Bump ua-parser-js from 0.7.32 to 0.7.33 in /website - #310
Closed
dependabot[bot] wants to merge 1 commit into
Closed
Conversation
Bumps [ua-parser-js](https://github.com/faisalman/ua-parser-js) from 0.7.32 to 0.7.33. - [Release notes](https://github.com/faisalman/ua-parser-js/releases) - [Changelog](https://github.com/faisalman/ua-parser-js/blob/master/changelog.md) - [Commits](faisalman/ua-parser-js@0.7.32...0.7.33) --- updated-dependencies: - dependency-name: ua-parser-js dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
requested review from
Andy Roth (RothAndrew) and
FlorianS (florian0410)
January 27, 2023 17:42
![bridgecrew[bot]](https://avatars.githubusercontent.com/in/52968?s=60&v=4){kind=small}
| }, | ||
| "engines": { | ||
| "node": ">=16.14" | ||
| "node": ">=18.12" |
There was a problem hiding this comment.
mdn-data 2.0.14 / package-lock.json
This package contains a license that is not OSI-approved.
| }, | ||
| "engines": { | ||
| "node": ">=16.14" | ||
| "node": ">=18.12" |
There was a problem hiding this comment.
trim 0.0.1 / package-lock.json
This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.
| }, | ||
| "engines": { | ||
| "node": ">=16.14" | ||
| "node": ">=18.12" |
There was a problem hiding this comment.
tslib 2.4.1 / package-lock.json
This package contains a license that is not OSI-approved.
| }, | ||
| "engines": { | ||
| "node": ">=16.14" | ||
| "node": ">=18.12" |
There was a problem hiding this comment.
type-fest 2.19.0 / package-lock.json
This package contains a license that is not OSI-approved.
| }, | ||
| "engines": { | ||
| "node": ">=16.14" | ||
| "node": ">=18.12" |
There was a problem hiding this comment.
type-fest 0.20.2 / package-lock.json
This package contains a license that is not OSI-approved.
| }, | ||
| "engines": { | ||
| "node": ">=16.14" | ||
| "node": ">=18.12" |
There was a problem hiding this comment.
caniuse-lite 1.0.30001430 / package-lock.json
This package contains a license that is not OSI-approved.
| }, | ||
| "engines": { | ||
| "node": ">=16.14" | ||
| "node": ">=18.12" |
There was a problem hiding this comment.
opener 1.5.2 / package-lock.json
This package contains a license that is not OSI-approved.
| }, | ||
| "engines": { | ||
| "node": ">=16.14" | ||
| "node": ">=18.12" |
There was a problem hiding this comment.
path-is-inside 1.0.2 / package-lock.json
This package contains a license that is not OSI-approved.
| }, | ||
| "engines": { | ||
| "node": ">=16.14" | ||
| "node": ">=18.12" |
There was a problem hiding this comment.
react-loadable npm:@docusaurus/react-loadable@5.5.2 / package-lock.json
This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.
| }, | ||
| "engines": { | ||
| "node": ">=16.14" | ||
| "node": ">=18.12" |
There was a problem hiding this comment.
require-like 0.1.2 / package-lock.json
This package use a non-SPDX, unrecognized, or private open-source license. Ensure this package is compliant.
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
Andriy Knysh (aknysh)
deleted the
dependabot/npm_and_yarn/website/ua-parser-js-0.7.33
branch
January 28, 2023 15:08
Erik Osterman (Cloud Posse) (osterman)
added a commit
that referenced
this pull request
Jul 31, 2026
The bash step re-parsing website/pnpm-lock.yaml on every PR was pure defense-in-depth on top of the allow-ghsas suppression and has cost four follow-up commits with no functional benefit over the one-line allowlist entry. Investigated a real fix (traced the dependency chain to serve-handler/minimatch, checked dependency-review-action's suppression options, confirmed upstream status via isaacs/minimatch#314 and #310): there isn't one currently reachable from this repo, so the suppression is structurally required, not a maintenance debt we're choosing to carry. Rewrote the allow-ghsas comment with the upstream citations and a concrete removal condition instead of dropping the extra verification step silently.
Andriy Knysh (aknysh)
added a commit
that referenced
this pull request
Jul 31, 2026
* fix(dag): stop concurrent map iteration/write crash in bulk terraform commands FindStacksMap returns its cached stack config maps by reference, and ProcessComponentConfig handed the shared component section straight to callers. DAG-scheduled bulk commands (terraform --all/--affected/--query) run ProcessStacks concurrently across workers, so one worker's writes (atmos_component, workspace, sources, deps, merged auth, ...) raced with another worker's reads of the same cached section, crashing with `fatal error: concurrent map iteration and map write` at higher --max-concurrency. Shallow-clone the component section before mutating it, and apply the same fix to two adjacent cache-corruption sites in the describe-stacks processor that deleted keys from cache-owned maps in place. Add regression tests that fail pre-fix both deterministically and under -race. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(security): bump brace-expansion to patch CVE-2026-14257 (GHSA-mh99-v99m-4gvg) brace-expansion <=5.0.7 lets expand() accumulate unbounded output length from chained brace groups, causing an uncatchable OOM crash (high severity, Dependabot alert #261). Bump the existing pnpm overrides for both major lines in use here (transitive via minimatch, pulled in by serve-handler/docusaurus and docusaurus-plugin-llms) to the patched releases: 1.1.18 and 2.1.4, both published today with the EXPANSION_MAX_LENGTH bound backported from the 5.0.8 fix. Verified by diffing the published tarballs against the vulnerable versions. Website builds clean with the bump; no Go code is affected. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs(fixes): add fix-log record for DAG concurrent map crash Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(ci): allowlist GHSA-mh99-v99m-4gvg pending advisory data update The Dependency Review job still flags brace-expansion@1.1.18/2.1.4 (added in the prior brace-expansion bump) because GHSA-mh99-v99m-4gvg's recorded vulnerable range ("<=5.0.7") doesn't distinguish between brace-expansion's parallel 1.x/2.x/5.x release lines. Both versions we use already contain the same EXPANSION_MAX_LENGTH bound backported from the 5.0.8 fix, verified by diffing the published tarballs against the CVE fix commit. Upgrading further to the only version the advisory recognizes as patched (5.0.8+) isn't safe here: brace-expansion 5.x's CommonJS build switched from a callable default export to a named `exports.expand`, which breaks minimatch@3.1.5's `require('brace-expansion')(...)` call convention (transitive via serve-handler/@docusaurus/core) — a genuine breaking API change, not just a semver-major label. Allowlisted following the existing GHSA-fxhp-mv3v-67qp precedent in this same file, with the reasoning recorded inline for removal once GitHub's advisory data or minimatch's dependency catches up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(describe): compute spacelift_stack/atlantis_project before templates Acceptance tests started failing after the ProcessComponentConfig clone (previous commit): describe component's tags.spacelift_stack/ tags.atlantis_project rendered as `<no value>` instead of the resolved name, and path-resolved describe component (`.`/`./component`) showed an empty imports list instead of the real one. Both were pre-existing bugs masked by the exact cache-mutation issue just fixed. `describe component` runs ProcessStacks twice per invocation (once via resolveAuthManager's preliminary ExecuteDescribeComponent call, once for the real result); pre-fix, the first call's completed computation leaked into the second call's shared, unprotected cache entry, making `{{ .spacelift_stack }}`/`{{ .atlantis_project }}` template references resolve "by accident" and making a describe-stacks preliminary pass's `delete(stackMap, "imports")` corruption invisible. Once ProcessStacks stopped mutating the shared cache, each call started from a clean slate and both latent bugs became visible and deterministic. BuildSpaceliftStackNameFromComponentConfig/BuildAtlantisProjectNameFromComponentConfig only depend on data already populated before template processing (ComponentSettingsSection, ComponentVarsSection, ComponentFromArg, Stack), so move both calls before the template-processing block instead of after it. This makes `.spacelift_stack`/`.atlantis_project` genuinely available to templates in a single pass, matching what the working "describe component <name>" (backward-compatibility) golden snapshot already showed, and consistent regardless of how many times ProcessStacks runs per invocation. Regenerated the 3 affected golden snapshots via `-regenerate-snapshots` per repo convention (never hand-edited) — verified each diff against the now-consistent, already-correct behavior on the other snapshot. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(ci): scope the brace-expansion GHSA allowlist to verified versions Address CodeRabbit review feedback on PR #2831: allow-ghsas allowlists GHSA-mh99-v99m-4gvg by ID only, so any future brace-expansion resolution (an unpatched 3.x/4.x, or a 1.x/2.x release without the backported fix) would silently bypass the vulnerability check. Add a CI step that parses website/pnpm-lock.yaml and fails the job if any resolved brace-expansion version isn't in the explicit verified-patched set (1.1.18, 2.1.4). Also add regression tests closing the patch-coverage gap Codecov flagged on the two Spacelift/Atlantis error-propagation lines moved earlier in ProcessStacks: real, reachable error paths (a malformed name_template for BuildSpaceliftStackNameFromComponentConfig; a type-mismatched settings.atlantis.project_template for BuildAtlantisProjectNameFromComponentConfig) that ProcessStacks must surface rather than silently swallow. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(ci): make the brace-expansion guard's no-match diagnostic reachable Address CodeRabbit review feedback on PR #2831: under `set -euo pipefail`, grep's exit status 1 for "no matches" was propagating through the pipeline into the `found=` assignment, aborting the step with a bare exit code before the intended "No brace-expansion entries found" error message ever printed. Convert grep's expected no-match status into empty input while still preserving failures from a genuinely unreadable/missing file (verified locally: exit 2 still aborts, exit 1 now reaches the diagnostic). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs(ci): correct override-pin wording in brace-expansion comment Address CodeRabbit review feedback on PR #2831: the pnpm override selectors (brace-expansion@^1/@^2) always carry a caret; only their pinned target values (1.1.18/2.1.4) are exact. The prior comment conflated the two, documenting an inaccurate contract. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(ci): drop brace-expansion lockfile re-verification step The bash step re-parsing website/pnpm-lock.yaml on every PR was pure defense-in-depth on top of the allow-ghsas suppression and has cost four follow-up commits with no functional benefit over the one-line allowlist entry. Investigated a real fix (traced the dependency chain to serve-handler/minimatch, checked dependency-review-action's suppression options, confirmed upstream status via isaacs/minimatch#314 and #310): there isn't one currently reachable from this repo, so the suppression is structurally required, not a maintenance debt we're choosing to carry. Rewrote the allow-ghsas comment with the upstream citations and a concrete removal condition instead of dropping the extra verification step silently. --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps ua-parser-js from 0.7.32 to 0.7.33.
Changelog
Sourced from ua-parser-js's changelog.
Commits
f2d0db0Bump version 0.7.33a6140a1Remove unsafe regex in trim() functiona886604Fix #605 - Identify Macintosh as Apple deviceb814bcdMerge pull request #606 from rileyjshaw/patch-17f71024Fix documentationc239ac5Merge pull request #604 from obecerra3/master8d3c2d3Add new browser: CobaltDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.