Heretek-AI/GDevelop
1
0
Fork 0
mirror of https://github.com/Heretek-AI/GDevelop.git synced 2026-07-21 01:25:32 -04:00
Code Issues 2 Packages Projects Releases 2 Wiki Activity

[PR #1] [CLOSED] Bump the npm_and_yarn group across 2 directories with 14 updates #1

New Issue
Closed
opened 2026-06-04 14:30:36 -04:00 by yindo · 0 comments
yindo commented 2026-06-04 14:30:36 -04:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/Heretek-AI/GDevelop/pull/1
Author: @dependabot[bot]
Created: 5/30/2026
Status: ❌ Closed

Base: master ← Head: dependabot/npm_and_yarn/newIDE/web-app/npm_and_yarn-97186a61f3

📝 Commits (1)

  • 4272be4 Bump the npm_and_yarn group across 2 directories with 14 updates

📊 Changes

5 files changed (+1967 additions, -3836 deletions)

View changed files

📝 newIDE/electron-app/package-lock.json (+963 -3244)
📝 newIDE/electron-app/package.json (+3 -3)
📝 newIDE/web-app/package-lock.json (+492 -117)
📝 newIDE/web-app/package.json (+4 -4)
📝 newIDE/web-app/yarn.lock (+505 -468)

📄 Description

Bumps the npm_and_yarn group with 6 updates in the /newIDE/web-app directory:

Package From To
axios 0.19.2 0.32.0
gh-pages 4.0.0 5.0.0
minimist 1.2.5 1.2.6
shelljs 0.8.4 0.8.5
minimatch 3.0.4 3.1.5
semver 6.3.0 6.3.1

Bumps the npm_and_yarn group with 7 updates in the /newIDE/electron-app directory:

Package From To
shelljs 0.8.4 0.8.5
lodash 4.17.23 4.18.1
minimatch 3.1.2 3.1.5
semver 5.7.1 5.7.2
electron 32.3.3 42.3.0
@xmldom/xmldom 0.8.11 0.8.13
tar 6.2.1 7.5.15

Updates axios from 0.19.2 to 0.32.0

Release notes

Sourced from axios's releases.

v0.32.0 — May 4, 2026

This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.

⚠️ Breaking Changes & Deprecations

  • Null-prototype merged objects: mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects. (#10838)

🔒 Security Fixes

  • Default error redaction: AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs. The behavior is configurable via config.redact, with defaults exposed on defaults.redact. (#10838)
  • Cookie & XSRF handling: Cookie names are read literally rather than via regex, and only own properties are respected when evaluating withXSRFToken. (#10838)
  • Proxy bypass IPv6 parity: NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1. (#10838)
  • Node http adapter hardening: Strips Proxy-Authorization when no proxy is in use and gates socketPath behind a new allowedSocketPaths allowlist (string or array, normalized) to reduce accidental Unix socket exposure. (#10838)
  • Browser xhr adapter: Stricter own-property checks when reading config and headers. (#10838)
  • URL parameters: AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout. (#10838)
  • Public type surface: Adds formDataHeaderPolicy, redact, and allowedSocketPaths to the TypeScript declarations alongside their runtime defaults. (#10838)

🔧 Maintenance & Chores

  • Repo hygiene: Updates README.md and CHANGELOG.md, adds AGENTS.md, and refreshes the issue and PR templates. (#10838)

Full Changelog

v0.31.1

This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed dist/ artefacts along with Bower support.

⚠️ Breaking Changes & Deprecations

  • Bower & Committed dist/ Removed: dist/ bundles are no longer committed to the repo, and bower.json plus the Grunt package2bower task have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (#10747)

🔒 Security Fixes

  • Prototype Pollution in Header Merge (GHSA-6chq-wfr3-2hj9): Tightened isFormData to reject plain/null-prototype objects and require append, and guarded the Node HTTP adapter so data.getHeaders() is only merged when it is not inherited from Object.prototype. Blocks injected headers via polluted getHeaders. (#10750)
  • Prototype Pollution in Config Merging (GHSA-pf86-5x62-jrwf): mergeConfig, defaults resolution, and the HTTP adapter now uses own-property checks for transport, env, Blob, formSerializer, and transforms arrays, and merged configs are returned as null-prototype objects. Prevents hijacking of the request flow through polluted prototypes. (#10752)
  • FormData / Params Recursion DoS: Added a configurable maxDepth (default 100, Infinity disables) to toFormData and params serialisation, throwing AxiosError with code ERR_FORM_DATA_DEPTH_EXCEEDED when exceeded. Circular-reference detection is preserved. (#10728)
  • Null-Byte Injection in Query Strings: Removed the unsafe %00 → null-byte substitution from AxiosURLSearchParams.encode so %00 is preserved as-is. Other encoding behaviour (including %20 → +) unchanged. (#10737)
  • Consolidated v1 Security Backport: Rolls up remaining v1 hardenings into v0.x: maxContentLength enforcement for responseType: 'stream' via a guarded transform with deferred piping, maxBodyLength enforcement for streamed uploads on native http/https with maxRedirects: 0, and stricter withXSRFToken handling so only own boolean true enables cross-origin XSRF headers. (#10764)

🔧 Maintenance & Chores

  • CODEOWNERS: Added .github/CODEOWNERS with * @jasonsaayman to set a default reviewer for all paths. (#10740)

Full Changelog

v0.31.0

This release backports security fixes from v1.x, hardens the CI/CD supply chain with OIDC publishing and zizmor scanning, resolves TypeScript typing issues in AxiosInstance, and fixes a performance regression in isEmptyObject().

🔒 Security Fixes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for axios since your current version.


Updates gh-pages from 4.0.0 to 5.0.0

Release notes

Sourced from gh-pages's releases.

v5.0.0

Potentially breaking change: the publish method now always returns a promise. Previously, it did not return a promise in some error cases. This should not impact most users.

Updates to the development dependencies required a minimum Node version of 14 for the tests. The library should still work on Node 12, but tests are no longer run in CI for version 12. A future major version of the library may drop support for version 12 altogether.

What's Changed

New Contributors

Full Changelog: https://github.com/tschaub/gh-pages/compare/v4.0.0...v5.0.0

Changelog

Sourced from gh-pages's changelog.

v5.0.0

Potentially breaking change: the publish method now always returns a promise. Previously, it did not return a promise in some error cases. This should not impact most users.

Updates to the development dependencies required a minimum Node version of 14 for the tests. The library should still work on Node 12, but tests are no longer run in CI for version 12. A future major version of the library may drop support for version 12 altogether.

Commits
  • f729b97 5.0.0
  • 51534c7 Log changes
  • ace063b Merge pull request #438 from Vicropht/patch-1
  • 58e54be Merge pull request #459 from tschaub/dependabot/npm_and_yarn/async-3.2.4
  • 2189df3 Bump async from 2.6.4 to 3.2.4
  • 051846e Merge pull request #454 from tschaub/dependabot/npm_and_yarn/email-addresses-...
  • 5c91c67 Merge pull request #455 from tschaub/dependabot/github_actions/actions/setup-...
  • fe0ad83 Merge pull request #453 from tschaub/dependabot/github_actions/actions/checko...
  • b89287d Merge pull request #445 from Nezteb/patch-1
  • e890bd1 Bump email-addresses from 3.0.1 to 5.0.0
  • Additional commits viewable in compare view

Updates minimist from 1.2.5 to 1.2.6

Changelog

Sourced from minimist's changelog.

v1.2.6 - 2022-03-21

Commits

  • test from prototype pollution PR bc8ecee
  • isConstructorOrProto adapted from PR c2b9819
  • security notice for additional prototype pollution issue ef88b93
Commits

Updates shelljs from 0.8.4 to 0.8.5

Release notes

Sourced from shelljs's releases.

v0.8.5

This was a small security fix for #1058.

Changelog

Sourced from shelljs's changelog.

v0.8.5 (2022-01-13)

Full Changelog

This was a small security fix for #1058.

Commits

Updates async from 2.6.1 to 3.2.6

Changelog

Sourced from async's changelog.

v3.2.5

  • Ensure Error objects such as AggregateError are propagated without modification (#1920)

v3.2.4

  • Fix a bug in priorityQueue where it didn't wait for the result. (#1725)
  • Fix a bug where unshiftAsync was included in priorityQueue. (#1790)

v3.2.3

  • Fix bugs in comment parsing in autoInject. (#1767, #1780)

v3.2.2

  • Fix potential prototype pollution exploit

v3.2.1

v3.2.0

  • Fix a bug in Safari related to overwriting func.name
  • Remove built-in browserify configuration (#1653)
  • Varios doc fixes (#1688, #1703, #1704)

v3.1.1

  • Allow redefining name property on wrapped functions.

v3.1.0

  • Added q.pushAsync and q.unshiftAsync, analagous to q.push and q.unshift, except they always do not accept a callback, and reject if processing the task errors. (#1659)
  • Promises returned from q.push and q.unshift when a callback is not passed now resolve even if an error ocurred. (#1659)
  • Fixed a parsing bug in autoInject with complicated function bodies (#1663)
  • Added ES6+ configuration for Browserify bundlers (#1653)
  • Various doc fixes (#1664, #1658, #1665, #1652)

v3.0.1

Bug fixes

  • Fixed a regression where arrays passed to queue and cargo would be completely flattened. (#1645)
  • Clarified Async's browser support (#1643)

v3.0.0

The async/await release!

There are a lot of new features and subtle breaking changes in this major version, but the biggest feature is that most Async methods return a Promise if you omit the callback, meaning you can await them from within an async function.

</tr></table>

... (truncated)

Commits
  • 85fb18f Version 3.2.6
  • 8c0c941 Update built files
  • 5f756b4 Fix ReDoS (#1980)
  • 39cdc9b build(deps-dev): bump karma from 6.4.3 to 6.4.4 (#1985)
  • 7b8ddeb build(deps-dev): bump @​babel/core from 7.24.7 to 7.25.2 (#1981)
  • 4634a9d build(deps-dev): bump rollup from 4.18.0 to 4.19.2 (#1982)
  • afb176c build(deps-dev): bump chai from 4.4.1 to 4.5.0 (#1983)
  • 3568a74 build(deps-dev): bump @​babel/eslint-parser from 7.24.7 to 7.25.1 (#1984)
  • 9e885fd build(deps-dev): bump babel-plugin-istanbul from 6.1.1 to 7.0.0 (#1986)
  • f9c7f2a build(deps-dev): bump semver from 7.6.2 to 7.6.3 (#1987)
  • Additional commits viewable in compare view

Updates follow-redirects from 1.5.10 to 1.16.0

Commits
  • 0c23a22 Release version 1.16.0 of the npm package.
  • 844c4d3 Add sensitiveHeaders option.
  • 5e8b8d0 ci: add Node.js 24.x to the CI matrix
  • 7953e22 ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6
  • 86dc1f8 Sanitizing input.
  • 21ef28a Release version 1.15.11 of the npm package.
  • 7c88135 Roll back tree shaking.
  • 6e389ba Release version 1.15.10 of the npm package.
  • 5bc496e Shake me up before you go-go.
  • 694d6b4 Bump minimist from 1.2.5 to 1.2.8
  • Additional commits viewable in compare view

Updates minimatch from 3.0.4 to 3.1.5

Commits

Updates semver from 6.3.0 to 6.3.1

Release notes

Sourced from semver's releases.

v6.3.1

6.3.1 (2023-07-10)

Bug Fixes

Changelog

Sourced from semver's changelog.

6.3.1 (2023-07-10)

Bug Fixes

6.2.0

  • Coerce numbers to strings when passed to semver.coerce()
  • Add rtl option to coerce from right to left

6.1.3

  • Handle X-ranges properly in includePrerelease mode

6.1.2

  • Do not throw when testing invalid version strings

6.1.1

  • Add options support for semver.coerce()
  • Handle undefined version passed to Range.test

6.1.0

  • Add semver.compareBuild function
  • Support * in semver.intersects

6.0

  • Fix intersects logic.

    This is technically a bug fix, but since it is also a change to behavior that may require users updating their code, it is marked as a major version increment.

5.7

  • Add minVersion method

5.6

  • Move boolean loose param to an options object, with backwards-compatibility protection.
  • Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.


Updates shelljs from 0.8.4 to 0.8.5

Release notes

Sourced from shelljs's releases.

v0.8.5

This was a small security fix for #1058.

Changelog

Sourced from shelljs's changelog.

v0.8.5 (2022-01-13)

Full Changelog

This was a small security fix for #1058.

Commits

Updates lodash from 4.17.23 to 4.18.1

Release notes

Sourced from lodash's releases.

4.18.1

Bugs

Fixes a ReferenceError issue in lodash lodash-es lodash-amd and lodash.template when using the template and fromPairs functions from the modular builds. See lodash/lodash#6167

These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.

There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:

4.18.0

v4.18.0

Full Changelog: https://github.com/lodash/lodash/compare/4.17.23...4.18.0

Security

_.unset / _.omit: Fixed prototype pollution via constructor/prototype path traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now constructor and prototype are blocked unconditionally as non-terminal path keys, matching baseSet. Calls that previously returned true and deleted the property now return false and leave the target untouched.

_.template: Fixed code injection via imports keys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. The variable option was validated against reForbiddenIdentifierChars but importsKeys was left unguarded, allowing code injection via the same Function() constructor sink. imports keys containing forbidden identifier characters now throw "Invalid imports option passed into _.template".

Docs

  • Add security notice for _.template in threat model and API docs (#6099)
  • Document lower > upper behavior in _.random (#6115)
  • Fix quotes in _.compact jsdoc (#6090)

lodash.* modular packages

Diff

We have also regenerated and published a select number of the lodash.* modular packages.

These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:

Commits
  • cb0b9b9 release(patch): bump main to 4.18.1 (#6177)
  • 75535f5 chore: prune stale advisory refs (#6170)
  • 62e91bc docs: remove n_ Node.js < 6 REPL note from README (#6165)
  • 59be2de release(minor): bump to 4.18.0 (#6161)
  • af63457 fix: broken tests for _.template 879aaa9
  • 1073a76 fix: linting issues
  • 879aaa9 fix: validate imports keys in _.template
  • fe8d32e fix: block prototype pollution in baseUnset via constructor/prototype traversal
  • 18ba0a3 refactor(fromPairs): use baseAssignValue for consistent assignment (#6153)
  • b819080 ci: add dist sync validation workflow (#6137)
  • Additional commits viewable in compare view

Updates minimatch from 3.1.2 to 3.1.5

Commits

Updates semver from 5.7.1 to 5.7.2

Release notes

Sourced from semver's releases.

v6.3.1

6.3.1 (2023-07-10)

Bug Fixes

Changelog

Sourced from semver's changelog.

6.3.1 (2023-07-10)

Bug Fixes

6.2.0

  • Coerce numbers to strings when passed to semver.coerce()
  • Add rtl option to coerce from right to left

6.1.3

  • Handle X-ranges properly in includePrerelease mode

6.1.2

  • Do not throw when testing invalid version strings

6.1.1

  • Add options support for semver.coerce()
  • Handle undefined version passed to Range.test

6.1.0

  • Add semver.compareBuild function
  • Support * in semver.intersects

6.0

  • Fix intersects logic.

    This is technically a bug fix, but since it is also a change to behavior that may require users updating their code, it is marked as a major version increment.

5.7

  • Add minVersion method

5.6

  • Move boolean loose param to an options object, with backwards-compatibility protection.
  • Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.


Updates electron from 32.3.3 to 42.3.0

Release notes

Sourced from electron's releases.

electron v42.3.0

Release Notes for v42.3.0

Features

  • Added Linux support for app.getApplicationInfoForProtocol(). #51680
  • Added Notification.remove(), removeAll(), and removeGroup() static methods for macOS. #51691 (Also in 43)
  • Added session support to net module requests from utility process. #51698

Fixes

  • Fixed an issue where process and other Node globals were undefined in ESM preload scripts when contextIsolation was disabled. #51726 (Also in 43)
  • Fixed native addon compilation failure with undefined msvc intrinsic from v8 headers. #51706 (Also in 43)

Other Changes

  • Updated Chromium to 148.0.7778.180. #51600

electron v42.2.0

Release Notes for v42.2.0

Features

  • Allowed the --experimental-inspector-network-resource Node.js flag to be passed through Electron. #51378 (Also in 41)

Fixes

  • Fixed crash for Notification close. #51657 (Also in 41, 43)

Other Changes

  • Backported fixes for a use-after-free in touch-event queue teardown, a runtime-effect validation gap in Skia image filters, and an integer overflow in the GLSL translator. #51646
  • Backported fixes for an out-of-bounds write in WebAudio worklet setup, a heap overflow in the ANGLE GL backend, a use-after-free in the GTK Wayland platform, an accessibility tree-state validation issue, and an integer overflow in text bidi handling. #51666
  • Improved performance of app.getApplicationNameForProtocol() on Linux. #51628

Documentation

  • Documentation changes: #51688

electron v42.1.0

Release Notes for v42.1.0

Fixes

  • Fixed a crash in the macOS Touch ID WebAuthn prompt caused by a missing string resource, and added touchID.promptReason to app.configureWebAuthn() to customize the prompt text. #51594 (Also in 41, 43)
  • Fixed a crash on MacOS when a user clicked into a title bar or top view. #51605 (Also in 43)

Other Changes

  • Improved performance of webRequest header conversions and several other gin converter hot paths. #51607 (Also in 43)
  • Improved performance of native event emission, IPC dispatch, and option-dictionary parsing. #51614 (Also in 41)

electron v42.0.1

Release Notes for v42.0.1

Fixes

... (truncated)

Commits
  • e0127e9 chore: bump chromium to 148.0.7778.180 (42-x-y) (#51600)
  • b07916b ci: unpin homebrew version (#51762)
  • 6aac40e refactor: api::utilityProcessWrapper managed by cppgc (#50955) (#51752)
  • bb52cd5 chore: do not require infr singoff for github workflows/actions (#51738) (#51...
  • fd02b05 refactor: rm chore_add_electron_objects_to_wrappablepointertag.patch (#51734)
  • 34102a5 fix: process undefined in ESM preload when contextIsolation is disabled (#5...
  • 09d7d7a feat: add Linux support for app.getApplicationInfoForProtocol() (#5… (#51680)
  • bbf87a7 feat: add remove, removeAll, and removeGroup for notifications API (#51691)
  • c9598c8 feat: add http cache support to requests from utility process (#51698)
  • 102aebe ci: set no color output during build (#51709)
  • Additional commits viewable in compare view

Updates @xmldom/xmldom from 0.8.11 to 0.8.13

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.13

Commits

Fixed

  • Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
    • Comment: throws when data contains -->
    • ProcessingInstruction: throws when data contains ?>
    • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
  • Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.8.12

Commits

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

https://github.com/xmldom/xmldom/discussions/357

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.13

Fixed

  • Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx Description has been truncated

    🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/Heretek-AI/GDevelop/pull/1 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 5/30/2026 **Status:** ❌ Closed **Base:** `master` ← **Head:** `dependabot/npm_and_yarn/newIDE/web-app/npm_and_yarn-97186a61f3` --- ### 📝 Commits (1) - [`4272be4`](https://github.com/Heretek-AI/GDevelop/commit/4272be42d04aeb12916abcb50e7dc3173ad215ec) Bump the npm_and_yarn group across 2 directories with 14 updates ### 📊 Changes **5 files changed** (+1967 additions, -3836 deletions) <details> <summary>View changed files</summary> 📝 `newIDE/electron-app/package-lock.json` (+963 -3244) 📝 `newIDE/electron-app/package.json` (+3 -3) 📝 `newIDE/web-app/package-lock.json` (+492 -117) 📝 `newIDE/web-app/package.json` (+4 -4) 📝 `newIDE/web-app/yarn.lock` (+505 -468) </details> ### 📄 Description Bumps the npm_and_yarn group with 6 updates in the /newIDE/web-app directory: | Package | From | To | | --- | --- | --- | | [axios](https://github.com/axios/axios) | `0.19.2` | `0.32.0` | | [gh-pages](https://github.com/tschaub/gh-pages) | `4.0.0` | `5.0.0` | | [minimist](https://github.com/minimistjs/minimist) | `1.2.5` | `1.2.6` | | [shelljs](https://github.com/shelljs/shelljs) | `0.8.4` | `0.8.5` | | [minimatch](https://github.com/isaacs/minimatch) | `3.0.4` | `3.1.5` | | [semver](https://github.com/npm/node-semver) | `6.3.0` | `6.3.1` | Bumps the npm_and_yarn group with 7 updates in the /newIDE/electron-app directory: | Package | From | To | | --- | --- | --- | | [shelljs](https://github.com/shelljs/shelljs) | `0.8.4` | `0.8.5` | | [lodash](https://github.com/lodash/lodash) | `4.17.23` | `4.18.1` | | [minimatch](https://github.com/isaacs/minimatch) | `3.1.2` | `3.1.5` | | [semver](https://github.com/npm/node-semver) | `5.7.1` | `5.7.2` | | [electron](https://github.com/electron/electron) | `32.3.3` | `42.3.0` | | [@xmldom/xmldom](https://github.com/xmldom/xmldom) | `0.8.11` | `0.8.13` | | [tar](https://github.com/isaacs/node-tar) | `6.2.1` | `7.5.15` | Updates `axios` from 0.19.2 to 0.32.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v0.32.0 — May 4, 2026</h2> <p>This release backports a comprehensive set of security and hardening fixes from the v1.x branch into v0.x, covering prototype-pollution protections, default error redaction, stricter proxy/cookie/socket handling, and one breaking change to merged config and header object prototypes.</p> <h2>⚠️ Breaking Changes &amp; Deprecations</h2> <ul> <li>Null-prototype merged objects: mergeConfig and header merging now return objects with a null prototype to block prototype-pollution gadgets. Consumers must use Object.prototype.hasOwnProperty.call(obj, key) and avoid implicit string coercion against merged config or header objects. (<a href="https://redirect.github.com/axios/axios/issues/10838">#10838</a>)</li> </ul> <h2>🔒 Security Fixes</h2> <ul> <li>Default error redaction: AxiosError.toJSON() now redacts sensitive keys by default to prevent credential leaks in logs. The behavior is configurable via config.redact, with defaults exposed on defaults.redact. (<a href="https://redirect.github.com/axios/axios/issues/10838">#10838</a>)</li> <li>Cookie &amp; XSRF handling: Cookie names are read literally rather than via regex, and only own properties are respected when evaluating withXSRFToken. (<a href="https://redirect.github.com/axios/axios/issues/10838">#10838</a>)</li> <li>Proxy bypass IPv6 parity: NO_PROXY matching now handles canonical IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1 and ::ffff:7f00:1. (<a href="https://redirect.github.com/axios/axios/issues/10838">#10838</a>)</li> <li>Node http adapter hardening: Strips Proxy-Authorization when no proxy is in use and gates socketPath behind a new allowedSocketPaths allowlist (string or array, normalized) to reduce accidental Unix socket exposure. (<a href="https://redirect.github.com/axios/axios/issues/10838">#10838</a>)</li> <li>Browser xhr adapter: Stricter own-property checks when reading config and headers. (<a href="https://redirect.github.com/axios/axios/issues/10838">#10838</a>)</li> <li>URL parameters: AxiosURLSearchParams keeps %00 encoded and applies consistent encoding throughout. (<a href="https://redirect.github.com/axios/axios/issues/10838">#10838</a>)</li> <li>Public type surface: Adds formDataHeaderPolicy, redact, and allowedSocketPaths to the TypeScript declarations alongside their runtime defaults. (<a href="https://redirect.github.com/axios/axios/issues/10838">#10838</a>)</li> </ul> <h2>🔧 Maintenance &amp; Chores</h2> <ul> <li>Repo hygiene: Updates README.md and CHANGELOG.md, adds AGENTS.md, and refreshes the issue and PR templates. (<a href="https://redirect.github.com/axios/axios/issues/10838">#10838</a>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v0.31.1...v0.32.0"><strong>Full Changelog</strong></a></p> <h2>v0.31.1</h2> <p>This release backports a broad set of security hardenings from the v1 line — covering prototype-pollution defences, stream size enforcement, XSRF handling, URL null-byte encoding, and bounded FormData recursion — and drops committed <code>dist/</code> artefacts along with Bower support.</p> <h2>⚠️ Breaking Changes &amp; Deprecations</h2> <ul> <li><strong>Bower &amp; Committed <code>dist/</code> Removed:</strong> <code>dist/</code> bundles are no longer committed to the repo, and <code>bower.json</code> plus the Grunt <code>package2bower</code> task have been removed. CI still builds bundles before publish, so npm/yarn/pnpm consumers are unaffected; installs via Bower or directly from the git tree must migrate to npm or a CDN. (<strong><a href="https://redirect.github.com/axios/axios/issues/10747">#10747</a></strong>)</li> </ul> <h2>🔒 Security Fixes</h2> <ul> <li><strong>Prototype Pollution in Header Merge (GHSA-6chq-wfr3-2hj9):</strong> Tightened <code>isFormData</code> to reject plain/null-prototype objects and require <code>append</code>, and guarded the Node HTTP adapter so <code>data.getHeaders()</code> is only merged when it is not inherited from <code>Object.prototype</code>. Blocks injected headers via polluted <code>getHeaders</code>. (<strong><a href="https://redirect.github.com/axios/axios/issues/10750">#10750</a></strong>)</li> <li><strong>Prototype Pollution in Config Merging (GHSA-pf86-5x62-jrwf):</strong> <code>mergeConfig</code>, defaults resolution, and the HTTP adapter now uses own-property checks for <code>transport</code>, <code>env</code>, <code>Blob</code>, <code>formSerializer</code>, and transforms arrays, and merged configs are returned as null-prototype objects. Prevents hijacking of the request flow through polluted prototypes. (<strong><a href="https://redirect.github.com/axios/axios/issues/10752">#10752</a></strong>)</li> <li><strong>FormData / Params Recursion DoS:</strong> Added a configurable <code>maxDepth</code> (default <code>100</code>, <code>Infinity</code> disables) to <code>toFormData</code> and params serialisation, throwing <code>AxiosError</code> with code <code>ERR_FORM_DATA_DEPTH_EXCEEDED</code> when exceeded. Circular-reference detection is preserved. (<strong><a href="https://redirect.github.com/axios/axios/issues/10728">#10728</a></strong>)</li> <li><strong>Null-Byte Injection in Query Strings:</strong> Removed the unsafe <code>%00</code> → null-byte substitution from <code>AxiosURLSearchParams.encode</code> so <code>%00</code> is preserved as-is. Other encoding behaviour (including <code>%20</code> → <code>+</code>) unchanged. (<strong><a href="https://redirect.github.com/axios/axios/issues/10737">#10737</a></strong>)</li> <li><strong>Consolidated v1 Security Backport:</strong> Rolls up remaining v1 hardenings into <code>v0.x</code>: <code>maxContentLength</code> enforcement for <code>responseType: 'stream'</code> via a guarded transform with deferred piping, <code>maxBodyLength</code> enforcement for streamed uploads on native <code>http</code>/<code>https</code> with <code>maxRedirects: 0</code>, and stricter <code>withXSRFToken</code> handling so only own boolean <code>true</code> enables cross-origin XSRF headers. (<strong><a href="https://redirect.github.com/axios/axios/issues/10764">#10764</a></strong>)</li> </ul> <h2>🔧 Maintenance &amp; Chores</h2> <ul> <li><strong>CODEOWNERS:</strong> Added <code>.github/CODEOWNERS</code> with <code>* @jasonsaayman</code> to set a default reviewer for all paths. (<strong><a href="https://redirect.github.com/axios/axios/issues/10740">#10740</a></strong>)</li> </ul> <p><a href="https://github.com/axios/axios/compare/v0.31.0...v0.31.1">Full Changelog</a></p> <h2>v0.31.0</h2> <p>This release backports security fixes from v1.x, hardens the CI/CD supply chain with OIDC publishing and <code>zizmor</code> scanning, resolves TypeScript typing issues in <code>AxiosInstance</code>, and fixes a performance regression in <code>isEmptyObject()</code>.</p> <h2>🔒 Security Fixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/8db2d44896849a21ed9721185b1034df24e1ba7b"><code>8db2d44</code></a> chore: bump version to v0.32.0 (<a href="https://redirect.github.com/axios/axios/issues/10840">#10840</a>)</li> <li><a href="https://github.com/axios/axios/commit/2af6116a957b1dd1b32056181326da8a5540d3bc"><code>2af6116</code></a> chore: backport fixes from the v1x branch (<a href="https://redirect.github.com/axios/axios/issues/10838">#10838</a>)</li> <li><a href="https://github.com/axios/axios/commit/a589dc525af12e0fabef7d6e5be028ad433eee31"><code>a589dc5</code></a> chore: bump version to v0.31.1 (<a href="https://redirect.github.com/axios/axios/issues/10766">#10766</a>)</li> <li><a href="https://github.com/axios/axios/commit/b0c632f36a5ea2e73c9bdf3a54164a8ede925736"><code>b0c632f</code></a> fix: backport security issues (<a href="https://redirect.github.com/axios/axios/issues/10764">#10764</a>)</li> <li><a href="https://github.com/axios/axios/commit/b52187f4571b6b8663fed5904e3082ab30660364"><code>b52187f</code></a> fix: harden config merging (<a href="https://redirect.github.com/axios/axios/issues/10752">#10752</a>)</li> <li><a href="https://github.com/axios/axios/commit/e3ddeb40f6a142a234925341151e2ca631a6de64"><code>e3ddeb4</code></a> fix: header security issues (<a href="https://redirect.github.com/axios/axios/issues/10750">#10750</a>)</li> <li><a href="https://github.com/axios/axios/commit/f4f2d76e25cc0f777e5416e2d76282ab873ef9dc"><code>f4f2d76</code></a> chore: stop committing dist/ and remove bower (<a href="https://redirect.github.com/axios/axios/issues/10747">#10747</a>)</li> <li><a href="https://github.com/axios/axios/commit/1f2f64433e5be205d74471c78c2721909282b9c0"><code>1f2f644</code></a> chore: add CODEOWNERS (<a href="https://redirect.github.com/axios/axios/issues/10740">#10740</a>)</li> <li><a href="https://github.com/axios/axios/commit/44bca902e1bdd7dd6490c7b4985b63e729b0e634"><code>44bca90</code></a> fix: improve regex in AxiosURLSearchParams (<a href="https://redirect.github.com/axios/axios/issues/10737">#10737</a>)</li> <li><a href="https://github.com/axios/axios/commit/4c4f07fabdb005f5430bab797f12b55e2ed5fb33"><code>4c4f07f</code></a> fix: form data recursion (<a href="https://redirect.github.com/axios/axios/issues/10728">#10728</a>)</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v0.19.2...v0.32.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~GitHub%20Actions">GitHub Actions</a>, a new releaser for axios since your current version.</p> </details> <br /> Updates `gh-pages` from 4.0.0 to 5.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tschaub/gh-pages/releases">gh-pages's releases</a>.</em></p> <blockquote> <h2>v5.0.0</h2> <p>Potentially breaking change: the <code>publish</code> method now always returns a promise. Previously, it did not return a promise in some error cases. This should not impact most users.</p> <p>Updates to the development dependencies required a minimum Node version of 14 for the tests. The library should still work on Node 12, but tests are no longer run in CI for version 12. A future major version of the library may drop support for version 12 altogether.</p> <h2>What's Changed</h2> <ul> <li>Assorted updates by <a href="https://github.com/tschaub"><code>@​tschaub</code></a> in <a href="https://redirect.github.com/tschaub/gh-pages/pull/452">tschaub/gh-pages#452</a></li> <li>Update README to clarify project site configuration requirements with tools like CRA, webpack, Vite, etc. by <a href="https://github.com/Nezteb"><code>@​Nezteb</code></a> in <a href="https://redirect.github.com/tschaub/gh-pages/pull/445">tschaub/gh-pages#445</a></li> <li>Bump actions/checkout from 2 to 3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/tschaub/gh-pages/pull/453">tschaub/gh-pages#453</a></li> <li>Bump actions/setup-node from 1 to 3 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/tschaub/gh-pages/pull/455">tschaub/gh-pages#455</a></li> <li>Bump email-addresses from 3.0.1 to 5.0.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/tschaub/gh-pages/pull/454">tschaub/gh-pages#454</a></li> <li>Bump async from 2.6.4 to 3.2.4 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a href="https://redirect.github.com/tschaub/gh-pages/pull/459">tschaub/gh-pages#459</a></li> <li>Remove quotation marks by <a href="https://github.com/Vicropht"><code>@​Vicropht</code></a> in <a href="https://redirect.github.com/tschaub/gh-pages/pull/438">tschaub/gh-pages#438</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Nezteb"><code>@​Nezteb</code></a> made their first contribution in <a href="https://redirect.github.com/tschaub/gh-pages/pull/445">tschaub/gh-pages#445</a></li> <li><a href="https://github.com/Vicropht"><code>@​Vicropht</code></a> made their first contribution in <a href="https://redirect.github.com/tschaub/gh-pages/pull/438">tschaub/gh-pages#438</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tschaub/gh-pages/compare/v4.0.0...v5.0.0">https://github.com/tschaub/gh-pages/compare/v4.0.0...v5.0.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tschaub/gh-pages/blob/main/changelog.md">gh-pages's changelog</a>.</em></p> <blockquote> <h2>v5.0.0</h2> <p>Potentially breaking change: the <code>publish</code> method now always returns a promise. Previously, it did not return a promise in some error cases. This should not impact most users.</p> <p>Updates to the development dependencies required a minimum Node version of 14 for the tests. The library should still work on Node 12, but tests are no longer run in CI for version 12. A future major version of the library may drop support for version 12 altogether.</p> <ul> <li><a href="https://redirect.github.com/tschaub/gh-pages/pull/438">#438</a> - Remove quotation marks (<a href="https://github.com/Vicropht"><code>@​Vicropht</code></a>)</li> <li><a href="https://redirect.github.com/tschaub/gh-pages/pull/459">#459</a> - Bump async from 2.6.4 to 3.2.4 (<a href="https://github.com/tschaub"><code>@​tschaub</code></a>)</li> <li><a href="https://redirect.github.com/tschaub/gh-pages/pull/454">#454</a> - Bump email-addresses from 3.0.1 to 5.0.0 (<a href="https://github.com/tschaub"><code>@​tschaub</code></a>)</li> <li><a href="https://redirect.github.com/tschaub/gh-pages/pull/455">#455</a> - Bump actions/setup-node from 1 to 3 (<a href="https://github.com/tschaub"><code>@​tschaub</code></a>)</li> <li><a href="https://redirect.github.com/tschaub/gh-pages/pull/453">#453</a> - Bump actions/checkout from 2 to 3 (<a href="https://github.com/tschaub"><code>@​tschaub</code></a>)</li> <li><a href="https://redirect.github.com/tschaub/gh-pages/pull/445">#445</a> - Update README to clarify project site configuration requirements with tools like CRA, webpack, Vite, etc. (<a href="https://github.com/Nezteb"><code>@​Nezteb</code></a>)</li> <li><a href="https://redirect.github.com/tschaub/gh-pages/pull/452">#452</a> - Assorted updates (<a href="https://github.com/tschaub"><code>@​tschaub</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tschaub/gh-pages/commit/f729b97ab9b60121ff36853bfcfd6d716f43ac69"><code>f729b97</code></a> 5.0.0</li> <li><a href="https://github.com/tschaub/gh-pages/commit/51534c798c20449826abebb0bd58b9e9ab04e20e"><code>51534c7</code></a> Log changes</li> <li><a href="https://github.com/tschaub/gh-pages/commit/ace063b81fd3e74467671749c0e60ece1601f292"><code>ace063b</code></a> Merge pull request <a href="https://redirect.github.com/tschaub/gh-pages/issues/438">#438</a> from Vicropht/patch-1</li> <li><a href="https://github.com/tschaub/gh-pages/commit/58e54be6248d33a283ddb5c6b335d342424956cc"><code>58e54be</code></a> Merge pull request <a href="https://redirect.github.com/tschaub/gh-pages/issues/459">#459</a> from tschaub/dependabot/npm_and_yarn/async-3.2.4</li> <li><a href="https://github.com/tschaub/gh-pages/commit/2189df392e42e4fa5c4a5f2b9978d068adf084b0"><code>2189df3</code></a> Bump async from 2.6.4 to 3.2.4</li> <li><a href="https://github.com/tschaub/gh-pages/commit/051846ed1c1ce657549170f985bbd0d1975b6a9f"><code>051846e</code></a> Merge pull request <a href="https://redirect.github.com/tschaub/gh-pages/issues/454">#454</a> from tschaub/dependabot/npm_and_yarn/email-addresses-...</li> <li><a href="https://github.com/tschaub/gh-pages/commit/5c91c678c510b1f232e3c81753103d10f415431c"><code>5c91c67</code></a> Merge pull request <a href="https://redirect.github.com/tschaub/gh-pages/issues/455">#455</a> from tschaub/dependabot/github_actions/actions/setup-...</li> <li><a href="https://github.com/tschaub/gh-pages/commit/fe0ad832548b3042814e53c9fe7417c32474da20"><code>fe0ad83</code></a> Merge pull request <a href="https://redirect.github.com/tschaub/gh-pages/issues/453">#453</a> from tschaub/dependabot/github_actions/actions/checko...</li> <li><a href="https://github.com/tschaub/gh-pages/commit/b89287d04677be890a09ac4a699876e5884e245a"><code>b89287d</code></a> Merge pull request <a href="https://redirect.github.com/tschaub/gh-pages/issues/445">#445</a> from Nezteb/patch-1</li> <li><a href="https://github.com/tschaub/gh-pages/commit/e890bd180ca99287f3be62033c64904a5bf39e7a"><code>e890bd1</code></a> Bump email-addresses from 3.0.1 to 5.0.0</li> <li>Additional commits viewable in <a href="https://github.com/tschaub/gh-pages/compare/v4.0.0...v5.0.0">compare view</a></li> </ul> </details> <br /> Updates `minimist` from 1.2.5 to 1.2.6 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/minimistjs/minimist/blob/main/CHANGELOG.md">minimist's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/minimistjs/minimist/compare/v1.2.5...v1.2.6">v1.2.6</a> - 2022-03-21</h2> <h3>Commits</h3> <ul> <li>test from prototype pollution PR <a href="https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb"><code>bc8ecee</code></a></li> <li>isConstructorOrProto adapted from PR <a href="https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d"><code>c2b9819</code></a></li> <li>security notice for additional prototype pollution issue <a href="https://github.com/minimistjs/minimist/commit/ef88b9325f77b5ee643ccfc97e2ebda577e4c4e2"><code>ef88b93</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/minimistjs/minimist/commit/7efb22a518b53b06f5b02a1038a88bd6290c2846"><code>7efb22a</code></a> 1.2.6</li> <li><a href="https://github.com/minimistjs/minimist/commit/ef88b9325f77b5ee643ccfc97e2ebda577e4c4e2"><code>ef88b93</code></a> security notice for additional prototype pollution issue</li> <li><a href="https://github.com/minimistjs/minimist/commit/c2b981977fa834b223b408cfb860f933c9811e4d"><code>c2b9819</code></a> isConstructorOrProto adapted from PR</li> <li><a href="https://github.com/minimistjs/minimist/commit/bc8ecee43875261f4f17eb20b1243d3ed15e70eb"><code>bc8ecee</code></a> test from prototype pollution PR</li> <li>See full diff in <a href="https://github.com/minimistjs/minimist/compare/v1.2.5...v1.2.6">compare view</a></li> </ul> </details> <br /> Updates `shelljs` from 0.8.4 to 0.8.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/shelljs/shelljs/releases">shelljs's releases</a>.</em></p> <blockquote> <h2>v0.8.5</h2> <p>This was a small security fix for <a href="https://redirect.github.com/shelljs/shelljs/issues/1058">#1058</a>.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/shelljs/shelljs/blob/main/CHANGELOG.md">shelljs's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/shelljs/shelljs/tree/v0.8.5">v0.8.5</a> (2022-01-13)</h2> <p><a href="https://github.com/shelljs/shelljs/compare/v0.8.4...v0.8.5">Full Changelog</a></p> <p>This was a small security fix for <a href="https://redirect.github.com/shelljs/shelljs/issues/1058">#1058</a>.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/shelljs/shelljs/commit/70668a4555c7d49c4f67d53ea063b899be4d6d40"><code>70668a4</code></a> 0.8.5</li> <li><a href="https://github.com/shelljs/shelljs/commit/d919d22dd6de385edaa9d90313075a77f74b338c"><code>d919d22</code></a> fix(exec): lockdown file permissions (<a href="https://redirect.github.com/shelljs/shelljs/issues/1060">#1060</a>)</li> <li>See full diff in <a href="https://github.com/shelljs/shelljs/compare/v0.8.4...v0.8.5">compare view</a></li> </ul> </details> <br /> Updates `async` from 2.6.1 to 3.2.6 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/caolan/async/blob/master/CHANGELOG.md">async's changelog</a>.</em></p> <blockquote> <h1>v3.2.5</h1> <ul> <li>Ensure <code>Error</code> objects such as <code>AggregateError</code> are propagated without modification (<a href="https://redirect.github.com/caolan/async/issues/1920">#1920</a>)</li> </ul> <h1>v3.2.4</h1> <ul> <li>Fix a bug in <code>priorityQueue</code> where it didn't wait for the result. (<a href="https://redirect.github.com/caolan/async/issues/1725">#1725</a>)</li> <li>Fix a bug where <code>unshiftAsync</code> was included in <code>priorityQueue</code>. (<a href="https://redirect.github.com/caolan/async/issues/1790">#1790</a>)</li> </ul> <h1>v3.2.3</h1> <ul> <li>Fix bugs in comment parsing in <code>autoInject</code>. (<a href="https://redirect.github.com/caolan/async/issues/1767">#1767</a>, <a href="https://redirect.github.com/caolan/async/issues/1780">#1780</a>)</li> </ul> <h1>v3.2.2</h1> <ul> <li>Fix potential prototype pollution exploit</li> </ul> <h1>v3.2.1</h1> <ul> <li>Use <code>queueMicrotask</code> if available to the environment (<a href="https://redirect.github.com/caolan/async/issues/1761">#1761</a>)</li> <li>Minor perf improvement in <code>priorityQueue</code> (<a href="https://redirect.github.com/caolan/async/issues/1727">#1727</a>)</li> <li>More examples in documentation (<a href="https://redirect.github.com/caolan/async/issues/1726">#1726</a>)</li> <li>Various doc fixes (<a href="https://redirect.github.com/caolan/async/issues/1708">#1708</a>, <a href="https://redirect.github.com/caolan/async/issues/1712">#1712</a>, <a href="https://redirect.github.com/caolan/async/issues/1717">#1717</a>, <a href="https://redirect.github.com/caolan/async/issues/1740">#1740</a>, <a href="https://redirect.github.com/caolan/async/issues/1739">#1739</a>, <a href="https://redirect.github.com/caolan/async/issues/1749">#1749</a>, <a href="https://redirect.github.com/caolan/async/issues/1756">#1756</a>)</li> <li>Improved test coverage (<a href="https://redirect.github.com/caolan/async/issues/1754">#1754</a>)</li> </ul> <h1>v3.2.0</h1> <ul> <li>Fix a bug in Safari related to overwriting <code>func.name</code></li> <li>Remove built-in browserify configuration (<a href="https://redirect.github.com/caolan/async/issues/1653">#1653</a>)</li> <li>Varios doc fixes (<a href="https://redirect.github.com/caolan/async/issues/1688">#1688</a>, <a href="https://redirect.github.com/caolan/async/issues/1703">#1703</a>, <a href="https://redirect.github.com/caolan/async/issues/1704">#1704</a>)</li> </ul> <h1>v3.1.1</h1> <ul> <li>Allow redefining <code>name</code> property on wrapped functions.</li> </ul> <h1>v3.1.0</h1> <ul> <li>Added <code>q.pushAsync</code> and <code>q.unshiftAsync</code>, analagous to <code>q.push</code> and <code>q.unshift</code>, except they always do not accept a callback, and reject if processing the task errors. (<a href="https://redirect.github.com/caolan/async/issues/1659">#1659</a>)</li> <li>Promises returned from <code>q.push</code> and <code>q.unshift</code> when a callback is not passed now resolve even if an error ocurred. (<a href="https://redirect.github.com/caolan/async/issues/1659">#1659</a>)</li> <li>Fixed a parsing bug in <code>autoInject</code> with complicated function bodies (<a href="https://redirect.github.com/caolan/async/issues/1663">#1663</a>)</li> <li>Added ES6+ configuration for Browserify bundlers (<a href="https://redirect.github.com/caolan/async/issues/1653">#1653</a>)</li> <li>Various doc fixes (<a href="https://redirect.github.com/caolan/async/issues/1664">#1664</a>, <a href="https://redirect.github.com/caolan/async/issues/1658">#1658</a>, <a href="https://redirect.github.com/caolan/async/issues/1665">#1665</a>, <a href="https://redirect.github.com/caolan/async/issues/1652">#1652</a>)</li> </ul> <h1>v3.0.1</h1> <h2>Bug fixes</h2> <ul> <li>Fixed a regression where arrays passed to <code>queue</code> and <code>cargo</code> would be completely flattened. (<a href="https://redirect.github.com/caolan/async/issues/1645">#1645</a>)</li> <li>Clarified Async's browser support (<a href="https://redirect.github.com/caolan/async/issues/1643">#1643</a>)</li> </ul> <h1>v3.0.0</h1> <p>The <code>async</code>/<code>await</code> release!</p> <p>There are a lot of new features and subtle breaking changes in this major version, but the biggest feature is that most Async methods return a Promise if you omit the callback, meaning you can <code>await</code> them from within an <code>async</code> function.</p> <pre lang="js"><code>&lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/caolan/async/commit/85fb18f3d319d14d893ec24648929ff0eb908768"><code>85fb18f</code></a> Version 3.2.6</li> <li><a href="https://github.com/caolan/async/commit/8c0c94152ff20e9b4aeff5d00244ec41dd78b66b"><code>8c0c941</code></a> Update built files</li> <li><a href="https://github.com/caolan/async/commit/5f756b4470d91778702cace5f5fce8060aeb7ad6"><code>5f756b4</code></a> Fix ReDoS (<a href="https://redirect.github.com/caolan/async/issues/1980">#1980</a>)</li> <li><a href="https://github.com/caolan/async/commit/39cdc9bd72046045b3f02f77da0dbca5028ba8fd"><code>39cdc9b</code></a> build(deps-dev): bump karma from 6.4.3 to 6.4.4 (<a href="https://redirect.github.com/caolan/async/issues/1985">#1985</a>)</li> <li><a href="https://github.com/caolan/async/commit/7b8ddeb976124ba110de5923ce40512d4f3369b1"><code>7b8ddeb</code></a> build(deps-dev): bump <code>@​babel/core</code> from 7.24.7 to 7.25.2 (<a href="https://redirect.github.com/caolan/async/issues/1981">#1981</a>)</li> <li><a href="https://github.com/caolan/async/commit/4634a9d26a8112500fb8ecbb67a1c78d735011c2"><code>4634a9d</code></a> build(deps-dev): bump rollup from 4.18.0 to 4.19.2 (<a href="https://redirect.github.com/caolan/async/issues/1982">#1982</a>)</li> <li><a href="https://github.com/caolan/async/commit/afb176c15be82a217ad198c5e7dee303a551705c"><code>afb176c</code></a> build(deps-dev): bump chai from 4.4.1 to 4.5.0 (<a href="https://redirect.github.com/caolan/async/issues/1983">#1983</a>)</li> <li><a href="https://github.com/caolan/async/commit/3568a74de7ab5bcbe20756cc9c5d631cf26e2e65"><code>3568a74</code></a> build(deps-dev): bump <code>@​babel/eslint-parser</code> from 7.24.7 to 7.25.1 (<a href="https://redirect.github.com/caolan/async/issues/1984">#1984</a>)</li> <li><a href="https://github.com/caolan/async/commit/9e885fda800b93b67f2e046db6ce154dfc4f613a"><code>9e885fd</code></a> build(deps-dev): bump babel-plugin-istanbul from 6.1.1 to 7.0.0 (<a href="https://redirect.github.com/caolan/async/issues/1986">#1986</a>)</li> <li><a href="https://github.com/caolan/async/commit/f9c7f2a06e515690186ce4108715085d6a7d1b69"><code>f9c7f2a</code></a> build(deps-dev): bump semver from 7.6.2 to 7.6.3 (<a href="https://redirect.github.com/caolan/async/issues/1987">#1987</a>)</li> <li>Additional commits viewable in <a href="https://github.com/caolan/async/compare/v2.6.1...v3.2.6">compare view</a></li> </ul> </details> <br /> Updates `follow-redirects` from 1.5.10 to 1.16.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/0c23a223067201c368035e82954c11eb2578a33b"><code>0c23a22</code></a> Release version 1.16.0 of the npm package.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/844c4d302ac963d29bdb5dc1754ec7df3d70d7f9"><code>844c4d3</code></a> Add sensitiveHeaders option.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/5e8b8d024e2c76f804a284258e585ecb49a575be"><code>5e8b8d0</code></a> ci: add Node.js 24.x to the CI matrix</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/7953e2255aa0b93602eed3804f3bc5e6923a03af"><code>7953e22</code></a> ci: upgrade GitHub Actions to use setup-node@v6 and checkout@v6</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/86dc1f86e4b56bcd642c78384d51f10f123aea75"><code>86dc1f8</code></a> Sanitizing input.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/21ef28a544c5e57f4c34b8476d75f2144609a1eb"><code>21ef28a</code></a> Release version 1.15.11 of the npm package.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/7c88135da3bd0681a7e156ee66b16b2f6f98b480"><code>7c88135</code></a> Roll back tree shaking.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/6e389ba094beec211a8847788a146917a16c1bdb"><code>6e389ba</code></a> Release version 1.15.10 of the npm package.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/5bc496e0229abda823221e0c6267926a3f93f262"><code>5bc496e</code></a> Shake me up before you go-go.</li> <li><a href="https://github.com/follow-redirects/follow-redirects/commit/694d6b47a42bc8377e5ef1480394de451e16bd5b"><code>694d6b4</code></a> Bump minimist from 1.2.5 to 1.2.8</li> <li>Additional commits viewable in <a href="https://github.com/follow-redirects/follow-redirects/compare/v1.5.10...v1.16.0">compare view</a></li> </ul> </details> <br /> Updates `minimatch` from 3.0.4 to 3.1.5 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/minimatch/commit/7bba97888a27a6162983056bcce2a6e28f668712"><code>7bba978</code></a> 3.1.5</li> <li><a href="https://github.com/isaacs/minimatch/commit/bd259425b2ca17b42897997f93e890314155522d"><code>bd25942</code></a> docs: add warning about ReDoS</li> <li><a href="https://github.com/isaacs/minimatch/commit/1a9c27c75725474dbde57db2995b6281b267756d"><code>1a9c27c</code></a> fix partial matching of globstar patterns</li> <li><a href="https://github.com/isaacs/minimatch/commit/1a2e084af579731af66c221214e3ca8222c9bf23"><code>1a2e084</code></a> 3.1.4</li> <li><a href="https://github.com/isaacs/minimatch/commit/ae24656237c3d58067442f790ce17eff84463a47"><code>ae24656</code></a> update lockfile</li> <li><a href="https://github.com/isaacs/minimatch/commit/b1003749228b2a79e1f237963a0d559ef7a0941e"><code>b100374</code></a> limit recursion for **, improve perf considerably</li> <li><a href="https://github.com/isaacs/minimatch/commit/26ffeaa091b9f660833e23f42e07165b33e85c13"><code>26ffeaa</code></a> lockfile update</li> <li><a href="https://github.com/isaacs/minimatch/commit/9eca892a4e5dbb20534f9f30483b85cdeee6c2eb"><code>9eca892</code></a> lock node version to 14</li> <li><a href="https://github.com/isaacs/minimatch/commit/00c323b188b704e5d4bc534ecec2268cfa70a32a"><code>00c323b</code></a> 3.1.3</li> <li><a href="https://github.com/isaacs/minimatch/commit/30486b2048929264f44d18822891cfffa02af78b"><code>30486b2</code></a> update CI matrix and actions</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/minimatch/compare/v3.0.4...v3.1.5">compare view</a></li> </ul> </details> <br /> Updates `semver` from 6.3.0 to 6.3.