quiz-app-in-nodejs
quiz-app-in-nodejs copied to clipboard
🚨 [security] Update winston 3.2.1 → 3.13.0 (minor)
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ winston (3.2.1 → 3.13.0) · Repo · Changelog
Release Notes
Too many releases to show here. View the full release notes.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ color (indirect, 3.0.0 → 3.2.1) · Repo
Release Notes
3.2.1
Patch Release 3.2.1
- Revert
color-convert
back down to <2 since v2 introduced ES6 syntax.If you need
color-convert@>=2
then you'll need to have ES6 support. It's 2021, embrace it.🙂
3.2.0
Minor Release 3.2.0
NOTE: This is the final release of
color
that uses ES5 syntax. For those following along,4.0.0
was just released that switches to ES6 (const
/let
) syntax, which will (at some point) be followed by another major release that further switches to ES Modules entirely. This will be a sweeping change across thecolor
package suite (color
,color-string
,color-convert
). Keep a look out if these issues have been bothering you.
- Bumps color convert to latest (fixes some issues with HCG)
- Bumps mocha to latest
3.1.3
- Fixes fixed alpha precision when parsing RGBA hex strings in constructor (#174)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 22 commits:
3.2.1
revert color convert back down to es5-compatible version
3.2.0
bump color-convert and mocha
3.1.4
bump color-string
add .npmrc
3.1.3
bump color-string and add regression test for #174 (fixes #174)
fixed typo about hex() in readme
#166 Add new examples after code review
#166 More clearly documentation of methods whiten() and darken()
fix build with latest versions of node
3.1.2
fix Color(null) not working
3.1.1
run tests on newer versions of node
update test deps
Close #103 (#157)
3.1.0
throw exception when an empty string is passed to the constructor (#148)
Update README.md (#144)
↗️ color-string (indirect, 1.5.3 → 1.9.1) · Repo · Changelog
Security Advisories 🚨
🚨 Regular Expression Denial of Service (ReDOS)
In the npm package
color-string
, there is a ReDos (Regular Expression Denial of Service) vulnerability regarding an exponential time complexity for
linearly increasing input lengths forhwb()
color strings.Strings reaching more than 5000 characters would see several
milliseconds of processing time; strings reaching more than
50,000 characters began seeing 1500ms (1.5s) of processing time.The cause was due to a the regular expression that parses
hwb() strings - specifically, the hue value - where
the integer portion of the hue value used a 0-or-more quantifier
shortly thereafter followed by a 1-or-more quantifier.This caused excessive backtracking and a cartesian scan,
resulting in exponential time complexity given a linear
increase in input length.
Release Notes
1.9.0
Minor Release 1.9.0
- Add parsing of exponential alpha values for HWB and HSL (#66)
Thanks to @babycannotsay for their contribution!
1.8.2
Patch release 1.8.2
- Fix incorrect handling of optional comma in rgb() regex (#65)
Thanks to @gerdasi and @mastertheblaster for reporting and confirming the bug!
1.8.1
Patch release 1.8.1
- Fix rgb alpha percentage parsing from int to float (#61)
Thanks to @clytras for their contribution!
1.7.4
Patch Release 1.7.4
- Fix bug in
.to.hex()
output if the inputs aren't rounded numbers (#25)
1.7.1
Patch release 1.7.1
- Reduce acceptable characters in keyword matching regex (#42)
Thanks to @benmccann for their contributions!
1.7.0
Minor Release 1.7.0
- Add support for space-separated RGB (#58)
- Removed Travis CI in favor of Github Actions
- Small repository cleanup.
1.6.0
Minor release 1.6.0
- #55 - Add support for space-separated HSL
Thanks @htunnicliff for the contribution :)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 2 commits:
↗️ fecha (indirect, 2.3.3 → 4.2.3) · Repo · Changelog
Release Notes
4.2.3 (from changelog)
- Fixed bug with UTC date on daylights savings time #94
4.2.1 (from changelog)
- Fixed missing source map
- Fixed security y18n
Does any of this look wrong? Please let us know.
↗️ logform (indirect, 2.1.2 → 2.6.0) · Repo · Changelog
Release Notes
2.6.0
- Add engines.node field to package.json, matching winston dc72f30
- Bump @babel/preset-env from 7.20.2 to 7.23.2 (#282) 3fa46ff
- Bump @babel/cli from 7.21.5 to 7.23.0 (#279) 5bbd37c
- Bump @babel/core from 7.21.8 to 7.23.2 (#283) 7829c80
- Bump rimraf from 3.0.2 to 5.0.5 (#276) 60f2a57
- Bump @colors/colors from 1.5.0 to 1.6.0 (#278) 4122c75
- Bump actions/checkout from 3 to 4 (#281) 696fca6
- Update Node versions used in CI tests to match winston 2456702
- Bump safe-stable-stringify from 2.4.2 to 2.4.3 (#260) e138505
- Bump @babel/cli from 7.19.3 to 7.21.5 (#268) 2f6b096
- Bump eslint from 8.33.0 to 8.40.0 (#270) 9f75e6c
- Bump @babel/core from 7.20.12 to 7.21.8 (#271) ac5a90d
- Update version number in bug report template 3e3a0b6
- Add TS version to issue template a93698c
- Note TS<4.4 incompatibility per #244 f79c612
2.5.1
2.5.1
2023/02/07
Bugfix
The triple-beam types package has been promoted to a full dependency, by first-time contributor @carboneater (Thanks!)
in #243 to fix #242.
2.5.0
2.5.0
2023/02/06
Improvements
All the improvements in this release are from first-time contributors - thanks for your contributions!
- Feature - optionally include Error.cause property by @davidnbooth in #226
- Add triple beam properties to types by @robinpokorny in #194
- TransformableInfo should support symbols as keys by @dancrumb in #240
Dependency updates by @dependabot
- Bump @babel/cli from 7.18.6 to 7.19.3 by @dependabot in #214
- Bump @babel/core from 7.18.6 to 7.20.12 by @dependabot in #212
and #237- Bump @babel/preset-env from 7.18.6 to 7.20.2 by @dependabot in #217
and #225- Bump eslint from 8.19.0 to 8.33.0 by @dependabot in #215
and #241- Bump mocha from 10.0.0 to 10.2.0 by @dependabot in #218
and #232- Bump safe-stable-stringify from 2.3.1 to 2.4.2 by @dependabot in #206
and #235
2.4.2
2.4.2
Bugfixes
This patch-level release includes a fix for a crash on attempt to uncolorize Symbol.
Thanks to @Alexsey for that first contribution in #188.Maintainability updates:
Line break styles were changed to be LF (instead of CRLF) more consistently so that linter warnings aren't drowned out by notes about that.
Dependency updates by @dependabot
2.4.1
What's Changed
- Feature: Implement issue templates by @maverick1872 in #149
- Change TransformableInfo message prop to any by @gregbair in #178
Dependabot bumps:
- Bump actions/checkout from 2 to 3 by @dependabot in #157
- Bump eslint from 8.9.0 to 8.10.0 by @dependabot in #154
- Bump mocha from 9.2.0 to 9.2.1 by @dependabot in #152
- Bump @babel/core from 7.17.2 to 7.17.5 by @dependabot in #151
- Bump @babel/cli from 7.17.0 to 7.17.6 by @dependabot in #155
- Bump actions/setup-node from 2 to 3 by @dependabot in #153
- Bump @babel/core from 7.17.5 to 7.18.2 by @dependabot in #177
- Bump fecha from 4.2.1 to 4.2.3 by @dependabot in #165
- Bump eslint from 8.10.0 to 8.16.0 by @dependabot in #175
- Bump mocha from 9.2.1 to 10.0.0 by @dependabot in #167
- Bump @babel/preset-env from 7.16.11 to 7.18.2 by @dependabot in #176
- Bump eslint from 8.16.0 to 8.18.0 by @dependabot in #182
- Bump @babel/core from 7.18.2 to 7.18.5 by @dependabot in #181
- Bump @babel/cli from 7.17.6 to 7.17.10 by @dependabot in #180
New Contributors
- @maverick1872 made their first contribution in #149
- @gregbair made their first contribution in #178
Full Changelog: v2.4.0...v2.4.1
2.4.0
- Update .npmignore 6e412cd
- Update changelog for 2.4.0 release 6e9ce5d
- Make use of new safe-stable-stringify 2.x features (#134) e3a8000
- In CliFormat use cli levels (not npm levels). (#135) 6c677ed
- Update to @colors/colors (#144) 5ee5fec
- Bump assume from 2.2.0 to 2.3.0 (#145) 9371de2
- Bump @babel/cli from 7.15.7 to 7.17.0 (#146) 48eee25
- Bump eslint from 8.8.0 to 8.9.0 (#148) 691182a
- Bump mocha from 8.4.0 to 9.2.0 (#139) 048c9df
- Bump safe-stable-stringify from 1.1.0 to 2.3.1 (#141) e0d2b5e
- Bump @babel/preset-env from 7.10.3 to 7.16.11 (#140) 1bb6f34
- Bump fecha from 4.2.0 to 4.2.1 (#137) 2377a51
- Bump ms from 2.1.2 to 2.1.3 (#138) ff0d634
- Update ESLint config (#142) 0ab2982
- Replace Travis CI with GitHub Actions (#136) 7e5cffc
2.3.2
This update, which also used up version number 2.3.1, pinned the version of the
colors
dependency due to vandalism by a developer of that package, as noted here.As discussed in the
winston
package, all users should update to this (or a later version, should one exist) ASAP.
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ triple-beam (indirect, 1.3.0 → 1.4.1) · Repo · Changelog
Release Notes
1.4.1
- Relax node engines requirement to geq 14.0.0 in package.json a537d09
1.4.0
- update package.json a592fa3
- update package.json e2bdb66
- Merge branch 'master' of github.com:winstonjs/triple-beam d4f8655
- update npmignore a608646
- Bump assume from 2.0.1 to 2.3.0 (#8) c1ba5e3
- rm ts test a39f448
- Fix lint config 46f21e4
- Update packages 5e66571
- Bump y18n from 3.2.1 to 3.2.2 (#7) a2ef367
- Add GitHub Actions CI 4e5b1c1
- Bump minimist, mkdirp, mocha and nyc (#6) 2347047
- Exclude unnecessary files from the npm package (#5) 3f9bc1c
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 15 commits:
1.4.1
Relax node engines requirement to geq 14.0.0 in package.json
1.4.0
update package.json
update package.json
Merge branch 'master' of github.com:winstonjs/triple-beam
update npmignore
Bump assume from 2.0.1 to 2.3.0 (#8)
rm ts test
Fix lint config
Update packages
Bump y18n from 3.2.1 to 3.2.2 (#7)
Add GitHub Actions CI
Bump minimist, mkdirp, mocha and nyc (#6)
Exclude unnecessary files from the npm package (#5)
↗️ winston-transport (indirect, 4.3.0 → 4.7.0) · Repo · Changelog
Release Notes
4.7.0
- Resolve circular dependency issues downstream in Winston (#207) 377285d
- Bump actions/checkout from 3 to 4 (#182) 66e8fdb
- Bump deep-equal from 2.2.2 to 2.2.3 (#190) 5a5a0ca
- Bump rimraf from 3.0.2 to 5.0.5 (#181) 5c14025
- Bump actions/setup-node from 3 to 4 (#185) 5cefa55
- Bump eslint from 8.51.0 to 8.56.0 (#199) aee4f5f
- Bump @types/node from 20.8.6 to 20.11.10 (#206) 0a134d3
- Bump @babel/traverse from 7.10.3 to 7.23.2 (#180) 7bbaf43
4.6.0
- Bump deep-equal from 2.0.5 to 2.2.2 (#178) a6d22ea
- Update dependencies and increase minimum node engine to 12 b81a3dc
- Update CI node versions to match winston 35d171a
- Bump eslint from 8.25.0 to 8.35.0 (#176) 80ba040
- Bump @types/node from 18.11.0 to 18.14.6 (#177) aefef19
- Bump decode-uri-component from 0.2.0 to 0.2.2 (#159) 70e5b8b
- Bump eslint from 8.16.0 to 8.25.0 (#148) 0e5e4c0
- Bump mocha from 10.0.0 to 10.1.0 (#150) 760fe66
- Bump @types/node from 17.0.36 to 18.11.0 (#151) 09f7424
- Bump logform from 2.4.1 to 2.4.2 (#126) 29684d1
- Bump logform from 2.4.0 to 2.4.1 (#122) 51baf61
- Bump @types/node from 17.0.21 to 17.0.36 (#115) fdf7ccc
- Bump eslint from 8.10.0 to 8.16.0 (#114) 193154a
- Bump mocha from 9.2.1 to 10.0.0 (#109) 8de37e4
- Bump minimist from 1.2.5 to 1.2.6 (#104) c4d1124
- Bump actions/setup-node from 2 to 3 (#95) 8edbd94
- Bump @types/node from 17.0.15 to 17.0.21 (#94) 9cbf51f
- Bump eslint from 8.8.0 to 8.10.0 (#93) f240c35
- Bump mocha from 9.2.0 to 9.2.1 (#91) 49e2c8c
- Bump logform from 2.3.2 to 2.4.0 (#90) 8614b9f
- Bump actions/checkout from 2 to 3 (#96) 98a481d
4.5.0
- Update .npmignore 8cbcdf3
- Merge branch 'master' of github.com:winstonjs/winston-transport 22b195e
- Changelog for 4.5.0 b47cfcd
- Memory leak fix: do not wait
process.nextTick
(#81) 6566518- Update linting dependencies (#87) 46e5822
- Replace Travis CI with GitHub Actions (#82) 0b7ad4f
- fix(logform): removed duplicate dependency (#67) ed56cf2
- Relative ref to bin file not needed; npm looks there by default (#80) 35baf39
4.4.1
Updates to dependencies and Typescript support for last feature release.
4.4.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 50 commits:
4.7.0
Resolve circular dependency issues downstream in Winston (#207)
Bump actions/checkout from 3 to 4 (#182)
Bump deep-equal from 2.2.2 to 2.2.3 (#190)
Bump rimraf from 3.0.2 to 5.0.5 (#181)
Bump actions/setup-node from 3 to 4 (#185)
Bump eslint from 8.51.0 to 8.56.0 (#199)
Bump @types/node from 20.8.6 to 20.11.10 (#206)
Bump @babel/traverse from 7.10.3 to 7.23.2 (#180)
4.6.0
Bump deep-equal from 2.0.5 to 2.2.2 (#178)
Update dependencies and increase minimum node engine to 12
Update CI node versions to match winston
Bump eslint from 8.25.0 to 8.35.0 (#176)
Bump @types/node from 18.11.0 to 18.14.6 (#177)
Bump decode-uri-component from 0.2.0 to 0.2.2 (#159)
Bump eslint from 8.16.0 to 8.25.0 (#148)
Bump mocha from 10.0.0 to 10.1.0 (#150)
Bump @types/node from 17.0.36 to 18.11.0 (#151)
Bump logform from 2.4.1 to 2.4.2 (#126)
Bump logform from 2.4.0 to 2.4.1 (#122)
Bump @types/node from 17.0.21 to 17.0.36 (#115)
Bump eslint from 8.10.0 to 8.16.0 (#114)
Bump mocha from 9.2.1 to 10.0.0 (#109)
Bump minimist from 1.2.5 to 1.2.6 (#104)
Bump actions/setup-node from 2 to 3 (#95)
Bump @types/node from 17.0.15 to 17.0.21 (#94)
Bump eslint from 8.8.0 to 8.10.0 (#93)
Bump mocha from 9.2.0 to 9.2.1 (#91)
Bump logform from 2.3.2 to 2.4.0 (#90)
Bump actions/checkout from 2 to 3 (#96)
4.5.0
Update .npmignore
Merge branch 'master' of github.com:winstonjs/winston-transport
Changelog for 4.5.0
Memory leak fix: do not wait `process.nextTick` (#81)
Update linting dependencies (#87)
Replace Travis CI with GitHub Actions (#82)
fix(logform): removed duplicate dependency (#67)
Relative ref to bin file not needed; npm looks there by default (#80)
Update logform dependency version and run npm audit fix; update package version to 4.4.2
4.4.1 release details (#78)
[fix] Bump to latest readable-stream. (#45)
Add handleRejections to types (#44)
Promote logform to dependency (#58)
Exclude unnecessary files from npm package (#60)
4.4.0
Prepare for v4.4.0: update changelog, update dependencies, update Travis Node version
Expose LegacyTransportStream on index (#42)
Add handleRejections option support (#41)
🆕 @colors/colors (added, 1.6.0)
🆕 @dabh/diagnostics (added, 2.0.3)
🆕 @types/triple-beam (added, 1.3.5)
🆕 fn.name (added, 1.1.0)
🆕 safe-stable-stringify (added, 2.4.3)
🗑️ colornames (removed)
🗑️ colors (removed)
🗑️ diagnostics (removed)
🗑️ env-variable (removed)
🗑️ fast-safe-stringify (removed)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase
.
All Depfu comment commands
- @depfu rebase
- Rebases against your default branch and redoes this update
- @depfu recreate
- Recreates this PR, overwriting any edits that you've made to it
- @depfu merge
- Merges this PR once your tests are passing and conflicts are resolved
- @depfu cancel merge
- Cancels automatic merging of this PR
- @depfu close
- Closes this PR and deletes the branch
- @depfu reopen
- Restores the branch and reopens this PR (if it's closed)
- @depfu pause
- Ignores all future updates for this dependency and closes this PR
- @depfu pause [minor|major]
- Ignores all future minor/major updates for this dependency and closes this PR
- @depfu resume
- Future versions of this dependency will create PRs again (leaves this PR as is)