Skip to content

Bump the npm_and_yarn group across 2 directories with 7 updates #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Bump the npm_and_yarn group across 2 directories with 7 updates #1

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Nov 17, 2024

Bumps the npm_and_yarn group with 3 updates in the / directory: @cyclonedx/cdxgen, cross-spawn and rollup.
Bumps the npm_and_yarn group with 2 updates in the /test/socket-npm-fixtures/npm8 directory: semver and npm.

Updates @cyclonedx/cdxgen from 10.9.9 to 10.11.0

Release notes

Sourced from @​cyclonedx/cdxgen's releases.

Release v10.11.0 - Happy swiftwali

Swift developers deserve better tooling to make their lives simple. Accurate information about where and how a given library (both internal and external) is used, can help with prioritization and vulnerability management.

This release adds a new state-of-the-art semantic analysis engine for swift 😎. cdxgen can generate a precise semantic slice representing the application context with accurate types and fully qualified call names for a range of swift applications. The slices are then utlilized by evinse to generate "occurrences evidence" for the SBOM as shown.

We can't wait to iterate to bring you more enhancements and visibility over the coming weeks.

What's Changed

🚀 Features

Other Changes

Full Changelog: cdxgen/cdxgen@v10.10.7...v10.11.0

v10.10.7

What's Changed

🚀 Features

Full Changelog: cdxgen/cdxgen@v10.10.6...v10.10.7

Release v10.10.6

What's Changed

Other Changes

Full Changelog: cdxgen/cdxgen@v10.10.5...v10.10.6

Release v10.10.5

What's Changed

Other Changes

... (truncated)

Commits
  • cb40883 Bug fix
  • 8890b7d Graciously fail for fastlane managed swift projects (#1443)
  • bb0a399 Adds occurrence evidence for swift (#1442)
  • ab161c3 Run some GitHub action jobs only on main repository (#1438)
  • 4c021f1 Run "Upload base images" action only on main repository (#1436)
  • 3f2bbd2 Use bom-ref consistently in the dependency tree (#1431)
  • b309cff Adds support for specifying npm install args (#1428)
  • 341ae63 More aliases for node.js with version
  • 5b39562 Bump version. Update packages
  • 9dc28de Remove libraries.io badge
  • Additional commits viewable in compare view

Updates cross-spawn from 7.0.3 to 7.0.5

Changelog

Sourced from cross-spawn's changelog.

7.0.5 (2024-11-07)

Bug Fixes

  • fix escaping bug introduced by backtracking (640d391)

7.0.4 (2024-11-07)

Bug Fixes

Commits
  • 0852683 chore(release): 7.0.5
  • 640d391 fix: fix escaping bug introduced by backtracking
  • bff0c87 chore: remove codecov
  • a7c6abc chore: replace travis with github workflows
  • 9b9246e chore(release): 7.0.4
  • 5ff3a07 fix: disable regexp backtracking (#160)
  • 9521e2d chore: fix tests in recent node js versions
  • 97ded39 chore: convert package lock
  • d52b6b9 chore: remove unused argument (#156)
  • 5d84384 chore: add travis jobs on ppc64le (#142)
  • Additional commits viewable in compare view

Updates rollup from 4.21.2 to 4.27.2

Release notes

Sourced from rollup's releases.

v4.27.2

4.27.2

2024-11-15

Bug Fixes

  • Ensure unused variables in patterns are always deconflicted if rendered (#5728)

Pull Requests

v4.27.1

4.27.1

2024-11-15

Bug Fixes

  • Fix some situations where parameter declarations could put Rollup into an infinite loop (#5727)

Pull Requests

v4.27.0

4.27.0

2024-11-15

Features

  • Tree-shake unused properties in object literals (#5420)

Bug Fixes

  • Change hash length limit to 21 to avoid inconsistent hash length (#5423)

Pull Requests

v4.26.0

4.26.0

2024-11-13

... (truncated)

Changelog

Sourced from rollup's changelog.

4.27.2

2024-11-15

Bug Fixes

  • Ensure unused variables in patterns are always deconflicted if rendered (#5728)

Pull Requests

4.27.1

2024-11-15

Bug Fixes

  • Fix some situations where parameter declarations could put Rollup into an infinite loop (#5727)

Pull Requests

4.27.0

2024-11-15

Features

  • Tree-shake unused properties in object literals (#5420)

Bug Fixes

  • Change hash length limit to 21 to avoid inconsistent hash length (#5423)

Pull Requests

4.26.0

2024-11-13

Features

  • Allow to avoid await bundle.close() via explicit resource management in TypeScript (#5721)

... (truncated)

Commits

Updates body-parser from 1.20.2 to 2.0.2

Release notes

Sourced from body-parser's releases.

2.0.2

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@2.0.1...2.0.2

2.0.1

What's Changed

New Contributors

Full Changelog: expressjs/body-parser@2.0.0...2.0.1

2.0.0

What's Changed

Important

  • add brotli support #406
  • Breaking Change: Node.js 18 is the minimum supported version

Details

New Contributors

... (truncated)

Changelog

Sourced from body-parser's changelog.

2.0.2 / 2024-10-31

  • remove unpipe package and use native unpipe() method

2.0.1 / 2024-09-10

  • Restore expected behavior extended to false

2.0.0 / 2024-09-10

  • Propagate changes from 1.20.3
  • add brotli support #406
  • Breaking Change: Node.js 18 is the minimum supported version

2.0.0-beta.2 / 2023-02-23

This incorporates all changes after 1.19.1 up to 1.20.2.

  • Remove deprecated bodyParser() combination middleware
  • deps: debug@3.1.0
    • Add DEBUG_HIDE_DATE environment variable
    • Change timer to per-namespace instead of global
    • Change non-TTY date format
    • Remove DEBUG_FD environment variable support
    • Support 256 namespace colors
  • deps: iconv-lite@0.5.2
    • Add encoding cp720
    • Add encoding UTF-32
  • deps: raw-body@3.0.0-beta.1

2.0.0-beta.1 / 2021-12-17

  • Drop support for Node.js 0.8
  • req.body is no longer always initialized to {}
    • it is left undefined unless a body is parsed
  • urlencoded parser now defaults extended to false
  • Use on-finished to determine when body read

1.20.3 / 2024-09-10

  • deps: qs@6.13.0
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)
Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.


Removes semver

Updates npm from 8.19.4 to 10.9.0

Release notes

Sourced from npm's releases.

v10.9.0

10.9.0 (2024-10-03)

Features

Bug Fixes

Documentation

Dependencies

... (truncated)

Changelog

Sourced from npm's changelog.

10.9.0 (2024-10-03)

Features

Bug Fixes

Documentation

Dependencies

... (truncated)

Commits
  • 977fd57 chore: release 10.9.0
  • 4d57928 feat: devEngines (#7766)
  • 95e2cb1 chore: ignore .github folder in release-please
  • 60a7ee5 deps: hoist npm-normalize-package-bin
  • 20dd44f deps: hoist minipass-fetch
  • be1e6da chore: update minify-registry-metadata@4.0.0
  • 43f2374 chore: update ignore-walk@7.0.0
  • bb03036 chore: update npm-packlist@9.0.0
  • 2072705 chore: update @​npmcli/eslint-config@​5.0.1
  • 5795987 deps: update proggy@3.0.0
  • Additional commits viewable in compare view

Updates tar from 6.1.11 to 6.2.1

Release notes

Sourced from tar's releases.

v6.1.13

6.1.13 (2022-12-07)

Dependencies

v6.1.12

6.1.12 (2022-10-31)

Bug Fixes

Documentation

Changelog

Sourced from tar's changelog.

Changelog

7.4

  • Deprecate onentry in favor of onReadEntry for clarity.

7.3

  • Add onWriteEntry option

7.2

  • DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

  • Update minipass to v7.1.0
  • Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

  • Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
  • Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
  • Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
  • Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

6.2

  • Add support for brotli compression
  • Add maxDepth option to prevent extraction into excessively deep folders.

6.1

  • remove dead link to benchmarks (#313) (@​yetzt)
  • add examples/explanation of using tar.t (@​isaacs)
  • ensure close event is emited after stream has ended (@​webark)

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the npm_and_yarn group across 2 directories with 7 updates
e5efb75 
Bumps the npm_and_yarn group with 3 updates in the / directory: [@cyclonedx/cdxgen](https://github.com/CycloneDX/cdxgen), [cross-spawn](https://github.com/moxystudio/node-cross-spawn) and [rollup](https://github.com/rollup/rollup).
Bumps the npm_and_yarn group with 2 updates in the /test/socket-npm-fixtures/npm8 directory: [semver](https://github.com/npm/node-semver) and [npm](https://github.com/npm/cli).


Updates `@cyclonedx/cdxgen` from 10.9.9 to 10.11.0
- [Release notes](https://github.com/CycloneDX/cdxgen/releases)
- [Commits](cdxgen/cdxgen@v10.9.9...v10.11.0)

Updates `cross-spawn` from 7.0.3 to 7.0.5
- [Changelog](https://github.com/moxystudio/node-cross-spawn/blob/master/CHANGELOG.md)
- [Commits](moxystudio/node-cross-spawn@v7.0.3...v7.0.5)

Updates `rollup` from 4.21.2 to 4.27.2
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](rollup/rollup@v4.21.2...v4.27.2)

Updates `body-parser` from 1.20.2 to 2.0.2
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.20.2...2.0.2)

Removes `semver`

Updates `npm` from 8.19.4 to 10.9.0
- [Release notes](https://github.com/npm/cli/releases)
- [Changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md)
- [Commits](npm/cli@v8.19.4...v10.9.0)

Updates `tar` from 6.1.11 to 6.2.1
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](isaacs/node-tar@v6.1.11...v6.2.1)

---
updated-dependencies:
- dependency-name: "@cyclonedx/cdxgen"
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: cross-spawn
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: rollup
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: semver
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: npm
  dependency-type: direct:production
  dependency-group: npm_and_yarn
- dependency-name: tar
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Nov 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant