Skip to content

fix: bump tough-cookie and jsdom #157

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: bump tough-cookie and jsdom #157

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 7, 2025

Bumps tough-cookie to 5.1.0 and updates ancestor dependency jsdom. These dependencies need to be updated together.

Updates tough-cookie from 2.5.0 to 5.1.0

Release notes

Sourced from tough-cookie's releases.

v5.1.0

What's Changed

Full Changelog: salesforce/tough-cookie@v5.0.0...v5.1.0

v5.1.0-rc.0

What's Changed

Full Changelog: salesforce/tough-cookie@v5.0.0...v5.1.0-rc.0

v5.0.0

Summary

Breaking Changes

... (truncated)

Commits
  • f27648d Merge pull request #484 from salesforce/prepare-v5.1.0
  • 7020bb0 5.1.0
  • 80cf3c9 Merge pull request #480 from salesforce/wjh/revert-domain-to-ascii
  • 58a5e7e Merge branch 'master' into wjh/revert-domain-to-ascii
  • b407f60 Merge pull request #483 from salesforce/provenance_perms
  • dc6508e Give permissions for provenance generation
  • 8cec91f Merge pull request #482 from salesforce/npm_auth
  • 5bf0608 Fix npm token config for publish
  • 8a9418d 5.1.0-rc.0
  • 2ff5218 revert: use runtime-agnostic domainToASCII
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by ccasey, a new releaser for tough-cookie since your current version.


Updates jsdom from 15.2.1 to 26.0.0

Release notes

Sourced from jsdom's releases.

Version 26.0.0

Breaking change: canvas peer dependency requirement has been upgraded from v2 to v3. (sebastianwachter)

Other changes:

  • Added AbortSignal.any(). (jdbevan)
  • Added initial support for form-associated custom elements, in particular making them labelable and supporting the ElementInternals labels property. The form-associated callbacks are not yet supported. (hesxenon)
  • Updated whatwg-url, adding support for URL.parse().
  • Updated cssstyle and rrweb-cssom, to improve CSS parsing capabilities.
  • Updated nwsapi, improving CSS selector matching.
  • Updated parse5, fixing a bug around <noframes> elements and HTML entity decoding.
  • Fixed JSDOM.fromURL() to properly reject the returned promise if the server redirects to an invalid URL, instead of causing an uncaught exception.

Version 25.0.1

  • Updated dependencies, notably tough-cookie, which no longer prints a deprecation warning.

Version 25.0.0

This major release changes the prototype of a jsdom's EventTarget.prototype to point to the Object.prototype inside the jsdom, instead of pointing to the Node.js Object.prototype. Thus, the prototype chain of Window stays entirely within the jsdom, never crossing over into the Node.js realm.

This only occurs when runScripts is set to non-default values of "dangerously" or "outside-only", as with the default value, there is no separate Object.prototype inside the jsdom.

This will likely not impact many programs, but could cause some changes in instanceof behavior, and so out of an abundance of caution, we're releasing it as a new major version.

Version 24.1.3

  • Fixed calls to postMessage() that were done as a bare property (i.e., postMessage() instead of window.postMessage()).

Version 24.1.2

  • Fixed an issue with the in operator applied to EventTarget methods, e.g. 'addEventListener' in window, which only appeared in Node.js ≥22.5.0. (legendecas)
  • Fixed the events fired by blur(): it no longer fires focus and focusin on the Document, and blur and focusout no longer have their relatedTarget property set. (asamuzaK)

Version 24.1.1

  • Fixed selection methods to trigger the selectionchange event on the Document object. (piotr-oles)

Version 24.1.0

  • Added the getSetCookie() method to the Headers class. (ushiboy)
  • Fixed the creation and parsing of elements with names from Object.prototype, like "constructor" or "toString".
  • Updated rweb-cssom, which can now parse additional CSS constructs.

Version 24.0.0

This release reverts our selector engine back to nwsapi. As discussed in #3659, the performance regressions from @asamuzakjp/dom-selector turned out to be higher than anticipated. In the future, we can revisit @asamuzakjp/dom-selector after it reaches nwsapi's performance on the two real-world benchmarks provided by the community.

Since reverting to nwsapi causes several functionality regressions, e.g. removing :has() support, we've decided to make this a major version.

Additionally:

  • Small fixes to edge-case behavior of the following properties: input.maxLength, input.minLength, input.size, progress.max, tableCell.colSpan, tableCell.rowSpan, tableCol.span, textArea.cols, textArea.maxLength, textArea.minLength, textArea.rows.

Version 23.2.0

This release switches our CSS selector engine from nwsapi to @asamuzakjp/dom-selector. The new engine is more actively maintained, and supports many new selectors: see the package's documentation for the full list. It also works better with shadow trees.

... (truncated)

Changelog

Sourced from jsdom's changelog.

26.0.0

Breaking change: canvas peer dependency requirement has been upgraded from v2 to v3. (sebastianwachter)

Other changes:

  • Added AbortSignal.any(). (jdbevan)
  • Added initial support for form-associated custom elements, in particular making them labelable and supporting the ElementInternals labels property. The form-associated callbacks are not yet supported. (hesxenon)
  • Updated whatwg-url, adding support for URL.parse().
  • Updated cssstyle and rrweb-cssom, to improve CSS parsing capabilities.
  • Updated nwsapi, improving CSS selector matching.
  • Updated parse5, fixing a bug around <noframes> elements and HTML entity decoding.
  • Fixed JSDOM.fromURL() to properly reject the returned promise if the server redirects to an invalid URL, instead of causing an uncaught exception.

25.0.1

  • Updated dependencies, notably tough-cookie, which no longer prints a deprecation warning.

25.0.0

This major release changes the prototype of a jsdom's EventTarget.prototype to point to the Object.prototype inside the jsdom, instead of pointing to the Node.js Object.prototype. Thus, the prototype chain of Window stays entirely within the jsdom, never crossing over into the Node.js realm.

This only occurs when runScripts is set to non-default values of "dangerously" or "outside-only", as with the default value, there is no separate Object.prototype inside the jsdom.

This will likely not impact many programs, but could cause some changes in instanceof behavior, and so out of an abundance of caution, we're releasing it as a new major version.

24.1.3

  • Fixed calls to postMessage() that were done as a bare property (i.e., postMessage() instead of window.postMessage()).

24.1.2

  • Fixed an issue with the in operator applied to EventTarget methods, e.g. 'addEventListener' in window, which only appeared in Node.js ≥22.5.0. (legendecas)
  • Fixed the events fired by blur(): it no longer fires focus and focusin on the Document, and blur and focusout no longer have their relatedTarget property set. (asamuzaK)

24.1.1

  • Fixed selection methods to trigger the selectionchange event on the Document object. (piotr-oles)

24.1.0

  • Added the getSetCookie() method to the Headers class. (ushiboy)
  • Fixed the creation and parsing of elements with names from Object.prototype, like "constructor" or "toString".
  • Updated rweb-cssom, which can now parse additional CSS constructs.

24.0.0

This release reverts our selector engine back to nwsapi. As discussed in #3659, the performance regressions from @asamuzakjp/dom-selector turned out to be higher than anticipated. In the future, we can revisit @asamuzakjp/dom-selector after it reaches nwsapi's performance on the two real-world benchmarks provided by the community.

Since reverting to nwsapi causes several functionality regressions, e.g. removing :has() support, we've decided to make this a major version.

... (truncated)

Commits
  • 3644055 Version 26.0.0
  • 8ebaee9 Update dependencies and dev dependencies
  • 5984ace Catch invalid redirect URLs
  • d5abcd1 Make querySelectorAll follow the always-impl rule
  • 56f27c2 Add support for ElementInternals's labels property
  • 854ae1b Implement AbortSignal.any()
  • 7cc3500 Update optional peer dependency canvas to v3
  • 8955c99 Add support for canvas v3
  • 8dfe288 Add Node 22 to CI test matrix
  • 04541b3 Version 25.0.1
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
fix: bump tough-cookie and jsdom
60856da 
Bumps [tough-cookie](https://github.com/salesforce/tough-cookie) to 5.1.0 and updates ancestor dependency [jsdom](https://github.com/jsdom/jsdom). These dependencies need to be updated together.


Updates `tough-cookie` from 2.5.0 to 5.1.0
- [Release notes](https://github.com/salesforce/tough-cookie/releases)
- [Changelog](https://github.com/salesforce/tough-cookie/blob/master/CHANGELOG.md)
- [Commits](salesforce/tough-cookie@v2.5.0...v5.1.0)

Updates `jsdom` from 15.2.1 to 26.0.0
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Changelog](https://github.com/jsdom/jsdom/blob/main/Changelog.md)
- [Commits](jsdom/jsdom@15.2.1...26.0.0)

---
updated-dependencies:
- dependency-name: tough-cookie
  dependency-type: indirect
- dependency-name: jsdom
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from a team as a code owner February 7, 2025 16:07
@dependabot dependabot bot mentioned this pull request Feb 7, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ft-dependency-auto-merger ft-dependency-auto-merger Awaiting requested review from ft-dependency-auto-merger ft-dependency-auto-merger is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

auto-merge: unsafe dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant