Bump the npm_and_yarn group across 1 directory with 13 updates #136

dependabot · 2024-06-18T12:16:44Z

Bumps the npm_and_yarn group with 13 updates in the / directory:

Package	From	To
express	`4.18.2`	`4.19.2`
firebase-tools	`12.9.1`	`13.6.0`
@grpc/grpc-js	`1.8.21`	`1.8.22`
braces	`3.0.2`	`3.0.3`
browserify-sign	`4.2.1`	`4.2.3`
ws	`7.4.6`	`7.5.10`
protobufjs	`7.2.4`	`7.2.5`
firebase-admin	`11.11.1`	`12.1.1`
jose	`4.15.3`	`4.15.7`
jsrsasign	`10.5.26`	`removed`
@simplewebauthn/server	`6.3.0-alpha.1`	`10.0.0`
undici	`5.26.5`	`5.28.4`
firebase	`10.7.1`	`10.12.2`

Updates express from 4.18.2 to 4.19.2

Release notes

Sourced from express's releases.

4.19.2

What's Changed

Improved fix for open redirect allow list bypass

Full Changelog: expressjs/express@4.19.1...4.19.2

4.19.1

What's Changed

Fix ci after location patch by @wesleytodd in expressjs/express#5552

fixed un-edited version in history.md for 4.19.0 by @wesleytodd in expressjs/express#5556

Full Changelog: expressjs/express@4.19.0...4.19.1

4.19.0

What's Changed

fix typo in release date by @UlisesGascon in expressjs/express#5527

docs: nominating @wesleytodd to be project captian by @wesleytodd in expressjs/express#5511

docs: loosen TC activity rules by @wesleytodd in expressjs/express#5510

Add note on how to update docs for new release by @crandmck in expressjs/express#5541

Prevent open redirect allow list bypass due to encodeurl

Release 4.19.0 by @wesleytodd in expressjs/express#5551

New Contributors

@crandmck made their first contribution in expressjs/express#5541

Full Changelog: expressjs/express@4.18.3...4.19.0

4.18.3

Main Changes

Fix routing requests without method

deps: [email protected]

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: [email protected]

Other Changes

Use https: protocol instead of deprecated git: protocol by @vcsjones in expressjs/express#5032

build: [email protected] and [email protected] by @abenhamdine in expressjs/express#5034

ci: update actions/checkout to v3 by @armujahid in expressjs/express#5027

test: remove unused function arguments in params by @raksbisht in expressjs/express#5124

Remove unused originalIndex from acceptParams by @raksbisht in expressjs/express#5119

Fixed typos by @raksbisht in expressjs/express#5117

examples: remove unused params by @raksbisht in expressjs/express#5113

fix: parameter str is not described in JSDoc by @raksbisht in expressjs/express#5130

fix: typos in History.md by @raksbisht in expressjs/express#5131

build : add [email protected] by @abenhamdine in expressjs/express#5028

test: remove unused function arguments in params by @raksbisht in expressjs/express#5137

... (truncated)

Changelog

Sourced from express's changelog.

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

Prevent open redirect allow list bypass due to encodeurl

deps: [email protected]

4.18.3 / 2024-02-29

Fix routing requests without method

deps: [email protected]

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: [email protected]

deps: [email protected]

Add partitioned option

Commits

04bc627 4.19.2
da4d763 Improved fix for open redirect allow list bypass
4f0f6cc 4.19.1
a003cfa Allow passing non-strings to res.location with new encoding handling checks f...
a1fa90f fixed un-edited version in history.md for 4.19.0
11f2b1d build: fix build due to inconsistent supertest behavior in older versions
084e365 4.19.0
0867302 Prevent open redirect allow list bypass due to encodeurl
567c9c6 Add note on how to update docs for new release (#5541)
69a4cf2 deps: [email protected]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.

Updates firebase-tools from 12.9.1 to 13.6.0

Release notes

Sourced from firebase-tools's releases.

v13.6.0

Released Firestore Emulator 1.19.4. This version fixes a minor bug with reserve ids and adds a reset endpoint for Datastore Mode.

Released PubSub Emulator 0.8.2. This version includes support for no_wrapper options.

Fixes issue where GitHub actions service account cannot add preview URLs to Auth authorized domains. (#6895)

Fixes issue where GOOGLE_CLOUD_QUOTA_PROJECT breaks functions source uploads (#6917)

v13.5.2

Fix hosting rewrite deployment bug for skipped functions (#6658).

v13.5.1

Release Emulator Suite UI v1.11.8 which adds support for Multiple DBs in the Emulator UI Firestore page via editing the URL. (#6874)

v13.5.0

Enable dynamic debugger port for functions + support for inspecting multiple codebases (#6854)

Inject an environment variable in the node functions emulator to tell the google-gax SDK not to look for the metadata service. (#6860)

Release Firestore Emulator 1.19.3 which fixes ancestor and namespace scope queries for Datastore Mode. This release also fixes internal errors seen across REST API and firebase-js-sdk.

v2 scheduled functions with explicit service accounts trigger eventarc to use that service account (#6858)

v2 event functions with explicit service accounts trigger eventarc to use that service account (#6859)

v13.4.1

Released Firestore emulator v1.19.2, which fixes some bugs affecting client SDKs when in Datastore Mode.

Fix demo projects + web frameworks with emulators (#6737)

Fix Next.js static routes with server actions (#6664)

Fixed an issue where GOOGLE_CLOUD_QUOTA_PROJECT was not correctly respected. (#6801)

Make VPC egress settings in functions parameterizeable (#6843)

v13.4.0

Added new commands for managing Firestore backups and restoring databases. (#6778)

Fixed quota attribution for Firebase Auth API calls. (#6819)

v13.3.1

Release Cloud Firestore emulator v1.19.1:

Adds support for Datastore Mode to the Firstore Emulator. Adds --database-mode flag to gcloud emulator firestore start command. Note that this is a preview feature and if you find any bugs, please file them here: https://github.com/firebase/firebase-tools/issues.

Improve FAH onboarding flow to connect backends with SCMs (#6764).

Fixed issue where GitHub actions would fail due to lack of permission. (#6791)

v13.3.0

Improved detection for when login has expired due to Google Cloud Session Control. (#1846)

Added support for Python 3.12. (#6679)

Fixed issues with internal utilities. (#6754)

Fixed an issue where firestore:delete wouldn't target the emulator when expected. (#6537)

v13.2.1

Fixed an issue where appdistribution:distribute would always attempt to run tests. (#6749)

v13.2.0

Added rudimentary email enumeration protection for auth emulator. (#6702)

... (truncated)

Commits

f6b7d05 13.6.0
a26c3d0 Ignore quota project in GCF source uploads (#6917)
476bd33 Update to PubSub emulator 0.8.2 (#6916)
ccab9b7 Add Service Usage Consumer role to GitHub Actions service account (#6895)
4c1bd42 Switching a few more places to getters (#6914)
6950829 Fix "could not assert Secret Manager permissions" Cloud Build error (#6904)
4a17ca7 Refactor api.ts file constants to getters (#6913)
c6d1615 Update Firestore Emulator version (#6912)
90b6506 Vector config support (#6900)
dc13cb9 make fetchLinkableGitRepositories get all linkable git repositories (#6889)
Additional commits viewable in compare view

Updates @grpc/grpc-js from 1.8.21 to 1.8.22

Release notes

Sourced from @grpc/grpc-js's releases.

@grpc/grpc-js 1.8.22

Avoid buffering significantly more than grpc.max_receive_message_size per received message.

Commits

a8a0203 Merge pull request from GHSA-7v5v-9h63-cj86
3b110cd grpc-js: Bump to 1.8.22
8e62222 grpc-js: Avoid buffering significantly more than max_receive_message_size per...
9d83947 Merge pull request #2742 from sergiitk/backport-1.8-psm-interop-common-prod-t...
00f348c Merge pull request #2729 from sergiitk/psm-interop-common-prod-tests
36d105b Merge pull request #2737 from murgatroid99/backport-1.8-grpc-js_linkify-it_fix
969e305 Merge pull request #2735 from murgatroid99/grpc-js_linkify-it_fix
d78216f Merge pull request #2715 from sergiitk/backport-1.8-psm-interop-pkg-dev
f38966a Merge pull request #2712 from sergiitk/psm-interop-pkg-dev
ffefff2 Merge pull request #2640 from XuanWang-Amos/backport-1.8-psm-interop-shared-b...
Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates browserify-sign from 4.2.1 to 4.2.3

Changelog

Sourced from browserify-sign's changelog.

v4.2.3 - 2024-03-05

Commits

[patch] widen support to 0.12 9247adf

[patch] drop minimum node support to v1 4d0ee49

[Dev Deps] update aud, npmignore, tape 87f3a35

[actions] remove redundant finisher 37a4758

[Deps] pin hash-base to ~3.0, due to a breaking change 9e2bf12

[Deps] update parse-asn1 [f427270`](browserify/browserify-sign@f427270)

[Deps] update elliptic fb261ce

[Deps] pin elliptic due to a breaking change 168e16f

v4.2.2 - 2023-10-25

Fixed

[Tests] log when openssl doesn't support cipher [#37](https://github.com/crypto-browserify/browserify-sign/issues/37)

Commits

Only apps should have lockfiles 09a8995

[eslint] switch to eslint 83fe463

[meta] add npmignore and auto-changelog 4418183

[meta] fix package.json indentation 9ac5a5e

[Tests] migrate from travis to github actions d845d85

[Fix] sign: throw on unsupported padding scheme 8767739

[Fix] properly check the upper bound for DSA signatures 85994cd

[Tests] handle openSSL not supporting a scheme f5f17c2

[Deps] update bn.js, browserify-rsa, elliptic, parse-asn1, readable-stream, safe-buffer a67d0eb

[Dev Deps] update nyc, standard, tape cc5350b

[Tests] always run coverage; downgrade nyc 75ce1d5

[meta] add safe-publish-latest dcf49ce

[Tests] add npm run posttest 75dd8fd

[Dev Deps] update tape 3aec038

[Tests] skip unsupported schemes 703c83e

[Tests] node < 6 lacks array includes 3aa43cf

[Dev Deps] fix eslint range 98d4e0d

Commits

bf2c3ec v4.2.3
9247adf [patch] widen support to 0.12
f427270 [Deps] update `parse-asn1
87f3a35 [Dev Deps] update aud, npmignore, tape
fb261ce [Deps] update elliptic
4d0ee49 [patch] drop minimum node support to v1
9e2bf12 [Deps] pin hash-base to ~3.0, due to a breaking change
168e16f [Deps] pin elliptic due to a breaking change
37a4758 [actions] remove redundant finisher
4af5a90 v4.2.2
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by ljharb, a new releaser for browserify-sign since your current version.

Updates ws from 7.4.6 to 7.5.10

Release notes

Sourced from ws's releases.

7.5.10

Bug fixes

Backported e55e5106 to the 7.x release line (22c28763).

7.5.9

Bug fixes

Backported bc8bd34e to the 7.x release line (0435e6e1).

7.5.8

Bug fixes

Backported 0fdcc0af to the 7.x release line (2758ed35).

Backported d68ba9e1 to the 7.x release line (dc1781bc).

7.5.7

Bug fixes

Backported 6946f5fe to the 7.x release line (1f72e2e1).

7.5.6

Bug fixes

Backported b8186dd1 to the 7.x release line (73dec34b).

Backported ed2b8039 to the 7.x release line (22a26afb).

7.5.5

Bug fixes

Backported ec9377ca to the 7.x release line (0e274acd).

7.5.4

Bug fixes

Backported 6a72da3e to the 7.x release line (76087fbf).

Backported 869c9892 to the 7.x release line (27997933).

7.5.3

Bug fixes

The WebSocketServer constructor now throws an error if more than one of the noServer, server, and port options are specefied (66e58d27).

Fixed a bug where a 'close' event was emitted by a WebSocketServer before the internal HTTP/S server was actually closed (5a587304).

Fixed a bug that allowed WebSocket connections to be established after WebSocketServer.prototype.close() was called (772236a1).

7.5.2

Bug fixes

... (truncated)

Commits

d962d70 [dist] 7.5.10
22c2876 [security] Fix crash when the Upgrade header cannot be read (#2231)
8a78f87 [dist] 7.5.9
0435e6e [security] Fix same host check for ws+unix: redirects
4271f07 [dist] 7.5.8
dc1781b [security] Drop sensitive headers when following insecure redirects
2758ed3 [fix] Abort the handshake if the Upgrade header is invalid
a370613 [dist] 7.5.7
1f72e2e [security] Drop sensitive headers when following redirects (#2013)
8ecd890 [dist] 7.5.6
Additional commits viewable in compare view

Updates protobufjs from 7.2.4 to 7.2.5

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.2.5

7.2.5 (2023-08-21)

Bug Fixes

crash in comment parsing (#1890) (eaf9f0a)

deprecation warning for new Buffer (#1905) (e93286e)

possible infinite loop when parsing option (#1923) (f2a8620)

Changelog

Sourced from protobufjs's changelog.

7.2.5 (2023-08-21)

Bug Fixes

crash in comment parsing (#1890) (eaf9f0a)

deprecation warning for new Buffer (#1905) (e93286e)

possible infinite loop when parsing option (#1923) (f2a8620)

Commits

4436cc7 chore: release master (#1925)
e93286e fix: deprecation warning for new Buffer (#1905)
eaf9f0a fix: crash in comment parsing (#1890)
f2a8620 fix: possible infinite loop when parsing option (#1923)
See full diff in compare view

Updates firebase-admin from 11.11.1 to 12.1.1

Release notes

Sourced from firebase-admin's releases.

Firebase Admin Node.js SDK v12.1.1

Bug Fixes

fix: Export error classes (#2151)

Miscellaneous

[chore] Release 12.1.1 (#2561)

build(deps): updgrade jwks-rsa (#2570)

--- (#2568)

--- (#2566)

--- (#2567)

--- (#2569)

build(deps-dev): bump @firebase/auth-types from 0.12.1 to 0.12.2 (#2556)

build(deps-dev): bump @microsoft/api-extractor from 7.43.2 to 7.43.7 (#2559)

chore: upgrade firestore to 7.7.0 (#2560)

build(deps-dev): bump @firebase/app-compat from 0.2.32 to 0.2.33 (#2555)

build(deps): bump @google-cloud/firestore from 7.6.0 to 7.7.0 (#2558)

Fix api extractor issues to expose error types (#2549)

build(deps-dev): bump @types/lodash from 4.17.0 to 4.17.1 (#2546)

build(deps): bump @google-cloud/storage from 7.10.2 to 7.11.0 (#2547)

build(deps-dev): bump @microsoft/api-extractor from 7.43.1 to 7.43.2 (#2545)

build(deps): bump @types/node from 20.12.7 to 20.12.10 (#2544)

build(deps-dev): bump @firebase/app-compat from 0.2.31 to 0.2.32 (#2540)

build(deps): bump @google-cloud/storage from 7.10.1 to 7.10.2 (#2541)

build(deps): bump @google-cloud/storage from 7.10.0 to 7.10.1 (#2536)

Update package.json to use farmhash 3.3.1 (#2534)

Firebase Admin Node.js SDK v12.1.0

New Features

feat(rc): Add server side Remote Config support (#2529)

Miscellaneous

[chore] Release 12.1.0 (#2532)

Fix minor typo (#2533)

chore: Excluding certain event_types from processing uid (#2370)

build(deps-dev): bump gulp from 4.0.2 to 5.0.0 (#2526)

build(deps-dev): bump @firebase/app-compat from 0.2.29 to 0.2.30 (#2527)

build(deps): bump @google-cloud/firestore from 7.5.0 to 7.6.0 (#2528)

build(deps): bump undici in /.github/actions/send-email (#2521)

build(deps-dev): bump @firebase/auth-types from 0.12.0 to 0.12.1 (#2514)

build(deps-dev): bump mocha from 10.3.0 to 10.4.0 (#2513)

build(deps): bump @types/node from 20.11.30 to 20.12.2 (#2516)

build(deps): bump @google-cloud/firestore from 7.4.0 to 7.5.0 (#2517)

build(deps-dev): bump @firebase/app-compat from 0.2.28 to 0.2.29 (#2510)

build(deps): bump @google-cloud/storage from 7.7.0 to 7.9.0 (#2509)

... (truncated)

Commits

e2515f2 [chore] Release 12.1.1 (#2561)
4d4fd39 build(deps): updgrade jwks-rsa (#2570)
1754b7e --- (#2568)
72f0169 --- (#2566)
8f622cf --- (#2567)
f8f8eb9 --- (#2569)
ee78c87 build(deps-dev): bump @firebase/auth-types from 0.12.1 to 0.12.2 (#2556)
f837c23 build(deps-dev): bump @microsoft/api-extractor from 7.43.2 to 7.43.7 (#2559)
41aea3a chore: upgrade firestore to 7.7.0 (#2560)
26cd8b0 build(deps-dev): bump @firebase/app-compat from 0.2.32 to 0.2.33 (#2555)
Additional commits viewable in compare view

Updates jose from 4.15.3 to 4.15.7

Release notes

Sourced from jose's releases.

v4.15.7

Fixes

add a workerd package.json target (e36d69e)

v4.15.5

Fixes

add a maxOutputLength option to zlib inflate (1b91d88), fixes CVE-2024-28176

v4.15.4

Fixes

types: export GetKeyFunction (#592) (936c9df), closes #591

Changelog

Sourced from jose's changelog.

4.15.7 (2024-06-18)

4.15.6 (2024-06-18)

Fixes

add a workerd package.json target (e36d69e)

4.15.5 (2024-03-07)

Fixes

add a maxOutputLength option to zlib inflate (1b91d88)

4.15.4 (2023-10-14)

Fixes

types: export GetKeyFunction (#592) (936c9df), closes #591

Commits

5084808 chore(release): 4.15.7
122c939 chore(release): 4.15.6
e36d69e fix: add a workerd package.json target
765aafd chore(release): 4.15.5
b36e45e test: add export check to x509 pem import tests
e839ecb test: stop testing JWE RSA1_5 Algorithm
1b91d88 fix: add a maxOutputLength option to zlib inflate
9ca2b24 build: remove release action
f3035d8 chore: cleanup after release
f0bb220 chore(release): 4.15.4
Additional commits viewable in compare view

Removes jsrsasign

Updates @simplewebauthn/server from 6.3.0-alpha.1 to 10.0.0

Release notes

Sourced from @simplewebauthn/server's releases.

v10.0.0 - The one that goes up to 20

Thanks for everything, Node 16 and Node 18, but it's time to move on! The headlining change of this release is the targeting of Node LTS v20+ as the minimum Node runtime. Additional developer-centric quality-of-life changes have also been made in the name of streamlining use of SimpleWebAuthn on both the back end and front end.

This release is packed with updates, so buckle up! Refactor advice for breaking changes is, as always, offered below.

Packages

@simplewebauthn/browser@10.0.0

@simplewebauthn/server@10.0.0

@simplewebauthn/types@10.0.0

Changes

[server] The minimum supported Node version has been raised to Node v20 (#531)

[server] user.displayName now defaults to an empty string if a value is not specified for userDisplayName when calling generateRegistrationOptions() (#538)

[browser] The browserSupportsWebAuthnAutofill() helper will no longer break in environments in which PublicKeyCredential is not present (#557, with thanks to @clarafitzgerald)

Breaking Changes

[server] The following breaking changes were made in PR #529:

generateRegistrationOptions() now expects Base64URLString for excluded credential IDs

generateAuthenticationOptions() now expects Base64URLString for allowed credential IDs

credentialID returned from response verification methods is now a Base64URLString

AuthenticatorDevice.credentialID is now a Base64URLString

isoBase64URL.isBase64url() is now called isoBase64URL.isBase64URL()

[browser, server] The following breaking changes were made in PR #552:

generateRegistrationOptions() now accepts an optional Uint8Array instead of a string for userID

isoBase64URL.toString() and isoBase64URL.fromString() have been renamed

generateRegistrationOptions() will now generate random user IDs

user.id is now treated like a base64url string in startRegistration()

userHandle is now treated like a base64url string in startAuthentication()

[server] rpID is now a required argument when calling generateAuthenticationOptions() (#555)

[server] generateRegistrationOptions() now expects Base64URLString for excluded credential IDs

... (truncated)

Changelog

Sourced from @simplewebauthn/server's changelog.

v10.0.0 - The one that goes up to 20

Thanks for everything, Node 16 and Node 18, but it's time to move on! The headlining change of this release is the targeting of Node LTS v20+ as the minimum Node runtime. Additional developer-centric quality-of-life changes have also been made in the name of streamlining use of SimpleWebAuthn on both the back end and front end.

This release is packed with updates, so buckle up! Refactor advice for breaking changes is, as always, offered below.

Packages

@simplewebauthn/browser@10.0.0

@simplewebauthn/server@10.0.0

@simplewebauthn/types@10.0.0

Changes

[server] The minimum supported Node version has been raised to Node v20 (#531)

[server] user.displayName now defaults to an empty string if a value is not specified for userDisplayName when calling generateRegistrationOptions() (#538)

[browser] The browserSupportsWebAuthnAutofill() helper will no longer break in environments in which PublicKeyCredential is not present (#557, with thanks to @clarafitzgerald)

Breaking Changes

[server] The following breaking changes were made in PR #529:

generateRegistrationOptions() now expects Base64URLString for excluded credential IDs

generateAuthenticationOptions() now expects Base64URLString for allowed credential IDs

credentialID returned from response verification methods is now a Base64URLString

AuthenticatorDevice.credentialID is now a Base64URLString

isoBase64URL.isBase64url() is now called isoBase64URL.isBase64URL()

[browser, server] The following breaking changes were made in PR #552:

generateRegistrationOptions() now accepts an optional Uint8Array instead of a string for userID

isoBase64URL.toString() and isoBase64URL.fromString() have been renamed

generateRegistrationOptions() will now generate random user IDs

user.id is now treated like a base64url string in startRegistration()

userHandle is now treated like a base64url string in startAuthentication()

[server] rpID is now a required argument when calling generateAuthenticationOptions() (#555)

[server] generateRegistrationOptions() now expects Base64URLString for excluded credential IDs

... (truncated)

Commits

81d9e49 chore(release): publish v10.0.0
7a86e80 Modernize server method docstrings
eb1988a Require rpID arg when generating auth options
b316c3f Update uses of base64url string methods
84a2ea5 Clarify string encoding on isoBase64URL methods
a95489e Remove trailing close parenthesis
d470a1c Explicitly disallow string userIDs
9ebd9ec Update generateRegistrationOptions tests
4c3f693 Generate user IDs by default
b1b6d33 Add method to generate user IDs
Additional commits viewable in compare view

Updates undici from 5.26.5 to 5.28.4

Release notes

Sourced from undici's releases.

v5.28.4

⚠️ Security Release ⚠️

Fixes GHSA-m4v8-wqvr-p9f7 CVE-2024-30260

Fixes GHSA-9qxr-qj54-h672 CVE-2024-30261

Full Changelog: nodejs/undici@v5.28.3...v5.28.4

v5.28.3

⚠️ Security Release ⚠️

Fixes:

CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch

Full Changelog: nodejs/undici@v5.28.2...v5.28.3

v5.28.2

What's Changed

fix: remove optional chainning for compatible with Nodejs12 and below by @bugb in nodejs/undici#2470

fix: remove node: prefix by @tsctx in nodejs/undici#2471

perf: avoid Headers initialization by @tsctx in nodejs/undici#2468

fix: handle SharedArrayBuffer correctly by @tsctx in nodejs/undici#2466

fix: Add null type to signal in RequestInit by @gebsh in nodejs/undici#2455

fix: correctly handle data URL with hashes. by @tsctx in nodejs/undici#2475

fix: check response for timinginfo allow flag by @ToshB in nodejs/undici#2477

Make call to onBodySent conditional in RetryHandler by @MzUgM in nodejs/undici#2478

refactor: better integrity check by @tsctx in nodejs/undici#2462

fix: Added support for inline URL username:password proxy auth by @matt-way in nodejs/undici#2473

build(deps-dev): bump jsdom from 22.1.0 to 23.0.0 by @dependabot in nodejs/undici#2472

build(deps-dev): bump sinon from 16.1.3 to 17.0.1 by @dependabot in nodejs/undici#2405

build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 by @dependabot in nodejs/undici#2396

build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 by @dependabot in nodejs/undici#2395

build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 by

Bumps the npm_and_yarn group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [express](https://github.com/expressjs/express) | `4.18.2` | `4.19.2` | | [firebase-tools](https://github.com/firebase/firebase-tools) | `12.9.1` | `13.6.0` | | [@grpc/grpc-js](https://github.com/grpc/grpc-node) | `1.8.21` | `1.8.22` | | [braces](https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [browserify-sign](https://github.com/crypto-browserify/browserify-sign) | `4.2.1` | `4.2.3` | | [ws](https://github.com/websockets/ws) | `7.4.6` | `7.5.10` | | [protobufjs](https://github.com/protobufjs/protobuf.js) | `7.2.4` | `7.2.5` | | [firebase-admin](https://github.com/firebase/firebase-admin-node) | `11.11.1` | `12.1.1` | | [jose](https://github.com/panva/jose) | `4.15.3` | `4.15.7` | | [jsrsasign](https://github.com/kjur/jsrsasign) | `10.5.26` | `removed` | | [@simplewebauthn/server](https://github.com/MasterKale/SimpleWebAuthn/tree/HEAD/packages/server) | `6.3.0-alpha.1` | `10.0.0` | | [undici](https://github.com/nodejs/undici) | `5.26.5` | `5.28.4` | | [firebase](https://github.com/firebase/firebase-js-sdk) | `10.7.1` | `10.12.2` | Updates `express` from 4.18.2 to 4.19.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.18.2...4.19.2) Updates `firebase-tools` from 12.9.1 to 13.6.0 - [Release notes](https://github.com/firebase/firebase-tools/releases) - [Changelog](https://github.com/firebase/firebase-tools/blob/master/CHANGELOG.md) - [Commits](firebase/firebase-tools@v12.9.1...v13.6.0) Updates `@grpc/grpc-js` from 1.8.21 to 1.8.22 - [Release notes](https://github.com/grpc/grpc-node/releases) - [Commits](https://github.com/grpc/grpc-node/compare/@grpc/[email protected]...@grpc/[email protected]) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `browserify-sign` from 4.2.1 to 4.2.3 - [Changelog](https://github.com/browserify/browserify-sign/blob/main/CHANGELOG.md) - [Commits](browserify/browserify-sign@v4.2.1...v4.2.3) Updates `ws` from 7.4.6 to 7.5.10 - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.4.6...7.5.10) Updates `protobufjs` from 7.2.4 to 7.2.5 - [Release notes](https://github.com/protobufjs/protobuf.js/releases) - [Changelog](https://github.com/protobufjs/protobuf.js/blob/master/CHANGELOG.md) - [Commits](protobufjs/protobuf.js@protobufjs-v7.2.4...protobufjs-v7.2.5) Updates `firebase-admin` from 11.11.1 to 12.1.1 - [Release notes](https://github.com/firebase/firebase-admin-node/releases) - [Commits](firebase/firebase-admin-node@v11.11.1...v12.1.1) Updates `jose` from 4.15.3 to 4.15.7 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/v4.15.7/CHANGELOG.md) - [Commits](panva/jose@v4.15.3...v4.15.7) Removes `jsrsasign` Updates `@simplewebauthn/server` from 6.3.0-alpha.1 to 10.0.0 - [Release notes](https://github.com/MasterKale/SimpleWebAuthn/releases) - [Changelog](https://github.com/MasterKale/SimpleWebAuthn/blob/master/CHANGELOG.md) - [Commits](https://github.com/MasterKale/SimpleWebAuthn/commits/v10.0.0/packages/server) Updates `undici` from 5.26.5 to 5.28.4 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.26.5...v5.28.4) Updates `firebase` from 10.7.1 to 10.12.2 - [Release notes](https://github.com/firebase/firebase-js-sdk/releases) - [Changelog](https://github.com/firebase/firebase-js-sdk/blob/master/CHANGELOG.md) - [Commits](https://github.com/firebase/firebase-js-sdk/compare/[email protected]@10.12.2) --- updated-dependencies: - dependency-name: express dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: firebase-tools dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@grpc/grpc-js" dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: braces dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: browserify-sign dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: protobufjs dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: firebase-admin dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: jose dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: jsrsasign dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@simplewebauthn/server" dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: undici dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: firebase dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jun 18, 2024

dependabot bot mentioned this pull request Jun 18, 2024

Bump the npm_and_yarn group across 1 directory with 12 updates #135

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the npm_and_yarn group across 1 directory with 13 updates #136

Bump the npm_and_yarn group across 1 directory with 13 updates #136

Uh oh!

dependabot bot commented on behalf of github Jun 18, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the npm_and_yarn group across 1 directory with 13 updates #136

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 13 updates #136

Uh oh!

Conversation

dependabot bot commented on behalf of github Jun 18, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

4.19.2

What's Changed

4.19.1

What's Changed

4.19.0

What's Changed

New Contributors

4.18.3

Main Changes

Other Changes

4.19.2 / 2024-03-25

4.19.1 / 2024-03-20

4.19.0 / 2024-03-20

4.18.3 / 2024-02-29

v13.6.0

v13.5.2

v13.5.1

v13.5.0

v13.4.1

v13.4.0

v13.3.1

v13.3.0

v13.2.1

v13.2.0

@​grpc/grpc-js 1.8.22

v4.2.3 - 2024-03-05

Commits

v4.2.2 - 2023-10-25

Fixed

Commits

7.5.10

Bug fixes

7.5.9

Bug fixes

7.5.8

Bug fixes

7.5.7

Bug fixes

7.5.6

Bug fixes

7.5.5

Bug fixes

7.5.4

Bug fixes

7.5.3

Bug fixes

7.5.2

Bug fixes

protobufjs: v7.2.5

7.2.5 (2023-08-21)

Bug Fixes

7.2.5 (2023-08-21)

Bug Fixes

Firebase Admin Node.js SDK v12.1.1

Bug Fixes

Miscellaneous

Firebase Admin Node.js SDK v12.1.0

New Features

Miscellaneous

v4.15.7

Fixes

v4.15.5

Fixes

v4.15.4

Fixes

4.15.7 (2024-06-18)

4.15.6 (2024-06-18)

Fixes

4.15.5 (2024-03-07)

Fixes

4.15.4 (2023-10-14)

Fixes

v10.0.0 - The one that goes up to 20

dependabot bot commented on behalf of github Jun 18, 2024 •

edited

Loading

`@grpc/grpc-js` 1.8.22

[server] `generateRegistrationOptions()` now expects `Base64URLString` for excluded credential IDs

[server] `generateRegistrationOptions()` now expects `Base64URLString` for excluded credential IDs