meilisearch-js-plugins Bump the npm_and

Bumps the npm_and_yarn group with 5 updates:

Package	From	To
rollup	`2.79.2`	`3.29.5`
braces	`3.0.2`	`3.0.3`
micromatch	`4.0.2`	`4.0.8`
nanoid	`3.3.7`	`3.3.8`
qs	`6.9.6`	`6.9.7`

Updates rollup from 2.79.2 to 3.29.5

Release notes

Sourced from rollup's releases.

v3.29.5

3.29.5

2024-09-21

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

v3.29.4

3.29.4

2023-09-28

Bug Fixes

Fix static analysis when an exported function uses callbacks (#5158)

Pull Requests

#5158: Deoptimize all parameters when losing track of a function (@lukastaegert)

v3.29.3

3.29.3

2023-09-24

Bug Fixes

Fix a bug where code was wrongly tree-shaken after mutating function parameters (#5153)

Pull Requests

#5145: docs: improve the docs repl appearance in the light mode (@TrickyPi)

#5148: chore(deps): update dependency @vue/eslint-config-typescript to v12 (@renovate[bot])

#5149: chore(deps): lock file maintenance minor/patch updates (@renovate[bot])

#5153: Fully deoptimize first level path when deoptimizing nested parameter paths (@lukastaegert)

v3.29.2

3.29.2

2023-09-15

Bug Fixes

Export TreeshakingPreset type (#5131)

... (truncated)

Changelog

Sourced from rollup's changelog.

2.79.2

2024-09-26

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

3.29.5

2024-09-21

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5671: Fix DOM Clobbering CVE (@lukastaegert)

4.22.4

2024-09-21

Bug Fixes

Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (#5671)

Pull Requests

#5670: refactor: Use object.prototype to check for reserved properties (@YuHyeonWook)

#5671: Fix DOM Clobbering CVE (@lukastaegert)

4.22.3

2024-09-21

Bug Fixes

Ensure that mutations in modules without side effects are observed while properly handling transitive dependencies (#5669)

Pull Requests

#5669: Ensure impure dependencies of pure modules are added (@lukastaegert)

4.22.2

... (truncated)

Commits

dfd233d 3.29.5
2ef77c0 Fix DOM Clobbering CVE
a6448b9 3.29.4
4e92d60 Deoptimize all parameters when losing track of a function (#5158)
801ffd1 3.29.3
353e462 Fully deoptimize first level path when deoptimizing nested parameter paths (#...
a1a89e7 chore(deps): update dependency @vue/eslint-config-typescript to v12 (#5148)
cc14f70 chore(deps): lock file maintenance minor/patch updates (#5149)
1e8355b docs: improve the docs repl appearance in the light mode (#5145)
5950fc8 Adapt branches in REPL workflow
Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates micromatch from 4.0.2 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

4.0.4

fix: Update picomatch to fix regression #179 (8becb55)

4.0.3

Enforce newer version of picomatch with bugfixes

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

this is basically v4.0.5, with some README updates

it is vulnerable to CVE-2024-4067

Updated braces to v3.0.3 to avoid CVE-2024-4068

does NOT break API compatibility

[4.0.6] - 2024-05-21

Added hasBraces to check if a pattern contains braces.

Fixes CVE-2024-4067

BREAKS API COMPATIBILITY

Should be labeled as a major release, but it's not.

[4.0.1 - 4.0.5]

[4.0.0] - 2019-03-20

Added

Adds support for options.onMatch. See the readme for details

Adds support for options.onIgnore. See the readme for details

Adds support for options.onResult. See the readme for details

Breaking changes

Require Node.js >= 8.6

Removed support for passing an array of brace patterns to micromatch.braces().

To strictly enforce closing brackets (for {, [, and (), you must now use strictBrackets=true instead of strictErrors.

cache - caching and all related options and methods have been removed

options.unixify was renamed to options.windows

options.nodupes Was removed. Duplicates are always removed by default. You can override this with custom behavior by using the onMatch, onResult and onIgnore functions.

options.snapdragon was removed, as snapdragon is no longer used.

options.sourcemap was removed, as snapdragon is no longer used, which provided sourcemap support.

[3.0.0] - 2017-04-11

Complete overhaul, with 36,000+ new unit tests validated against actual output generated by Bash and minimatch. More specifically, 35,000+ of the tests:

micromatch results are directly compared to bash results

in rare cases, when micromatch and bash disagree, micromatch's results are compared to minimatch's results

micromatch is much more accurate than minimatch, so there were cases where I had to make assumptions. I'll try to document these.

This refactor introduces a parser and compiler that are supersets of more granular parsers and compilers from other sub-modules. Each of these sub-modules has a singular responsibility and focuses on a certain type of matching that aligns with a specific part of the Bash "expansion" API.

These sub-modules work like plugins to seamlessly create the micromatch parser/compiler, so that strings are parsed in one pass, an AST is created, then a new string is generated by the compiler.

... (truncated)

Commits

8bd704e 4.0.8
a0e6841 run verb to generate README documentation
4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
814f5f7 lint
67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
113f2e3 fix: CVE numbers in CHANGELOG
d9dbd9a feat: updated CHANGELOG
2ab1315 fix: use actions/setup-node@v4
1406ea3 feat: rework test to work on macos with node 10,12 and 14
Additional commits viewable in compare view

Updates nanoid from 3.3.7 to 3.3.8

Changelog

Sourced from nanoid's changelog.

3.3.8

Fixed a way to break Nano ID by passing non-integer size (by @myndzi).

Commits

3044cd5 Release 3.3.8 version
4fe3495 Update size limit
d643045 Fix pool pollution, infinite loop (#510)
See full diff in compare view

Updates qs from 6.9.6 to 6.9.7

Changelog

Sourced from qs's changelog.

6.9.7

[Fix] parse: ignore __proto__ keys (#428)

[Fix] stringify: avoid encoding arrayformat comma when encodeValuesOnly = true (#424)

[Robustness] stringify: avoid relying on a global undefined (#427)

[readme] remove travis badge; add github actions/codecov badges; update URLs

[Docs] add note and links for coercing primitive values (#408)

[Tests] clean up stringify tests slightly

[meta] fix README.md (#399)

Revert "[meta] ignore eclint transitive audit warning"

[actions] backport actions from main

[Dev Deps] backport updates from main

Commits

4cd0032 v6.9.7
e799ba5 [Fix] parse: ignore __proto__ keys (#428)
02ca358 [Robustness] stringify: avoid relying on a global undefined (#427)
4a17709 [Fix] stringify: avoid encoding arrayformat comma when `encodeValuesOnly = ...
c0e13e9 [readme] remove travis badge; add github actions/codecov badges; update URLs
4113a5f [Tests] clean up stringify tests slightly
749a584 [Docs] add note and links for coercing primitive values (#408)
cce2082 [meta] fix README.md (#399)
c44f0c5 Revert "[meta] ignore eclint transitive audit warning"
e6cfd8b [actions] backport actions from main
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the Security Alerts page.

Jan 10 '25 09:01 dependabot[bot]

⚠️ No Changeset found

Latest commit: a1ca4f1c3ca804f3b519a8927b4364f70441ab2e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Jan 10 '25 09:01 changeset-bot[bot]

@dependabot rebase

Jan 10 '25 09:01 Strift

Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

Jan 10 '25 09:01 dependabot[bot]

@dependabot rebase

Sep 16 '25 02:09 Strift

Dependabot encountered an unknown error. Because of this, Dependabot cannot update this pull request.

Sep 16 '25 02:09 dependabot[bot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

Sep 16 '25 02:09 dependabot[bot]

@dependabot recreate

Sep 16 '25 03:09 Strift

Dependabot encountered an unknown error. Because of this, Dependabot cannot update this pull request.

Sep 16 '25 03:09 dependabot[bot]

Bump the npm_and_yarn group with 5 updates

v3.29.5

3.29.5

Bug Fixes

Pull Requests

v3.29.4

3.29.4

Bug Fixes

Pull Requests

v3.29.3

3.29.3

Bug Fixes

Pull Requests

v3.29.2

3.29.2

Bug Fixes

2.79.2

Bug Fixes

Pull Requests

3.29.5

Bug Fixes

Pull Requests

4.22.4

Bug Fixes

Pull Requests

4.22.3

Bug Fixes

Pull Requests

4.22.2

4.0.8

4.0.4

4.0.3

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

[4.0.6] - 2024-05-21

[4.0.1 - 4.0.5]

[4.0.0] - 2019-03-20

Added

Breaking changes

[3.0.0] - 2017-04-11

3.3.8

6.9.7

⚠️ No Changeset found