Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update all non-major dependencies #10

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Nov 1, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@rspack/core (source) 1.0.14 -> 1.1.8 age adoption passing confidence
@types/node (source) ^22.8.7 -> ^22.10.2 age adoption passing confidence
execa 9.5.1 -> 9.5.2 age adoption passing confidence
pnpm (source) 9.12.3 -> 9.15.1 age adoption passing confidence
typescript (source) 5.6.3 -> 5.7.2 age adoption passing confidence

Release Notes

web-infra-dev/rspack (@​rspack/core)

v1.1.8

Security Vulnerability Report

Overview

This is a re-release version of v1.1.6

On 12/19/2024, 02:01 (UTC), we discovered that our npm packages @rspack/core and @rspack/cli were maliciously attacked. The attacker released v1.1.7 using a compromised npm token, which contained malicious code. We took immediate action upon discovering the issue.

Impact

  • Affected versions: @rspack/core and @rspack/cli v1.1.7
  • Duration: 12/19/2024, 02:01 (UTC), lasting approximately 1 hour
  • Malicious code impact: After npm install, the postinstall script in package.json runs malicious code in dist/util/support.js. See Malicious code analysis for more details.

Actions Taken

Upon discovery, we immediately deprecated the affected v1.1.7, redirected the npm latest tag to v1.1.6, and reset all related tokens.
Subsequently, we released a secure new version v1.1.8.

Recommended Actions

If you installed v1.1.7 during the affected period, please:

  1. Update to the latest safe version immediately: @rspack/core and @rspack/cli to >= 1.1.8
  2. Check your system for any unusual activity

Apology and Commitment

We deeply apologize for the risks caused by this incident. To prevent similar incidents from happening again, we will implement stricter token management protocols and enhance our security review processes.

If you have any questions or discover any suspicious activity, please create an issue or send an email to: web-infra-security@bytedance.com

We will continue to follow and respond to community feedback.

v1.1.6

Compare Source

What's Changed

Highlights 💡

Reduced memory usage

Rspack's memory usage in large projects has been significantly reduced since v1.1.6:

Related PRs:

Performance Improvements ⚡
Exciting New Features 🎉
Bug Fixes 🐞
Document Updates 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rspack@v1.1.5...v1.1.6

v1.1.5

Compare Source

What's Changed

Performance Improvements ⚡
Exciting New Features 🎉
Bug Fixes 🐞
Document Updates 📖
Other Changes

Full Changelog: web-infra-dev/rspack@v1.1.4...v1.1.5

v1.1.4

Compare Source

What's Changed

Exciting New Features 🎉
Bug Fixes 🐞
Document Updates 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rspack@v1.1.3...v1.1.4

v1.1.3

Compare Source

What's Changed
Performance Improvements ⚡
Exciting New Features 🎉
Bug Fixes 🐞
Other Changes

Full Changelog: web-infra-dev/rspack@v1.1.2...v1.1.3

v1.1.2

Compare Source

What's Changed

💡 Highlights

DefinePlugin destructuring optimization

Rspack v1.1.2 improved the output of DefinePlugin by eliminating unused object properties from the final bundle, resulting in a smaller output size:

Exciting New Features 🎉
Bug Fixes 🐞
Document Updates 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rspack@v1.1.1...v1.1.2

v1.1.1

Compare Source

💡 Highlights
Support for DllPlugin

This release introduced rspack.DllPlugin and rspack.DllReferencePlugin in #​8296 to be compatible with webpack's DLLPlugin and DllReferencePlugin.

DLL plugins help you improve build performance by separating rarely-changed code (like vendor dependencies) into separate bundles. The term "DLL" stands for Dynamic-link library. See here for more information.

What's Changed
Exciting New Features 🎉
Bug Fixes 🐞
Document Updates 📖
Other Changes

Full Changelog: web-infra-dev/rspack@v1.1.0...v1.1.1

v1.1.0

Compare Source

See Announcing Rspack 1.1 for more details.
What's Changed
Performance Improvements ⚡
Exciting New Features 🎉
Bug Fixes 🐞
Document Updates 📖

Configuration

📅 Schedule: Branch creation - "* 0-3 1 * *" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot changed the title chore(deps): update node.js to >=16.20.2 chore(deps): update node.js to >=16.20.2 - autoclosed Nov 1, 2024
@renovate renovate bot closed this Nov 1, 2024
@renovate renovate bot deleted the renovate/all-minor-patch branch November 1, 2024 03:13
@renovate renovate bot restored the renovate/all-minor-patch branch November 3, 2024 04:31
@renovate renovate bot changed the title chore(deps): update node.js to >=16.20.2 - autoclosed chore(deps): update node.js to >=16.20.2 Nov 3, 2024
@renovate renovate bot reopened this Nov 3, 2024
@renovate renovate bot changed the title chore(deps): update node.js to >=16.20.2 chore(deps): update dependency @types/node to ^20.17.6 Nov 3, 2024
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from c8ea248 to f638de2 Compare November 3, 2024 06:46
@renovate renovate bot changed the title chore(deps): update dependency @types/node to ^20.17.6 chore(deps): update dependency @types/node to ^20.17.6 - autoclosed Nov 3, 2024
@renovate renovate bot closed this Nov 3, 2024
@renovate renovate bot deleted the renovate/all-minor-patch branch November 3, 2024 12:55
@renovate renovate bot restored the renovate/all-minor-patch branch November 5, 2024 01:45
@renovate renovate bot changed the title chore(deps): update dependency @types/node to ^20.17.6 - autoclosed chore(deps): update dependency @types/node to ^20.17.6 Nov 5, 2024
@renovate renovate bot reopened this Nov 5, 2024
@renovate renovate bot changed the title chore(deps): update dependency @types/node to ^20.17.6 chore(deps): update dependency @types/node to ^22.9.0 Nov 5, 2024
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 0021d30 to 07bc3e1 Compare November 7, 2024 07:30
@renovate renovate bot changed the title chore(deps): update dependency @types/node to ^22.9.0 chore(deps): update all non-major dependencies Nov 7, 2024
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 4 times, most recently from ca9a134 to a0a08e6 Compare November 15, 2024 05:08
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 8 times, most recently from d365d28 to bb1e813 Compare November 23, 2024 07:22
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 6 times, most recently from c12079c to 24c6746 Compare November 29, 2024 13:54
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 3 times, most recently from be3d092 to 8cee1c3 Compare December 8, 2024 00:28
@renovate renovate bot changed the title chore(deps): update all non-major dependencies chore(deps): update pnpm to v9.15.0 Dec 8, 2024
@renovate renovate bot changed the title chore(deps): update pnpm to v9.15.0 chore(deps): update all non-major dependencies Dec 8, 2024
@renovate renovate bot force-pushed the renovate/all-minor-patch branch 2 times, most recently from 851a87a to 7d344f9 Compare December 11, 2024 14:26
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 7d344f9 to 65ea957 Compare December 19, 2024 06:57
@renovate renovate bot force-pushed the renovate/all-minor-patch branch from 65ea957 to 216ff26 Compare December 20, 2024 01:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants