Skip to content

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Apr 30, 2025

Bumps the npm_and_yarn group with 1 update in the / directory: karma.

Updates karma from 1.3.0 to 6.3.16

Release notes

Sourced from karma's releases.

v6.3.16

6.3.16 (2022-02-10)

Bug Fixes

  • security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

v6.3.15

6.3.15 (2022-02-05)

Bug Fixes

v6.3.14

6.3.14 (2022-02-05)

Bug Fixes

  • remove string template from client code (91d5acd)
  • warn when singleRun and autoWatch are false (69cfc76)
  • security: remove XSS vulnerability in returnUrl query param (839578c)

v6.3.13

6.3.13 (2022-01-31)

Bug Fixes

  • deps: bump log4js to resolve security issue (5bf2df3), closes #3751

v6.3.12

6.3.12 (2022-01-24)

Bug Fixes

  • remove depreciation warning from log4js (41bed33)

v6.3.11

6.3.11 (2022-01-13)

Bug Fixes

  • deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

... (truncated)

Changelog

Sourced from karma's changelog.

6.3.16 (2022-02-10)

Bug Fixes

  • security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

6.3.15 (2022-02-05)

Bug Fixes

6.3.14 (2022-02-05)

Bug Fixes

  • remove string template from client code (91d5acd)
  • warn when singleRun and autoWatch are false (69cfc76)
  • security: remove XSS vulnerability in returnUrl query param (839578c)

6.3.13 (2022-01-31)

Bug Fixes

  • deps: bump log4js to resolve security issue (5bf2df3), closes #3751

6.3.12 (2022-01-24)

Bug Fixes

  • remove depreciation warning from log4js (41bed33)

6.3.11 (2022-01-13)

Bug Fixes

  • deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

6.3.10 (2022-01-08)

Bug Fixes

  • logger: create parent folders if they are missing (0d24bd9), closes #3734

... (truncated)

Commits
  • ab4b328 chore(release): 6.3.16 [skip ci]
  • ff7edbb fix(security): mitigate the "Open Redirect Vulnerability"
  • c1befa0 chore(release): 6.3.15 [skip ci]
  • d9dade2 fix(helper): make mkdirIfNotExists helper resilient to concurrent calls
  • 653c762 ci: prevent duplicate CI tasks on creating a PR
  • c97e562 chore(release): 6.3.14 [skip ci]
  • 91d5acd fix: remove string template from client code
  • 69cfc76 fix: warn when singleRun and autoWatch are false
  • 839578c fix(security): remove XSS vulnerability in returnUrl query param
  • db53785 chore(release): 6.3.13 [skip ci]
  • Additional commits viewable in compare view

Updates body-parser from 1.15.2 to 1.20.3

Release notes

Sourced from body-parser's releases.

1.20.3

What's Changed

Important

  • deps: [email protected]
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity). Documentation

Other changes

New Contributors

Full Changelog: expressjs/body-parser@1.20.2...1.20.3

1.20.2

  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
    • perf: skip value escaping when unnecessary
  • deps: [email protected]

1.20.1

1.20.0

... (truncated)

Changelog

Sourced from body-parser's changelog.

1.20.3 / 2024-09-10

  • deps: [email protected]
  • add depth option to customize the depth level in the parser
  • IMPORTANT: The default depth level for parsing URL-encoded data is now 32 (previously was Infinity)

1.20.2 / 2023-02-21

  • Fix strict json error message on Node.js 19+
  • deps: content-type@~1.0.5
    • perf: skip value escaping when unnecessary
  • deps: [email protected]

1.20.1 / 2022-10-06

1.20.0 / 2022-04-02

1.19.2 / 2022-02-15

1.19.1 / 2021-12-10

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by ulisesgascon, a new releaser for body-parser since your current version.


Updates braces from 0.1.5 to 1.8.5

Changelog

Sourced from braces's changelog.

[1.8.5] - 2016-05-21

  • Refactor (#10)

[1.8.4] - 2016-04-20

[1.8.0] - 2015-03-18

[1.6.0] - 2015-01-30

  • optimizations, bash mode:
  • improve path escaping

[1.5.0] - 2015-01-28

  • Merge pull request #5 from eush77/lib-files

[1.4.0] - 2015-01-24

  • add extglob tests
  • externalize exponent function
  • better whitespace handling

[1.3.0] - 2015-01-24

  • make regex patterns explicity

[1.1.0] - 2015-01-11

  • don't create a match group with makeRe

[1.0.0] - 2014-12-23

  • Merge commit '97b05f5544f8348736a8efaecf5c32bbe3e2ad6e'
  • support empty brace syntax
  • better bash coverage
  • better support for regex strings

[0.1.4] - 2014-11-14

  • improve recognition of bad args, recognize mismatched argument types
  • support escaping
  • remove pathname-expansion
  • support whitespace in patterns

... (truncated)

Commits

Updates engine.io from 1.6.10 to 6.6.4

Release notes

Sourced from engine.io's releases.

[email protected]

The bump of the cookie dependency was reverted, as it drops support for older Node.js versions (< 14).

Dependencies

[email protected]

This release contains a bump of the cookie dependency.

Release notes: https://github.com/jshttp/cookie/releases/tag/v1.0.0

Dependencies

[email protected]

Bug Fixes

Dependencies

[email protected]

Bug Fixes

  • types: remove ws type from .d.ts file (175a2c5)
  • prevent infinite loop with Node.js built-in WebSocket (4865f2e)

Dependencies

[email protected]

This release contains a bump of the cookie dependency.

See also: GHSA-pxg6-pf52-xh8x

Dependencies

[email protected]

Bug Fixes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by darrachequesne, a new releaser for engine.io since your current version.


Updates fsevents from 1.0.15 to 2.3.3

Release notes

Sourced from fsevents's releases.

Release v2.3.3

Released to npm as v2.3.3

Release v2.3.2

Released to npm as v2.3.2

Release v2.3.1

Released to npm as v2.3.1

Release contains universal binary for x86 & amd64 (m1) chips

Release v2.2.2

Released to npm as v2.2.2

Universal Binary Support x86-64 & amd64(m1)

Release v2.2.0

Electron Enabled (no static functions/variables)

Release v1.2.3

No release notes provided.

Release v2.1.2

No release notes provided.

2.1.0

Latest stable release

Release NAPI v2.0.6

Include essential files only.

Release NAPI v2.0.5

No release notes provided.

Release NAPI v2.0.4

No release notes provided.

Release NAPI v2.0.3

Moved NAPI version out of experimental.

NAPI release

No release notes provided.

deprecated

Fixing the API for chokidar since it was calling FSEvents as a constructor

deprecated

We have upgraded to N-API. For that reason we have also dropped support for node < 6.

For that reason, we have made this a major version bump so dependents have to opt in. The actual API remains entirely the same, so if you are depending on fsevents, it should be as simple as changing the version number in your package.json.

... (truncated)

Commits

Updates http-proxy from 1.15.2 to 1.18.1

Release notes

Sourced from http-proxy's releases.

Long overdue maintenance

Due to some great contributions I'm happy to announce a new release of http-proxy containing numerous bug fixes, feature additions and documentation improvements. Thanks to all who contributed for their patience and willingness to contribute despite perceived stagnation in activity in the project. I welcome all contributions and those who are interested in getting more involved with the project. Below I will highlight the changes that landed in the latest version but you can find the full diff of the changes in nodejitsu/node-http-proxy#1251

  • Add option to rewrite path of set-cookie headers. @​swillis12
  • Add option for overriding http METHOD when proxying request @​AydinChavez
  • Feature: selfHandleResponse for taking responsibility in returning your own response when listening on the proxyRes event. @​cpd0101 @​guoxiangyang
  • Add followRedirects option @​n30n0v
  • Document timeout option @​jlaamanen
  • Fix documentation typos @​carpsareokiguess
  • Document buffer option @​jonhunter1977
  • Include websocket non-upgrade response instead of just closing the socket. Allows auth schemes to be possible with websocket proxying. @​Tigge
  • Stop using the writeHead method explicitly and let node handle it internally to prevent thrown errors @​jakefurler
  • Be more defensive in handling of detecting response state when proxying @​thiagobustamante
Changelog