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/npm/node-semver/releases">semver's releases</a>.</em></p> <blockquote> <h2>v6.3.1</h2> <h2><a href="https://github.com/npm/node-semver/compare/v6.3.0...v6.3.1">6.3.1</a> (2023-07-10)</h2> <h3>Bug Fixes</h3> <ul> <li><a href="https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c"><code>928e56d</code></a> <a href="https://redirect.github.com/npm/node-semver/pull/591">#591</a> better handling of whitespace (<a href="https://redirect.github.com/npm/node-semver/issues/591">#591</a>) (<a href="https://github.com/lukekarrys"><code>@​lukekarrys</code></a>, <a href="https://github.com/joaomoreno"><code>@​joaomoreno</code></a>, <a href="https://github.com/nicolo-ribaudo"><code>@​nicolo-ribaudo</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/npm/node-semver/blob/v6.3.1/CHANGELOG.md">semver's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/npm/node-semver/compare/v6.3.0...v6.3.1">6.3.1</a> (2023-07-10)</h2> <h3>Bug Fixes</h3> <ul> <li><a href="https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c"><code>928e56d</code></a> <a href="https://redirect.github.com/npm/node-semver/pull/591">#591</a> better handling of whitespace (<a href="https://redirect.github.com/npm/node-semver/issues/591">#591</a>) (<a href="https://github.com/lukekarrys"><code>@​lukekarrys</code></a>, <a href="https://github.com/joaomoreno"><code>@​joaomoreno</code></a>, <a href="https://github.com/nicolo-ribaudo"><code>@​nicolo-ribaudo</code></a>)</li> </ul> <h2>6.2.0</h2> <ul> <li>Coerce numbers to strings when passed to semver.coerce()</li> <li>Add <code>rtl</code> option to coerce from right to left</li> </ul> <h2>6.1.3</h2> <ul> <li>Handle X-ranges properly in includePrerelease mode</li> </ul> <h2>6.1.2</h2> <ul> <li>Do not throw when testing invalid version strings</li> </ul> <h2>6.1.1</h2> <ul> <li>Add options support for semver.coerce()</li> <li>Handle undefined version passed to Range.test</li> </ul> <h2>6.1.0</h2> <ul> <li>Add semver.compareBuild function</li> <li>Support <code>*</code> in semver.intersects</li> </ul> <h2>6.0</h2> <ul> <li> <p>Fix <code>intersects</code> logic.</p> <p>This is technically a bug fix, but since it is also a change to behavior that may require users updating their code, it is marked as a major version increment.</p> </li> </ul> <h2>5.7</h2> <ul> <li>Add <code>minVersion</code> method</li> </ul> <h2>5.6</h2> <ul> <li>Move boolean <code>loose</code> param to an options object, with backwards-compatibility protection.</li> <li>Add ability to opt out of special prerelease version handling with the <code>includePrerelease</code> option flag.</li> </ul> <h2>5.5</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/npm/node-semver/commit/44d27bc007e4827e9b797d6145f1076c127005f2"><code>44d27bc</code></a> chore: release 6.3.1</li> <li><a href="https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c"><code>928e56d</code></a> fix: better handling of whitespace (<a href="https://redirect.github.com/npm/node-semver/issues/591">#591</a>)</li> <li><a href="https://github.com/npm/node-semver/commit/39f632690ea5b1b0d64fa913aa0f96f42b9bde32"><code>39f6326</code></a> chore: <code>@​npmcli/template-oss</code><a href="https://github.com/4"><code>@​4</code></a>.16.0</li> <li>See full diff in <a href="https://github.com/npm/node-semver/compare/v6.3.0...v6.3.1">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~lukekarrys">lukekarrys</a>, a new releaser for semver since your current version.</p> </details> <br /> Updates `shelljs` from 0.8.4 to 0.8.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/shelljs/shelljs/releases">shelljs's releases</a>.</em></p> <blockquote> <h2>v0.8.5</h2> <p>This was a small security fix for <a href="https://redirect.github.com/shelljs/shelljs/issues/1058">#1058</a>.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/shelljs/shelljs/blob/main/CHANGELOG.md">shelljs's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/shelljs/shelljs/tree/v0.8.5">v0.8.5</a> (2022-01-13)</h2> <p><a href="https://github.com/shelljs/shelljs/compare/v0.8.4...v0.8.5">Full Changelog</a></p> <p>This was a small security fix for <a href="https://redirect.github.com/shelljs/shelljs/issues/1058">#1058</a>.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/shelljs/shelljs/commit/70668a4555c7d49c4f67d53ea063b899be4d6d40"><code>70668a4</code></a> 0.8.5</li> <li><a href="https://github.com/shelljs/shelljs/commit/d919d22dd6de385edaa9d90313075a77f74b338c"><code>d919d22</code></a> fix(exec): lockdown file permissions (<a href="https://redirect.github.com/shelljs/shelljs/issues/1060">#1060</a>)</li> <li>See full diff in <a href="https://github.com/shelljs/shelljs/compare/v0.8.4...v0.8.5">compare view</a></li> </ul> </details> <br /> Updates `lodash` from 4.17.23 to 4.18.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/lodash/lodash/releases">lodash's releases</a>.</em></p> <blockquote> <h2>4.18.1</h2> <h2>Bugs</h2> <p>Fixes a <code>ReferenceError</code> issue in <code>lodash</code> <code>lodash-es</code> <code>lodash-amd</code> and <code>lodash.template</code> when using the <code>template</code> and <code>fromPairs</code> functions from the modular builds. See <a href="https://redirect.github.com/lodash/lodash/issues/6167#issuecomment-4165269769">lodash/lodash#6167</a></p> <p>These defects were related to how lodash distributions are built from the main branch using <a href="https://github.com/lodash-archive/lodash-cli">https://github.com/lodash-archive/lodash-cli</a>. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.</p> <p>There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:</p> <ul> <li><code>lodash</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm">https://github.com/lodash/lodash/compare/4.18.0-npm...4.18.1-npm</a></li> <li><code>lodash-es</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es">https://github.com/lodash/lodash/compare/4.18.0-es...4.18.1-es</a></li> <li><code>lodash-amd</code>: <a href="https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd">https://github.com/lodash/lodash/compare/4.18.0-amd...4.18.1-amd</a></li> <li><code>lodash.template</code><a href="https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages">https://github.com/lodash/lodash/compare/4.18.0-npm-packages...4.18.1-npm-packages</a></li> </ul> <h2>4.18.0</h2> <h2>v4.18.0</h2> <p><strong>Full Changelog</strong>: <a href="https://github.com/lodash/lodash/compare/4.17.23...4.18.0">https://github.com/lodash/lodash/compare/4.17.23...4.18.0</a></p> <h3>Security</h3> <p><strong><code>_.unset</code> / <code>_.omit</code></strong>: Fixed prototype pollution via <code>constructor</code>/<code>prototype</code> path traversal (<a href="https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh">GHSA-f23m-r3pf-42rh</a>, <a href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b">fe8d32e</a>). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Now <code>constructor</code> and <code>prototype</code> are blocked unconditionally as non-terminal path keys, matching <code>baseSet</code>. Calls that previously returned <code>true</code> and deleted the property now return <code>false</code> and leave the target untouched.</p> <p><strong><code>_.template</code></strong>: Fixed code injection via <code>imports</code> keys (<a href="https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc">GHSA-r5fr-rjxr-66jc</a>, CVE-2026-4800, <a href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6">879aaa9</a>). Fixes an incomplete patch for CVE-2021-23337. The <code>variable</code> option was validated against <code>reForbiddenIdentifierChars</code> but <code>importsKeys</code> was left unguarded, allowing code injection via the same <code>Function()</code> constructor sink. <code>imports</code> keys containing forbidden identifier characters now throw <code>&quot;Invalid imports option passed into _.template&quot;</code>.</p> <h3>Docs</h3> <ul> <li>Add security notice for <code>_.template</code> in threat model and API docs (<a href="https://redirect.github.com/lodash/lodash/pull/6099">#6099</a>)</li> <li>Document <code>lower &gt; upper</code> behavior in <code>_.random</code> (<a href="https://redirect.github.com/lodash/lodash/pull/6115">#6115</a>)</li> <li>Fix quotes in <code>_.compact</code> jsdoc (<a href="https://redirect.github.com/lodash/lodash/pull/6090">#6090</a>)</li> </ul> <h3><code>lodash.*</code> modular packages</h3> <p><a href="https://redirect.github.com/lodash/lodash/pull/6157">Diff</a></p> <p>We have also regenerated and published a select number of the <code>lodash.*</code> modular packages.</p> <p>These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:</p> <ul> <li><a href="https://www.npmjs.com/package/lodash.orderby">lodash.orderby</a></li> <li><a href="https://www.npmjs.com/package/lodash.tonumber">lodash.tonumber</a></li> <li><a href="https://www.npmjs.com/package/lodash.trim">lodash.trim</a></li> <li><a href="https://www.npmjs.com/package/lodash.trimend">lodash.trimend</a></li> <li><a href="https://www.npmjs.com/package/lodash.sortedindexby">lodash.sortedindexby</a></li> <li><a href="https://www.npmjs.com/package/lodash.zipobjectdeep">lodash.zipobjectdeep</a></li> <li><a href="https://www.npmjs.com/package/lodash.unset">lodash.unset</a></li> <li><a href="https://www.npmjs.com/package/lodash.omit">lodash.omit</a></li> <li><a href="https://www.npmjs.com/package/lodash.template">lodash.template</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/lodash/lodash/commit/cb0b9b9212521c08e3eafe7c8cb0af1b42b6649e"><code>cb0b9b9</code></a> release(patch): bump main to 4.18.1 (<a href="https://redirect.github.com/lodash/lodash/issues/6177">#6177</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/75535f57883b7225adb96de1cfc1cd4169cfcb51"><code>75535f5</code></a> chore: prune stale advisory refs (<a href="https://redirect.github.com/lodash/lodash/issues/6170">#6170</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/62e91bc6a39c98d85b9ada8c44d40593deaf82a4"><code>62e91bc</code></a> docs: remove n_ Node.js &lt; 6 REPL note from README (<a href="https://redirect.github.com/lodash/lodash/issues/6165">#6165</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/59be2de61f8aa9461c7856533b51d31b7d8babc4"><code>59be2de</code></a> release(minor): bump to 4.18.0 (<a href="https://redirect.github.com/lodash/lodash/issues/6161">#6161</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/af634573030f979194871da7c68f79420992f53d"><code>af63457</code></a> fix: broken tests for _.template 879aaa9</li> <li><a href="https://github.com/lodash/lodash/commit/1073a7693e1727e0cf3641e5f71f75ddcf8de7c0"><code>1073a76</code></a> fix: linting issues</li> <li><a href="https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6"><code>879aaa9</code></a> fix: validate imports keys in _.template</li> <li><a href="https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b"><code>fe8d32e</code></a> fix: block prototype pollution in baseUnset via constructor/prototype traversal</li> <li><a href="https://github.com/lodash/lodash/commit/18ba0a32f42fd02117f096b032f89c984173462d"><code>18ba0a3</code></a> refactor(fromPairs): use baseAssignValue for consistent assignment (<a href="https://redirect.github.com/lodash/lodash/issues/6153">#6153</a>)</li> <li><a href="https://github.com/lodash/lodash/commit/b8190803d48d60b8c80ad45d39125f32fa618cb2"><code>b819080</code></a> ci: add dist sync validation workflow (<a href="https://redirect.github.com/lodash/lodash/issues/6137">#6137</a>)</li> <li>Additional commits viewable in <a href="https://github.com/lodash/lodash/compare/4.17.23...4.18.1">compare view</a></li> </ul> </details> <br /> Updates `minimatch` from 3.1.2 to 3.1.5 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/isaacs/minimatch/commit/7bba97888a27a6162983056bcce2a6e28f668712"><code>7bba978</code></a> 3.1.5</li> <li><a href="https://github.com/isaacs/minimatch/commit/bd259425b2ca17b42897997f93e890314155522d"><code>bd25942</code></a> docs: add warning about ReDoS</li> <li><a href="https://github.com/isaacs/minimatch/commit/1a9c27c75725474dbde57db2995b6281b267756d"><code>1a9c27c</code></a> fix partial matching of globstar patterns</li> <li><a href="https://github.com/isaacs/minimatch/commit/1a2e084af579731af66c221214e3ca8222c9bf23"><code>1a2e084</code></a> 3.1.4</li> <li><a href="https://github.com/isaacs/minimatch/commit/ae24656237c3d58067442f790ce17eff84463a47"><code>ae24656</code></a> update lockfile</li> <li><a href="https://github.com/isaacs/minimatch/commit/b1003749228b2a79e1f237963a0d559ef7a0941e"><code>b100374</code></a> limit recursion for **, improve perf considerably</li> <li><a href="https://github.com/isaacs/minimatch/commit/26ffeaa091b9f660833e23f42e07165b33e85c13"><code>26ffeaa</code></a> lockfile update</li> <li><a href="https://github.com/isaacs/minimatch/commit/9eca892a4e5dbb20534f9f30483b85cdeee6c2eb"><code>9eca892</code></a> lock node version to 14</li> <li><a href="https://github.com/isaacs/minimatch/commit/00c323b188b704e5d4bc534ecec2268cfa70a32a"><code>00c323b</code></a> 3.1.3</li> <li><a href="https://github.com/isaacs/minimatch/commit/30486b2048929264f44d18822891cfffa02af78b"><code>30486b2</code></a> update CI matrix and actions</li> <li>Additional commits viewable in <a href="https://github.com/isaacs/minimatch/compare/v3.0.4...v3.1.5">compare view</a></li> </ul> </details> <br /> Updates `semver` from 5.7.1 to 5.7.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/npm/node-semver/releases">semver's releases</a>.</em></p> <blockquote> <h2>v6.3.1</h2> <h2><a href="https://github.com/npm/node-semver/compare/v6.3.0...v6.3.1">6.3.1</a> (2023-07-10)</h2> <h3>Bug Fixes</h3> <ul> <li><a href="https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c"><code>928e56d</code></a> <a href="https://redirect.github.com/npm/node-semver/pull/591">#591</a> better handling of whitespace (<a href="https://redirect.github.com/npm/node-semver/issues/591">#591</a>) (<a href="https://github.com/lukekarrys"><code>@​lukekarrys</code></a>, <a href="https://github.com/joaomoreno"><code>@​joaomoreno</code></a>, <a href="https://github.com/nicolo-ribaudo"><code>@​nicolo-ribaudo</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/npm/node-semver/blob/v6.3.1/CHANGELOG.md">semver's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/npm/node-semver/compare/v6.3.0...v6.3.1">6.3.1</a> (2023-07-10)</h2> <h3>Bug Fixes</h3> <ul> <li><a href="https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c"><code>928e56d</code></a> <a href="https://redirect.github.com/npm/node-semver/pull/591">#591</a> better handling of whitespace (<a href="https://redirect.github.com/npm/node-semver/issues/591">#591</a>) (<a href="https://github.com/lukekarrys"><code>@​lukekarrys</code></a>, <a href="https://github.com/joaomoreno"><code>@​joaomoreno</code></a>, <a href="https://github.com/nicolo-ribaudo"><code>@​nicolo-ribaudo</code></a>)</li> </ul> <h2>6.2.0</h2> <ul> <li>Coerce numbers to strings when passed to semver.coerce()</li> <li>Add <code>rtl</code> option to coerce from right to left</li> </ul> <h2>6.1.3</h2> <ul> <li>Handle X-ranges properly in includePrerelease mode</li> </ul> <h2>6.1.2</h2> <ul> <li>Do not throw when testing invalid version strings</li> </ul> <h2>6.1.1</h2> <ul> <li>Add options support for semver.coerce()</li> <li>Handle undefined version passed to Range.test</li> </ul> <h2>6.1.0</h2> <ul> <li>Add semver.compareBuild function</li> <li>Support <code>*</code> in semver.intersects</li> </ul> <h2>6.0</h2> <ul> <li> <p>Fix <code>intersects</code> logic.</p> <p>This is technically a bug fix, but since it is also a change to behavior that may require users updating their code, it is marked as a major version increment.</p> </li> </ul> <h2>5.7</h2> <ul> <li>Add <code>minVersion</code> method</li> </ul> <h2>5.6</h2> <ul> <li>Move boolean <code>loose</code> param to an options object, with backwards-compatibility protection.</li> <li>Add ability to opt out of special prerelease version handling with the <code>includePrerelease</code> option flag.</li> </ul> <h2>5.5</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/npm/node-semver/commit/44d27bc007e4827e9b797d6145f1076c127005f2"><code>44d27bc</code></a> chore: release 6.3.1</li> <li><a href="https://github.com/npm/node-semver/commit/928e56d21150da0413a3333a3148b20e741a920c"><code>928e56d</code></a> fix: better handling of whitespace (<a href="https://redirect.github.com/npm/node-semver/issues/591">#591</a>)</li> <li><a href="https://github.com/npm/node-semver/commit/39f632690ea5b1b0d64fa913aa0f96f42b9bde32"><code>39f6326</code></a> chore: <code>@​npmcli/template-oss</code><a href="https://github.com/4"><code>@​4</code></a>.16.0</li> <li>See full diff in <a href="https://github.com/npm/node-semver/compare/v6.3.0...v6.3.1">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~lukekarrys">lukekarrys</a>, a new releaser for semver since your current version.</p> </details> <br /> Updates `electron` from 32.3.3 to 42.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/electron/electron/releases">electron's releases</a>.</em></p> <blockquote> <h2>electron v42.3.0</h2> <h1>Release Notes for v42.3.0</h1> <h2>Features</h2> <ul> <li>Added Linux support for <code>app.getApplicationInfoForProtocol()</code>. <a href="https://redirect.github.com/electron/electron/pull/51680">#51680</a></li> <li>Added Notification.remove(), removeAll(), and removeGroup() static methods for macOS. <a href="https://redirect.github.com/electron/electron/pull/51691">#51691</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51690">43</a>)<!-- raw HTML omitted --></li> <li>Added session support to net module requests from utility process. <a href="https://redirect.github.com/electron/electron/pull/51698">#51698</a></li> </ul> <h2>Fixes</h2> <ul> <li>Fixed an issue where <code>process</code> and other Node globals were undefined in ESM preload scripts when <code>contextIsolation</code> was disabled. <a href="https://redirect.github.com/electron/electron/pull/51726">#51726</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51723">43</a>)<!-- raw HTML omitted --></li> <li>Fixed native addon compilation failure with undefined msvc intrinsic from v8 headers. <a href="https://redirect.github.com/electron/electron/pull/51706">#51706</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51705">43</a>)<!-- raw HTML omitted --></li> </ul> <h2>Other Changes</h2> <ul> <li>Updated Chromium to 148.0.7778.180. <a href="https://redirect.github.com/electron/electron/pull/51600">#51600</a></li> </ul> <h2>electron v42.2.0</h2> <h1>Release Notes for v42.2.0</h1> <h2>Features</h2> <ul> <li>Allowed the <code>--experimental-inspector-network-resource</code> Node.js flag to be passed through Electron. <a href="https://redirect.github.com/electron/electron/pull/51378">#51378</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51377">41</a>)<!-- raw HTML omitted --></li> </ul> <h2>Fixes</h2> <ul> <li>Fixed crash for Notification close. <a href="https://redirect.github.com/electron/electron/pull/51657">#51657</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51656">41</a>, <a href="https://redirect.github.com/electron/electron/pull/51655">43</a>)<!-- raw HTML omitted --></li> </ul> <h2>Other Changes</h2> <ul> <li>Backported fixes for a use-after-free in touch-event queue teardown, a runtime-effect validation gap in Skia image filters, and an integer overflow in the GLSL translator. <a href="https://redirect.github.com/electron/electron/pull/51646">#51646</a></li> <li>Backported fixes for an out-of-bounds write in WebAudio worklet setup, a heap overflow in the ANGLE GL backend, a use-after-free in the GTK Wayland platform, an accessibility tree-state validation issue, and an integer overflow in text bidi handling. <a href="https://redirect.github.com/electron/electron/pull/51666">#51666</a></li> <li>Improved performance of <code>app.getApplicationNameForProtocol()</code> on Linux. <a href="https://redirect.github.com/electron/electron/pull/51628">#51628</a></li> </ul> <h2>Documentation</h2> <ul> <li>Documentation changes: <a href="https://redirect.github.com/electron/electron/pull/51688">#51688</a></li> </ul> <h2>electron v42.1.0</h2> <h1>Release Notes for v42.1.0</h1> <h2>Fixes</h2> <ul> <li>Fixed a crash in the macOS Touch ID WebAuthn prompt caused by a missing string resource, and added <code>touchID.promptReason</code> to <code>app.configureWebAuthn()</code> to customize the prompt text. <a href="https://redirect.github.com/electron/electron/pull/51594">#51594</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51604">41</a>, <a href="https://redirect.github.com/electron/electron/pull/51595">43</a>)<!-- raw HTML omitted --></li> <li>Fixed a crash on MacOS when a user clicked into a title bar or top view. <a href="https://redirect.github.com/electron/electron/pull/51605">#51605</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51606">43</a>)<!-- raw HTML omitted --></li> </ul> <h2>Other Changes</h2> <ul> <li>Improved performance of <code>webRequest</code> header conversions and several other gin converter hot paths. <a href="https://redirect.github.com/electron/electron/pull/51607">#51607</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51608">43</a>)<!-- raw HTML omitted --></li> <li>Improved performance of native event emission, IPC dispatch, and option-dictionary parsing. <a href="https://redirect.github.com/electron/electron/pull/51614">#51614</a> <!-- raw HTML omitted -->(Also in <a href="https://redirect.github.com/electron/electron/pull/51613">41</a>)<!-- raw HTML omitted --></li> </ul> <h2>electron v42.0.1</h2> <h1>Release Notes for v42.0.1</h1> <h2>Fixes</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/electron/electron/commit/e0127e99aeaa66bb580538fc7409831b5248cccb"><code>e0127e9</code></a> chore: bump chromium to 148.0.7778.180 (42-x-y) (<a href="https://redirect.github.com/electron/electron/issues/51600">#51600</a>)</li> <li><a href="https://github.com/electron/electron/commit/b07916bfa5b7cb5056c36c0cf4769849941d7ce1"><code>b07916b</code></a> ci: unpin homebrew version (<a href="https://redirect.github.com/electron/electron/issues/51762">#51762</a>)</li> <li><a href="https://github.com/electron/electron/commit/6aac40e76ca1eace7b13f5c5451b586e010fe558"><code>6aac40e</code></a> refactor: api::utilityProcessWrapper managed by cppgc (<a href="https://redirect.github.com/electron/electron/issues/50955">#50955</a>) (<a href="https://redirect.github.com/electron/electron/issues/51752">#51752</a>)</li> <li><a href="https://github.com/electron/electron/commit/bb52cd543ded7b33e1232c3d8d743c8fa8387d8e"><code>bb52cd5</code></a> chore: do not require infr singoff for github workflows/actions (<a href="https://redirect.github.com/electron/electron/issues/51738">#51738</a>) (<a href="https://redirect.github.com/electron/electron/issues/51">#51</a>...</li> <li><a href="https://github.com/electron/electron/commit/fd02b05625e0e4a950e45a67642d8fba95510689"><code>fd02b05</code></a> refactor: rm chore_add_electron_objects_to_wrappablepointertag.patch (<a href="https://redirect.github.com/electron/electron/issues/51734">#51734</a>)</li> <li><a href="https://github.com/electron/electron/commit/34102a58a53d64c992d37bd745db49ecee1b5a30"><code>34102a5</code></a> fix: <code>process</code> undefined in ESM preload when contextIsolation is disabled (<a href="https://redirect.github.com/electron/electron/issues/5">#5</a>...</li> <li><a href="https://github.com/electron/electron/commit/09d7d7af4d9e87dfe86f445790f0f699d3aedc96"><code>09d7d7a</code></a> feat: add Linux support for <code>app.getApplicationInfoForProtocol()</code> (<a href="https://redirect.github.com/electron/electron/issues/5">#5</a>… (<a href="https://redirect.github.com/electron/electron/issues/51680">#51680</a>)</li> <li><a href="https://github.com/electron/electron/commit/bbf87a7d991ca4bafb03717adc157413fb729d18"><code>bbf87a7</code></a> feat: add remove, removeAll, and removeGroup for notifications API (<a href="https://redirect.github.com/electron/electron/issues/51691">#51691</a>)</li> <li><a href="https://github.com/electron/electron/commit/c9598c82e42f52b772e96b4b6d2bff04465fedde"><code>c9598c8</code></a> feat: add http cache support to requests from utility process (<a href="https://redirect.github.com/electron/electron/issues/51698">#51698</a>)</li> <li><a href="https://github.com/electron/electron/commit/102aebe84143dceb32e7de7ffed64755ca47c20d"><code>102aebe</code></a> ci: set no color output during build (<a href="https://redirect.github.com/electron/electron/issues/51709">#51709</a>)</li> <li>Additional commits viewable in <a href="https://github.com/electron/electron/compare/v32.3.3...v42.3.0">compare view</a></li> </ul> </details> <br /> Updates `@xmldom/xmldom` from 0.8.11 to 0.8.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/xmldom/xmldom/releases">@​xmldom/xmldom's releases</a>.</em></p> <blockquote> <h2>0.8.13</h2> <p><a href="https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13">Commits</a></p> <h3>Fixed</h3> <ul> <li>Security: <code>XMLSerializer.serializeToString()</code> (and <code>Node.toString()</code>, <code>NodeList.toString()</code>) now accept a <code>requireWellFormed</code> option (fourth argument, after <code>isHtml</code> and <code>nodeFilter</code>). When <code>{ requireWellFormed: true }</code> is passed, the serializer throws <code>InvalidStateError</code> for injection-prone node content, preventing XML injection via attacker-controlled node data. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8"><code>GHSA-j759-j44w-7fr8</code></a> <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx"><code>GHSA-x6wf-f3px-wcqx</code></a> <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h"><code>GHSA-f6ww-3ggp-fr8h</code></a> <ul> <li>Comment: throws when <code>data</code> contains <code>--&gt;</code></li> <li>ProcessingInstruction: throws when <code>data</code> contains <code>?&gt;</code></li> <li>DocumentType: throws when <code>publicId</code> fails <code>PubidLiteral</code>, <code>systemId</code> fails <code>SystemLiteral</code>, or <code>internalSubset</code> contains <code>]&gt;</code></li> </ul> </li> <li>Security: DOM traversal operations (<code>XMLSerializer.serializeToString()</code>, <code>Node.prototype.normalize()</code>, <code>Node.prototype.cloneNode(true)</code>, <code>Document.prototype.importNode(node, true)</code>, <code>node.textContent</code> getter, <code>getElementsByTagName()</code> / <code>getElementsByTagNameNS()</code> / <code>getElementsByClassName()</code> / <code>getElementById()</code>) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable <code>RangeError</code>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw"><code>GHSA-2v35-w6hq-6mfw</code></a></li> </ul> <p>Thank you, <a href="https://github.com/Jvr2022"><code>@​Jvr2022</code></a>, <a href="https://github.com/praveen-kv"><code>@​praveen-kv</code></a>, <a href="https://github.com/TharVid"><code>@​TharVid</code></a>, <a href="https://github.com/decsecre583"><code>@​decsecre583</code></a>, <a href="https://github.com/tlsbollei"><code>@​tlsbollei</code></a>, <a href="https://github.com/KarimTantawey"><code>@​KarimTantawey</code></a>, for your contributions</p> <h2>0.8.12</h2> <p><a href="https://github.com/xmldom/xmldom/compare/0.8.11...0.8.12">Commits</a></p> <h3>Fixed</h3> <ul> <li>preserve trailing whitespace in ProcessingInstruction data <a href="https://redirect.github.com/xmldom/xmldom/pull/962"><code>[#962](https://github.com/xmldom/xmldom/issues/962)</code></a> / <a href="https://redirect.github.com/xmldom/xmldom/issues/42"><code>[#42](https://github.com/xmldom/xmldom/issues/42)</code></a></li> <li>Security: <code>createCDATASection</code> now throws <code>InvalidCharacterError</code> when <code>data</code> contains <code>&quot;]]&gt;&quot;</code>, as required by the <a href="https://dom.spec.whatwg.org/#dom-document-createcdatasection">WHATWG DOM spec</a>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li> <li>Security: <code>XMLSerializer</code> now splits CDATASection nodes whose data contains <code>&quot;]]&gt;&quot;</code> into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (<code>appendData</code>, <code>replaceData</code>, <code>.data =</code>, <code>.textContent =</code>). <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li> </ul> <p>Code that passes a string containing <code>&quot;]]&gt;&quot;</code> to <code>createCDATASection</code> and relied on the previously unsafe behavior will now receive <code>InvalidCharacterError</code>. Use a mutation method such as <code>appendData</code> if you intentionally need <code>&quot;]]&gt;&quot;</code> in a CDATASection node's data.</p> <p>Thank you, <a href="https://github.com/thesmartshadow"><code>@​thesmartshadow</code></a>, <a href="https://github.com/stevenobiajulu"><code>@​stevenobiajulu</code></a>, for your contributions</p> <p><a href="https://github.com/xmldom/xmldom/discussions/357">https://github.com/xmldom/xmldom/discussions/357</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md">@​xmldom/xmldom's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13">0.8.13</a></h2> <h3>Fixed</h3> <ul> <li>Security: <code>XMLSerializer.serializeToString()</code> (and <code>Node.toString()</code>, <code>NodeList.toString()</code>) now accept a <code>requireWellFormed</code> option (fourth argument, after <code>isHtml</code> and <code>nodeFilter</code>). When <code>{ requireWellFormed: true }</code> is passed, the serializer throws <code>InvalidStateError</code> for injection-prone node content, preventing XML injection via attacker-controlled node data. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8"><code>GHSA-j759-j44w-7fr8</code></a> <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx"><code>GHSA-x6wf-f3px-wcqx</code></a> <a href="https://github.com/xmldom/xmldom/securit... _Description has been truncated_ --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-06-04 14:30:36 -04:00
yindo closed this issue 2026-06-04 14:30:37 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Heretek-AI/GDevelop#1
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?