Skip to content

Bump minimatch #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Bump minimatch #8

wants to merge 1 commit into from

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Apr 10, 2024

Bumps and minimatch. These dependencies needed to be updated together.
Updates minimatch from 3.0.4 to 3.1.2

Commits

Updates minimatch from 3.0.3 to 3.1.2

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump minimatch
7c6db14 
Bumps  and [minimatch](https://github.com/isaacs/minimatch). These dependencies needed to be updated together.

Updates `minimatch` from 3.0.4 to 3.1.2
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.0.4...v3.1.2)

Updates `minimatch` from 3.0.3 to 3.1.2
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.0.4...v3.1.2)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-type: indirect
- dependency-name: minimatch
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Apr 10, 2024
@socket-security
Copy link

socket-security bot commented Apr 10, 2024

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@serialport/parser-byte-length@1.0.5 None 0 2.04 kB reconbot
npm/@serialport/parser-cctalk@1.0.5 None 0 1.72 kB reconbot
npm/@serialport/parser-delimiter@1.0.5 None 0 2.02 kB reconbot
npm/@serialport/parser-readline@1.0.5 None 0 1.46 kB reconbot
npm/@serialport/parser-ready@1.0.5 None 0 2.46 kB reconbot
npm/@serialport/parser-regex@1.0.5 None 0 1.73 kB reconbot
npm/ajv@6.12.6 eval 0 929 kB esp
npm/ansi-bgblack@0.1.1 None 0 4.86 kB jonschlinkert
npm/ansi-bgblue@0.1.1 None 0 4.84 kB jonschlinkert
npm/ansi-bgcyan@0.1.1 None 0 4.84 kB jonschlinkert
npm/ansi-bggreen@0.1.1 None 0 4.86 kB jonschlinkert
npm/ansi-bgmagenta@0.1.1 None 0 4.89 kB jonschlinkert
npm/ansi-bgred@0.1.1 None 0 4.82 kB jonschlinkert
npm/ansi-bgwhite@0.1.1 None 0 4.86 kB jonschlinkert
npm/ansi-bgyellow@0.1.1 None 0 4.88 kB jonschlinkert
npm/ansi-black@0.1.1 None 0 4.82 kB jonschlinkert
npm/ansi-blue@0.1.1 None 0 4.81 kB jonschlinkert
npm/ansi-bold@0.1.1 None 0 4.81 kB jonschlinkert
npm/ansi-colors@0.2.0 None 0 18.9 kB jonschlinkert
npm/ansi-cyan@0.1.1 None 0 4.81 kB jonschlinkert
npm/ansi-dim@0.1.1 None 0 4.79 kB jonschlinkert
npm/ansi-gray@0.1.1 None 0 4.81 kB jonschlinkert
npm/ansi-green@0.1.1 None 0 4.82 kB jonschlinkert
npm/ansi-grey@0.1.1 None 0 4.81 kB jonschlinkert
npm/ansi-hidden@0.1.1 None 0 4.84 kB jonschlinkert
npm/ansi-inverse@0.1.1 None 0 4.86 kB jonschlinkert
npm/ansi-italic@0.1.1 None 0 4.84 kB jonschlinkert
npm/ansi-magenta@0.1.1 None 0 4.86 kB jonschlinkert
npm/ansi-red@0.1.1 None 0 4.79 kB jonschlinkert
npm/ansi-reset@0.1.1 None 0 4.82 kB jonschlinkert
npm/ansi-strikethrough@0.1.1 None 0 4.96 kB jonschlinkert
npm/ansi-underline@0.1.1 None 0 4.89 kB jonschlinkert
npm/ansi-white@0.1.1 None 0 4.82 kB jonschlinkert
npm/ansi-wrap@0.1.0 None 0 4.92 kB jonschlinkert
npm/ansi-yellow@0.1.1 None 0 4.84 kB jonschlinkert
npm/are-we-there-yet@1.1.7 None 0 14.7 kB gar
npm/argparse@1.0.10 environment, filesystem 0 116 kB vitaly
npm/arr-flatten@1.1.0 None 0 6.88 kB jonschlinkert
npm/arr-swap@1.0.1 None +1 13.1 kB jonschlinkert
npm/bindings@1.5.0 environment, filesystem 0 11.2 kB tootallnate
npm/bl@1.2.3 None 0 38.9 kB rvagg
npm/bluebird@3.7.2 environment, eval, unsafe 0 632 kB esailija
npm/buffer-alloc-unsafe@1.1.0 None 0 1.94 kB linusu
npm/buffer-alloc@1.2.0 None 0 2.27 kB linusu
npm/buffer-fill@1.0.0 None 0 4.39 kB linusu
npm/choices-separator@2.0.0 Transitive: environment, filesystem, network +2 66.5 kB jonschlinkert
npm/chownr@1.1.4 filesystem 0 5.71 kB isaacs
npm/clone-deep@1.0.0 None +1 23.4 kB jonschlinkert
npm/clone@1.0.4 None 0 11.1 kB pvorb
npm/collection-visit@1.0.0 None 0 6.85 kB jonschlinkert
npm/component-emitter@1.3.1 None 0 6.3 kB sindresorhus
npm/copy-descriptor@0.1.1 None 0 4.15 kB jonschlinkert
npm/debug@3.2.7 environment 0 53.3 kB qix
npm/decompress-response@3.3.0 None 0 3.54 kB sindresorhus
npm/deep-extend@0.6.0 None 0 9.19 kB unclechu
npm/define-property@1.0.0 None 0 6.75 kB jonschlinkert
npm/defined@1.0.1 None 0 10.7 kB ljharb
npm/end-of-stream@1.4.4 None 0 6.23 kB mafintosh
npm/error-symbol@0.1.0 None 0 3.23 kB jonschlinkert
npm/expand-template@1.1.1 None 0 3.83 kB ralphtheninja
npm/extend-shallow@2.0.1 None 0 4.82 kB jonschlinkert
npm/fast-deep-equal@3.1.3 None 0 13 kB esp
npm/fast-json-stable-stringify@2.1.0 None 0 17 kB esp
npm/faye-websocket@0.11.4 network 0 30.8 kB jcoglan
npm/file-uri-to-path@1.0.0 None 0 8.07 kB tootallnate
npm/flatten@1.0.3 None 0 3.68 kB mk-pmb
npm/for-in@1.0.2 None 0 6.28 kB jonschlinkert
npm/for-own@1.0.0 None 0 6.47 kB jonschlinkert
npm/form-data@2.3.3 filesystem, network +1 131 kB alexindigo
npm/fs-constants@1.0.0 filesystem 0 2.22 kB mafintosh
npm/function-bind@1.1.2 None 0 31.4 kB ljharb
npm/glob@7.2.3 filesystem 0 55.1 kB isaacs
npm/har-validator@5.1.5 None 0 8.22 kB ahmadnassri
npm/has@1.0.4 None 0 3.02 kB tarruda
npm/hasown@2.0.2 None 0 8.77 kB ljharb
npm/highlight.js@9.18.5 None 0 1.44 MB joshgoebel
npm/html-comment-regex@1.1.2 None 0 2.97 kB stevemao
npm/http-parser-js@0.5.8 None 0 25.8 kB jimbly
npm/info-symbol@0.1.0 None 0 3.22 kB jonschlinkert
npm/inherits@2.0.4 None 0 3.96 kB isaacs
npm/ini@1.3.8 None 0 9.3 kB isaacs
npm/is-accessor-descriptor@1.0.1 None 0 20.3 kB ljharb
npm/is-buffer@1.1.6 None 0 5.58 kB feross
npm/is-data-descriptor@1.0.1 None 0 18.8 kB ljharb
npm/is-descriptor@1.0.3 None 0 20.6 kB ljharb
npm/is-extendable@0.1.1 None 0 5.09 kB jonschlinkert
npm/is-number@6.0.0 None 0 8.96 kB jonschlinkert
npm/is-plain-object@2.0.4 None 0 7.5 kB jonschlinkert
npm/is-windows@1.0.2 None 0 7.96 kB jonschlinkert
npm/isobject@3.0.1 None 0 6.93 kB doowb
npm/jquery@3.7.1 None 0 1.25 MB timmywil
npm/json-schema-traverse@0.4.1 None 0 19.6 kB esp
npm/keytar@4.2.1 None 0 42.7 kB daviwil
npm/kind-of@3.2.2 None 0 13.4 kB jonschlinkert
npm/koalas@1.0.2 None 0 6.46 kB doowb
npm/lazy-cache@2.0.2 environment 0 11 kB jonschlinkert
npm/log-ok@0.1.1 None 0 2.56 kB jonschlinkert
npm/log-utils@0.2.1 None 0 6.17 kB jonschlinkert
npm/map-visit@1.0.0 None 0 8.47 kB jonschlinkert
npm/marked@0.3.19 None 0 80.6 kB amidknight
npm/math-expression-evaluator@1.4.0 None 0 64 kB bugwheels94
npm/mimic-response@1.0.1 None 0 3.58 kB sindresorhus
npm/minimatch@3.1.2 None 0 34.9 kB isaacs
npm/mixin-object@2.0.1 None +1 11.7 kB jonschlinkert
npm/ms@2.1.3 None 0 6.72 kB styfle
npm/mute-stream@0.0.7 None 0 75.6 kB isaacs
npm/node-abi@2.30.1 None 0 28.8 kB marshallofsound
npm/object-copy@0.1.0 None +2 33.6 kB jonschlinkert
npm/object-visit@1.0.1 None 0 6.7 kB jonschlinkert
npm/pointer-symbol@1.0.0 None 0 4.56 kB jonschlinkert
npm/postcss-filter-plugins@2.0.3 None 0 9.77 kB ryanzim
npm/prebuild-install@2.5.3 environment, filesystem +1 73.7 kB mathiask
npm/process-nextick-args@2.0.1 None 0 3.17 kB cwmma
npm/promirepl@1.0.1 None 0 6.47 kB leedm777
npm/prompt-actions@3.0.2 None 0 12.3 kB jonschlinkert
npm/prompt-base@4.1.0 None 0 48.8 kB jonschlinkert
npm/prompt-checkbox@2.2.0 None 0 13.4 kB jonschlinkert
npm/prompt-choices@4.1.0 None +4 93.8 kB jonschlinkert
npm/prompt-list@3.2.0 None 0 9.65 kB jonschlinkert
npm/prompt-question@5.0.2 None 0 20.4 kB jonschlinkert
npm/prompt-radio@1.2.1 None 0 8.34 kB jonschlinkert
npm/psl@1.9.0 None 0 461 kB lupomontero
npm/pump@2.0.1 filesystem 0 7.38 kB mafintosh
npm/pxt-core@0.18.6 environment, filesystem, network, shell 0 37.1 MB kindscript
npm/qs@6.5.3 None 0 126 kB ljharb
npm/radio-symbol@2.0.0 None 0 7.77 kB jonschlinkert
npm/rc@1.2.8 environment, filesystem 0 17.3 kB dominictarr
npm/readable-stream@2.3.8 environment 0 88.1 kB matteo.collina
npm/readline-ui@2.2.3 None +4 30.2 kB jonschlinkert
npm/readline-utils@2.2.3 None 0 32.6 kB doowb
npm/reduce-function-call@1.0.3 None +1 13.1 kB moox
npm/request@2.88.2 environment, filesystem, network +9 680 kB mikeal
npm/semantic-ui-less@2.2.14 None 0 3.82 MB semantic-bot
npm/semver@5.7.2 None 0 63.3 kB lukekarrys
npm/serialport@6.2.2 filesystem, shell Transitive: environment +4 729 kB reconbot
npm/set-getter@0.1.1 None 0 7.42 kB doowb
npm/set-value@3.0.3 None 0 18.1 kB doowb
npm/shallow-clone@1.0.0 None 0 8.79 kB jonschlinkert
npm/signal-exit@3.0.7 None 0 9.96 kB isaacs
npm/simple-concat@1.0.1 None 0 4.62 kB feross
npm/simple-get@2.8.2 network 0 13.5 kB linusu
npm/static-extend@0.1.2 None 0 4.69 kB jonschlinkert
npm/string_decoder@1.1.1 None 0 15.3 kB matteo.collina
npm/strip-color@0.1.0 None 0 4.39 kB jonschlinkert
npm/success-symbol@0.1.0 None 0 3.26 kB jonschlinkert
npm/tar-fs@1.16.3 filesystem +1 34.6 kB mafintosh
npm/tar-stream@1.6.2 filesystem 0 26.8 kB mafintosh
npm/terminal-paginator@2.0.2 None 0 8.28 kB jonschlinkert
npm/time-stamp@1.1.0 None 0 8.58 kB jonschlinkert
npm/to-buffer@1.1.1 None 0 3.25 kB mafintosh
npm/to-object-path@0.3.0 None 0 5.07 kB jonschlinkert
npm/toggle-array@1.0.1 None 0 6.78 kB jonschlinkert
npm/uri-js@4.4.1 None 0 470 kB garycourt
npm/vendors@1.0.4 None 0 4.17 kB wooorm
npm/warning-symbol@0.1.0 None 0 3.3 kB jonschlinkert
npm/websocket-driver@0.7.4 network 0 67.4 kB jcoglan
npm/websocket-extensions@0.1.4 None 0 55 kB jcoglan
npm/which-pm-runs@1.1.0 None 0 3.16 kB zkochan
npm/wide-align@1.1.5 None 0 4.47 kB iarna
npm/window-size@1.1.1 environment, shell 0 12.6 kB doowb
npm/xtend@4.0.2 None 0 6.46 kB raynos

🚮 Removed packages: npm/ajv@5.5.2, npm/are-we-there-yet@1.1.4, npm/argparse@1.0.9, npm/bl@1.2.1, npm/bluebird@3.5.1, npm/boom@4.3.1, npm/chownr@1.0.1, npm/clone@1.0.3, npm/cryptiles@3.1.2, npm/deep-extend@0.4.2, npm/define-properties@1.1.2, npm/defined@1.0.0, npm/end-of-stream@1.4.1, npm/expand-template@1.1.0, npm/fast-deep-equal@1.0.0, npm/fast-json-stable-stringify@2.0.0, npm/faye-websocket@0.11.1, npm/flatten@1.0.2, npm/foreach@2.0.5, npm/form-data@2.3.1, npm/function-bind@1.1.1, npm/glob@7.1.2, npm/har-validator@5.0.3, npm/has-symbols@1.0.0, npm/has@1.0.1, npm/hawk@6.0.2, npm/highlight.js@9.12.0, npm/hoek@4.2.0, npm/html-comment-regex@1.1.1, npm/http-parser-js@0.4.10, npm/immediate@3.0.6, npm/inherits@2.0.3, npm/ini@1.3.5, npm/jquery@3.2.1, npm/json-schema-traverse@0.3.1, npm/keytar@3.0.2, npm/lie@3.2.0, npm/macaddress@0.2.8, npm/marked@0.3.12, npm/math-expression-evaluator@1.2.17, npm/minimatch@3.0.4, npm/nan@2.3.2, npm/node-abi@2.2.0, npm/object-keys@1.0.11, npm/object.assign@4.1.0, npm/postcss-filter-plugins@2.0.2, npm/prebuild-install@2.5.0, npm/process-nextick-args@1.0.7, npm/pxt-core@0.16.1, npm/qs@6.5.1, npm/rc@1.2.5, npm/readable-stream@2.3.3, npm/reduce-function-call@1.0.2, npm/request@2.83.0, npm/semantic-ui-less@2.2.12, npm/semver@5.5.0, npm/serialport@4.0.7, npm/signal-exit@3.0.2, npm/simple-get@1.4.3, npm/sntp@2.1.0, npm/string_decoder@1.0.3, npm/tar-fs@1.16.0, npm/tar-stream@1.5.5, npm/uniqid@4.1.1, npm/unzip-response@1.0.2, npm/vendors@1.0.1, npm/websocket-driver@0.7.0, npm/websocket-extensions@0.1.3, npm/wide-align@1.1.2, npm/xtend@4.0.1

View full report↗︎

@socket-security
Copy link

socket-security bot commented Apr 10, 2024

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSource
Install scripts npm/highlight.js@9.18.5
  • Install script: postinstall
  • Source: node deprecated.js

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore npm/highlight.js@9.18.5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant