chore(deps): Bump the npm_and_yarn group across 54 directories with 19 updates

[dependabot]

Bumps the npm_and_yarn group with 9 updates in the / directory:

Package	From	To
gh-pages	3.2.3	5.0.0
braces	3.0.2	3.0.3
gulp	4.0.2	5.0.0
ejs	3.1.9	3.1.10
tar	6.1.11	6.2.1
lerna	7.4.1	8.1.5
@lerna/legacy-package-management	7.4.1	8.1.5
tough-cookie	4.1.3	4.1.4
ws	8.17.0	8.17.1

Bumps the npm_and_yarn group with 10 updates in the /examples directory:

Package	From	To
braces	3.0.2	3.0.3
ejs	3.1.8	3.1.10
follow-redirects	1.15.2	1.15.6
ip	2.0.0	removed
socks	2.7.1	2.8.3
tar	6.1.13	6.2.1
ws	8.17.0	8.17.1
express	4.18.2	4.19.2
webpack-dev-middleware	5.3.3	5.3.4
postcss	8.4.27	8.4.39

Bumps the npm_and_yarn group with 1 update in the /examples/backpack-demo directory: ws.
Bumps the npm_and_yarn group with 4 updates in the /examples/blockly-angular directory: braces, tar, ws and socket.io.
Bumps the npm_and_yarn group with 4 updates in the /examples/blockly-react directory: braces, ejs, tough-cookie and ws.
Bumps the npm_and_yarn group with 7 updates in the /examples/blockly-rtc directory:

Package	From	To
braces	3.0.2	3.0.3
webpack	4.42.1	5.92.1
webpack-cli	3.3.12	5.1.4
webpack-dev-server	3.11.0	5.0.4
ip	1.1.9	removed
socks	2.6.2	2.8.3
socket.io	4.7.2	4.7.5

Bumps the npm_and_yarn group with 2 updates in the /examples/blockly-svelte directory: braces and ws.
Bumps the npm_and_yarn group with 3 updates in the /examples/blockly-vue3 directory: braces, ws and postcss.
Bumps the npm_and_yarn group with 1 update in the /examples/custom-dialogs-demo directory: ws.
Bumps the npm_and_yarn group with 3 updates in the /examples/custom-generator-codelab directory: braces, ws and postcss.
Bumps the npm_and_yarn group with 3 updates in the /examples/custom-renderer-codelab directory: braces, ws and postcss.
Bumps the npm_and_yarn group with 1 update in the /examples/custom-tooltips-demo directory: ws.
Bumps the npm_and_yarn group with 8 updates in the /examples/developer-tools directory:

Package	From	To
braces	3.0.2	3.0.3
ejs	3.1.9	3.1.10
follow-redirects	1.15.2	1.15.6
tar	6.2.0	6.2.1
ws	8.17.0	8.17.1
express	4.18.2	4.19.2
webpack-dev-middleware	5.3.3	5.3.4
postcss	8.4.27	8.4.39

Bumps the npm_and_yarn group with 1 update in the /examples/devsite-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /examples/devsite-landing-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /examples/fixed-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /examples/generator-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /examples/graph-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /examples/headless-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /examples/interpreter-demo directory: ws.
Bumps the npm_and_yarn group with 3 updates in the /examples/keyboard-navigation-codelab directory: braces, ws and postcss.
Bumps the npm_and_yarn group with 1 update in the /examples/max-blocks-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /examples/mirror-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /examples/pitch-field-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /examples/resizable-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /examples/rtl-demo directory: ws.
Bumps the npm_and_yarn group with 3 updates in the /examples/sample-app directory: braces, ws and postcss.
Bumps the npm_and_yarn group with 3 updates in the /examples/sample-app-ts directory: braces, ws and postcss.
Bumps the npm_and_yarn group with 1 update in the /examples/single-direction-scroll-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /examples/toolbox-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /examples/turtle-field-demo directory: ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/block-dynamic-connection directory: braces.
Bumps the npm_and_yarn group with 1 update in the /plugins/block-plus-minus directory: braces.
Bumps the npm_and_yarn group with 2 updates in the /plugins/block-shareable-procedures directory: tough-cookie and ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/block-test directory: ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/continuous-toolbox directory: ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/cross-tab-copy-paste directory: ws.
Bumps the npm_and_yarn group with 2 updates in the /plugins/dev-scripts directory: braces and ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/disable-top-blocks directory: ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/eslint-config directory: braces.
Bumps the npm_and_yarn group with 1 update in the /plugins/field-bitmap directory: braces.
Bumps the npm_and_yarn group with 1 update in the /plugins/field-colour directory: braces.
Bumps the npm_and_yarn group with 1 update in the /plugins/fixed-edges directory: ws.
Bumps the npm_and_yarn group with 3 updates in the /plugins/keyboard-navigation directory: braces, tough-cookie and ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/migration directory: braces.
Bumps the npm_and_yarn group with 3 updates in the /plugins/modal directory: braces, tough-cookie and ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/theme-dark directory: ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/theme-deuteranopia directory: ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/theme-hackermode directory: ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/theme-highcontrast directory: ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/theme-modern directory: ws.
Bumps the npm_and_yarn group with 1 update in the /plugins/theme-tritanopia directory: ws.
Bumps the npm_and_yarn group with 3 updates in the /plugins/typed-variable-modal directory: braces, tough-cookie and ws.
Bumps the npm_and_yarn group with 2 updates in the /plugins/workspace-search directory: tough-cookie and ws.

Updates gh-pages from 3.2.3 to 5.0.0

Release notes

Sourced from gh-pages's releases.

v5.0.0

Potentially breaking change: the publish method now always returns a promise. Previously, it did not return a promise in some error cases. This should not impact most users.

Updates to the development dependencies required a minimum Node version of 14 for the tests. The library should still work on Node 12, but tests are no longer run in CI for version 12. A future major version of the library may drop support for version 12 altogether.

What's Changed

• Assorted updates by @​tschaub in tschaub/gh-pages#452
• Update README to clarify project site configuration requirements with tools like CRA, webpack, Vite, etc. by @​Nezteb in tschaub/gh-pages#445
• Bump actions/checkout from 2 to 3 by @​dependabot in tschaub/gh-pages#453
• Bump actions/setup-node from 1 to 3 by @​dependabot in tschaub/gh-pages#455
• Bump email-addresses from 3.0.1 to 5.0.0 by @​dependabot in tschaub/gh-pages#454
• Bump async from 2.6.4 to 3.2.4 by @​dependabot in tschaub/gh-pages#459
• Remove quotation marks by @​Vicropht in tschaub/gh-pages#438

New Contributors

• @​Nezteb made their first contribution in tschaub/gh-pages#445
• @​Vicropht made their first contribution in tschaub/gh-pages#438

Full Changelog: tschaub/gh-pages@v4.0.0...v5.0.0

v4.0.0

This release doesn't include any breaking changes, but due to updated development dependencies, tests are no longer run on Node 10.

What's Changed

• Bump minimist from 1.2.5 to 1.2.6 by @​dependabot in tschaub/gh-pages#423
• Bump async from 2.6.1 to 2.6.4 by @​dependabot in tschaub/gh-pages#427
• Bump path-parse from 1.0.6 to 1.0.7 by @​dependabot in tschaub/gh-pages#431
• Bump ansi-regex from 3.0.0 to 3.0.1 by @​dependabot in tschaub/gh-pages#430
• Updated dev dependencies and formatting by @​tschaub in tschaub/gh-pages#432

Full Changelog: tschaub/gh-pages@v3.2.3...v4.0.0

Changelog

Sourced from gh-pages's changelog.

v5.0.0

Potentially breaking change: the publish method now always returns a promise. Previously, it did not return a promise in some error cases. This should not impact most users.

Updates to the development dependencies required a minimum Node version of 14 for the tests. The library should still work on Node 12, but tests are no longer run in CI for version 12. A future major version of the library may drop support for version 12 altogether.

• #438 - Remove quotation marks (@​Vicropht)
• #459 - Bump async from 2.6.4 to 3.2.4 (@​tschaub)
• #454 - Bump email-addresses from 3.0.1 to 5.0.0 (@​tschaub)
• #455 - Bump actions/setup-node from 1 to 3 (@​tschaub)
• #453 - Bump actions/checkout from 2 to 3 (@​tschaub)
• #445 - Update README to clarify project site configuration requirements with tools like CRA, webpack, Vite, etc. (@​Nezteb)
• #452 - Assorted updates (@​tschaub)

v4.0.0

This release doesn't include any breaking changes, but due to updated development dependencies, tests are no longer run on Node 10.

• #432 - Updated dev dependencies and formatting (@​tschaub)
• #430 - Bump ansi-regex from 3.0.0 to 3.0.1 (@​tschaub)
• #431 - Bump path-parse from 1.0.6 to 1.0.7 (@​tschaub)
• #427 - Bump async from 2.6.1 to 2.6.4 (@​tschaub)
• #423 - Bump minimist from 1.2.5 to 1.2.6 (@​tschaub)

Commits

• f729b97 5.0.0
• 51534c7 Log changes
• ace063b Merge pull request #438 from Vicropht/patch-1
• 58e54be Merge pull request #459 from tschaub/dependabot/npm_and_yarn/async-3.2.4
• 2189df3 Bump async from 2.6.4 to 3.2.4
• 051846e Merge pull request #454 from tschaub/dependabot/npm_and_yarn/email-addresses-...
• 5c91c67 Merge pull request #455 from tschaub/dependabot/github_actions/actions/setup-...
• fe0ad83 Merge pull request #453 from tschaub/dependabot/github_actions/actions/checko...
• b89287d Merge pull request #445 from Nezteb/patch-1
• e890bd1 Bump email-addresses from 3.0.1 to 5.0.0
• Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

• 74b2db2 3.0.3
• 88f1429 update eslint. lint, fix unit tests.
• 415d660 Snyk js braces 6838727 (#40)
• 190510f fix tests, skip 1 test in test/braces.expand
• 716eb9f readme bump
• a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
• 2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
• 9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
• 98414f9 remove funding file
• 665ab5d update keepEscaping doc (#27)
• Additional commits viewable in compare view

Updates gulp from 4.0.2 to 5.0.0

Release notes

Sourced from gulp's releases.

gulp v5.0.0

We've tried to provide a high-level changelog for gulp v5 below, but it doesn't contain all changes from the 60+ dependencies that we maintain.

Please see individual changelogs to drill down into all changes that were made.

⚠ BREAKING CHANGES

• Drop support for Node.js <10.13
• Default stream encoding to UTF-8
• Standardized on anymatch library for globbing paths. All globs should work the same between src and watch now!
• Removed support for ordered globs. This aligns with the chokidar globbing implementation. If you need your globs to be ordered, you can use ordered-read-stream
• All globs and paths are normalized to unix-like filepaths
• Only allow JS variants for .gulp.* config files
• Removed support for alpha releases of v4 from gulp-cli
• Removed the --verify flag
• Renamed the --require flag to --preload to avoid conflicting with Node.js flags
• Removed many legacy and deprecated loaders
• Upgrade to chokidar v3
• Clone Vinyl objects with stream contents using teex, but no longer wait for all streams to flow before cloned streams will receive data
• Stop using process.umask() to make directories, instead falling back to Node's default mode
• Throw on non-function, non-string option coercers
• Drop support of Node.js snake_case flags
• Use a Symbol for attaching the gulplog namespace to the store
• Use a Symbol for attaching the gulplog store to the global
• Use sha256 to hash the v8flags cache into a filename

Features

• Streamlined the dependency tree
• Switch all streams implementation to Streamx
• Rewrote glob-stream to use a custom directory walk that relies on newer Node.js features and is more performant than old implementation
• Implement translation support for all CLI messages and all messages passing through gulplog
• Allow users to customize or remove the timestamp from their logs
• Upgraded gulplog to v2. Messages logged via v1 will also display a deprecated warning. Plugins should update to v2 as the community upgrades to gulp 5
• Added support for gulpile.cjs and gulpfile.mjs
• Add support for swc, esbuild, sucrase, and mdx loaders
• Provide an ESM export (#2760) (b00de68)
• Support sourcemap handling on streaming Vinyl contents
• Support extends syntax for .gulp.* config file
• Allow overriding gulpfile and preloads via .gulp.* config file

Bug Fixes

• Resolve bugs related to symlinks on various platforms
• Resolved some reported ReDoS CVEs and improved performance in glob-parent
• Rework errors surfaced when encountering files or symlinks when trying to create directories
• Ensure watch allows japanese characters in globs (72668c6)

... (truncated)

Changelog

Sourced from gulp's changelog.

5.0.0 (2024-03-29)

We've tried to provide a high-level changelog for gulp v5 below, but it doesn't contain all changes from the 60+ dependencies that we maintain.

Please see individual changelogs to drill down into all changes that were made.

⚠ BREAKING CHANGES

• Drop support for Node.js <10.13
• Default stream encoding to UTF-8
• Standardized on anymatch library for globbing paths. All globs should work the same between src and watch now!
• Removed support for ordered globs. This aligns with the chokidar globbing implementation. If you need your globs to be ordered, you can use ordered-read-stream
• All globs and paths are normalized to unix-like filepaths
• Only allow JS variants for .gulp.* config files
• Removed support for alpha releases of v4 from gulp-cli
• Removed the --verify flag
• Renamed the --require flag to --preload to avoid conflicting with Node.js flags
• Removed many legacy and deprecated loaders
• Upgrade to chokidar v3
• Clone Vinyl objects with stream contents using teex, but no longer wait for all streams to flow before cloned streams will receive data
• Stop using process.umask() to make directories, instead falling back to Node's default mode
• Throw on non-function, non-string option coercers
• Drop support of Node.js snake_case flags
• Use a Symbol for attaching the gulplog namespace to the store
• Use a Symbol for attaching the gulplog store to the global
• Use sha256 to hash the v8flags cache into a filename

Features

• Streamlined the dependency tree
• Switch all streams implementation to Streamx
• Rewrote glob-stream to use a custom directory walk that relies on newer Node.js features and is more performant than old implementation
• Implement translation support for all CLI messages and all messages passing through gulplog
• Allow users to customize or remove the timestamp from their logs
• Upgraded gulplog to v2. Messages logged via v1 will also display a deprecated warning. Plugins should update to v2 as the community upgrades to gulp 5
• Added support for gulpile.cjs and gulpfile.mjs
• Add support for swc, esbuild, sucrase, and mdx loaders
• Provide an ESM export (#2760) (b00de68)
• Support sourcemap handling on streaming Vinyl contents
• Support extends syntax for .gulp.* config file
• Allow overriding gulpfile and preloads via .gulp.* config file

Bug Fixes

• Resolve bugs related to symlinks on various platforms
• Resolved some reported ReDoS CVEs and improved performance in glob-parent
• Rework errors surfaced when encountering files or symlinks when trying to create directories
• Ensure watch allows japanese characters in globs (72668c6)

... (truncated)

Commits

• 5c4c547 chore: Release 5.0.0 (#2762)
• bf72116 chore: Add index.mjs to files list
• b00de68 feat: Provide an ESM export (#2760)
• 72668c6 chore!: Normalize repository, dropping node <10.13 support (#2758)
• 85896d4 chore(docs): Update stream handbook link (#2711)
• 818bd73 Docs: Remove gulp-sourcemaps because it is built-in (#2592)
• 598f971 Docs: Fix broken link in recipe (#2571)
• 9877de0 Docs: Guide CustomRegistries to maintain properties on tasks (fixes #2561) (#...
• f91c388 Docs: Remove typo in custom registry docs (#2543)
• df25250 Docs: Fix typo in task docs (#2524)
• Additional commits viewable in compare view

Updates ejs from 3.1.9 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

Commits

• d3f807d Version 3.1.10
• 9ee26dd Mocha TDD
• e469741 Basic pollution protection
• 715e950 Merge pull request #756 from Jeffrey-mu/main
• cabe314 Include advanced usage examples
• 29b076c Added header
• 11503c7 Merge branch 'main' of github.com:mde/ejs into main
• 7690404 Added security banner to README
• f47d7ae Update SECURITY.md
• 828cea1 Update SECURITY.md
• Additional commits viewable in compare view

Updates tar from 6.1.11 to 6.2.1

Release notes

Sourced from tar's releases.

v6.1.13

6.1.13 (2022-12-07)

Dependencies

• cc4e0dd #343 bump minipass from 3.3.6 to 4.0.0

v6.1.12

6.1.12 (2022-10-31)

Bug Fixes

• 57493ee #332 ensuring close event is emited after stream has ended (@​webark)
• b003c64 #314 replace deprecated String.prototype.substr() (#314) (@​CommanderRoot, @​lukekarrys)

Documentation

• f129929 #313 remove dead link to benchmarks (#313) (@​yetzt)
• c1faa9f add examples/explanation of using tar.t (@​isaacs)

Changelog

Sourced from tar's changelog.

Changelog

7.4

• Deprecate onentry in favor of onReadEntry for clarity.

7.3

• Add onWriteEntry option

7.2

• DRY the command definitions into a single makeCommand method, and update the type signatures to more appropriately infer the return type from the options and arguments provided.

7.1

• Update minipass to v7.1.0
• Update the type definitions of write() and end() methods on Unpack and Parser classes to be compatible with the NodeJS.WritableStream type in the latest versions of @types/node.

7.0

• Rewrite in TypeScript, provide ESM and CommonJS hybrid interface
• Add tree-shake friendly exports, like import('tar/create') and import('tar/read-entry') to get individual functions or classes.
• Add chmod option that defaults to false, and deprecate noChmod. That is, reverse the default option regarding explicitly setting file system modes to match tar entry settings.
• Add processUmask option to avoid having to call process.umask() when chmod: true (or noChmod: false) is set.

6.2

• Add support for brotli compression
• Add maxDepth option to prevent extraction into excessively deep folders.

6.1

• remove dead link to benchmarks (#313) (@​yetzt)
• add examples/explanation of using tar.t (@​isaacs)
• ensure close event is emited after stream has ended (@​webark)

... (truncated)

Commits

• bef7b1e 6.2.1
• fe8cd57 prevent extraction in excessively deep subfolders
• fe7ebfd remove security.md
• 5bc9d40 6.2.0
• fe1ef5e changelog 6.2
• e483220 get rid of npm lint stuff
• 689928a ci that works outside of npm org
• db6f539 file inference improvements for .tbr and .tgz
• 336fa8f refactor: dry and other pr comments
• eeba222 chore: lint fixes
• Additional commits viewable in compare view

Updates lerna from 7.4.1 to 8.1.5

Release notes

Sourced from lerna's releases.

v8.1.5

8.1.5 (2024-06-24)

Bug Fixes

• update npm utility dependencies and related packages (#4033) (bd1c2d8)

v8.1.4

8.1.4 (2024-06-09)

Bug Fixes

• specify 'dependencies: true' when prepping task runner options (#4017) (244462d)

v8.1.3

8.1.3 (2024-05-13)

Bug Fixes

• deps: bump tar from 6.1.11 to 6.2.1 (#3990) (3fe0cf0)
• list: flush output before exiting (#3971) (6426da8)
• update to nx 19 (#4003) (03f476b)
• version: create release when using custom tag-version-separator (#3979) (cbe01ba)

v8.1.2

8.1.2 (2024-02-05)

Bug Fixes

• improve git binary error (#3945) (7637972)

v8.1.1

8.1.1 (2024-02-05)

Bug Fixes

• list: explicitly exit upon completion (bafe090)

v8.1.0

8.1.0 (2024-02-05)

Features

• support nx v18 (#3950) (ea3fb65)
• version: custom tag-version-separator for independent projects (#3951) (43de79c)

... (truncated)

Changelog

Sourced from lerna's changelog.

8.1.5 (2024-06-24)

Bug Fixes

• update npm utility dependencies and related packages (#4033) (bd1c2d8)

8.1.4 (2024-06-09)

Note: Version bump only for package lerna

8.1.3 (2024-05-13)

Bug Fixes

• deps: bump tar from 6.1.11 to 6.2.1 (#3990) (3fe0cf0)
• update to nx 19 (#4003) (03f476b)

8.1.2 (2024-02-05)

Note: Version bump only for package lerna

8.1.1 (2024-02-05)

Note: Version bump only for package lerna

8.1.0 (2024-02-05)

Features

• support nx v18 (#3950) (ea3fb65)

8.0.2 (2024-01-05)

Bug Fixes

• add-caching: explicitly set targetDefaults for all scripts (#3929) (dae18c9)

8.0.1 (2023-12-15)

Bug Fixes

• update node-gyp usage to v10 to resolve npm warning (#3919) (f5fdcba)

8.0.0 (2023-11-23)

Features

• version: add --premajor-version-bump option to force patch bumps for non-breaking changes in premajor packages (#3876) (3b05947)

8.0.0-alpha.0 (2023-11-22)

... (truncated)

Commits

• 3f91a34 chore(misc): publish 8.1.5
• bd1c2d8 fix: update npm utility dependencies and related packages (#4033)
• 7bd9835 chore(misc): publish 8.1.4
• 65657cd chore: set corepack env vars in workflow (#4015)
• 059864f chore(misc): publish 8.1.3
• 03f476b fix: update to nx 19 (#4003)
• 3fe0cf0 fix(deps): bump tar from 6.1.11 to 6.2.1 (#3990)
• bb68e00 chore: update snapshots (#3968)
• 13c80ae chore: unset GITHUB_ACTIONS environment variable in other node versions workflow
• 9a4ad5e chore(misc): publish 8.1.2
• Additional commits viewable in compare view

Updates @lerna/legacy-package-management from 7.4.1 to 8.1.5

Release notes

Sourced from @​lerna/legacy-package-management's releases.

v8.1.5

8.1.5 (2024-06-24)

Bug Fixes

• update npm utility dependencies and related packages (#4033) (bd1c2d8)

v8.1.4

8.1.4 (2024-06-09)

Bug Fixes

• specify 'dependencies: true' when prepping task runner options (#4017) (244462d)

v8.1.3

8.1.3 (2024-05-13)

Bug Fixes

• deps: bump tar from 6.1.11 to 6.2.1 (#3990) (3fe0cf0)
• list: flush output before exiting (#3971) (6426da8)
• update to nx 19 (#4003) (03f476b)
• version: create release when using custom tag-version-separator (#3979) (cbe01ba)

v8.1.2

8.1.2 (2024-02-05)

Bug Fixes

• improve git binary error (#3945) (7637972)

v8.1.1

8.1.1 (2024-02-05)

Bug Fixes

• list: explicitly exit upon completion (bafe090)

v8.1.0

8.1.0 (2024-02-05)

Features

• support nx v18 (#3950) (ea3fb65)
• version: custom tag-version-separator for independent projects (#3951) (43de79c)

... (truncated)

Changelog

Sourced from @​lerna/legacy-package-management's changelog.

8.1.5 (2024-06-24)

Bug Fixes

• update npm utility dependencies and related packages (#4033) (bd1c2d8)

8.1.4 (2024-06-09)

Note: Version bump only for package @​lerna/legacy-package-management

8.1.3 (2024-05-13)

Bug Fixes

• deps: bump tar from 6.1.11 to 6.2.1 (#3990) (3fe0cf0)
• update to nx 19 (#4003) (03f476b)

8.1.2 (2024-02-05)

Note: Version bump only for package @​lerna/legacy-package-management

8.1.1 (2024-02-05)

Note: Version bump only for package @​lerna/legacy-package-management

8.1.0 (2024-02-05)

Note: Version bump only for package @​lerna/legacy-package-management

8.0.2 (2024-01-05)

Note: Version bump only for package @​lerna/legacy-package-management

8.0.1 (2023-12-15)

Bug Fixes

• update node-gyp usage to v10 to resolve npm warning (#3919) (f5fdcba)

8.0.0 (2023-11-23)

Note: Version bump only for package @​lerna/legacy-package-management

8.0.0-alpha.0 (2023-11-22)

Note: Version bump only for package @​lerna/legacy-package-management

7.4.2 (2023-10-27)

Note: Version bump only for package @​lerna/legacy-package-management

Commits

• 3f91a34 chore(misc): publish 8.1.5
• bd1c2d8 fix: update npm utility dependencies and related packages (#4033)
• 7bd9835 chore(misc): publish 8.1.4
• 059864f chore(misc): publish 8.1.3
• 03f476b fix: update to nx 19 (#4003)
• 3fe0cf0 fix(deps): bump tar from 6.1.11 to 6.2.1 (#3990)
• 13c80ae chore: unset GITHUB_ACTIONS environment variable in other node versions workflow
• 9a4ad5e chore(misc): publish 8.1.2
• b2b8b7d chore(misc): publish 8.1.1
• 8c7316e chore(misc): publish 8.1.0
• Additional commits viewable in compare view

Updates tough-cookie from 4.1.3 to 4.1.4

Release notes

Sourced from tough-cookie's releases.

v4.1.4

https://www.npmjs.com/package/tough-cookie/v/4.1.4

What's Changed

• Add local alias for toString by @​corvidism in salesforce/tough-cookie#409
• Fix incorrect string validation for URL by @​coditva in salesforce/tough-cookie#261

New Contributors

• @​corvidism made their first contribution in salesforce/tough-cookie#409
• @​coditva made their first contribution in salesforce/tough-cookie#261

Full Changelog: salesforce/tough-cookie@v4.1.3...v4.1.4

Commits

• cacbc37 Bump version to 4.1.4
• a48fb3a Add tests for url validation
• 50e69bf Merge pull request #261 from postmanlabs/fix/url-string-validation
• 1253d58 Merge pull request #409 from corvidism/validators-to-string
• 238367e Add local alias for toString
• cf6debd Fix incorrect string validation for URL
• See full diff in compare view

Maintainer changes

This version was pushed to npm by ccasey, a new releaser for tough-cookie since your current version.

Updates ws from 8.17.0 to 8.17.1

Release notes

Sourced from ws's releases.

8.17.1

Bug fixes

• Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

In vulnerable versions of ws, the issue can be mitigated in the following ways:

1. Reduce the maximum allowed length of the request headers using the [--max-http-header-size=size][] and/or the [maxHeaderSize][] options so that no more headers than the server.maxHeadersCount limit can be sent.

... (truncated)

Commits

• 3c56601 [dist] 8.17.1
• e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
• 6a00029 [test] Increase code coverage
• ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
• See full diff in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

• 74b2db2 3.0.3
• 88f1429 ...

  Description has been truncated