faas-js-runtime icon indicating copy to clipboard operation
faas-js-runtime copied to clipboard

Published 20 hours ago • verified publisher icon nodeshift

[Snyk] Upgrade @cyclonedx/cyclonedx-npm from 3.0.0 to 4.0.0

Open lholmquist opened this issue 4 months ago • 1 comments

snyk-top-banner

Snyk has created this PR to upgrade @cyclonedx/cyclonedx-npm from 3.0.0 to 4.0.0.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

  • The recommended version is 3 versions ahead of your current version.

  • The recommended version was released 24 days ago.

Release notes
Package name: @cyclonedx/cyclonedx-npm
  • 4.0.0 - 2025-06-23

    BREAKING Changes

    • SBOM results might have slightly changed (via #1307)

    Fixed

    • External dependency edge-cases are now properly nested (via #1307)

    Changed

    • SBOM result's bom-ref is prefixed with parent-component's one to ensure uniqueness (via #1307)
    • Uses only trusted data from npm-ls internally (via #1307)
      No changes in data quality are expected.

    What's Changed

    Full Changelog: v3.1.0...v4.0.0

  • 3.1.0 - 2025-06-16

    Changed

    • Utilizes license file gatherer of @ cyclonedx/cyclonedx-library, previously used own implementation (via #1303)

    Runtime Dependencies

    • Raised @ cyclonedx/cyclonedx-library@^8.4.0, was @^8.0.0 (via #1301, #1303)
    • Raised commander@^14.0.0, was @^13.1.0 (via #1297)

    What's Changed

    Full Changelog: v3.0.0...v3.1.0

  • 3.0.1-alpha.0 - 2025-05-26

    3.0.1-alpha.0

    Signed-off-by: jkowalleck <[email protected]>

  • 3.0.0 - 2025-04-08

    BREAKING Changes

    Added

    • CLI switch -o as shorthand for --output-file (#1282 via #1288)
    • CLI switch --of as shorthand for --outout-format (#1282 via #1288)
    • CLI switch --sv as shorthand for --spec-version (#1282 via #1288)

    Fixed

    • License gathering correctly ignores symlinks and directories (#1290 via #1291)

    Runtime Dependencies

    • Raised @ cyclonedx/cyclonedx-library@^8.0.0, was @^7.0.0 (via #1281)
    • Raised commander@^13.1.0, was @^10.0.0 (via #1281, #1288)
    • Raised normalize-package-data@^7.0.0, was @^3||^4||^5||^6 (via #1281)

    Build

    • Use TypeScript v5.8.3 now, was v5.7.3 (via #1267, #1289)

    What's Changed

    Full Changelog: v2.1.0...v3.0.0

from @cyclonedx/cyclonedx-npm GitHub release notes

[!IMPORTANT]

  • Warning: This PR contains a major version upgrade, and may be a breaking change.
  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

lholmquist avatar Jul 17 '25 09:07 lholmquist

:tada: Snyk checks have passed. No issues have been found so far.

:white_check_mark: security/snyk check is complete. No issues have been found. (View Details)

lholmquist avatar Jul 17 '25 09:07 lholmquist