Skip to content

chore(deps): bump the npm_and_yarn group across 3 directories with 9 updates #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: canary
Choose a base branch
from
Open

chore(deps): bump the npm_and_yarn group across 3 directories with 9 updates #2

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Feb 9, 2025

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package From To
nanoid 3.3.7 3.3.8
next 15.0.1 15.1.2
undici 6.19.4 6.21.1
ws 8.16.0 8.17.1
vitest 1.6.0 1.6.1
hono 4.5.8 4.6.5

Bumps the npm_and_yarn group with 5 updates in the /apps/dokploy directory:

Package From To
next 15.0.1 15.1.2
undici 6.19.4 6.21.1
ws 8.16.0 8.17.1
vitest 1.6.0 1.6.1
rollup 4.19.1 4.34.6

Bumps the npm_and_yarn group with 1 update in the /packages/server directory: ws.

Updates nanoid from 3.3.7 to 3.3.8

Changelog

Sourced from nanoid's changelog.

3.3.8

  • Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).
Commits

Updates next from 15.0.1 to 15.1.2

Release notes

Sourced from next's releases.

v15.1.2

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Credits

Huge thanks to @​ztanner for helping!

v15.1.1

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Credits

Huge thanks to @​devjiwonchoi and @​ztanner for helping!

v15.1.1-canary.27

Core Changes

  • Update font data: #74572
  • Upgrade React from 3b009b4c-20250102 to 3ce77d55-20250106: #74557
  • [metadata] Change the array head to single node in flight data: #74299
  • [DevOverlay] Add Toolbar: #74555
  • restore deleted comment in next-app-loader: #74597
  • Turbopack dev: Remove client to server websocket ping event: #74584

Example Changes

  • chore(examples): update React in reproduction templates to stable 19: #74499

Misc Changes

  • chore(github): update issue_stale token to release bot token: #74575
  • chore(ci): Ensure all 6 shards are used equally in deploy tests: #74574
  • fix: force module format for virtual client-proxy file: #74162
  • [Turbopack] fix shadow-rs build caching: #74579

Credits

Huge thanks to @​samcx, @​nnnnoel, @​lubieowoce, @​huozhi, @​sokra, @​devjiwonchoi, and @​timneutkens for helping!

v15.1.1-canary.26

Core Changes

... (truncated)

Commits
  • df392a1 v15.1.2
  • 40c9424 Backport (v15): Update React from 7283a213-20241206 to 65e06cb7-20241218 (#74...
  • 4384c68 v15.1.1
  • d137863 run build_and_test workflow on backport branch
  • d27bb14 backport: fix(turbo): sassOptions silenceDeprecations was not overwritten wit...
  • 0c8187a Add NEXT_PRIVATE_SKIP_CANARY_CHECK env for bench job (#73763)
  • e83ab18 backport: refactor collectAppPageSegments (#73996)
  • ada25fc Designate as backport branch
  • dafcd43 v15.1.0
  • 2deb35d v15.0.4-canary.52
  • Additional commits viewable in compare view

Updates undici from 6.19.4 to 6.21.1

Release notes

Sourced from undici's releases.

v6.21.1

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

What's Changed

Full Changelog: nodejs/undici@v6.21.0...v6.21.1

v6.21.0

What's Changed

Full Changelog: nodejs/undici@v6.20.1...v6.21.0

v6.20.1

What's Changed

Full Changelog: nodejs/undici@v6.20.0...v6.20.1

v6.20.0

What's Changed

... (truncated)

Commits

Updates ws from 8.16.0 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

  • Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

  1. Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits
  • 3c56601 [dist] 8.17.1
  • e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
  • 6a00029 [test] Increase code coverage
  • ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
  • b73b118 [dist] 8.17.0
  • 29694a5 [test] Use the highWaterMark variable
  • 934c9d6 [ci] Test on node 22
  • 1817bac [ci] Do not test on node 21
  • 96c9b3d [major] Flip the default value of allowSynchronousEvents (#2221)
  • e5f32c7 [fix] Emit at most one event per event loop iteration (#2218)
  • Additional commits viewable in compare view

Updates vitest from 1.6.0 to 1.6.1

Release notes

Sourced from vitest's releases.

v1.6.1

This release includes security patches for:

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates hono from 4.5.8 to 4.6.5

Release notes

Sourced from hono's releases.

v4.6.5

Security fix for CSRF Protection Middleware

This release includes a security fix for CSRF Protection Middleware. If you are using CSRF Protection Middleware, please upgrade this hono package immediately.

Before this release, a request without a Content-Type header can bypass the protection. This fix does not allow it. See: GHSA-2234-fmw7-43wr

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.6.4...v4.6.5

v4.6.4

What's Changed

New Contributors

Full Changelog: honojs/hono@v4.6.3...v4.6.4

v4.6.3

This release has many new features, but each feature is small, so we've released it as a patch release.

What's Changed

... (truncated)

Commits

Updates cross-spawn from 7.0.3 to 7.0.6

Changelog

Sourced from cross-spawn's changelog.

7.0.6 (2024-11-18)

Bug Fixes

  • update cross-spawn version to 7.0.5 in package-lock.json (f700743)

7.0.5 (2024-11-07)

Bug Fixes

  • fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

Commits
  • 77cd97f chore(release): 7.0.6
  • 6717de4 chore: upgrade standard-version
  • f700743 fix: update cross-spawn version to 7.0.5 in package-lock.json
  • 9a7e3b2 chore: fix build status badge
  • 0852683 chore(release): 7.0.5
  • 640d391 fix: fix escaping bug introduced by backtracking
  • bff0c87 chore: remove codecov
  • a7c6abc chore: replace travis with github workflows
  • 9b9246e chore(release): 7.0.4
  • 5ff3a07 fix: disable regexp backtracking (#160)
  • Additional commits viewable in compare view

Updates rollup from 4.19.1 to 4.34.6

Release notes

Sourced from rollup's releases.

v4.34.6

4.34.6

2025-02-07

Bug Fixes

  • Retain "void 0" in the output for smaller output and fewer surprises (#5838)

Pull Requests

v4.34.5

4.34.5

2025-02-07

Bug Fixes

  • Ensure namespace reexports always include all properties of all exports (#5837)

Pull Requests

v4.34.4

4.34.4

2025-02-05

Bug Fixes

  • Do not tree-shake properties if a rest element is used in destructuring (#5833)

Pull Requests

v4.34.3

4.34.3

2025-02-05

Bug Fixes

  • Ensure properties of "this" are included in getters (#5831)

... (truncated)

Changelog

Sourced from rollup's changelog.

4.34.6

2025-02-07

Bug Fixes

  • Retain "void 0" in the output for smaller output and fewer surprises (#5838)

Pull Requests

4.34.5

2025-02-07

Bug Fixes

  • Ensure namespace reexports always include all properties of all exports (#5837)

Pull Requests

4.34.4

2025-02-05

Bug Fixes

  • Do not tree-shake properties if a rest element is used in destructuring (#5833)

Pull Requests

4.34.3

2025-02-05

Bug Fixes

  • Ensure properties of "this" are included in getters (#5831)

Pull Requests

... (truncated)

Commits

Updates vite from 5.3.5 to 5.4.14

Release notes

Sourced from vite's releases.

v5.4.14

Please refer to CHANGELOG.md for details.

v5.4.13

Please refer to CHANGELOG.md for details.

v5.4.12

This version contains a breaking change due to security fixes. See GHSA-vg6x-rcgg-rjx6 for more details.

Please refer to CHANGELOG.md for details.

v5.4.11

Please refer to CHANGELOG.md for details.

v5.4.10

Please refer to CHANGELOG.md for details.

v5.4.9

Please refer to CHANGELOG.md for details.

v5.4.8

Please refer to CHANGELOG.md for details.

v5.4.7

Please refer to CHANGELOG.md for details.

v5.4.6

Please refer to CHANGELOG.md for details.

v5.4.5

Please refer to CHANGELOG.md for details.

v5.4.4

Please refer to CHANGELOG.md for details.

v5.4.3

Please refer to CHANGELOG.md for details.

plugin-legacy@5.4.3

Please refer to CHANGELOG.md for details.

plugin-legacy@5.4.2

Please refer to CHANGELOG.md for details.

v5.4.2

Please refer to CHANGELOG.md for details.

plugin-legacy@5.4.1

Please refer to CHANGELOG.md for details.

... (truncated)

Changelog

Sourced from vite's changelog.

5.4.14 (2025-01-21)

5.4.13 (2025-01-20)

5.4.12 (2025-01-20)

  • fix!: check host header to prevent DNS rebinding attacks and introduce server.allowedHosts (9da4abc)
  • fix!: default server.cors: false to disallow fetching from untrusted origins (dfea38f)
  • fix: verify token for HMR WebSocket connection (b71a5c8)
  • chore: add deps update changelog (ecd2375)

5.4.11 (2024-11-11)

  • fix(deps): update dependencies of postcss-modules (ceb15db), closes #18617

5.4.10 (2024-10-23)

  • fix: backport #18367,augment hash for CSS files to prevent chromium erroring by loading previous fil (7d1a3bc), closes #18367 #18412

5.4.9 (2024-10-14)

5.4.8 (2024-09-25)

... (truncated)

Commits
  • e7eb3c5 release: v5.4.14
  • 7d1699c fix: allow CORS from loopback addresses by default (#19249)
  • 9df6e6b fix: preview.allowedHosts with specific values was not respected (#19246)
  • a1824c5 release: v5.4.13
  • 5946215 fix: try parse server.origin URL (#19241)
  • f428aa9 release: v5.4.12
  • 9da4abc fix!: check host header to prevent DNS rebinding attacks and introduce `serve...
  • b71a5c8 fix: verify token for HMR WebSocket connection
  • dfea38f fix!: default server.cors: false to disallow fetching from untrusted origins
  • ecd2375 chore: add deps update changelog
  • Additional commits viewable in compare view

Updates next from 15.0.1 to 15.1.2

Release notes

Sourced from next's releases.

v15.1.2

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Credits

Huge thanks to @​ztanner for helping!

v15.1.1

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Credits

Huge thanks to @​devjiwonchoi and @​ztanner for helping!

v15.1.1-canary.27

Core Changes

  • Update font data: #74572
  • Upgrade React from 3b009b4c-20250102 to 3ce77d55-20250106: #74557
  • [metadata] Change the array head to single node in flight data: #74299
  • [DevOverlay] Add Toolbar: #74555
  • restore deleted comment in next-app-loader: #74597
  • Turbopack dev: Remove client to server websocket ping event: #74584

Example Changes

  • chore(examples): update React in reproduction templates to stable 19: #74499

Misc Changes

  • chore(github): update issue_stale token to release bot token: #74575
  • chore(ci): Ensure all 6 shards are used equally in deploy tests: #74574
  • fix: force module format for virtual client-proxy file: #74162
  • [Turbopack] fix shadow-rs build caching: #74579

Credits

Huge thanks to @​samcx, @​nnnnoel, @​lubieowoce, @​huozhi, @​sokra, @​devjiwonchoi, and @​timneutkens for helping!

v15.1.1-canary.26

Core Changes

... (truncated)

Commits
  • df392a1 v15.1.2
  • 40c9424 Backport (v15): Update React from 7283a213-20241206 to 65e06cb7-20241218 (#74...
  • 4384c68 v15.1.1
  • d137863 run build_and_test workflow on backport branch
  • d27bb14 backport: fix(turbo): sassOptions silenceDeprecations was not overwritten wit...
  • 0c8187a Add NEXT_PRIVATE_SKIP_CANARY_CHECK env for bench job (#73763)
  • e83ab18 backport: refactor collectAppPageSegments (#73996)
  • ada25fc Designate as backport branch
  • dafcd43 v15.1.0
  • 2deb35d v15.0.4-canary.52
  • Additional commits viewable in compare view

Updates undici from 6.19.4 to 6.21.1

Release notes

Sourced from undici's releases.

v6.21.1

⚠️ Security Release ⚠️

Fixes CVE CVE-2025-22150 GHSA-c76h-2ccp-4975 (embargoed until 22-01-2025).

What's Changed

Full Changelog: nodejs/undici@v6.21.0...v6.21.1

v6.21.0

What's Changed

Full Changelog: nodejs/undici@v6.20.1...v6.21.0

v6.20.1

What's Changed

@dependabot
chore(deps): bump the npm_and_yarn group across 3 directories with 9 …
798e659 
…updates

Bumps the npm_and_yarn group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [nanoid](https://github.com/ai/nanoid) | `3.3.7` | `3.3.8` |
| [next](https://github.com/vercel/next.js) | `15.0.1` | `15.1.2` |
| [undici](https://github.com/nodejs/undici) | `6.19.4` | `6.21.1` |
| [ws](https://github.com/websockets/ws) | `8.16.0` | `8.17.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `1.6.0` | `1.6.1` |
| [hono](https://github.com/honojs/hono) | `4.5.8` | `4.6.5` |

Bumps the npm_and_yarn group with 5 updates in the /apps/dokploy directory:

| Package | From | To |
| --- | --- | --- |
| [next](https://github.com/vercel/next.js) | `15.0.1` | `15.1.2` |
| [undici](https://github.com/nodejs/undici) | `6.19.4` | `6.21.1` |
| [ws](https://github.com/websockets/ws) | `8.16.0` | `8.17.1` |
| [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `1.6.0` | `1.6.1` |
| [rollup](https://github.com/rollup/rollup) | `4.19.1` | `4.34.6` |

Bumps the npm_and_yarn group with 1 update in the /packages/server directory: [ws](https://github.com/websockets/ws).


Updates `nanoid` from 3.3.7 to 3.3.8
- [Release notes](https://github.com/ai/nanoid/releases)
- [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md)
- [Commits](ai/nanoid@3.3.7...3.3.8)

Updates `next` from 15.0.1 to 15.1.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.0.1...v15.1.2)

Updates `undici` from 6.19.4 to 6.21.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.19.4...v6.21.1)

Updates `ws` from 8.16.0 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.16.0...8.17.1)

Updates `vitest` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v1.6.1/packages/vitest)

Updates `hono` from 4.5.8 to 4.6.5
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.5.8...v4.6.5)

Updates `cross-spawn` from 7.0.3 to 7.0.6
- [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md)
- [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.6)

Updates `rollup` from 4.19.1 to 4.34.6
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.19.1...v4.34.6)

Updates `vite` from 5.3.5 to 5.4.14
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.14/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.14/packages/vite)

Updates `next` from 15.0.1 to 15.1.2
- [Release notes](https://github.com/vercel/next.js/releases)
- [Changelog](https://github.com/vercel/next.js/blob/canary/release.js)
- [Commits](vercel/next.js@v15.0.1...v15.1.2)

Updates `undici` from 6.19.4 to 6.21.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v6.19.4...v6.21.1)

Updates `ws` from 8.16.0 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.16.0...8.17.1)

Updates `vitest` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v1.6.1/packages/vitest)

Updates `rollup` from 4.19.1 to 4.34.6
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.19.1...v4.34.6)

Updates `vite` from 5.3.5 to 5.4.14
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v5.4.14/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v5.4.14/packages/vite)

Updates `ws` from 8.16.0 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@8.16.0...8.17.1)

---
updated-dependencies:
- dependency-name: nanoid
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: hono
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: cross-spawn
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: next
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: undici
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: vitest
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: vite
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-type: direct:production
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Feb 9, 2025
@dependabot dependabot bot mentioned this pull request Feb 9, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants