Commits on May 4, 2022
-
-
fix: embed.js doesn't expands iframes height (#18301)
also including some refactoring: - add `// @ts-check` - use Map to completely avoid prototype pollution - assign random id to each iframe for reduce chance to brute-force attack, and leak of iframe counts - check iframe.contentWindow and MessageEvent.source to validate message is coming from correct iframe (it works on latest Chrome/Firefox/Safari but I'm not sure this is allowed by spec) follow-up of #17420 fix #18299
-
Bump redis from 4.0.6 to 4.1.0 (#18282)
Bumps [redis](https://github.com/redis/node-redis) from 4.0.6 to 4.1.0. - [Release notes](https://github.com/redis/node-redis/releases) - [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md) - [Commits](https://github.com/redis/node-redis/compare/redis@4.0.6...redis@4.1.0) --- updated-dependencies: - dependency-name: redis dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
-
Bump rubocop from 1.27.0 to 1.28.2 (#18084)
Bumps [rubocop](https://github.com/rubocop/rubocop) from 1.27.0 to 1.28.2. - [Release notes](https://github.com/rubocop/rubocop/releases) - [Changelog](https://github.com/rubocop/rubocop/blob/master/CHANGELOG.md) - [Commits](rubocop/rubocop@v1.27.0...v1.28.2) --- updated-dependencies: - dependency-name: rubocop dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
-
Bump brakeman from 5.2.2 to 5.2.3 (#18274)
Bumps [brakeman](https://github.com/presidentbeef/brakeman) from 5.2.2 to 5.2.3. - [Release notes](https://github.com/presidentbeef/brakeman/releases) - [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md) - [Commits](presidentbeef/brakeman@v5.2.2...v5.2.3) --- updated-dependencies: - dependency-name: brakeman dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
-
Bump ws from 8.5.0 to 8.6.0 (#18279)
Bumps [ws](https://github.com/websockets/ws) from 8.5.0 to 8.6.0. - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.5.0...8.6.0) --- updated-dependencies: - dependency-name: ws dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
-
Bump jest from 27.5.1 to 28.0.3 (#18280)
* Bump jest from 27.5.1 to 28.0.3 Bumps [jest](https://github.com/facebook/jest/tree/HEAD/packages/jest) from 27.5.1 to 28.0.3. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/commits/v28.0.3/packages/jest) --- updated-dependencies: - dependency-name: jest dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Bump babel-jest from 27.5.1 to 28.0.3 Bumps [babel-jest](https://github.com/facebook/jest/tree/HEAD/packages/babel-jest) from 27.5.1 to 28.0.3. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/commits/v28.0.3/packages/babel-jest) --- updated-dependencies: - dependency-name: babel-jest dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Add jest-environment-jsdom Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Yamagishi Kazutoshi <ykzts@desire.sh>
-
Bump axios from 0.26.1 to 0.27.2 (#18270)
Bumps [axios](https://github.com/axios/axios) from 0.26.1 to 0.27.2. - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/master/CHANGELOG.md) - [Commits](axios/axios@v0.26.1...v0.27.2) --- updated-dependencies: - dependency-name: axios dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
-
Bump redux from 4.1.2 to 4.2.0 (#18087)
Bumps [redux](https://github.com/reduxjs/redux) from 4.1.2 to 4.2.0. - [Release notes](https://github.com/reduxjs/redux/releases) - [Changelog](https://github.com/reduxjs/redux/blob/master/CHANGELOG.md) - [Commits](reduxjs/redux@v4.1.2...v4.2.0) --- updated-dependencies: - dependency-name: redux dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
-
Bump stoplight from 2.2.1 to 3.0.0 (#17645)
Bumps [stoplight](https://github.com/orgsync/stoplight) from 2.2.1 to 3.0.0. - [Release notes](https://github.com/orgsync/stoplight/releases) - [Changelog](https://github.com/bolshakov/stoplight/blob/master/CHANGELOG.md) - [Commits](bolshakov/stoplight@v2.2.1...v3.0.0) --- updated-dependencies: - dependency-name: stoplight dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
-
Bump glob from 7.2.0 to 8.0.1 (#18013)
Bumps [glob](https://github.com/isaacs/node-glob) from 7.2.0 to 8.0.1. - [Release notes](https://github.com/isaacs/node-glob/releases) - [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md) - [Commits](isaacs/node-glob@v7.2.0...v8.0.1) --- updated-dependencies: - dependency-name: glob dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
-
Bump sidekiq-scheduler from 3.2.0 to 4.0.0 (#18275)
Bumps [sidekiq-scheduler](https://github.com/moove-it/sidekiq-scheduler) from 3.2.0 to 4.0.0. - [Release notes](https://github.com/moove-it/sidekiq-scheduler/releases) - [Changelog](https://github.com/moove-it/sidekiq-scheduler/blob/master/CHANGELOG.md) - [Commits](sidekiq-scheduler/sidekiq-scheduler@v3.2.0...v4.0.0) --- updated-dependencies: - dependency-name: sidekiq-scheduler dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
