Bump the npm_and_yarn group across 1 directory with 12 updates #10

dependabot · 2024-05-01T08:55:19Z

Bumps the npm_and_yarn group with 12 updates in the / directory:

Package	From	To
async	`2.4.1`	`2.6.4`
ejs	`2.5.6`	`3.1.10`
express	`4.16.0`	`4.19.2`
extend	`3.0.1`	`3.0.2`
ip	`1.1.5`	`1.1.9`
js-yaml	`3.10.0`	`3.13.1`
lodash	`4.17.4`	`4.17.21`
redis	`2.7.1`	`3.1.1`
semver	`5.3.0`	`5.7.2`
socket.io	`2.0.3`	`2.4.0`
grunt	`1.0.1`	`1.5.3`
moment	`2.19.3`	`2.29.4`

Updates async from 2.4.1 to 2.6.4

Changelog

Sourced from async's changelog.

v2.6.4

Fix potential prototype pollution exploit (#1828)

v2.6.3

Updated lodash to squelch a security warning (#1675)

v2.6.2

Updated lodash to squelch a security warning (#1620)

v2.6.1

Updated lodash to prevent npm audit warnings. (#1532, #1533)

Made async-es more optimized for webpack users (#1517)

Fixed a stack overflow with large collections and a synchronous iterator (#1514)

Various small fixes/chores (#1505, #1511, #1527, #1530)

v2.6.0

Added missing aliases for many methods. Previously, you could not (e.g.) require('async/find') or use async.anyLimit. (#1483)

Improved queue performance. (#1448, #1454)

Add missing sourcemap (#1452, #1453)

Various doc updates (#1448, #1471, #1483)

v2.5.0

Added concatLimit, the Limit equivalent of concat (#1426, #1430)

concat improvements: it now preserves order, handles falsy values and the iteratee callback takes a variable number of arguments (#1437, #1436)

Fixed an issue in queue where there was a size discrepancy between workersList().length and running() (#1428, #1429)

Various doc fixes (#1422, #1424)

Commits

c6bdaca Version 2.6.4
8870da9 Update built files
4df6754 update changelog
8f7f903 Fix prototype pollution vulnerability (#1828)
f1d8383 Version 2.6.3
2b674c1 update changelog
eab740f fix: udpate lodash. closes #1675
eaf32be Version 2.6.2
684b42e Update built files
e1bd3da update changelog
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by hargasinski, a new releaser for async since your current version.

Updates ejs from 2.5.6 to 3.1.10

Release notes

Sourced from ejs's releases.

v3.1.10

Version 3.1.10

v3.1.9

Version 3.1.9

v3.1.8

Version 3.1.8

v3.1.7

Version 3.1.7

v3.1.6

Version 3.1.6

v3.1.5

Version 3.1.5

v3.0.2

No release notes provided.

v2.7.4

Bug fixes

Fixed Node 4 support, which broke in v2.7.3 (mde/ejs@5e42d6c, @mde)

v2.7.3

Bug fixes

Made the post-install message more discreet by following the example of opencollective-postinstall (mde/ejs@228d8e4, @mde)

v2.7.2

Features

Added support for destructuring locals (#452, @ExE-Boss)

Added support for disabling legacy include directives (#458, #459, @ExE-Boss)

Compiled functions are now shown in the debugger (#456, @S2-)

function.name is now set to the file base name in environments that support this (#466, @ExE-Boss)

Bug Fixes

The error message when async != true now correctly mention the existence of the async option (#460, @ExE-Boss)

Improved performance of HTML output generation (#470, @nwoltman)

v2.7.1

Deprecated:

Added deprecation notice for use of require.extensions (@mde)

v2.6.2

Correctly pass custom escape function to includes (@alecgibson)

... (truncated)

Commits

d3f807d Version 3.1.10
9ee26dd Mocha TDD
e469741 Basic pollution protection
715e950 Merge pull request #756 from Jeffrey-mu/main
cabe314 Include advanced usage examples
29b076c Added header
11503c7 Merge branch 'main' of github.com:mde/ejs into main
7690404 Added security banner to README
f47d7ae Update SECURITY.md
828cea1 Update SECURITY.md
Additional commits viewable in compare view

Updates express from 4.16.0 to 4.19.2

Release notes

Sourced from express's releases.

4.19.2

What's Changed

Improved fix for open redirect allow list bypass

Full Changelog: expressjs/express@4.19.1...4.19.2

4.19.1

What's Changed

Fix ci after location patch by @wesleytodd in expressjs/express#5552

fixed un-edited version in history.md for 4.19.0 by @wesleytodd in expressjs/express#5556

Full Changelog: expressjs/express@4.19.0...4.19.1

4.19.0

What's Changed

fix typo in release date by @UlisesGascon in expressjs/express#5527

docs: nominating @wesleytodd to be project captian by @wesleytodd in expressjs/express#5511

docs: loosen TC activity rules by @wesleytodd in expressjs/express#5510

Add note on how to update docs for new release by @crandmck in expressjs/express#5541

Prevent open redirect allow list bypass due to encodeurl

Release 4.19.0 by @wesleytodd in expressjs/express#5551

New Contributors

@crandmck made their first contribution in expressjs/express#5541

Full Changelog: expressjs/express@4.18.3...4.19.0

4.18.3

Main Changes

Fix routing requests without method

deps: [email protected]

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: [email protected]

Other Changes

Use https: protocol instead of deprecated git: protocol by @vcsjones in expressjs/express#5032

build: [email protected] and [email protected] by @abenhamdine in expressjs/express#5034

ci: update actions/checkout to v3 by @armujahid in expressjs/express#5027

test: remove unused function arguments in params by @raksbisht in expressjs/express#5124

Remove unused originalIndex from acceptParams by @raksbisht in expressjs/express#5119

Fixed typos by @raksbisht in expressjs/express#5117

examples: remove unused params by @raksbisht in expressjs/express#5113

fix: parameter str is not described in JSDoc by @raksbisht in expressjs/express#5130

fix: typos in History.md by @raksbisht in expressjs/express#5131

build : add [email protected] by @abenhamdine in expressjs/express#5028

test: remove unused function arguments in params by @raksbisht in expressjs/express#5137

... (truncated)

Changelog

Sourced from express's changelog.

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

Prevent open redirect allow list bypass due to encodeurl

deps: [email protected]

4.18.3 / 2024-02-29

Fix routing requests without method

deps: [email protected]

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: [email protected]

deps: [email protected]

Add partitioned option

4.18.2 / 2022-10-08

Fix regression routing a large stack in a single route

deps: [email protected]

deps: [email protected]

perf: remove unnecessary object clone

deps: [email protected]

4.18.1 / 2022-04-29

Fix hanging on large stack of sync routes

4.18.0 / 2022-04-25

Add "root" option to res.download

Allow options without filename in res.download

Deprecate string and non-integer arguments to res.status

Fix behavior of null/undefined as maxAge in res.cookie

Fix handling very large stacks of sync middleware

Ignore Object.prototype values in settings through app.set/app.get

... (truncated)

Commits

04bc627 4.19.2
da4d763 Improved fix for open redirect allow list bypass
4f0f6cc 4.19.1
a003cfa Allow passing non-strings to res.location with new encoding handling checks f...
a1fa90f fixed un-edited version in history.md for 4.19.0
11f2b1d build: fix build due to inconsistent supertest behavior in older versions
084e365 4.19.0
0867302 Prevent open redirect allow list bypass due to encodeurl
567c9c6 Add note on how to update docs for new release (#5541)
69a4cf2 deps: [email protected]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.

Updates extend from 3.0.1 to 3.0.2

Changelog

Sourced from extend's changelog.

3.0.2 / 2018-07-19

[Fix] Prevent merging __proto__ property (#48)

[Dev Deps] update eslint, @ljharb/eslint-config, tape

[Tests] up to node v10.7, v9.11, v8.11, v7.10, v6.14, v4.9; use nvm install-latest-npm

Commits

8d106d2 v3.0.2
e97091f [Dev Deps] update tape
e841aac [Tests] up to node v10.7
0e68e71 [Fix] Prevent merging proto property
a689700 Only apps should have lockfiles
f13c1c4 [Dev Deps] update eslint, @ljharb/eslint-config, tape
f3570fe [Tests] up to node v10.0, v9.11, v8.11, v7.10, v6.14, v4.9; use...
See full diff in compare view

Updates ip from 1.1.5 to 1.1.9

Commits

1ecbf2f 1.1.9
6a3ada9 lib: fixed CVE-2023-42282 and added unit test
5dc3b2f 1.1.8
8e6f28b lib: even better node 6 support
088c9e5 1.1.7
1a4ca35 lib: add back support for Node.js 6
af82ef4 1.1.6
dba19f6 package: exclude test folder from publishing
7cd7f30 ci: use github workflows
4de50ae lib: node 18 support
See full diff in compare view

Updates js-yaml from 3.10.0 to 3.13.1

Changelog

Sourced from js-yaml's changelog.

[3.13.1] - 2019-04-05

Security

Fix possible code execution in (already unsafe) .load(), #480.

[3.13.0] - 2019-03-20

Security

Security fix: safeLoad() can hang when arrays with nested refs used as key. Now throws exception for nested arrays. #475.

[3.12.2] - 2019-02-26

Fixed

Fix noArrayIndent option for root level, #468.

[3.12.1] - 2019-01-05

Added

Added noArrayIndent option, #432.

[3.12.0] - 2018-06-02

Changed

Support arrow functions without a block statement, #421.

[3.11.0] - 2018-03-05

Added

Add arrow functions suport for !!js/function.

Fixed

Fix dump in bin/octal/hex formats for negative integers, #399.

Commits

665aadd 3.13.1 released
da8ecf2 Browser files rebuild
b2f9e88 Merge pull request #480 from nodeca/toString
e18afbf Fix possible code execution in (already unsafe) load()
9d4ce5e 3.13.0 released
f64c673 Browser files rebuild
a567ef3 Restrict data types for object keys
59b6e76 Fix test name
e4267fc 3.12.2 released
7231a49 Browser files rebuild
Additional commits viewable in compare view

Updates lodash from 4.17.4 to 4.17.21

Commits

f299b52 Bump to v4.17.21
c4847eb Improve performance of toNumber, trim and trimEnd on large input strings
3469357 Prevent command injection through _.template's variable option
ded9bc6 Bump to v4.17.20.
63150ef Documentation fixes.
00f0f62 test.js: Remove trailing comma.
846e434 Temporarily use a custom fork of lodash-cli.
5d046f3 Re-enable Travis tests on 4.17 branch.
aa816b3 Remove /npm-package.
d7fbc52 Bump to v4.17.19
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by bnjmnt4n, a new releaser for lodash since your current version.

Updates redis from 2.7.1 to 3.1.1

Changelog

Sourced from redis's changelog.

v3.1.1

Enhancements

Upgrade node and dependencies

Fixes

Fix a potential exponential regex in monitor mode

v3.1.0 - 31 Mar, 2021

Enhancements

Upgrade node and dependencies and redis-commands to support Redis 6

Add support for Redis 6 auth pass [user]

v3.0.0 - 09 Feb, 2020

This version is mainly a release to distribute all the unreleased changes on master since 2017 and additionally removes a lot of old deprecated features and old internals in preparation for an upcoming modernization refactor (v4).

Breaking Changes

Dropped support for Node.js < 6

Dropped support for hiredis (no longer required)

Removed previously deprecated drain event

Removed previously deprecated idle event

Removed previously deprecated parser option

Removed previously deprecated max_delay option

Removed previously deprecated max_attempts option

Removed previously deprecated socket_no_delay option

Bug Fixes

Removed development files from published package (#1370)

Duplicate function now allows db param to be passed (#1311)

Features

Upgraded to latest redis-commands package

Upgraded to latest redis-parser package, v3.0.0, which brings performance improvements

Replaced double-ended-queue with denque, which brings performance improvements

Add timestamps to debug traces

Add socket_initial_delay option for socket.setKeepAlive (#1396)

Add support for rediss protocol in url (#1282)

v2.8.0 - 31 Jul, 2017

Features

... (truncated)

Commits

fc28860 Bump version to 3.1.1 (#1597)
2d11b6d fix #1569 - improve monitor_regex (#1595)
7e77de8 Add Chat (#1594)
5d3e995 Merge branch 'master' of https://github.com/NodeRedis/node-redis
b797cf2 add user to README.md
79f34c2 Bump version to 3.1.0 (#1590)
7fdc54e fix for 428e1c8a7b2322c2650294638cb1663ac5692728 - fix auth retry when redis ...
09f0fe8 "fix" tests
428e1c8 Add support for Redis 6 auth pass [user] (#1508)
bb208d0 Add codeclimate badge (#1572)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by leibale, a new releaser for redis since your current version.

Updates semver from 5.3.0 to 5.7.2

Release notes

Sourced from semver's releases.

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

2f8fd41 #585 better handling of whitespace (#585) (@joaomoreno, @lukekarrys)

Changelog

Sourced from semver's changelog.

5.7.2 (2023-07-10)

Bug Fixes

2f8fd41 #585 better handling of whitespace (#585) (@joaomoreno, @lukekarrys)

5.7

Add minVersion method

5.6

Move boolean loose param to an options object, with backwards-compatibility protection.

Add ability to opt out of special prerelease version handling with the includePrerelease option flag.

5.5

Add version coercion capabilities

5.4

Add intersection checking

5.3

Add minSatisfying method

5.2

Add prerelease(v) that returns prerelease components

5.1

Add Backus-Naur for ranges

Remove excessively cute inspection methods

5.0

Remove AMD/Browserified build artifacts

Fix ltr and gtr when using the * range

Fix for range * with a prerelease identifier

Commits

f8cc313 chore: release 5.7.2
2f8fd41 fix: better handling of whitespace (#585)
deb5ad5 chore: @npmcli/template-oss@4.16.0
c83c18c 5.7.1
956e228 Correct typo in README
8055dda 5.7.0
604e73d auto-publishing scripts
bed01e2 remove the nomin comments, since we don't minify any more anyway
9cb68f1 document parse method
38d42ca 5.7 changelog
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by lukekarrys, a new releaser for semver since your current version.

Updates socket.io from 2.0.3 to 2.4.0

Release notes

Sourced from socket.io's releases.

2.4.0

Related blog post: https://socket.io/blog/socket-io-2-4-0/

Features (from Engine.IO)

add support for all cookie options (19cc582)

disable perMessageDeflate by default (5ad2736)

Bug Fixes

security: do not allow all origins by default (f78a575)

properly overwrite the query sent in the handshake (d33a619)

⚠️ BREAKING CHANGE ⚠️

Previously, CORS was enabled by default, which meant that a Socket.IO server sent the necessary CORS headers (Access-Control-Allow-xxx) to any domain. This will not be the case anymore, and you now have to explicitly enable it.

Please note that you are not impacted if:

you are using Socket.IO v2 and the origins option to restrict the list of allowed domains

you are using Socket.IO v3 (disabled by default)

This commit also removes the support for '*' matchers and protocol-less URL:
io.origins('https://example.com:443'); => io.origins(['https://example.com']);
io.origins('localhost:3000');          => io.origins(['http:https://localhost:3000']);
io.origins('http:https://localhost:*');      => io.origins(['http:https://localhost:3000']);
io.origins('*:3000');                  => io.origins(['http:https://localhost:3000']);
To restore the previous behavior (please use with caution):
io.origins((_, callback) => {
  callback(null, true);
});
See also:

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

https://socket.io/docs/v3/handling-cors/

https://socket.io/docs/v3/migrating-from-2-x-to-3-0/#CORS-handling

Thanks a lot to @ni8walk3r for the security report.

Links:

... (truncated)

Changelog

Sourced from socket.io's changelog.

2.4.0 (2021-01-04)

Bug Fixes

security: do not allow all origins by default (f78a575)

properly overwrite the query sent in the handshake (d33a619)

3.0.4 (2020-12-07)

3.0.3 (2020-11-19)

3.0.2 (2020-11-17)

Bug Fixes

merge Engine.IO options (43705d7)

3.0.1 (2020-11-09)

Bug Fixes

export ServerOptions and Namespace types (#3684) (f62f180)

typings: update the signature of the emit method (50671d9)

3.0.0 (2020-11-05)

Bug Fixes

close clients with no namespace (91cd255)

Features

emit an Error object upon middleware error (54bf4a4)

serve msgpack bundle (aa7574f)

add support for catch-all listeners (5c73733)

make Socket#join() and Socket#leave() synchronous (129c641)

remove prod dependency to socket.io-client (7603da7)

move binary detection back to the parser (669592d)

add ES6 module export (8b6b100)

do not reuse the Engine.IO id (2875d2c)

remove Server#set() method (029f478)

... (truncated)

Commits

873fdc5 chore(release): 2.4.0
f78a575 fix(security): do not allow all origins by default
d33a619 fix: properly overwrite the query sent in the handshake
3951a79 chore: bump engine.io version
6fa026f ci: migrate to GitHub Actions
47161a6 [chore] Release 2.3.0
cf39362 [chore] Bump socket.io-parser to version 3.4.0
4d01b2c test: remove deprecated Buffer usage (#3481)
8227192 [docs] Fix the default value of the 'origins' parameter (#3464)
1150eb5 [chore] Bump engine.io to version 3.4.0
Additional commits viewable in compare view

Updates grunt from 1.0.1 to 1.5.3

Release notes

Sourced from grunt's releases.

v1.5.3

Merge pull request #1745 from gruntjs/fix-copy-op 572d79b

Patch up race condition in symlink copying. 58016ff

Merge pull request #1746 from JamieSlome/patch-1 0749e1d

Create SECURITY.md 69b7c50

gruntjs/grunt@v1.5.2...v1.5.3

v1.5.2

Update Changelog 7f15fd5

Merge pull request #1743 from gruntjs/cleanup-link b0ec6e1

Clean up link handling 433f91b

gruntjs/grunt@v1.5.1...v1.5.2

v1.5.1

Merge pull request #1742 from gruntjs/update-symlink-test ad22608

Fix symlink test 0652305

gruntjs/grunt@v1.5.0...v1.5.1

v1.5.0

Updated changelog b2b2c2b

Merge pull request #1740 from gruntjs/update-deps-22-10 3eda6ae

Update testing matrix 47d32de

More updates 2e9161c

Remove console log 04b960e

Update dependencies, tests... aad3d45

Merge pull request #1736 from justlep/main fdc7056

support .cjs extension e35fe54

gruntjs/grunt@v1.4.1...v1.5.0

v1.4.1

Update Changelog e7625e5

Merge pull request #1731 from gruntjs/update-options 5d67e34

Fix ci install d13bf88

Switch to Actions 08896ae

Update grunt-known-options eee0673

Add note about a breaking change 1b6e288

gruntjs/grunt@v1.4.0...v1.4.1

v1.4.0

Merge pull request #1728 from gruntjs/update-deps-changelog 63b2e89

Update changelog and util dep 106ed17

Merge pull request #1727 from gruntjs/update-deps-apr 49de70b

Update CLI and nodeunit 47cf8b6

Merge pull request #1722 from gruntjs/update-through e86db1c

Update deps 4952368

... (truncated)

Changelog

Sourced from grunt's changelog.

v1.5.3 date: 2022-04-23 changes: - Patch up race condition in symlink copying. v1.5.2 date: 2022-04-12 changes: - Unlink symlinks when copy destination is a symlink. v1.5.1 date: 2022-04-11 changes: - Fixed symlink destination handling. v1.5.0 date: 2022-04-10 changes: - Updated dependencies. - Add symlink handling for copying files. v1.4.1 date: 2021-05-24 changes: - Fix --preload option to be a known option - Switch to GitHub Actions v1.4.0 date: 2021-04-21 changes: - Security fixes in production and dev dependencies - Liftup/Liftoff upgrade breaking change. Update your scripts to use --preload instead of --require. Ref: gulpjs/liftoff@e7a969d. v1.3.0 date: 2020-08-18 changes: - Switch to use safeLoad for loading YML files via file.readYAML. - Upgrade legacy-log to ~3.0.0. - Upgrade legacy-util to ~2.0.0. v1.2.1 date: 2020-07-07 changes: - Remove path-is-absolute dependency. (PR: gruntjs/grunt#1715) v1.2.0 date: 2020-07-03 changes: - Allow usage of grunt plugins that are located in any location that is visible to Node.js and NPM, instead of node_modules directly inside package that have a dev dependency to these plugins. (PR: gruntjs/grunt#1677) - Removed coffeescript from dependencies. To ease transition, if coffeescript is still around, Grunt will attempt to load it. If it is not, and the user loads a CoffeeScript file, Grunt will print a useful error indicating that the coffeescript package should be installed as a dev dependency.

... (truncated)

Commits

82d79b8 1.5.3
572d79b Merge pull request #1745 from gruntjs/fix-copy-op
58016ff Patch up race condition in symlink copying.
0749e1d Merge pull request #1746 from JamieSlome/patch-1
69b7c50 Create SECURITY.md
ac667b2 1.5.2
7f15fd5 Update Changelog
b0ec6e1 Merge pull request #1743 from gruntjs/cleanup-link
433f91b Clean up link handling
d5969ec 1.5.1
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by vladikoff, a new releaser for grunt since your current version.

Updates moment from 2.19.3 to 2.29.4

Changelog

Sourced from moment's changelog.

2.29.4

Release Jul 6, 2022

#6015 [bugfix] Fix ReDoS in preprocessRFC2822 regex

2.29.3 Full changelog

Release Apr 17, 2022

#5995 [bugfix] Remove const usage

#5990 misc: fix advisory link

2.29.2 See full changelog

Release Apr 3 2022

Address GHSA-8hfj-j24r-96c4

2.29.1 See full changelog

Release Oct 6, 2020

Updated deprecation message, bugfix in hi locale

2.29.0 See full changelog

Release Sept 22, 2020

New locales (es-mx, bn-bd). Minor bugfixes and locale improvements. More tests. Moment is in maintenance mode. Read more at this link: https://momentjs.com/docs/#/-project-status/

2.28.0 See full changelog

Release Sept 13, 2020

Fix bug where .format() modifies original instance, and locale updates

2.27.0 See full changelog

Release June 18, 2020

Added Turkmen locale, other locale improvements, slight TypeScript fixes

2.26.0 See full changelog

Release May 19, 2020

... (truncated)

Commits

000ac18 Build 2.24.4
f2006b6 Bump version to 2.24.4
536ad0c Update changelog for 2.29.4
9a3b589 [bugfix] Fix redos in preprocessRFC2822 regex (#6015)
6374fd8 Merge branch 'master' into develop
b4e6153 Revert "[bugfix] Fix redos in preprocessRFC2822 regex (#6015)"
7aebb16 [bugfix] Fix redos in preprocessRFC2822 regex (#6015)
57c9062 Build 2.29.3
aaf50b6 Fixup release complaints
26f4aef Bump version to 2.29.3
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [async](https://github.com/caolan/async) | `2.4.1` | `2.6.4` | | [ejs](https://github.com/mde/ejs) | `2.5.6` | `3.1.10` | | [express](https://github.com/expressjs/express) | `4.16.0` | `4.19.2` | | [extend](https://github.com/justmoon/node-extend) | `3.0.1` | `3.0.2` | | [ip](https://github.com/indutny/node-ip) | `1.1.5` | `1.1.9` | | [js-yaml](https://github.com/nodeca/js-yaml) | `3.10.0` | `3.13.1` | | [lodash](https://github.com/lodash/lodash) | `4.17.4` | `4.17.21` | | [redis](https://github.com/redis/node-redis) | `2.7.1` | `3.1.1` | | [semver](https://github.com/npm/node-semver) | `5.3.0` | `5.7.2` | | [socket.io](https://github.com/socketio/socket.io) | `2.0.3` | `2.4.0` | | [grunt](https://github.com/gruntjs/grunt) | `1.0.1` | `1.5.3` | | [moment](https://github.com/moment/moment) | `2.19.3` | `2.29.4` | Updates `async` from 2.4.1 to 2.6.4 - [Release notes](https://github.com/caolan/async/releases) - [Changelog](https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md) - [Commits](caolan/async@v2.4.1...v2.6.4) Updates `ejs` from 2.5.6 to 3.1.10 - [Release notes](https://github.com/mde/ejs/releases) - [Commits](mde/ejs@v2.5.6...v3.1.10) Updates `express` from 4.16.0 to 4.19.2 - [Release notes](https://github.com/expressjs/express/releases) - [Changelog](https://github.com/expressjs/express/blob/master/History.md) - [Commits](expressjs/express@4.16.0...4.19.2) Updates `extend` from 3.0.1 to 3.0.2 - [Changelog](https://github.com/justmoon/node-extend/blob/main/CHANGELOG.md) - [Commits](justmoon/node-extend@v3.0.1...v3.0.2) Updates `ip` from 1.1.5 to 1.1.9 - [Commits](indutny/node-ip@v1.1.5...v1.1.9) Updates `js-yaml` from 3.10.0 to 3.13.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.10.0...3.13.1) Updates `lodash` from 4.17.4 to 4.17.21 - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.4...4.17.21) Updates `redis` from 2.7.1 to 3.1.1 - [Release notes](https://github.com/redis/node-redis/releases) - [Changelog](https://github.com/redis/node-redis/blob/master/CHANGELOG.md) - [Commits](redis/node-redis@v.2.7.1...v3.1.1) Updates `semver` from 5.3.0 to 5.7.2 - [Release notes](https://github.com/npm/node-semver/releases) - [Changelog](https://github.com/npm/node-semver/blob/v5.7.2/CHANGELOG.md) - [Commits](npm/node-semver@v5.3.0...v5.7.2) Updates `socket.io` from 2.0.3 to 2.4.0 - [Release notes](https://github.com/socketio/socket.io/releases) - [Changelog](https://github.com/socketio/socket.io/blob/main/CHANGELOG.md) - [Commits](socketio/socket.io@2.0.3...2.4.0) Updates `grunt` from 1.0.1 to 1.5.3 - [Release notes](https://github.com/gruntjs/grunt/releases) - [Changelog](https://github.com/gruntjs/grunt/blob/main/CHANGELOG) - [Commits](gruntjs/grunt@v1.0.1...v1.5.3) Updates `moment` from 2.19.3 to 2.29.4 - [Changelog](https://github.com/moment/moment/blob/develop/CHANGELOG.md) - [Commits](moment/moment@2.19.3...2.29.4) --- updated-dependencies: - dependency-name: async dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ejs dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: express dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: extend dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: ip dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: js-yaml dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: lodash dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: redis dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: semver dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: socket.io dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: grunt dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: moment dependency-type: direct:development dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added the dependencies Pull requests that update a dependency file label May 1, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 12 updates #10

Bump the npm_and_yarn group across 1 directory with 12 updates #10

dependabot bot commented on behalf of github May 1, 2024

Bump the npm_and_yarn group across 1 directory with 12 updates #10

Are you sure you want to change the base?

Bump the npm_and_yarn group across 1 directory with 12 updates #10

Conversation

dependabot bot commented on behalf of github May 1, 2024

v2.6.4

v2.6.3

v2.6.2

v2.6.1

v2.6.0

v2.5.0

v3.1.10

v3.1.9

v3.1.8

v3.1.7

v3.1.6

v3.1.5

v3.0.2

v2.7.4

Bug fixes

v2.7.3

Bug fixes

v2.7.2

Features

Bug Fixes

v2.7.1

Deprecated:

v2.6.2

4.19.2

What's Changed

4.19.1

What's Changed

4.19.0

What's Changed

New Contributors

4.18.3

Main Changes

Other Changes

4.19.2 / 2024-03-25

4.19.1 / 2024-03-20

4.19.0 / 2024-03-20

4.18.3 / 2024-02-29

4.18.2 / 2022-10-08

4.18.1 / 2022-04-29

4.18.0 / 2022-04-25

3.0.2 / 2018-07-19

[3.13.1] - 2019-04-05

Security

[3.13.0] - 2019-03-20

Security

[3.12.2] - 2019-02-26

Fixed

[3.12.1] - 2019-01-05

Added

[3.12.0] - 2018-06-02

Changed

[3.11.0] - 2018-03-05

Added

Fixed

v3.1.1

Enhancements

Fixes

v3.1.0 - 31 Mar, 2021

Enhancements

v3.0.0 - 09 Feb, 2020

Breaking Changes

Bug Fixes

Features

v2.8.0 - 31 Jul, 2017

v5.7.2

5.7.2 (2023-07-10)

Bug Fixes

5.7.2 (2023-07-10)

Bug Fixes

5.7

5.6

5.5

5.4

5.3

5.2