Sourced from http-proxy's changelog.

v1.18.1 - 2020-05-17

Merged

1.18.0 - 2019-09-18

Merged

Commits

  • [dist] New test fixtures. 7e4a0e5
  • [dist] End of an era. a9b09cc
  • [dist] Version bump. 1.18.0 9bbe486
  • [fix] Latest versions. 59c4403
  • [fix test] Update tests. dd1d08b
  • [dist] Update dependency ws to v3 [SECURITY] b00911c
  • [dist] .gitattributes all the things. fc93520
  • [dist] Regenerate package-lock.json. 16d4f8a

1.17.0 - 2018-04-20

Merged

... (truncated)

Commits
  • 9b96cd7 1.18.1
  • 335aeeb Skip sending the proxyReq event when the expect header is present (#1447)
  • dba3966 Remove node6 support, add node12 to build (#1397)
  • 9bbe486 [dist] Version bump. 1.18.0
  • 6e4bef4 Added in auto-changelog module set to keepachangelog format (#1373)
  • d056241 fix 'Modify Response' readme section to avoid unnecessary array copying (#1300)
  • 244303b Fix incorrect target name for reverse proxy example (#1135)
  • b4028ba Fix modify response middleware example (#1139)
  • 77a9815 [dist] Update dependency async to v3 (#1359)
  • c662f9e Fix path to local http-proxy in examples. (#1072)
  • Additional commits viewable in compare view

Updates log4js from 0.6.38 to 6.9.1

Changelog

Sourced from log4js's changelog.

6.9.1

6.9.0

6.8.0

6.7.1

... (truncated)

Commits
  • 26dcec6 6.9.1
  • 63ae5b9 Merge pull request #1379 from log4js-node/update-docs
  • 185fa66 docs: updated changelog for 6.9.1
  • ed54dc2 Merge pull request #1378 from log4js-node/1377-defaultparsecallstack-cant-par...
  • 2628688 fix(7922e82): regex for stacktrace
  • b3919d8 6.9.0
  • 7cfe8a4 Merge pull request #1376 from log4js-node/update-docs
  • f89e7b6 docs: updated changelog for 6.9.0
  • 0082928 Merge pull request #1375 from log4js-node/update-docs
  • c0db6a4 docs: added that log4js.getLogger() may call log4js.configure()
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by csausdev, a new releaser for log4js since your current version.


Updates mime from 1.3.4 to 2.6.0

Changelog

Sourced from mime's changelog.

2.6.0 (2021-11-02)

Features

2.5.2 (2021-02-17)

Bug Fixes

2.5.0 (2021-01-16)

Features

2.4.7 (2020-12-16)

Bug Fixes

  • update to latest mime-db (43b09ef)

2.4.6 (2020-05-27)

Bug Fixes

2.4.5 (2020-05-01)

Bug Fixes

2.4.4 (2019-06-07)

2.4.3 (2019-05-15)

2.4.2 (2019-04-07)

Bug Fixes

  • don't use arrow function introduced in 2.4.1 (2e00b5c)

2.4.1 (2019-04-03)

Bug Fixes

... (truncated)

Commits

Updates negotiator from 0.4.9 to 0.6.3

Release notes

Sourced from negotiator's releases.

0.6.3

  • Revert "Lazy-load modules from main entry point"

0.6.2

  • Fix sorting charset, encoding, and language with extra parameters

0.6.1

  • perf: improve Accept parsing speed
  • perf: improve Accept-Charset parsing speed
  • perf: improve Accept-Encoding parsing speed
  • perf: improve Accept-Language parsing speed

0.6.0

  • Fix including type extensions in parameters in Accept parsing
  • Fix parsing Accept parameters with quoted equals
  • Fix parsing Accept parameters with quoted semicolons
  • Lazy-load modules from main entry point
  • perf: delay type concatenation until needed
  • perf: enable strict mode
  • perf: hoist regular expressions
  • perf: remove closures getting spec properties
  • perf: remove a closure from media type parsing
  • perf: remove property delete from media type parsing

0.5.3

  • Fix media type parameter matching to be case-insensitive

0.5.2

  • Fix comparing media types with quoted values
  • Fix splitting media types with quoted commas

0.5.1

  • Fix preference sorting to be stable for long acceptable lists

0.5.0

  • Fix list return order when large accepted list
  • Fix missing identity encoding when q=0 exists
  • Remove dynamic building of Negotiator class
Changelog

Sourced from negotiator's changelog.

0.6.3 / 2022-01-22

  • Revert "Lazy-load modules from main entry point"

0.6.2 / 2019-04-29

  • Fix sorting charset, encoding, and language with extra parameters

0.6.1 / 2016-05-02

  • perf: improve Accept parsing speed
  • perf: improve Accept-Charset parsing speed
  • perf: improve Accept-Encoding parsing speed
  • perf: improve Accept-Language parsing speed

0.6.0 / 2015-09-29

  • Fix including type extensions in parameters in Accept parsing
  • Fix parsing Accept parameters with quoted equals
  • Fix parsing Accept parameters with quoted semicolons
  • Lazy-load modules from main entry point
  • perf: delay type concatenation until needed
  • perf: enable strict mode
  • perf: hoist regular expressions
  • perf: remove closures getting spec properties
  • perf: remove a closure from media type parsing
  • perf: remove property delete from media type parsing

0.5.3 / 2015-05-10

  • Fix media type parameter matching to be case-insensitive

0.5.2 / 2015-05-06

  • Fix comparing media types with quoted values
  • Fix splitting media types with quoted commas

0.5.1 / 2015-02-14

  • Fix preference sorting to be stable for long acceptable lists

0.5.0 / 2014-12-18

... (truncated)

Commits

Updates socket.io-parser from 2.2.2 to 4.2.4

Release notes

Sourced from socket.io-parser's releases.

4.2.4

Bug Fixes

  • ensure reserved events cannot be used as event names (d9db473)
  • properly detect plain objects (b0e6400)

Links

4.2.3

⚠️ This release contains an important security fix ⚠️

A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:

TypeError: Cannot convert object to primitive value
       at Socket.emit (node:events:507:25)
       at .../node_modules/socket.io/lib/socket.js:531:14

Please upgrade as soon as possible.

Bug Fixes

  • check the format of the event name (3b78117)

Links

4.2.2

Bug Fixes

  • calling destroy() should clear all internal state (22c42e3)
  • do not modify the input packet upon encoding (ae8dd88)

Links

4.2.1

Bug Fixes

  • check the format of the index of each attachment (b5d0cb7)

Links

... (truncated)

Changelog

Sourced from socket.io-parser's changelog.

4.2.4 (2023-05-31)

Bug Fixes

  • ensure reserved events cannot be used as event names (d9db473)
  • properly detect plain objects (b0e6400)

3.4.3 (2023-05-22)

Bug Fixes

  • check the format of the event name (2dc3c92)

4.2.3 (2023-05-22)

Bug Fixes

  • check the format of the event name (3b78117)

4.2.2 (2023-01-19)

Bug Fixes

  • calling destroy() should clear all internal state (22c42e3)
  • do not modify the input packet upon encoding (ae8dd88)

3.3.3 (2022-11-09)

Bug Fixes

  • check the format of the index of each attachment (fb21e42)

3.4.2 (2022-11-09)

... (truncated)

Commits
  • 164ba2a chore(release): 4.2.4
  • b0e6400 fix: properly detect plain objects
  • d9db473 fix: ensure reserved events cannot be used as event names
  • 6a5a004 docs(changelog): include changelog for release 3.4.3
  • b6c824f chore(release): 4.2.3
  • dcc70d9 refactor: export typescript declarations for the commonjs build
  • 3b78117 fix: check the format of the event name
  • 0841bd5 chore: bump ua-parser-js from 1.0.32 to 1.0.33 (#121)
  • 28dd668 chore(release): 4.2.2
  • 22c42e3 fix: calling destroy() should clear all internal state
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by darrachequesne, a new releaser for socket.io-parser since your current version.


Updates socket.io from 1.4.7 to 4.8.1

Release notes

Sourced from socket.io's releases.

[email protected]

Due to a change in the bundler configuration, the production bundle (socket.io.min.js) did not support sending and receiving binary data in version 4.8.0. This is now fixed.

Dependencies

[email protected]

Bug Fixes

  • bundle: do not mangle the "_placeholder" attribute (

Bumps the npm_and_yarn group with 1 update in the / directory: [karma](https://github.com/karma-runner/karma).


Updates `karma` from 1.3.0 to 6.3.16
- [Release notes](https://github.com/karma-runner/karma/releases)
- [Changelog](https://github.com/karma-runner/karma/blob/master/CHANGELOG.md)
- [Commits](karma-runner/karma@v1.3.0...v6.3.16)

Updates `body-parser` from 1.15.2 to 1.20.3
- [Release notes](https://github.com/expressjs/body-parser/releases)
- [Changelog](https://github.com/expressjs/body-parser/blob/master/HISTORY.md)
- [Commits](expressjs/body-parser@1.15.2...1.20.3)

Updates `braces` from 0.1.5 to 1.8.5
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/braces/commits/1.8.5)

Updates `engine.io` from 1.6.10 to 6.6.4
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/commits/[email protected])

Updates `fsevents` from 1.0.15 to 2.3.3
- [Release notes](https://github.com/fsevents/fsevents/releases)
- [Commits](fsevents/fsevents@v1.0.15...v2.3.3)

Updates `http-proxy` from 1.15.2 to 1.18.1
- [Release notes](https://github.com/http-party/node-http-proxy/releases)
- [Changelog](https://github.com/http-party/node-http-proxy/blob/master/CHANGELOG.md)
- [Commits](http-party/node-http-proxy@1.15.2...1.18.1)

Updates `log4js` from 0.6.38 to 6.9.1
- [Changelog](https://github.com/log4js-node/log4js-node/blob/master/CHANGELOG.md)
- [Commits](log4js-node/log4js-node@v0.6.38...v6.9.1)

Updates `mime` from 1.3.4 to 2.6.0
- [Release notes](https://github.com/broofa/mime/releases)
- [Changelog](https://github.com/broofa/mime/blob/main/CHANGELOG.md)
- [Commits](broofa/mime@v1.3.4...v2.6.0)

Updates `negotiator` from 0.4.9 to 0.6.3
- [Release notes](https://github.com/jshttp/negotiator/releases)
- [Changelog](https://github.com/jshttp/negotiator/blob/master/HISTORY.md)
- [Commits](jshttp/negotiator@0.4.9...0.6.3)

Updates `socket.io-parser` from 2.2.2 to 4.2.4
- [Release notes](https://github.com/Automattic/socket.io-parser/releases)
- [Changelog](https://github.com/socketio/socket.io-parser/blob/4.2.4/CHANGELOG.md)
- [Commits](socketio/socket.io-parser@2.2.2...4.2.4)

Updates `socket.io` from 1.4.7 to 4.8.1
- [Release notes](https://github.com/socketio/socket.io/releases)
- [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md)
- [Commits](https://github.com/socketio/socket.io/compare/[email protected])

Updates `ws` from 1.0.1 to 8.17.1
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](websockets/ws@1.0.1...8.17.1)

---
updated-dependencies:
- dependency-name: karma
  dependency-version: 6.3.16
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: body-parser
  dependency-version: 1.20.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: braces
  dependency-version: 1.8.5
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: engine.io
  dependency-version: 6.6.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: fsevents
  dependency-version: 2.3.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: http-proxy
  dependency-version: 1.18.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: log4js
  dependency-version: 6.9.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: mime
  dependency-version: 2.6.0
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: negotiator
  dependency-version: 0.6.3
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: socket.io-parser
  dependency-version: 4.2.4
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: socket.io
  dependency-version: 4.8.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: ws
  dependency-version: 8.17.1
  dependency-type: indirect
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants