[Snyk] Upgrade metalsmith from 2.3.0 to 2.6.0 #5
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade metalsmith from 2.3.0 to 2.6.0. See this package in npm: https://www.npmjs.com/package/metalsmith See this project in Snyk: https://app.snyk.io/org/lidorg-dev/project/3f573cd9-00f2-4d6b-ad02-57e26f0b882e?utm_source=github&utm_medium=referral&page=upgrade-pr
![jit-ci[bot]](https://avatars.githubusercontent.com/in/142441?s=60&v=4){kind=small}
| @@ -45,7 +45,7 @@ | |||
| "junk": "^3.1.0", | |||
| "lodash.defaultsdeep": "^4.6.1", | |||
| "marked": "^0.8.0", | |||
| "metalsmith": "^2.3.0", | |||
| "metalsmith": "^2.6.0", | |||
There was a problem hiding this comment.
Security control: Software Component Analysis Js
Type: Glob-Parent Before 5.1.2 Vulnerable To Regular Expression Denial Of Service In Enclosure Regex
Description: metalsmith>chokidar>glob-parent
Is fix available? Yes
Severity: HIGH
Jit Bot commands and options (e.g., ignore issue)
You can trigger Jit actions by commenting on this PR review:
#jit_ignore_fpIgnore and mark this specific single instance of finding as “False Positive”#jit_ignore_acceptIgnore and mark this specific single instance of finding as “Accept Risk”#jit_undo_ignoreUndo ignore command
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to upgrade metalsmith from 2.3.0 to 2.6.0.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version fixes:
SNYK-JS-ANSIREGEX-1583908
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
(*) Note that the real score may have changed since the PR was raised.
Release notes
Package name: metalsmith
-
2.6.0 - 2023-05-29
- [#356] Added Typescript support
- Added --debug and --dry-run options to metalsmith (build) command
- Added --env option to metalsmith (build) command
- Added Metalsmith CLI support for loading a .(c)js config. Reads from metalsmith.js as second default after metalsmith.json
- Added support for running (C/M)JS config files from CLI
- Dependencies:
- #231 Dropped support for Node < 14.14.0
- Dependencies:
- Modernized Metalsmith CLI, prepared transition to imports instead of require
- Dependencies:
- Fixes a duplicate empty input check in metalsmith.match
- Gray-matter excerpts are removed from contents instead of being duplicated to the
- Gray-matter excerpts are trimmed
-
2.5.1 - 2022-10-07
- Dependencies:
- Clarified semver policy in README.md
- Added SECURITY.md
- Fixes #373: do not crash when postinstall script fails in specific environments
-
2.5.0 - 2022-06-10
- #354 Added
- #356 Added
- #362 Upgraded all generator-based methods (
- Added org migration notification to postinstall script to encourage users to upgrade
- #231 Dropped support for Node < 12
- Dependencies:
- Restructured and updated
- #247 Calling
- #355 Proper path resolution for edge-cases using CLI, running metalsmith from outside or subfolder of
-
2.4.3 - 2022-05-16
- Dependencies:
- Updated README.md
- Fixes repeat
-
2.4.2 - 2022-02-13
- Dependencies:
- Updated README.md
- Fixed Metalsmith JSDoc type hints in VS code
-
2.4.1 - 2022-01-31
- #338 Added
- #358 Added TS-style JSdocs
- Use native
- #226 Allow passing a gray-matter options object to
- Modernized dev setup
- Added 8 new tests (match method, front-matter options, path & symbolic link handling)
- Files object file paths are now guaranteed to be sorted aphabetically.
- #211
- #231 Dropped support for Node < 8
- Dependencies:
-
-
- #206
- #226 Metalsmith will no longer 'swallow' errors on invalid front-matter, they will be passed to
- Fix test error on Windows #158 (@ moozzyk)
- #281 Metalsmith now properly handles symbolic links (will throw an ENOENT error or they can be
- #178
- #295 Metalsmith now catches all FS errors and passes them to the build callback/ thenable appropriately.
- Replace all occurences of
- Development Dependencies:
-
2.4.0 - 2022-01-31
-
2.3.0 - 2016-10-28
- Add packaging metadata to build the metalsmith snap (#249)
- Update dependencies (#246)
- Remove unused dependencies
- Fix error when reading a symbolic link to a dir (#229)
- Upgrade dependency to include security fix (#258)
from metalsmith GitHub release notesAdded
58d22a32d84fbe9661ddc45a4afe424e6ecchokidar9d40674lodash.clonedeepwithe12537fRemoved
80d8508rimraf: replaced with native Node.js methodsae05945cross-spawn:baee1deUpdated
24fcffb4929bc2commander: 6.2.1 -> 10.0.124fcffb0810728Fixed
60e173aexcerptproperty2bfe800acb363eFull Changelog: v2.5.1...v2.6.0
774a164debug: 4.3.3 ▶︎ 4.3.4Fixed
Important note to metalsmith-watch users:
Although 2.5.0 is a semver-minor release, it breaks compatibility with metalsmith-watch, which relies on the Metalsmith < 2.4.x private method signature using the outdated unyield package. See issue #374 for more details.
Added
Metalsmith#envmethod. Supports passingDEBUGandDEBUG_LOGamongst others. SetsCLI: truewhen run from the metalsmith CLI.b42df8c,446c676,33d936b,4c483a3Metalsmith#debugmethod for creating plugin debuggersMetalsmith#read,Metalsmith#readFile,Metalsmith#write,Metalsmith#writeFile,Metalsmith#runandMetalsmith#process) to dual callback-/ promise-based methods16a91c5,faf6ab6,6cb62293a11a24Removed
0a53007thunkify: replaced with promise-based implementationfaf6ab6unyieldreplaced with promise-based implementationfaf6ab6co-fs-extra: replaced with native Node.js methodsfaf6ab6chalk: not necessary for the few colors used by Metalsmith CLI1dae1cbclone: see #247a871af6Updated
README.md0da0c4dMetalsmith#metadatano longer clones the object passed to it, overwriting the previous metadata, but merges it into existing metadata.Fixed
metalsmith.directory()5d75539Updated
774a164micromatch: 4.0.4 ▶︎ 4.0.5Fixed
metalsmith.matchfile cache in repeat runs without re-read, see metalsmith/layouts#183a727309Updated
af9dec0chalk: 3.0.0 ▶︎ 4.1.2Fixed
ebf82f4Fixed
Bugfix: include index.js in package.json files
Unfortunately release 2.4.0 missed the index.js file and was only usable by doing require('metalsmith/lib'). For this reason the release notes from 2.4.0 are re-included below:
Added
Metalsmith#matchmethod. Plugins no longer need to require a matching library705c4bb,f01c724828b17efs.rminstead ofrimrafwhen available (Node 14.4+)fcbb76e,66e4376Metalsmith#frontmattera6438d2ef7b7814eb1184Metalsmith#buildnow returns a promise which you can attach athen/catchto orawait. The build callback model is still available.6d5a42dRemoved
2db47f5,75e6878has-generators: obsolete in supported Node versions2db47f5absolutereplaced with native Nodepath.isAbsolutec05f9e2(@ Zearin)isreplaced with own implementation7eaac9e2,54dba0c1(@ Zearin)recursive-readdir: replaced with own implementation4eb1184Updated
Dependencies:
75e6878chalk: 1.1.3 ▶︎ 3.0.0gray-matter: 2.0.0 ▶︎ 4.0.3stat-mode: 0.2.0 ▶︎ 1.0.0rimraf: 2.2.8 ▶︎ 3.0.2ware: 1.2.0 ▶︎ 1.3.0commander(used in CLI): 2.15.1 ▶︎ 6.2.1win-fork(used in CLI): replaced withcross-spawn:7.0.3Updated
CHANGELOG.mdformat to follow “Keep A Changelog” (#266) (@ Zearin)Fixed
Metalsmith#ignorenow only matches paths relative toMetalsmith#source(as it should). See linked issue for details4eb1184Metalsmith#builda6438d2Metalsmith#ignore'd)4eb1184Metalsmith#ignorenow removes the matched files before they arestattedfor glob-based ignores (saving some perf & potential errors).Security
new BufferwithBuffer.fromnpm auditvulnerability fixescoveralls: 2.11.6 ▶︎ 3.0.1 (#308) (@ Zearin)Fix 5 “Moderate” vulnerabilities
metalsmith-markdown: 0.2.1 ▶︎ 0.2.2 (#312) (@ Zearin)Fix 1 “Low” vulnerability
Read more
Added
Updated
Removed
Fixed
Security
Commit messages
Package name: metalsmith
Compare
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
🧐 View latest project report
🛠 Adjust upgrade PR settings
🔕 Ignore this dependency or unsubscribe from future upgrade PRs