Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): bump micromatch from 4.0.5 to 4.0.8 #33978

Merged
merged 3 commits into from
Jan 22, 2025

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 18, 2024

Bumps micromatch from 4.0.5 to 4.0.8.

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

[4.0.7] - 2024-05-22

  • this is basically v4.0.5, with some README updates
  • it is vulnerable to CVE-2024-4067
  • Updated braces to v3.0.3 to avoid CVE-2024-4068
  • does NOT break API compatibility

[4.0.6] - 2024-05-21

  • Added hasBraces to check if a pattern contains braces.
  • Fixes CVE-2024-4067
  • BREAKS API COMPATIBILITY
  • Should be labeled as a major release, but it's not.
Commits

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot bot added the automerge label Nov 18, 2024
Copy link

changeset-bot bot commented Nov 18, 2024

⚠️ No Changeset found

Latest commit: e792ad1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Copy link
Contributor

dionisio-bot bot commented Nov 18, 2024

Looks like this PR is not ready to merge, because of the following issues:

  • This PR is missing the 'stat: QA assured' label
  • This PR is missing the required milestone or project

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

Copy link

codecov bot commented Nov 18, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 75.00%. Comparing base (40328bc) to head (e792ad1).
Report is 1 commits behind head on develop.

Additional details and impacted files

Impacted file tree graph

@@             Coverage Diff              @@
##           develop   #33978       +/-   ##
============================================
+ Coverage    59.17%   75.00%   +15.83%     
============================================
  Files         2822      517     -2305     
  Lines        68124    22756    -45368     
  Branches     15149     5522     -9627     
============================================
- Hits         40314    17069    -23245     
+ Misses       24978     5024    -19954     
+ Partials      2832      663     -2169     
Flag Coverage Δ
e2e ?
e2e-api ?
unit 75.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

kodiakhq[bot]
kodiakhq bot previously approved these changes Nov 18, 2024
Copy link
Contributor Author

dependabot bot commented on behalf of github Nov 18, 2024

Looks like micromatch is no longer updatable, so this is no longer needed.

@dependabot dependabot bot closed this Nov 18, 2024
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/micromatch-4.0.8 branch November 18, 2024 18:21
@julio-rocketchat julio-rocketchat restored the dependabot/npm_and_yarn/micromatch-4.0.8 branch January 22, 2025 04:48
@CLAassistant
Copy link

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


Julio Araujo seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

Copy link
Contributor

PR Preview Action v1.6.0

🚀 View preview at
https://RocketChat.github.io/Rocket.Chat/pr-preview/pr-33978/

Built to branch gh-pages at 2025-01-22 05:05 UTC.
Preview will be ready when the GitHub Pages deployment is complete.

@kodiakhq kodiakhq bot merged commit 1385f95 into develop Jan 22, 2025
47 of 48 checks passed
@kodiakhq kodiakhq bot deleted the dependabot/npm_and_yarn/micromatch-4.0.8 branch January 22, 2025 07:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants