build(deps): bump js-yaml, eslint and mocha #71
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.1.1 and updates ancestor dependencies [js-yaml](https://github.com/nodeca/js-yaml), [eslint](https://github.com/eslint/eslint) and [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together. Updates `js-yaml` from 3.12.2 to 4.1.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.12.2...4.1.1) Updates `eslint` from 5.15.1 to 9.39.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v5.15.1...v9.39.1) Updates `mocha` from 6.0.2 to 11.7.5 - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/v11.7.5/CHANGELOG.md) - [Commits](mochajs/mocha@v6.0.2...v11.7.5) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect - dependency-name: eslint dependency-version: 9.39.1 dependency-type: direct:development - dependency-name: mocha dependency-version: 11.7.5 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Comment |
![arnica-github-connector[bot]](https://avatars.githubusercontent.com/in/144692?s=60&v=4){kind=small}
| }, | ||
| "handlebars": { | ||
| "node_modules/handlebars": { |
There was a problem hiding this comment.
Dependency Risk: handlebars@4.1.2 has 12 vulnerabilities
🔍 Upgrade to 4.7.8 (minor version) to mitigate 100% of critical and high risks (100% of all)
Severity: Critical 💥
Status: Open 🔴
Suggested reviewers 🧐: @spencescu
More details:
For any questions, please contact security at security@global-e.com
Details
Take action by replying with an [arnica] command 💬
Actions
Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.
To acknowledge the finding as a valid code risk:
[arnica] ack <acknowledge additional details>
To dismiss the risk with a reason:
[arnica] dismiss <fp|accept|capacity> <dismissal reason>
Examples
-
[arnica] ack This is a valid risk and im looking into it -
[arnica] dismiss fp Dismissed - Risk Not Accurate: (i.e. False Positive) -
[arnica] dismiss accept Dismiss - Risk Accepted: Allow the risk to exist in the system -
[arnica] dismiss capacity Dismiss - No Capacity: This will need to wait for a future sprint
| "url": "https://github.com/sponsors/ljharb" | ||
| } | ||
| }, | ||
| "node_modules/axe-core": { |
There was a problem hiding this comment.
License Risk: axe-core@4.11.0 uses MPL-2.0
MPL-2.0 violates license policy.
Severity: Medium
Status: Open 🔴
License Details:
Suggested reviewers 🧐: @spencescu
More details:
For any questions, please contact security at security@global-e.com
Details
Take action by replying with an [arnica] command 💬
Actions
Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.
To acknowledge the finding as a valid code risk:
[arnica] ack <acknowledge additional details>
To dismiss the risk with a reason:
[arnica] dismiss <fp|accept|capacity> <dismissal reason>
Examples
-
[arnica] ack This is a valid risk and im looking into it -
[arnica] dismiss fp Dismissed - Risk Not Accurate: (i.e. False Positive) -
[arnica] dismiss accept Dismiss - Risk Accepted: Allow the risk to exist in the system -
[arnica] dismiss capacity Dismiss - No Capacity: This will need to wait for a future sprint
Bumps js-yaml to 4.1.1 and updates ancestor dependencies js-yaml, eslint and mocha. These dependencies need to be updated together.
Updates
js-yamlfrom 3.12.2 to 4.1.1Changelog
Sourced from js-yaml's changelog.
... (truncated)
Commits
cc482e74.1.1 released50968b8dist rebuildd092d86lint fix383665ffix prototype pollution in merge (<<)0d3ca7aREADME.md: HTTP => HTTPS (#678)49baadddoc: 'empty' style option for !!nullba3460eFix demo link (#618)2cef47b4.1.0 released810b149dist rebuild2b5620eExport built-in types, type override now preserves orderUpdates
eslintfrom 5.15.1 to 9.39.1Release notes
Sourced from eslint's releases.
... (truncated)
Commits
e2772819.39.14cdf397Build: changelog update for 9.39.192db329chore: update@eslint/jsversion to 9.39.1 (#20284)c7ebefcchore: package.json update for@eslint/jsrelease650753efix: Only pass node to JS lang visitor methods (#20283)51b51f4docs: add a section on when to use extends vs cascading (#20268)61778f6chore: update eslint-config-eslint dependency@eslint/jsto ^9.39.0 (#20275)d9ca2fcci: Add rangeStrategy to eslint group in renovate config (#20266)009e507test: fix version tests for ESLint v10 (#20274)b44d426docs: Update READMEMaintainer changes
This version was pushed to npm by eslintbot, a new releaser for eslint since your current version.
Updates
mochafrom 6.0.2 to 11.7.5Release notes
Sourced from mocha's releases.
... (truncated)
Changelog
Sourced from mocha's changelog.
... (truncated)
Commits
9a6a5dbchore(v11.x): release 11.7.5 (#5523)8b21b38chore: run tests on PRs for and pushes to v11.x (#5525)663fff4chore: setup release-please for v11 (#5522)8d97220Update release-please to include v11.x and use Node ^22d89dbaffix: swallow morerequireerrors from *ts files (#5498)8649f39chore(main): release 11.7.4 (#5473)c2667c3fix: watch mode using chokidar v4 (#5379)7f68e5cchore: remove trailing spaces (#5475)bff9166Docs: migrate remaining legacy wiki pages to main documentation (#5465)c805327chore(main): release 11.7.3 (#5455)Maintainer changes
This version was pushed to npm by voxpelli, a new releaser for mocha since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.