Bump the npm_and_yarn group across 1 directory with 5 updates #27

dependabot · 2024-08-31T21:34:57Z

Bumps the npm_and_yarn group with 5 updates in the / directory:

Package	From	To
next	`14.0.4`	`14.2.7`
braces	`3.0.2`	`3.0.3`
micromatch	`4.0.5`	`4.0.8`
ws	`8.14.2`	`8.18.0`
@vercel/postgres	`0.5.1`	`0.9.0`

Updates next from 14.0.4 to 14.2.7

Release notes

Sourced from next's releases.

v14.2.7

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Revert "chore: externalize undici for bundling" (#65727)

Refactor internal routing headers to use request meta (#66987)

fix(next): add cross origin in react dom preload (#67423)

build: upgrade edge-runtime (#67565)

GTM dataLayer parameter should take an object, not an array of strings (#66339)

fix: properly patch lockfile against swc bindings (#66515)

Add deployment id header for rsc payload if present (#67255)

Update font data (#68639)

fix i18n data pathname resolving (#68947)

pages router: ensure x-middleware-cache is respected (#67734)

Fix bad modRequest in flight entry manifest #68888

Reject next image urls in image optimizer #68628

Fix hmr assetPrefix escaping and reuse logic from other files #67983

Credits

Huge thanks to @kjugi, @huozhi, @ztanner, @SukkaW, @marlier, @Kikobeats, @syi0808, @ijjk, and @samcx for helping!

v14.2.6

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

Ensure fetch cache TTL is updated properly (#69164)

v14.2.5

[!NOTE]
This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

avoid merging global css in a way that leaks into other chunk groups (#67373)

Fix server action edge redirect with middleware rewrite (#67148)

fix(next): reject protocol-relative URLs in image optimization (#65752)

fix(next-swc): correct path interop to filepath for wasm (#65633)

Use addDependency to track metadata route file changes (#66714)

Fix noindex is missing on static not-found page (#67135)

perf: improve retrieving versionInfo on Turbo HMR (#67309)

fix(next/image): handle invalid url (#67465)

fix(next): initial prefetch cache not set properly with different search params (#65977)

fix: Backport class properties fix (#67377)

Upgrade acorn (#67592)

Misc

Log stdio for pull-turbo-cache script (#66759)

Ensure turbo is setup when building in docker (#66804)

... (truncated)

Commits

a1c3a03 v14.2.7
d46ab2c Fix hmr assetPrefix escaping and reuse logic from other files (#67983)
d11cbc9 Reject next image urls in image optimizer (#68628)
575385e Fix bad modRequest in flight entry manifest (#68888)
9ecf2e8 update turbopack build manifest
325dc4b pages router: ensure x-middleware-cache is respected (#67734)
d3021b6 update playwright interface
5e6f511 fix i18n data pathname resolving (#68947)
dd32e0f Update font data (#68639)
2f7fa98 Add deployment id header for rsc payload if present (#67255)
Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (/~https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

this is basically v4.0.5, with some README updates

it is vulnerable to CVE-2024-4067

Updated braces to v3.0.3 to avoid CVE-2024-4068

does NOT break API compatibility

[4.0.6] - 2024-05-21

Added hasBraces to check if a pattern contains braces.

Fixes CVE-2024-4067

BREAKS API COMPATIBILITY

Should be labeled as a major release, but it's not.

Commits

8bd704e 4.0.8
a0e6841 run verb to generate README documentation
4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
814f5f7 lint
67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
113f2e3 fix: CVE numbers in CHANGELOG
d9dbd9a feat: updated CHANGELOG
2ab1315 fix: use actions/setup-node@v4
1406ea3 feat: rework test to work on macos with node 10,12 and 14
Additional commits viewable in compare view

Updates ws from 8.14.2 to 8.18.0

Release notes

Sourced from ws's releases.

8.18.0

Features

Added support for Blob (#2229).

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

... (truncated)

Commits

976c53c [dist] 8.18.0
59b9629 [feature] Add support for Blob (#2229)
0d1b5e6 [security] Use more descriptive text for 2017 vulnerability link
15f11a0 [security] Add new DoS vulnerability to SECURITY.md
3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
Additional commits viewable in compare view

Updates @vercel/postgres from 0.5.1 to 0.9.0

Release notes

Sourced from @vercel/postgres's releases.

@vercel/postgres-kysely@0.9.0

Patch Changes

Updated dependencies [30fe8d0]

@vercel/postgres@0.9.0

@vercel/postgres@0.9.0

Minor Changes

30fe8d0: Upgrade underlying @neondatabase/serverless to 0.9.3. We follow @neondatabase/serverless's versioning scheme, thus the major bump.

The main changes, per /~https://github.com/neondatabase/serverless/blob/main/CHANGELOG.md, are:

Use a single (per-region) domain name for all connections to Neon databases. Intended to help with connection caching in V8. Passes the endpoint ID inside connection options for WebSocket connections.

Deprecate fetchConnectionCache option, which is now always enabled. For neon http fetch queries, enable setting options on individual queries within a batch transaction (but note that the types still do not allow this).

Pass username (and database name) through URL decoder, so all usernames can successfully authorize.

Upgrading to this version should be safe for all users.

Also fixes #701

@vercel/postgres-kysely@0.8.0

Patch Changes

Updated dependencies [e36fa70]

@vercel/postgres@0.8.0

@vercel/postgres@0.8.0

Minor Changes

e36fa70: feat(types): re-export pg-types for Drizzle

@vercel/postgres-kysely@0.7.2

Patch Changes

5d84a4a: chore(deps): update dependency kysely to v0.27.2

Updated dependencies [5d84a4a]

@vercel/postgres@0.7.2

@vercel/postgres@0.7.2

Patch Changes

5d84a4a: chore(deps): update dependency kysely to v0.27.2

@vercel/postgres-kysely@0.7.1

Patch Changes

abfdf65: fix(deps): update dependency @neondatabase/serverless to v0.7.2

Updated dependencies [abfdf65]

... (truncated)

Changelog

Sourced from @vercel/postgres's changelog.

0.9.0

Minor Changes

30fe8d0: Upgrade underlying @neondatabase/serverless to 0.9.3. We follow @neondatabase/serverless's versioning scheme, thus the major bump.

The main changes, per /~https://github.com/neondatabase/serverless/blob/main/CHANGELOG.md, are:

Use a single (per-region) domain name for all connections to Neon databases. Intended to help with connection caching in V8. Passes the endpoint ID inside connection options for WebSocket connections.

Deprecate fetchConnectionCache option, which is now always enabled. For neon http fetch queries, enable setting options on individual queries within a batch transaction (but note that the types still do not allow this).

Pass username (and database name) through URL decoder, so all usernames can successfully authorize.

Upgrading to this version should be safe for all users.

Also fixes #701

0.8.0

Minor Changes

e36fa70: feat(types): re-export pg-types for Drizzle

0.7.2

Patch Changes

5d84a4a: chore(deps): update dependency kysely to v0.27.2

0.7.1

Patch Changes

abfdf65: fix(deps): update dependency @neondatabase/serverless to v0.7.2

Commits

c128a14 Version Packages (#703)
30fe8d0 feat(postgres): Upgrade underlying @neondatabase/serverless to 0.9.3 (#702)
271b409 Version Packages (#646)
03360f5 Expose types object from neon/serverless (#641)
7fb7fcc chore(deps): upgrade dev deps (#599)
46ad264 Version Packages (#578)
02f97b6 Version Packages (#575)
abfdf65 fix(deps): update dependency @neondatabase/serverless to v0.7.2 (#545)
91f7dd9 chore(deps): update dependency prettier to v3.1.1 (#529)
44f84bd chore(deps): upgrade all deps (#498)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [next](/~https://github.com/vercel/next.js) | `14.0.4` | `14.2.7` | | [braces](/~https://github.com/micromatch/braces) | `3.0.2` | `3.0.3` | | [micromatch](/~https://github.com/micromatch/micromatch) | `4.0.5` | `4.0.8` | | [ws](/~https://github.com/websockets/ws) | `8.14.2` | `8.18.0` | | [@vercel/postgres](/~https://github.com/vercel/storage/tree/HEAD/packages/postgres) | `0.5.1` | `0.9.0` | Updates `next` from 14.0.4 to 14.2.7 - [Release notes](/~https://github.com/vercel/next.js/releases) - [Changelog](/~https://github.com/vercel/next.js/blob/canary/release.js) - [Commits](vercel/next.js@v14.0.4...v14.2.7) Updates `braces` from 3.0.2 to 3.0.3 - [Changelog](/~https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) Updates `micromatch` from 4.0.5 to 4.0.8 - [Release notes](/~https://github.com/micromatch/micromatch/releases) - [Changelog](/~https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md) - [Commits](micromatch/micromatch@4.0.5...4.0.8) Updates `ws` from 8.14.2 to 8.18.0 - [Release notes](/~https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.14.2...8.18.0) Updates `@vercel/postgres` from 0.5.1 to 0.9.0 - [Release notes](/~https://github.com/vercel/storage/releases) - [Changelog](/~https://github.com/vercel/storage/blob/main/packages/postgres/CHANGELOG.md) - [Commits](/~https://github.com/vercel/storage/commits/@vercel/postgres@0.9.0/packages/postgres) --- updated-dependencies: - dependency-name: next dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: braces dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: micromatch dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: ws dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: "@vercel/postgres" dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2024-08-31T21:34:59Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
sendtemps	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Aug 31, 2024 9:36pm

dependabot bot added the dependencies Pull requests that update a dependency file label Aug 31, 2024

vercel bot deployed to Preview August 31, 2024 21:36 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 5 updates #27

Bump the npm_and_yarn group across 1 directory with 5 updates #27

dependabot bot commented on behalf of github Aug 31, 2024

vercel bot commented Aug 31, 2024 •

edited

Loading

Bump the npm_and_yarn group across 1 directory with 5 updates #27

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 5 updates #27

Conversation

dependabot bot commented on behalf of github Aug 31, 2024

v14.2.7

Core Changes

Credits

v14.2.6

Core Changes

v14.2.5

Core Changes

Misc

4.0.8

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

[4.0.6] - 2024-05-21

8.18.0

Features

8.17.1

Bug fixes

@​vercel/postgres-kysely@​0.9.0

Patch Changes

@​vercel/postgres@​0.9.0

Minor Changes

@​vercel/postgres-kysely@​0.8.0

Patch Changes

@​vercel/postgres@​0.8.0

Minor Changes

@​vercel/postgres-kysely@​0.7.2

Patch Changes

@​vercel/postgres@​0.7.2

Patch Changes

@​vercel/postgres-kysely@​0.7.1

Patch Changes

0.9.0

Minor Changes

0.8.0

Minor Changes

0.7.2

Patch Changes

0.7.1

Patch Changes

vercel bot commented Aug 31, 2024 • edited Loading

`@vercel/postgres-kysely@0`.9.0

`@vercel/postgres@0`.9.0

`@vercel/postgres-kysely@0`.8.0

`@vercel/postgres@0`.8.0

`@vercel/postgres-kysely@0`.7.2

`@vercel/postgres@0`.7.2

`@vercel/postgres-kysely@0`.7.1

vercel bot commented Aug 31, 2024 •

edited

Loading