Default `content` `src` when content tag is missing
- [GH-1506](https://togithub.com/apache/cordova-android/pull/1506) fix:
only do fadeout animation if `FadeSplashScreen` is true
- [GH-1505](https://togithub.com/apache/cordova-android/pull/1505) fix:
correctly flag API dependency on `AppCompat` for Maven
- [GH-1487](https://togithub.com/apache/cordova-android/pull/1487) fix:
Add **Android** prefix to `WindowSplashScreenBrandingImage`
- [GH-1489](https://togithub.com/apache/cordova-android/pull/1489) fix:
import type definitions from obsolete `cordova-plugin-splashscreen`

**Chores, Refactor,  Dependencies & CI:**

- [GH-1493](https://togithub.com/apache/cordova-android/pull/1493)
chore: add `lint:fix` script for fixing lint errors
- [GH-1491](https://togithub.com/apache/cordova-android/pull/1491)
chore: Use gradle 7.4.2 distribution url
- [GH-1588](https://togithub.com/apache/cordova-android/pull/1588)
refactor: Removed obsolete version code checks
- [GH-1492](https://togithub.com/apache/cordova-android/pull/1492)
refactor: replace deprecated `Handler` constructor
- [GH-1587](https://togithub.com/apache/cordova-android/pull/1587) dep:
bump npm dependencies
    -   `fs-extra@11.1.1`
    -   `nopt@7.1.0`
    -   `@cordova/eslint-config@5.0.0`
    -   `jasmine@4.6.0`
- [GH-1607](https://togithub.com/apache/cordova-android/pull/1607) ci:
Added NodeJS 20.x to the workflow matrix
- [GH-1542](https://togithub.com/apache/cordova-android/pull/1542)
ci(workflow): update `codecov/codecov-action@v3`
- [GH-1532](https://togithub.com/apache/cordova-android/pull/1532) ci:
update `codecov/codecov-action` reporting format

###
[`v11.0.0`](https://togithub.com/apache/cordova-android/blob/HEAD/RELEASENOTES.md#1100-Jul-04-2022)

[Compare
Source](https://togithub.com/apache/cordova-android/compare/10.1.2...11.0.0)

**Breaking:**

- [GH-1441](https://togithub.com/apache/cordova-android/pull/1441)
feat!: **Android** 12 splash screen
- [GH-1427](https://togithub.com/apache/cordova-android/pull/1427)
feat!: API 32 support
- [GH-1410](https://togithub.com/apache/cordova-android/pull/1410)
feat!: API 31 support
- [GH-1444](https://togithub.com/apache/cordova-android/pull/1444) fix!:
set & use `ANDROID_HOME` as default
- [GH-1411](https://togithub.com/apache/cordova-android/pull/1411)
chore!: Drop Node 12 support

**Features:**

- [GH-1448](https://togithub.com/apache/cordova-android/pull/1448) feat:
Update `androidx.appcompat` version
- [GH-1446](https://togithub.com/apache/cordova-android/pull/1446) feat:
Update gradle plugin version
- [GH-1447](https://togithub.com/apache/cordova-android/pull/1447) feat:
Update google services pluging
- [GH-1431](https://togithub.com/apache/cordova-android/pull/1431) feat:
support custom `compileSdk` setting
- [GH-1311](https://togithub.com/apache/cordova-android/pull/1311) feat:
added support for BoM imports

**Fixes:**

- [GH-1455](https://togithub.com/apache/cordova-android/pull/1455)
fix(`prepare`): `destFile` path separator
- [GH-1453](https://togithub.com/apache/cordova-android/pull/1453) fix:
support installing platfrom from local git checkout
- [GH-1449](https://togithub.com/apache/cordova-android/pull/1449) fix:
accept file cookies only if `AndroidInsecureFileModeEnabled`
- [GH-1443](https://togithub.com/apache/cordova-android/pull/1443) fix:
force `hostname` to lowercase
- [GH-1434](https://togithub.com/apache/cordova-android/pull/1434) fix:
restore `checkReqs` in `prepare.js`
- [GH-1154](https://togithub.com/apache/cordova-android/pull/1154) fix:
move `MainActivity.java` to folder that tracks the app package name
(widget id)

**Chores, Dependencies & CI:**

- [GH-1451](https://togithub.com/apache/cordova-android/pull/1451)
chore: display warning on deprecated `<splash>` tag usage
- [GH-1430](https://togithub.com/apache/cordova-android/pull/1430)
chore: remove unneeded deprecated annotation
- [GH-1421](https://togithub.com/apache/cordova-android/pull/1421)
chore(npm): bump `@cordova/eslint-config@^4.0.0`
- [GH-1420](https://togithub.com/apache/cordova-android/pull/1420)
chore(npm): bump dependencies
- [GH-1452](https://togithub.com/apache/cordova-android/pull/1452) dep:
bump `jasmine@4.2.1` w/ `package-lock` rebuild
- [GH-1439](https://togithub.com/apache/cordova-android/pull/1439) ci:
update github action workflow
- [GH-1424](https://togithub.com/apache/cordova-android/pull/1424) ci:
Added Node 18 to test matrix

###
[`v10.1.2`](https://togithub.com/apache/cordova-android/blob/HEAD/RELEASENOTES.md#1012-Apr-11-2022)

[Compare
Source](https://togithub.com/apache/cordova-android/compare/10.1.1...10.1.2)

**Fixes:**

- [GH-1372](https://togithub.com/apache/cordova-android/pull/1372)
fix(`AndroidManifest`): explicitly define the `activity` attribute
`android:exported`
- [GH-1406](https://togithub.com/apache/cordova-android/pull/1406) fix:
detect `JAVA_HOME` with Java 11
- [GH-1401](https://togithub.com/apache/cordova-android/pull/1401)
fix([GH-1391](https://togithub.com/apache/cordova-android/issues/1391)):
Reword minimum build tools version to make it more clear what is
actually required.
- [GH-1384](https://togithub.com/apache/cordova-android/pull/1384) fix:
escape `strings.xml` app name

**Chores:**

- [GH-1413](https://togithub.com/apache/cordova-android/pull/1413)
chore: update `package-lock` to satisfy `npm audit`
- [GH-1348](https://togithub.com/apache/cordova-android/pull/1348)
chore: `npmrc`

###
[`v10.1.1`](https://togithub.com/apache/cordova-android/blob/HEAD/RELEASENOTES.md#1011-Sep-13-2021)

[Compare
Source](https://togithub.com/apache/cordova-android/compare/10.1.0...10.1.1)

**Fixes:**

- [GH-1349](https://togithub.com/apache/cordova-android/pull/1349)
fix(`PluginManager`): `AllowNavigation` default policy to handle scheme
& hostname
- [GH-1342](https://togithub.com/apache/cordova-android/pull/1342)
fix(`AllowListPlugin`): Safely handle default allow navigation policy in
allow request
- [GH-1332](https://togithub.com/apache/cordova-android/pull/1332)
fix(`PluginManager`): `AllowBridgeAccess` default policy to handle
scheme & hostname

###
[`v10.1.0`](https://togithub.com/apache/cordova-android/blob/HEAD/RELEASENOTES.md#1010-Aug-13-2021)

[Compare
Source](https://togithub.com/apache/cordova-android/compare/10.0.1...10.1.0)

**Features:**

- [GH-1213](https://togithub.com/apache/cordova-android/pull/1213) feat:
unify `create` default values & stop project name transform
- [GH-1306](https://togithub.com/apache/cordova-android/pull/1306) feat:
bump `ANDROIDX_APP_COMPAT@1.3.1`
- [GH-1303](https://togithub.com/apache/cordova-android/pull/1303) feat:
bump `Google Services Gradle Plugin@4.3.8`
- [GH-1302](https://togithub.com/apache/cordova-android/pull/1302) feat:
bump `kotlin@1.5.21`
- [GH-1298](https://togithub.com/apache/cordova-android/pull/1298) feat:
support `http` w/ `content` `src` fix

**Fixes:**

- [GH-1214](https://togithub.com/apache/cordova-android/pull/1214) fix:
display project name in Android Studio
- [GH-1300](https://togithub.com/apache/cordova-android/pull/1300) fix:
fall back to project root `repositories.gradle`

**Docs:**

- [GH-1308](https://togithub.com/apache/cordova-android/pull/1308) doc:
update `README` about development & testing

###
[`v10.0.1`](https://togithub.com/apache/cordova-android/blob/HEAD/RELEASENOTES.md#1001-Jul-27-2021)

[Compare
Source](https://togithub.com/apache/cordova-android/compare/10.0.0...10.0.1)

**Fixes:**

- [GH-1295](https://togithub.com/apache/cordova-android/pull/1295) fix:
`maven-publish` setup
- [GH-1293](https://togithub.com/apache/cordova-android/pull/1293) fix:
`gradle` build tools config
- [GH-1294](https://togithub.com/apache/cordova-android/pull/1294) fix:
automatic latest build tools finding
- [GH-1287](https://togithub.com/apache/cordova-android/pull/1287) fix:
Google Services Gradle Plugin version check failure

**Chores:**

- [GH-1291](https://togithub.com/apache/cordova-android/pull/1291)
chore: add missing release notes
- [GH-1286](https://togithub.com/apache/cordova-android/pull/1286)
chore: update `README` requirements

###
[`v10.0.0`](https://togithub.com/apache/cordova-android/blob/HEAD/RELEASENOTES.md#1000-Jul-17-2021)

[Compare
Source](https://togithub.com/apache/cordova-android/compare/9.1.0...10.0.0)

**Breaking:**

- [GH-1052](https://togithub.com/apache/cordova-android/pull/1052)
feat!: only support `AndroidX`
- [GH-1137](https://togithub.com/apache/cordova-android/pull/1137)
feat!: implement `WebViewAssetLoader`
- [GH-1268](https://togithub.com/apache/cordova-android/pull/1268)
feat!: release build defaults to `aab` package type
- [GH-1182](https://togithub.com/apache/cordova-android/pull/1182)
feat!: bump `target sdk@30` w/ `build-tool@30.0.3`
- [GH-1257](https://togithub.com/apache/cordova-android/pull/1257)
feat!: upgrade `gradle@7.1.1`
- [GH-1197](https://togithub.com/apache/cordova-android/pull/1197)
feat!: upgrade `gradle@6.8.3`
- [GH-1256](https://togithub.com/apache/cordova-android/pull/1256)
feat!: upgrade `kotlin@1.5.20`
- [GH-1204](https://togithub.com/apache/cordova-android/pull/1204)
feat!: upgrade `kotlin@1.4.32`
- [GH-1200](https://togithub.com/apache/cordova-android/pull/1200)
feat!: upgrade `kotlin@1.4.31`
- [GH-1255](https://togithub.com/apache/cordova-android/pull/1255)
feat!: upgrade `android-gradle-plugin@4.2.2`
- [GH-1232](https://togithub.com/apache/cordova-android/pull/1232)
feat!: upgrade `android-gradle-plugin@4.2.1`
- [GH-1198](https://togithub.com/apache/cordova-android/pull/1198)
feat!: upgrade `android-gradle-plugin@4.1.3`
- [GH-1199](https://togithub.com/apache/cordova-android/pull/1199)
feat!: upgrade `Google Services Gradle Plugin@4.3.5`
- [GH-1262](https://togithub.com/apache/cordova-android/pull/1262)
feat!: bump `appcompat@1.3.0`
- [GH-1258](https://togithub.com/apache/cordova-android/pull/1258)
feat!: bump `android.webkit@1.4.0`
- [GH-1252](https://togithub.com/apache/cordova-android/pull/1252)
feat!: drop abandoned `com.github.dcendents:android-maven-gradle-plugin`
- [GH-1212](https://togithub.com/apache/cordova-android/pull/1212)
feat!: unify & fix gradle library/tooling overrides
- [GH-1138](https://togithub.com/apache/cordova-android/pull/1138)
feat(allow-list)!: integrate and refactor core plugin
- [GH-1201](https://togithub.com/apache/cordova-android/pull/1201)
feat!: upgrade jfrog `gradle-bintray-plugin@1.8.5`
- [GH-1279](https://togithub.com/apache/cordova-android/pull/1279)
chore!: bump all dependencies
- [GH-1278](https://togithub.com/apache/cordova-android/pull/1278)
chore!: drop `node` 10 support
- [GH-1205](https://togithub.com/apache/cordova-android/pull/1205)
chore! (`npm`): update all dependencies
- [GH-1274](https://togithub.com/apache/cordova-android/pull/1274)
cleanup!: remove deprecated settings & add todo comments
- [GH-1048](https://togithub.com/apache/cordova-android/pull/1048)
cleanup!: remove `keystore` password prompt
- [GH-1251](https://togithub.com/apache/cordova-android/pull/1251)
cleanup!: drop `jcenter` & update dependencies
- [GH-1269](https://togithub.com/apache/cordova-android/pull/1269)
refactor!: do not copy JS lib to platform project
- [GH-1270](https://togithub.com/apache/cordova-android/pull/1270)
refactor(Api)!: use version from `package.json`
- [GH-1266](https://togithub.com/apache/cordova-android/pull/1266)
refactor(run)!: `run` method
- [GH-1083](https://togithub.com/apache/cordova-android/pull/1083)
refactor!: drop support for `android` SDK tool
- [GH-1100](https://togithub.com/apache/cordova-android/pull/1100)
refactor!: remove most platform binaries

**Features:**

- [GH-1241](https://togithub.com/apache/cordova-android/pull/1241) feat:
remove `java` 1.8 version check
- [GH-1254](https://togithub.com/apache/cordova-android/pull/1254) feat:
support `webkit` version override
- [GH-1229](https://togithub.com/apache/cordova-android/pull/1229) feat:
`CORDOVA_JAVA_HOME` env variable
- [GH-1222](https://togithub.com/apache/cordova-android/pull/1222) feat:
add backwards compatibility mode for `WebViewAssetLoader`
- [GH-1166](https://togithub.com/apache/cordova-android/pull/1166) feat:
overload `PluginEntry` constructor to set onload property
- [GH-1208](https://togithub.com/apache/cordova-android/pull/1208) feat:
allow `appcompat` version to be configurable
- [GH-1047](https://togithub.com/apache/cordova-android/pull/1047) feat:
Deprecated `onRequestPermissionResult` in favour for
`onRequestPermissionsResult` for consistency

**Fixes:**

- [GH-1283](https://togithub.com/apache/cordova-android/pull/1283) fix:
add missing apache-license header to `getASPath.bat`
- [GH-1275](https://togithub.com/apache/cordova-android/pull/1275) fix:
add `WebViewAssetloader` to default allow list
- [GH-1216](https://togithub.com/apache/cordova-android/pull/1216) fix:
request focus after custom view hided
- [GH-1264](https://togithub.com/apache/cordova-android/pull/1264) fix:
missing `super.onRequestPermissionsResult` error (`MissingSuperCall`)
- [GH-563](https://togithub.com/apache/cordova-android/pull/563)
fix(build): support tilde expansion on Windows
- [GH-1220](https://togithub.com/apache/cordova-android/pull/1220)
fix(`requirements` check): use regex to get java version from javac
output
- [GH-1227](https://togithub.com/apache/cordova-android/pull/1227)
fix(prepare): delete splash screens if none are used
- [GH-1228](https://togithub.com/apache/cordova-android/pull/1228) fix:
java checks
- [GH-1276](https://togithub.com/apache/cordova-android/pull/1276) fix:
remove forced default `gradle.daemon` setting

**Refactors:**

- [GH-1265](https://togithub.com/apache/cordova-android/pull/1265)
refactor: do not infer project root from script location
- [GH-1267](https://togithub.com/apache/cordova-android/pull/1267)
refactor: use target SDK of built APK to determine best emulator
- [GH-1253](https://togithub.com/apache/cordova-android/pull/1253)
refactor: `gradle` cleanup
- [GH-1260](https://togithub.com/apache/cordova-android/pull/1260)
refactor(`check_reqs`): drop `originalError` param from
`check_android_target`
- [GH-1246](https://togithub.com/apache/cordova-android/pull/1246)
refactor(`env/java`): improve tests and implementation

**Chores & Cleanup:**

- [GH-1273](https://togithub.com/apache/cordova-android/pull/1273)
chore: remove old `VERSION` file
- [GH-1272](https://togithub.com/apache/cordova-android/pull/1272)
cleanup: delete old ANT & Eclipse files
- [GH-1141](https://togithub.com/apache/cordova-android/pull/1141)
cleanup: remove app cache settings

**CI, Build & Testing:**

- [GH-1218](https://togithub.com/apache/cordova-android/pull/1218) ci:
Add `Node16` to CI matrix
- [GH-1271](https://togithub.com/apache/cordova-android/pull/1271)
build: build `cordova.js` during npm prepare
- [GH-1207](https://togithub.com/apache/cordova-android/pull/1207)
test(`AndroidManifest`): update theme to `Theme.AppCompat.NoActionBar`
- [GH-1263](https://togithub.com/apache/cordova-android/pull/1263)
test(`check_reqs`): do not hardcode `DEFAULT_TARGET_API`
- [GH-1259](https://togithub.com/apache/cordova-android/pull/1259)
test(`prepare`): factor out common vars

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/chemicaltools/chemicaltools-web).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4wLjMiLCJ1cGRhdGVkSW5WZXIiOiIzNy4wLjMiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
github-merge-queue bot pushed a commit that referenced this pull request Oct 9, 2023
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [cordova-ios](https://togithub.com/apache/cordova-ios) | [`^6.0.0` ->
`^7.0.0`](https://renovatebot.com/diffs/npm/cordova-ios/6.3.0/7.0.1) |
[![age](https://developer.mend.io/api/mc/badges/age/npm/cordova-ios/7.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![adoption](https://developer.mend.io/api/mc/badges/adoption/npm/cordova-ios/7.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![passing](https://developer.mend.io/api/mc/badges/compatibility/npm/cordova-ios/6.3.0/7.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|
[![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/cordova-ios/6.3.0/7.0.1?slim=true)](https://docs.renovatebot.com/merge-confidence/)
|

---

### Release Notes

<details>
<summary>apache/cordova-ios (cordova-ios)</summary>

###
[`v7.0.1`](https://togithub.com/apache/cordova-ios/blob/HEAD/RELEASENOTES.md#701-Sep-03-2023)

[Compare
Source](https://togithub.com/apache/cordova-ios/compare/7.0.0...7.0.1)

- [GH-1369](https://togithub.com/apache/cordova-ios/pull/1369) fix:
`xcodebuild` version check to 11
- [GH-1358](https://togithub.com/apache/cordova-ios/pull/1358) fix:
ensure Xcode project file references use `path`
- [GH-1368](https://togithub.com/apache/cordova-ios/pull/1368) fix: make
code compile on Xcode 11
- [GH-1360](https://togithub.com/apache/cordova-ios/pull/1360) fix: add
missing cordova versions to `CDVAvailability.h`

###
[`v7.0.0`](https://togithub.com/apache/cordova-ios/blob/HEAD/RELEASENOTES.md#700-Jul-07-2023)

[Compare
Source](https://togithub.com/apache/cordova-ios/compare/6.3.0...7.0.0)

**Breaking:**

- [GH-1340](https://togithub.com/apache/cordova-ios/pull/1340) chore!:
Remove `podspec` support from `framework` tag
- [GH-1310](https://togithub.com/apache/cordova-ios/pull/1310) feat!:
Remove some Xcode build dir overrides
- [GH-1305](https://togithub.com/apache/cordova-ios/pull/1305) dep!:
bump all possible dependencies w/ node engine requirement update
`>=16.13.0`
    -   `semver@7.4.0`
    -   `plist@3.0.6`
    -   `fs-extra@11.1.1`
    -   `cordova-common@5.0.0`
    -   `nopt@7.1.0`
    -   `which@3.0.0`
    -   `@cordova/eslint-config@5.0.0`
    -   `jasmine@4.6.0`
    -   `rewire@6.0.0`
- [GH-1180](https://togithub.com/apache/cordova-ios/pull/1180)
refactor!: drop platform binaries
- [GH-1169](https://togithub.com/apache/cordova-ios/pull/1169) chore!:
Rename `Images.xcassets` to `Assets.xcassets`
- [GH-1161](https://togithub.com/apache/cordova-ios/pull/1161) chore!:
Breaking API cleanups
- [GH-1182](https://togithub.com/apache/cordova-ios/pull/1182)
dep(dev)!: bump eslint w/ corrections
- [GH-1181](https://togithub.com/apache/cordova-ios/pull/1181) dep!: use
latest dependencies
    -   `nyc@^15.1.0`

**Features:**

- [GH-1249](https://togithub.com/apache/cordova-ios/pull/1249) feat: Add
`LimitsNavigationsToAppBoundDomains` configuration key
- [GH-1320](https://togithub.com/apache/cordova-ios/pull/1320) feat: add
`listTarget` api & revert original bin file location
- [GH-1266](https://togithub.com/apache/cordova-ios/pull/1266)
feat(plugman): support `framework` `link` attribute
- [GH-1276](https://togithub.com/apache/cordova-ios/pull/1276) feat:
Support Apple Cloud Distribution signing
- [GH-1210](https://togithub.com/apache/cordova-ios/pull/1210) feat:
support extending export options
- [GH-1251](https://togithub.com/apache/cordova-ios/pull/1251) feat:
support multiple provisioning profiles
- [GH-1186](https://togithub.com/apache/cordova-ios/pull/1186)
feat(versions): print error messages, not error objects
- [GH-1168](https://togithub.com/apache/cordova-ios/pull/1168)
feat(catalyst): Enable Mac Catalyst support
- [GH-1050](https://togithub.com/apache/cordova-ios/pull/1050) feat: add
`CDVWebViewEngineConfigurationDelegate`
- [GH-1154](https://togithub.com/apache/cordova-ios/pull/1154) feat:
Swift Package Manager support for CordovaLib

**Fixes:**

- [GH-1354](https://togithub.com/apache/cordova-ios/pull/1354) fix:
Various ObjC/template cleanups
- [GH-1341](https://togithub.com/apache/cordova-ios/pull/1341) fix: Try
updating `Podfile` deployment target on prepare
- [GH-1343](https://togithub.com/apache/cordova-ios/pull/1343) fix:
Apply new Xcode flags consistently across test projects
- [GH-1126](https://togithub.com/apache/cordova-ios/pull/1126) fix:
replace of `podspec` variables in `Podfile`
- [GH-1336](https://togithub.com/apache/cordova-ios/pull/1336) fix:
Xcode 15 Beta
- [GH-1337](https://togithub.com/apache/cordova-ios/pull/1337) fix: make
the WebView the first responder when it loads
- [GH-1326](https://togithub.com/apache/cordova-ios/pull/1326) fix:
memory leak when removing the `CDVViewController`
- [GH-1312](https://togithub.com/apache/cordova-ios/pull/1312)
fix(create): Ensure unix paths in Xcode project file
- [GH-1315](https://togithub.com/apache/cordova-ios/pull/1315)
fix(splashscreen): positioning after rotation
- [GH-1295](https://togithub.com/apache/cordova-ios/pull/1295)
fix(`CDVPlugin`): swift init
- [GH-1255](https://togithub.com/apache/cordova-ios/pull/1255) fix:
import type definitions from obsolete `cordova-plugin-splashscreen`
- [GH-1170](https://togithub.com/apache/cordova-ios/pull/1170)
fix(bin/create): set failing exit code on failure
- [GH-1171](https://togithub.com/apache/cordova-ios/pull/1171)
fix(spec/create): handle `createAndBuild` promises
- [GH-1140](https://togithub.com/apache/cordova-ios/pull/1140) fix:
split xcode project location by env separator

**Refactors:**

- [GH-1206](https://togithub.com/apache/cordova-ios/pull/1206) refactor:
platform version logic
- [GH-1204](https://togithub.com/apache/cordova-ios/pull/1204) refactor:
move cordova minimum template
- [GH-1203](https://togithub.com/apache/cordova-ios/pull/1203)
refactor!: do not copy JS lib to platform project
- [GH-1202](https://togithub.com/apache/cordova-ios/pull/1202) refactor:
do not infer project root from script location
- [GH-1201](https://togithub.com/apache/cordova-ios/pull/1201)
refactor(create): convert main implementation to class
- [GH-1200](https://togithub.com/apache/cordova-ios/pull/1200)
refactor(create): sort functions in breadth-first call order
- [GH-1199](https://togithub.com/apache/cordova-ios/pull/1199)
refactor(create): further cleanup
- [GH-1198](https://togithub.com/apache/cordova-ios/pull/1198)
refactor(create): cleanup createProject
- [GH-1196](https://togithub.com/apache/cordova-ios/pull/1196) refactor:
move project template out of bin w/ code changes
- [GH-1195](https://togithub.com/apache/cordova-ios/pull/1195)
refactor(create): cleanup `copyTemplateFiles`
- [GH-1194](https://togithub.com/apache/cordova-ios/pull/1194)
refactor(create)!: move apple_\* binaries & cleanup `copyScripts`
- [GH-1193](https://togithub.com/apache/cordova-ios/pull/1193) refactor:
cleanup create script
- [GH-1190](https://togithub.com/apache/cordova-ios/pull/1190) refactor:
replace superspawn with execa
- [GH-1188](https://togithub.com/apache/cordova-ios/pull/1188) refactor:
hide implementation of build & run
- [GH-1189](https://togithub.com/apache/cordova-ios/pull/1189)
refactor(run): code cleanup
- [GH-1185](https://togithub.com/apache/cordova-ios/pull/1185)
refactor(versions): DRY version binary code
- [GH-1167](https://togithub.com/apache/cordova-ios/pull/1167) refactor:
Api class
- [GH-1158](https://togithub.com/apache/cordova-ios/pull/1158) refactor:
replace `copy-www-build-step` script with build phase
- [GH-1032](https://togithub.com/apache/cordova-ios/pull/1032) refactor:
update allow list name
- [GH-1116](https://togithub.com/apache/cordova-ios/pull/1116)
refactor(projectFile): drop dependency on underscore

**Chores:**

-   chore(rat): add auto generated xcode files to ignore list
- [GH-1339](https://togithub.com/apache/cordova-ios/pull/1339) chore:
Remove unused `BackupWebStorage` preference
- [GH-1308](https://togithub.com/apache/cordova-ios/pull/1308) chore:
remove long-unused `codeSignResourceRules` option
- [GH-1183](https://togithub.com/apache/cordova-ios/pull/1183) chore:
remove unused and outdated `listStartedEmulators`
- [GH-1174](https://togithub.com/apache/cordova-ios/pull/1174) chore:
remove stale coffeescript tests
- [GH-1173](https://togithub.com/apache/cordova-ios/pull/1173) chore:
Remove unused imports from template
- [GH-1160](https://togithub.com/apache/cordova-ios/pull/1160)
chore(swiftpm): Fix up CordovaLib Swift Package
- [GH-1034](https://togithub.com/apache/cordova-ios/pull/1034) chore:
remove more deprecated `UIWebView` things
- [GH-1145](https://togithub.com/apache/cordova-ios/pull/1145) chore:
`npmrc`
- [GH-1129](https://togithub.com/apache/cordova-ios/pull/1129) chore:
rebuild `package-lock.json` to address reported npm audit
vulnerabilities
- [GH-1105](https://togithub.com/apache/cordova-ios/pull/1105) chore:
add undeclared dependency `underscore`

**Others:**

- [GH-1197](https://togithub.com/apache/cordova-ios/pull/1197) build:
build `cordova.js` during npm prepare
- [GH-1317](https://togithub.com/apache/cordova-ios/pull/1317) ci: add
node 20.x
- [GH-1307](https://togithub.com/apache/cordova-ios/pull/1307) ci: Drop
NodeJS 14 tests for non-darwin jobs
- [GH-1277](https://togithub.com/apache/cordova-ios/pull/1277)
ci(workflow): update dependencies
- [GH-1271](https://togithub.com/apache/cordova-ios/pull/1271) ci:
remove Node 10-12 & add Node 16-18.
- [GH-1237](https://togithub.com/apache/cordova-ios/pull/1237) dep: bump
`simple-plist` from 1.3.0 to 1.3.1
- [GH-1208](https://togithub.com/apache/cordova-ios/pull/1208) dep: bump
`jasmine@^3.10.0`
- [GH-1187](https://togithub.com/apache/cordova-ios/pull/1187)
test(version): merge two test suites into one
- [GH-1184](https://togithub.com/apache/cordova-ios/pull/1184)
test(create): further increase timeouts to avoid false negatives
- [GH-1177](https://togithub.com/apache/cordova-ios/pull/1177)
test(create): waste less time on name variants
- [GH-1179](https://togithub.com/apache/cordova-ios/pull/1179) test:
simpler killing of running simulators
- [GH-1178](https://togithub.com/apache/cordova-ios/pull/1178)
test(versions): increase test timeout when invoking pod
- [GH-1176](https://togithub.com/apache/cordova-ios/pull/1176)
test(create): increase test timeout
- [GH-1133](https://togithub.com/apache/cordova-ios/pull/1133) doc:
`README` improvements (cleaup, xcode debugging, etc)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/chemicaltools/chemicaltools-web).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4wLjMiLCJ1cGRhdGVkSW5WZXIiOiIzNy4wLjMiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIifQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file PR: merged released security vulnerability Security vulnerability detected by WhiteSource size/XS
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant