Skip to content

Bump the minor-and-patch group with 16 updates - #112

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-973a5a8b65
Closed

Bump the minor-and-patch group with 16 updates#112
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-973a5a8b65

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 18, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 16 updates:

Package From To
@sentry/node 8.13.0 8.18.0
ajv 8.12.0 8.17.1
axios 1.5.1 1.7.2
fastify 4.24.3 4.28.1
ioredis 5.3.2 5.4.1
prom-client 15.1.0 15.1.3
@babel/preset-typescript 7.23.2 7.24.7
@types/jest 29.5.6 29.5.12
@types/node 20.8.7 20.14.11
@types/yargs 17.0.29 17.0.32
dotenv 16.3.1 16.4.5
lint-staged 15.0.2 15.2.7
ts-jest 29.1.1 29.2.2
ts-loader 9.5.0 9.5.1
typescript 5.2.2 5.5.3
webpack 5.89.0 5.93.0

Updates @sentry/node from 8.13.0 to 8.18.0

Release notes

Sourced from @​sentry/node's releases.

8.18.0

Important Changes

  • ref: Deprecate enableTracing (12897)

The enableTracing option has been deprecated and will be removed in the next major version. We recommend removing it in favor of the tracesSampleRate and tracesSampler options. If you want to enable performance monitoring, please set the tracesSampleRate to a sample rate of your choice, or provide a sampling function as tracesSampler option instead. If you want to disable performance monitoring, remove the tracesSampler and tracesSampleRate options.

Other Changes

  • feat(node): Expose exclude and include options for ESM loader (#12910)
  • feat(browser): Add user agent to INP standalone span attributes (#12896)
  • feat(nextjs): Add experimental_captureRequestError for onRequestError hook (#12885)
  • feat(replay): Bump rrweb to 2.25.0 (#12478)
  • feat(tracing): Add long animation frame tracing (#12646)
  • fix: Cleanup hooks when they are not used anymore (#12852)
  • fix(angular): Guard ErrorEvent check in ErrorHandler to avoid throwing in Node environments (#12892)
  • fix(inp): Ensure INP spans have correct transaction (#12871)
  • fix(nestjs): Do not make SentryTraced() decorated functions async (#12879)
  • fix(nextjs): Support automatic instrumentation for app directory with custom page extensions (#12858)
  • fix(node): Ensure correct URL is passed to ignoreIncomingRequests callback (#12929)
  • fix(otel): Do not add otel.kind: INTERNAL attribute (#12841)
  • fix(solidstart): Set proper sentry origin for solid router integration when used in solidstart sdk (#12919)
  • fix(sveltekit): Add Vite peer dep for proper type resolution (#12926)
  • fix(tracing): Ensure you can pass null as parentSpan in startSpan* (#12928)
  • ref(core): Small bundle size improvement (#12830)

Work in this release was contributed by @​GitSquared, @​ziyadkhalil and @​mcous. Thank you for your contributions!

Bundle size 📦

Path Size
@​sentry/browser 22.3 KB
@​sentry/browser (incl. Tracing) 33.69 KB
@​sentry/browser (incl. Tracing, Replay) 69.77 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags 63.08 KB
@​sentry/browser (incl. Tracing, Replay with Canvas) 74.17 KB
@​sentry/browser (incl. Tracing, Replay, Feedback) 86.49 KB
@​sentry/browser (incl. Tracing, Replay, Feedback, metrics) 88.36 KB
@​sentry/browser (incl. metrics) 26.59 KB
@​sentry/browser (incl. Feedback) 38.98 KB
@​sentry/browser (incl. sendFeedback) 26.93 KB
@​sentry/browser (incl. FeedbackAsync) 31.54 KB
@​sentry/react 25.06 KB
@​sentry/react (incl. Tracing) 36.75 KB
@​sentry/vue 26.41 KB

... (truncated)

Changelog

Sourced from @​sentry/node's changelog.

8.18.0

Important Changes

  • ref: Deprecate enableTracing (12897)

The enableTracing option has been deprecated and will be removed in the next major version. We recommend removing it in favor of the tracesSampleRate and tracesSampler options. If you want to enable performance monitoring, please set the tracesSampleRate to a sample rate of your choice, or provide a sampling function as tracesSampler option instead. If you want to disable performance monitoring, remove the tracesSampler and tracesSampleRate options.

Other Changes

  • feat(node): Expose exclude and include options for ESM loader (#12910)
  • feat(browser): Add user agent to INP standalone span attributes (#12896)
  • feat(nextjs): Add experimental_captureRequestError for onRequestError hook (#12885)
  • feat(replay): Bump rrweb to 2.25.0 (#12478)
  • feat(tracing): Add long animation frame tracing (#12646)
  • fix: Cleanup hooks when they are not used anymore (#12852)
  • fix(angular): Guard ErrorEvent check in ErrorHandler to avoid throwing in Node environments (#12892)
  • fix(inp): Ensure INP spans have correct transaction (#12871)
  • fix(nestjs): Do not make SentryTraced() decorated functions async (#12879)
  • fix(nextjs): Support automatic instrumentation for app directory with custom page extensions (#12858)
  • fix(node): Ensure correct URL is passed to ignoreIncomingRequests callback (#12929)
  • fix(otel): Do not add otel.kind: INTERNAL attribute (#12841)
  • fix(solidstart): Set proper sentry origin for solid router integration when used in solidstart sdk (#12919)
  • fix(sveltekit): Add Vite peer dep for proper type resolution (#12926)
  • fix(tracing): Ensure you can pass null as parentSpan in startSpan* (#12928)
  • ref(core): Small bundle size improvement (#12830)

Work in this release was contributed by @​GitSquared, @​ziyadkhalil and @​mcous. Thank you for your contributions!

8.17.0

  • feat: Upgrade OTEL deps (#12809)
  • fix(nuxt): Add module to build:transpile script (#12843)
  • fix(browser): Allow SDK initialization in NW.js apps (#12846)

8.16.0

Important Changes

  • feat(nextjs): Use spans generated by Next.js for App Router (#12729)

Previously, the @sentry/nextjs SDK automatically recorded spans in the form of transactions for each of your top-level server components (pages, layouts, ...). This approach had a few drawbacks, the main ones being that traces didn't have a root span, and more importantly, if you had data stream to the client, its duration was not captured because the server component spans had finished before the data could finish streaming.

With this release, we will capture the duration of App Router requests in their entirety as a single transaction with

... (truncated)

Commits
  • c9ea6b8 release: 8.18.0
  • 9a25dad Merge pull request #12932 from getsentry/prepare-release/8.18.0
  • c57e363 meta: Update CHANGELOG for 8.18.0
  • 6f4c045 fix(node): Ensure correct URL is passed to ignoreIncomingRequests callback ...
  • 707afd6 fix(tracing): Ensure you can pass null as parentSpan in startSpan* (#12...
  • 475d66f fix(sveltekit): Add Vite peer dep for proper type resolution (#12926)
  • 9d1b35d feat(browser): Add user agent to INP standalone span attributes (#12896)
  • f9ab138 ci: Do not run external contributor job for bots (#12886)
  • 383743a fix(solidstart): Set proper sentry origin for solid router integration when u...
  • 1d3e208 feat: Expose exclude and include options for ESM loader (#12910)
  • Additional commits viewable in compare view

Updates ajv from 8.12.0 to 8.17.1

Release notes

Sourced from ajv's releases.

v8.17.1

What's Changed

Full Changelog: ajv-validator/ajv@v8.17.0...v8.17.1

Plus everything in 8.17.0 which failed to release

The only functional change is to switch from uri-js (which is no longer supported), to fast-uri. This is the second attempt and the team on fast-uri have been really helpful addressing the issues we found last time.

Revert "Revert fast-uri change (ajv-validator/ajv#2444)" by @​gurgunday in ajv-validator/ajv#2448 fix: ignore new eslint error for @​typescript-eslint/no-extraneous-class by @​jasoniangreen in ajv-validator/ajv#2455 docs: clarify behaviour of addVocabulary by @​jasoniangreen in ajv-validator/ajv#2454 docs: refactor to improve legibility by @​blottn in ajv-validator/ajv#2432 Fix grammatical typo in managing-schemas.md by @​wetneb in ajv-validator/ajv#2305 docs: Fix broken strict-mode link by @​alexanderjsx in ajv-validator/ajv#2459 feat: add test for encoded refs and bump fast-uri by @​jasoniangreen in ajv-validator/ajv#2449 fix: changes for @​typescript-eslint/array-type rule by @​jasoniangreen in ajv-validator/ajv#2467 fixes ajv-validator/ajv#2217 - clarify custom keyword naming by @​jasoniangreen in ajv-validator/ajv#2457

v8.17.0

What's Changed

The only functional change is to switch from uri-js (which is no longer supported), to fast-uri. This is the second attempt and the team on fast-uri have been really helpful addressing the issues we found last time.

New Contributors

Full Changelog: ajv-validator/ajv@v8.16.0...v8.17.0

v8.16.0

What's Changed

Full Changelog: ajv-validator/ajv@v8.15.0...v8.16.0

... (truncated)

Commits

Updates axios from 1.5.1 to 1.7.2

Release notes

Sourced from axios's releases.

Release v1.7.2

Release notes:

Bug Fixes

Contributors to this release

Release v1.7.1

Release notes:

Bug Fixes

  • fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#6410) (733f15f)

Contributors to this release

Release v1.7.0

Release notes:

Features

Bug Fixes

  • core/axios: handle un-writable error stack (#6362) (81e0455)

Contributors to this release

Release v1.7.0-beta.2

Release notes:

Bug Fixes

  • fetch: capitalize HTTP method names; (#6395) (ad3174a)
  • fetch: fix & optimize progress capturing for cases when the request data has a nullish value or zero data length (#6400) (95a3e8e)
  • fetch: fix headers getting from a stream response; (#6401) (870e0a7)

Contributors to this release

Release v1.7.0-beta.1

Release notes:

... (truncated)

Changelog

Sourced from axios's changelog.

1.7.2 (2024-05-21)

Bug Fixes

Contributors to this release

1.7.1 (2024-05-20)

Bug Fixes

  • fetch: fixed ReferenceError issue when TextEncoder is not available in the environment; (#6410) (733f15f)

Contributors to this release

1.7.0 (2024-05-19)

Features

Bug Fixes

  • core/axios: handle un-writable error stack (#6362) (81e0455)

Contributors to this release

1.7.0-beta.2 (2024-05-19)

Bug Fixes

  • fetch: capitalize HTTP method names; (#6395) (ad3174a)
  • fetch: fix & optimize progress capturing for cases when the request data has a nullish value or zero data length (#6400) (95a3e8e)
  • fetch: fix headers getting from a stream response; (#6401) (870e0a7)

Contributors to this release

... (truncated)

Commits
  • 0e4f9fa chore(release): v1.7.2 (#6414)
  • 4f79aef fix(fetch): enhance fetch API detection; (#6413)
  • 67d1373 chore(release): v1.7.1 (#6411)
  • 733f15f fix(fetch): fixed ReferenceError issue when TextEncoder is not available in t...
  • 3041c61 [Release] v1.7.0 (#6408)
  • 18b13cb chore(docs): add fetch adapter docs; (#6407)
  • e62099b fix(fetch): fixed a possible memory leak in the AbortController for the strea...
  • b49aa8e chore(release): v1.7.0-beta.2 (#6403)
  • d57f03a chore(ci): bump create-pull-request version to fix a bug; (#6405)
  • 097b0d1 chore(ci): add tag resolution for npm releases based on package version; (#6404)
  • Additional commits viewable in compare view

Updates fastify from 4.24.3 to 4.28.1

Release notes

Sourced from fastify's releases.

v4.28.1

What's Changed

Full Changelog: fastify/fastify@v4.28.0...v4.28.1

v4.28.0

What's Changed

Full Changelog: fastify/fastify@v4.27.0...v4.28.0

v4.27.0

What's Changed

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by eomm, a new releaser for fastify since your current version.


Updates ioredis from 5.3.2 to 5.4.1

Release notes

Sourced from ioredis's releases.

v5.4.1

5.4.1 (2024-04-17)

Bug Fixes

v5.4.0

5.4.0 (2024-04-16)

Bug Fixes

  • when refreshSlotsCache is called concurrently, call the callback only when the refresh process is done (#1881) (804ee07)

Features

Changelog

Sourced from ioredis's changelog.

5.4.1 (2024-04-17)

Bug Fixes

5.4.0 (2024-04-16)

Bug Fixes

  • when refreshSlotsCache is callback concurrently, call the callback only when the refresh process is done (#1881) (804ee07)

Features

Commits

Updates prom-client from 15.1.0 to 15.1.3

Release notes

Sourced from prom-client's releases.

v15.1.3

What's Changed

New Contributors

Full Changelog: prometheus/client_js@v15.1.2...v15.1.3

v15.1.2

What's Changed

New Contributors

Full Changelog: prometheus/client_js@v15.1.1...v15.1.2

v15.1.1

What's Changed

New Contributors

Full Changelog: prometheus/client_js@v15.1.0...v15.1.1

Changelog

Sourced from prom-client's changelog.

[15.1.3] - 2024-06-27

Changed

  • Improve error message when number of registered labels mismatch with the number of labels provided

[15.1.2] - 2024-04-16

Changed

  • Add Registry.PROMETHEUS_CONTENT_TYPE and Registry.OPENMETRICS_CONTENT_TYPE constants to the TypeScript types
  • Correctly read and set contentType top level export

Added

  • Enable bun.js by catching NotImplemented error (Fixes #570)

[15.1.1] - 2024-03-26

Changed

  • Improve the memory usage of histograms when the enableExemplars option is disabled
  • fix: Avoid updating exemplar values during subsequent metric changes (Fixes #616)
Commits

Updates @babel/preset-typescript from 7.23.2 to 7.24.7

Release notes

Sourced from @​babel/preset-typescript's releases.

v7.24.7 (2024-06-05)

🐛 Bug Fix

🏠 Internal

  • babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

Committers: 7

v7.24.6 (2024-05-24)

Thanks @​amjed-98, @​blakewilson, @​coelhucas, and @​SukkaW for your first PRs!

🐛 Bug Fix

  • babel-helper-create-class-features-plugin, babel-plugin-transform-class-properties
  • babel-core, babel-generator, babel-plugin-transform-modules-commonjs
  • babel-helper-create-class-features-plugin, babel-plugin-proposal-decorators
  • babel-helpers, babel-plugin-proposal-decorators, babel-runtime-corejs3
    • #16483 Fix: throw TypeError if addInitializer is called after finished (@​JLHwung)
  • babel-parser, babel-plugin-transform-typescript

🏠 Internal

  • babel-core, babel-helpers, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-helpers
  • babel-cli, babel-helpers, babel-plugin-external-helpers, babel-plugin-proposal-decorators, babel-plugin-transform-class-properties, babel-plugin-transform-modules-commonjs, babel-plugin-transform-modules-systemjs, babel-plugin-transform-runtime, babel-preset-env, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime
  • babel-parser, babel-traverse
  • Other

... (truncated)

Changelog

Sourced from @​babel/preset-typescript's changelog.

v7.24.7 (2024-06-05)

🐛 Bug Fix

@dependabot
Bump the minor-and-patch group with 16 updates
b48b82f 
Bumps the minor-and-patch group with 16 updates:

| Package | From | To |
| --- | --- | --- |
| [@sentry/node](https://github.com/getsentry/sentry-javascript) | `8.13.0` | `8.18.0` |
| [ajv](https://github.com/ajv-validator/ajv) | `8.12.0` | `8.17.1` |
| [axios](https://github.com/axios/axios) | `1.5.1` | `1.7.2` |
| [fastify](https://github.com/fastify/fastify) | `4.24.3` | `4.28.1` |
| [ioredis](https://github.com/luin/ioredis) | `5.3.2` | `5.4.1` |
| [prom-client](https://github.com/siimon/prom-client) | `15.1.0` | `15.1.3` |
| [@babel/preset-typescript](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-typescript) | `7.23.2` | `7.24.7` |
| [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest) | `29.5.6` | `29.5.12` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `20.8.7` | `20.14.11` |
| [@types/yargs](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/yargs) | `17.0.29` | `17.0.32` |
| [dotenv](https://github.com/motdotla/dotenv) | `16.3.1` | `16.4.5` |
| [lint-staged](https://github.com/okonet/lint-staged) | `15.0.2` | `15.2.7` |
| [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.1.1` | `29.2.2` |
| [ts-loader](https://github.com/TypeStrong/ts-loader) | `9.5.0` | `9.5.1` |
| [typescript](https://github.com/Microsoft/TypeScript) | `5.2.2` | `5.5.3` |
| [webpack](https://github.com/webpack/webpack) | `5.89.0` | `5.93.0` |


Updates `@sentry/node` from 8.13.0 to 8.18.0
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md)
- [Commits](getsentry/sentry-javascript@8.13.0...8.18.0)

Updates `ajv` from 8.12.0 to 8.17.1
- [Release notes](https://github.com/ajv-validator/ajv/releases)
- [Commits](ajv-validator/ajv@v8.12.0...v8.17.1)

Updates `axios` from 1.5.1 to 1.7.2
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](axios/axios@v1.5.1...v1.7.2)

Updates `fastify` from 4.24.3 to 4.28.1
- [Release notes](https://github.com/fastify/fastify/releases)
- [Commits](fastify/fastify@v4.24.3...v4.28.1)

Updates `ioredis` from 5.3.2 to 5.4.1
- [Release notes](https://github.com/luin/ioredis/releases)
- [Changelog](https://github.com/redis/ioredis/blob/main/CHANGELOG.md)
- [Commits](redis/ioredis@v5.3.2...v5.4.1)

Updates `prom-client` from 15.1.0 to 15.1.3
- [Release notes](https://github.com/siimon/prom-client/releases)
- [Changelog](https://github.com/siimon/prom-client/blob/master/CHANGELOG.md)
- [Commits](prometheus/client_js@v15.1.0...v15.1.3)

Updates `@babel/preset-typescript` from 7.23.2 to 7.24.7
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.24.7/packages/babel-preset-typescript)

Updates `@types/jest` from 29.5.6 to 29.5.12
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest)

Updates `@types/node` from 20.8.7 to 20.14.11
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/yargs` from 17.0.29 to 17.0.32
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/yargs)

Updates `dotenv` from 16.3.1 to 16.4.5
- [Changelog](https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md)
- [Commits](motdotla/dotenv@v16.3.1...v16.4.5)

Updates `lint-staged` from 15.0.2 to 15.2.7
- [Release notes](https://github.com/okonet/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/master/CHANGELOG.md)
- [Commits](lint-staged/lint-staged@v15.0.2...v15.2.7)

Updates `ts-jest` from 29.1.1 to 29.2.2
- [Release notes](https://github.com/kulshekhar/ts-jest/releases)
- [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md)
- [Commits](kulshekhar/ts-jest@v29.1.1...v29.2.2)

Updates `ts-loader` from 9.5.0 to 9.5.1
- [Release notes](https://github.com/TypeStrong/ts-loader/releases)
- [Changelog](https://github.com/TypeStrong/ts-loader/blob/main/CHANGELOG.md)
- [Commits](TypeStrong/ts-loader@v9.5.0...v9.5.1)

Updates `typescript` from 5.2.2 to 5.5.3
- [Release notes](https://github.com/Microsoft/TypeScript/releases)
- [Changelog](https://github.com/microsoft/TypeScript/blob/main/azure-pipelines.release.yml)
- [Commits](microsoft/TypeScript@v5.2.2...v5.5.3)

Updates `webpack` from 5.89.0 to 5.93.0
- [Release notes](https://github.com/webpack/webpack/releases)
- [Commits](webpack/webpack@v5.89.0...v5.93.0)

---
updated-dependencies:
- dependency-name: "@sentry/node"
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ajv
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: axios
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: fastify
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ioredis
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: prom-client
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@babel/preset-typescript"
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/jest"
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@types/node"
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/yargs"
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: dotenv
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: lint-staged
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ts-jest
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ts-loader
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: typescript
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: webpack
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 18, 2024
@socket-security

socket-security Bot commented Jul 18, 2024

Copy link
Copy Markdown

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@babel/helper-member-expression-to-functions@7.24.8 None 0 105 kB nicolo-ribaudo
npm/@babel/helper-plugin-utils@7.24.8 None 0 114 kB nicolo-ribaudo
npm/@babel/plugin-syntax-jsx@7.24.7 None 0 70 kB nicolo-ribaudo
npm/@babel/plugin-syntax-typescript@7.24.7 None 0 72.8 kB nicolo-ribaudo
npm/@babel/preset-typescript@7.24.7 None +7 1.16 MB nicolo-ribaudo
npm/@fastify/error@3.4.1 None 0 18.5 kB jsumners
npm/@sentry/node@8.18.0 environment, unsafe Transitive: network +37 10.7 MB sentry-bot
npm/@types/estree@1.0.5 None 0 25.7 kB types
npm/@types/jest@29.5.12 None 0 78.7 kB types
npm/@types/node@20.14.11 None +1 2.16 MB types
npm/@types/yargs@17.0.32 None +1 68.8 kB types
npm/@webassemblyjs/ast@1.12.1 None +5 431 kB xtuc
npm/@webassemblyjs/wasm-parser@1.12.1 None +7 391 kB xtuc
npm/ajv@8.17.1 eval Transitive: unsafe +3 1.17 MB esp
npm/debug@4.3.5 environment +1 49.3 kB qix
npm/dotenv@16.4.5 environment, filesystem 0 79.1 kB motdotla
npm/enhanced-resolve@5.17.0 unsafe 0 210 kB evilebottnawi
npm/fastify@4.28.1 Transitive: environment, eval, filesystem, unsafe +31 4.78 MB eomm
npm/ioredis@5.4.1 network +7 859 kB ioredis-robot
npm/lint-staged@15.2.7 Transitive: environment, filesystem, shell +33 1.81 MB okonet
npm/micromatch@4.0.7 None +4 150 kB paulmillr
npm/pino-abstract-transport@1.2.0 Transitive: environment +8 655 kB matteo.collina
npm/prom-client@15.1.3 filesystem, network, unsafe +2 2.56 MB simenb
npm/string-width@7.2.0 None +4 64.9 kB sindresorhus
npm/ts-jest@29.2.2 environment, filesystem, unsafe Transitive: eval, network, shell +51 3.86 MB kul
npm/ts-loader@9.5.1 filesystem Transitive: network +3 496 kB johnnyreilly
npm/typescript@5.5.3 None 0 21.9 MB typescript-bot
npm/webpack@5.93.0 environment, filesystem, network, unsafe Transitive: eval, shell +36 9.13 MB evilebottnawi

🚮 Removed packages: npm/@babel/helper-function-name@7.23.0, npm/@babel/helper-plugin-utils@7.22.5, npm/@babel/plugin-syntax-jsx@7.22.5, npm/@babel/plugin-syntax-typescript@7.22.5, npm/@babel/preset-typescript@7.23.2, npm/@sentry/node@8.13.0, npm/@types/estree@1.0.3, npm/@types/jest@29.5.6, npm/@types/koa@2.14.0, npm/@types/node@20.8.7, npm/@types/yargs@17.0.29, npm/@webassemblyjs/ast@1.11.6, npm/@webassemblyjs/wasm-parser@1.11.6, npm/ajv@8.12.0, npm/axios@1.5.1, npm/debug@4.3.4, npm/dotenv@16.3.1, npm/enhanced-resolve@5.15.0, npm/fastify@4.24.3, npm/follow-redirects@1.15.3, npm/ioredis@5.3.2, npm/lint-staged@15.0.2, npm/micromatch@4.0.5, npm/prom-client@15.1.0, npm/string-width@5.1.2, npm/ts-jest@29.1.1, npm/ts-loader@9.5.0, npm/typescript@5.2.2, npm/webpack@5.89.0, npm/wrap-ansi@8.1.0

View full report↗︎

@socket-security

socket-security Bot commented Jul 18, 2024

Copy link
Copy Markdown

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSourceCI
Filesystem access npm/filelist@1.0.4 🚫
Filesystem access npm/ejs@3.1.10 🚫
Filesystem access npm/jake@10.9.1 🚫
Debug access npm/enhanced-resolve@5.17.0 🚫
Filesystem access npm/lilconfig@3.1.2 🚫

View full report↗︎

Next steps

What is filesystem access?

Accesses the file system, and could potentially read sensitive data.

If a package must read the file system, clarify what it will read and ensure it reads only what it claims to. If appropriate, packages can leave file system access to consumers and operate on data passed to it instead.

What is debug access?

Uses debug, reflection and dynamic code execution features.

Removing the use of debug will reduce the risk of any reflection and dynamic code execution.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore npm/filelist@1.0.4
  • @SocketSecurity ignore npm/ejs@3.1.10
  • @SocketSecurity ignore npm/jake@10.9.1
  • @SocketSecurity ignore npm/enhanced-resolve@5.17.0
  • @SocketSecurity ignore npm/lilconfig@3.1.2

@dependabot @github

dependabot Bot commented on behalf of github Jul 18, 2024

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 18, 2024
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/minor-and-patch-973a5a8b65 branch July 18, 2024 21:44
@piyalbasu piyalbasu mentioned this pull request Jun 24, 2026
Open
piyalbasu added a commit that referenced this pull request Jul 8, 2026
@piyalbasu @claude
refactor(onramp-auth): generalize to reusable address-proof; carry pr…
9bc1194 
…oof in body; 5s skew

Addresses Jake's design-doc review on #316:

- Generalize the src/auth primitive from onramp-specific to a reusable
  "address proof": verifyAddressProof, ADDRESS_PROOF_DOMAIN
  ("freighter:address-proof:v1"), reasons, and result type. The domain tag
  is named generically on purpose — it lives in the signed bytes, so a later
  rename would be a wire-breaking v2. Onramp is now the first consumer; the
  rollout policy (onrampAuthPreHandler, ONRAMP_AUTH_MODE, the onramp metric)
  stays onramp-scoped.
- Move the proof out of the Authorization header into the `address_proof`
  POST-body field, so it composes with v2's JWT (which occupies Authorization)
  and v2 needs no second auth scheme. body_hash now covers the business body
  with the proof field removed (sign-everything-but-the-signature).
- Bump clock skew 2s -> 5s to match freighter-backend-v2 #112 (ClockSkewLeeway).

tsc clean; jest green (auth + route + config suites).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants