build(deps): bump js-yaml and grunt

Open dependabot[bot] opened this issue 2 years ago • 0 comments

Bumps js-yaml to 3.14.0 and updates ancestor dependency grunt. These dependencies need to be updated together.

Updates js-yaml from 3.5.5 to 3.14.0

Changelog

[3.14.0] - 2020-05-22

Changed

Support safe/loadAll(input, options) variant of call.

CI: drop outdated nodejs versions.

Dev deps bump.

Fixed

Quote = in plain scalars #519.

Check the node type for !<?> tag in case user manually specifies it.

Verify that there are no null-bytes in input.

Fix wrong quote position when writing condensed flow, #526.

[3.13.1] - 2019-04-05

Security

Fix possible code execution in (already unsafe) .load(), #480.

[3.13.0] - 2019-03-20

Security

Security fix: safeLoad() can hang when arrays with nested refs used as key. Now throws exception for nested arrays. #475.

[3.12.2] - 2019-02-26

Fixed

Fix noArrayIndent option for root level, #468.

[3.12.1] - 2019-01-05

Added

Added noArrayIndent option, #432.

[3.12.0] - 2018-06-02

Changed

Support arrow functions without a block statement, #421.

[3.11.0] - 2018-03-05

Added

Add arrow functions suport for !!js/function.

Fixed

Fix dump in bin/octal/hex formats for negative integers, #399.

[3.10.0] - 2017-09-10

Fixed

Fix condenseFlow output (quote keys for sure, instead of spaces), #371, #370.

... (truncated)

Commits

34e5072 3.14.0 released
7b25c83 Browser files rebuild
6f73473 Dev deps bump
0c29349 Travis-CI: drop old nodejs versions
10be97e fix(loader): Add support for safe/loadAll(input, options)
d6983dd Fix issue #526: wrong quote position writing condensed flow (#527)
93fbf7d fix issue 526 (wrong quote position writing condensed flow)
e569cc7 readme: update titelift info
8fb2905 changelog format update
33c2236 Verify that there are no null-bytes in input
Additional commits viewable in compare view

Updates grunt from 1.0.3 to 1.6.1

Release notes

Sourced from grunt's releases.

v1.6.1

Changelog updates 72f6f03

Merge pull request #1755 from gruntjs/rm-dep 8d4c183

Add recursive 1c7d483

Merge pull request #1756 from gruntjs/downgrade-glob 2d4fd38

Downgrade glob 902db7c

Fix syntax 494f243

remove mkdirp b01389e

remove dep on rimraf and mkdirp 0072510

https://github.com/gruntjs/grunt/compare/v1.6.0...v1.6.1

v1.6.0

Merge pull request #1750 from gruntjs/dep-update-jan28 2805dc3

README updates 3f1e423

Bump to 16 8fd096d

Update more deps 42c5f95

Bump eslint and node version 1d88050

https://github.com/gruntjs/grunt/compare/v1.5.3...v1.6.0

v1.5.3

Merge pull request #1745 from gruntjs/fix-copy-op 572d79b

Patch up race condition in symlink copying. 58016ff

Merge pull request #1746 from JamieSlome/patch-1 0749e1d

Create SECURITY.md 69b7c50

https://github.com/gruntjs/grunt/compare/v1.5.2...v1.5.3

v1.5.2

Update Changelog 7f15fd5

Merge pull request #1743 from gruntjs/cleanup-link b0ec6e1

Clean up link handling 433f91b

https://github.com/gruntjs/grunt/compare/v1.5.1...v1.5.2

v1.5.1

Merge pull request #1742 from gruntjs/update-symlink-test ad22608

Fix symlink test 0652305

https://github.com/gruntjs/grunt/compare/v1.5.0...v1.5.1

v1.5.0

Updated changelog b2b2c2b

Merge pull request #1740 from gruntjs/update-deps-22-10 3eda6ae

Update testing matrix 47d32de

More updates 2e9161c

Remove console log 04b960e

Update dependencies, tests... aad3d45

Merge pull request #1736 from justlep/main fdc7056

... (truncated)

Changelog

Sourced from grunt's changelog.

v1.6.1 date: 2023-01-31 changes: - Downgrades to glob 7 for Windows compatability - Removes mkdirp and rimraf in favour of node.js APIs. v1.6.0 date: 2023-01-28 changes: - Requires node.js 16+. - template.date now uses dateformat ~4.6.2. - other dependency updates such as glob, rimraf, etc. v1.5.3 date: 2022-04-23 changes: - Patch up race condition in symlink copying. v1.5.2 date: 2022-04-12 changes: - Unlink symlinks when copy destination is a symlink. v1.5.1 date: 2022-04-11 changes: - Fixed symlink destination handling. v1.5.0 date: 2022-04-10 changes: - Updated dependencies. - Add symlink handling for copying files. v1.4.1 date: 2021-05-24 changes: - Fix --preload option to be a known option - Switch to GitHub Actions v1.4.0 date: 2021-04-21 changes: - Security fixes in production and dev dependencies - Liftup/Liftoff upgrade breaking change. Update your scripts to use --preload instead of --require. Ref: https://github.com/js-cli/js-liftoff/commit/e7a969d6706e730d90abb4e24d3cb4d3bce06ddb. v1.3.0 date: 2020-08-18 changes: - Switch to use safeLoad for loading YML files via file.readYAML. - Upgrade legacy-log to ~3.0.0. - Upgrade legacy-util to ~2.0.0. v1.2.1 date: 2020-07-07 changes: - Remove path-is-absolute dependency. (PR: gruntjs/grunt#1715) v1.2.0

... (truncated)

Commits

8372e11 1.6.1
72f6f03 Changelog updates
8d4c183 Merge pull request #1755 from gruntjs/rm-dep
1c7d483 Add recursive
2d4fd38 Merge pull request #1756 from gruntjs/downgrade-glob
902db7c Downgrade glob
494f243 Fix syntax
b01389e remove mkdirp
0072510 remove dep on rimraf and mkdirp
0afeb5c 1.6.0
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.

Sep 22 '23 04:09 dependabot[bot]