Skip to content

fix(deps): update all non-major dependencies

Delta10 Bot requested to merge renovate/all-minor-patch into master

This MR contains the following updates:

Package Change Age Adoption Passing Confidence
@fortawesome/fontawesome-free (source) 5.15.3 -> 5.15.4 age adoption passing confidence
@vue/cli-plugin-babel 4.5.12 -> 4.5.13 age adoption passing confidence
@vue/cli-plugin-eslint 4.5.12 -> 4.5.13 age adoption passing confidence
@vue/cli-service (source) 4.5.12 -> 4.5.13 age adoption passing confidence
Django (source, changelog) ==3.2 -> ==3.2.6 age adoption passing confidence
Pillow (source, changelog) ==8.2.0 -> ==8.3.1 age adoption passing confidence
core-js 3.10.1 -> 3.16.3 age adoption passing confidence
django-axes ==5.20.0 -> ==5.21.0 age adoption passing confidence
django-crispy-forms ==1.11.2 -> ==1.12.0 age adoption passing confidence
eslint (source) 7.23.0 -> 7.32.0 age adoption passing confidence
eslint-plugin-vue (source) 7.8.0 -> 7.16.0 age adoption passing confidence
node 12.22.1-alpine -> 12.22.5-alpine age adoption passing confidence
postgres 11.11-alpine -> 11.13-alpine age adoption passing confidence
prospector ==1.3.1 -> ==1.4.0 age adoption passing confidence
requests (source, changelog) ==2.25.1 -> ==2.26.0 age adoption passing confidence
requests_mock ==1.8.0 -> ==1.9.3 age adoption passing confidence
sphinx (source) ==3.5.3 -> ==3.5.4 age adoption passing confidence
sqlalchemy (changelog) ==1.4.6 -> ==1.4.23 age adoption passing confidence
vue 2.6.12 -> 2.6.14 age adoption passing confidence
vue-router 3.5.1 -> 3.5.2 age adoption passing confidence
vue-template-compiler 2.6.12 -> 2.6.14 age adoption passing confidence

Release Notes

FortAwesome/Font-Awesome

v5.15.4

Compare Source

Changed
  • Removed the tripadvisor brand icon by request of Tripadvisor
  • Update bug, bullseye, drone, icons #​17800 #​17106 #​17730
  • Update bootstrap, discord, figma, and font-awesome-* brand icons #​17436
Fixed
vuejs/vue-cli

v4.5.13

Compare Source

🐛 Bug Fix
Others
Committers: 3
django/django

v3.2.6

Compare Source

v3.2.5

Compare Source

v3.2.4

Compare Source

v3.2.3

Compare Source

v3.2.2

Compare Source

v3.2.1

Compare Source

python-pillow/Pillow

v8.3.1

Compare Source

  • Catch OSError when checking if fp is sys.stdout #​5585 [radarhere]

  • Handle removing orientation from alternate types of EXIF data #​5584 [radarhere]

  • Make Image.array take optional dtype argument #​5572 [t-vi, radarhere]

v8.3.0

Compare Source

  • Use snprintf instead of sprintf. CVE-2021-34552 #​5567 [radarhere]

  • Limit TIFF strip size when saving with LibTIFF #​5514 [kmilos]

  • Allow ICNS save on all operating systems #​4526 [baletu, radarhere, newpanjing, hugovk]

  • De-zigzag JPEG's DQT when loading; deprecate convert_dict_qtables #​4989 [gofr, radarhere]

  • Replaced xml.etree.ElementTree #​5565 [radarhere]

  • Moved CVE image to pillow-depends #​5561 [radarhere]

  • Added tag data for IFD groups #​5554 [radarhere]

  • Improved ImagePalette #​5552 [radarhere]

  • Add DDS saving #​5402 [radarhere]

  • Improved getxmp() #​5455 [radarhere]

  • Convert to float for comparison with float in IFDRational eq #​5412 [radarhere]

  • Allow getexif() to access TIFF tag_v2 data #​5416 [radarhere]

  • Read FITS image mode and size #​5405 [radarhere]

  • Merge parallel horizontal edges in ImagingDrawPolygon #​5347 [radarhere, hrdrq]

  • Use transparency behind first GIF frame and when disposing to background #​5557 [radarhere, zewt]

  • Avoid unstable nature of qsort in Quant.c #​5367 [radarhere]

  • Copy palette to new images in ImageOps expand #​5551 [radarhere]

  • Ensure palette string matches RGB mode #​5549 [radarhere]

  • Do not modify EXIF of original image instance in exif_transpose() #​5547 [radarhere]

  • Fixed default numresolution for small JPEG2000 images #​5540 [radarhere]

  • Added DDS BC5 reading #​5501 [radarhere]

  • Raise an error if ImageDraw.textbbox is used without a TrueType font #​5510 [radarhere]

  • Added ICO saving in BMP format #​5513 [radarhere]

  • Ensure PNG seeks to end of previous chunk at start of load_end #​5493 [radarhere]

  • Do not allow TIFF to seek to a past frame #​5473 [radarhere]

  • Avoid race condition when displaying images with eog #​5507 [mconst]

  • Added specific error messages when ink has incorrect number of bands #​5504 [radarhere]

  • Allow converting an image to a numpy array to raise errors #​5379 [radarhere]

  • Removed DPI rounding from BMP, JPEG, PNG and WMF loading #​5476, #​5470 [radarhere]

  • Remove spikes when drawing thin pieslices #​5460 [xtsm]

  • Updated default value for SAMPLESPERPIXEL TIFF tag #​5452 [radarhere]

  • Removed TIFF DPI rounding #​5446 [radarhere, hugovk]

  • Include code in WebP error #​5471 [radarhere]

  • Do not alter pixels outside mask when drawing text on an image with transparency #​5434 [radarhere]

  • Reset handle when seeking backwards in TIFF #​5443 [radarhere]

  • Replace sys.stdout with sys.stdout.buffer when saving #​5437 [radarhere]

  • Fixed UNDEFINED TIFF tag of length 0 being changed in roundtrip #​5426 [radarhere]

  • Fixed bug when checking FreeType2 version if it is not installed #​5445 [radarhere]

  • Do not round dimensions when saving PDF #​5459 [radarhere]

  • Added ImageOps contain() #​5417 [radarhere, hugovk]

  • Changed WebP default "method" value to 4 #​5450 [radarhere]

  • Switched to saving 1-bit PDFs with DCTDecode #​5430 [radarhere]

  • Use bpp from ICO header #​5429 [radarhere]

  • Corrected JPEG APP14 transform value #​5408 [radarhere]

  • Changed TIFF tag 33723 length to 1 #​5425 [radarhere]

  • Changed ImageMorph incorrect mode errors to ValueError #​5414 [radarhere]

  • Add EXIF tags specified in EXIF 2.32 #​5419 [gladiusglad]

  • Treat previous contents of first GIF frame as transparent #​5391 [radarhere]

  • For special image modes, revert default resize resampling to NEAREST #​5411 [radarhere]

  • JPEG2000: Support decoding subsampled RGB and YCbCr images #​4996 [nulano, radarhere]

  • Stop decoding BC1 punchthrough alpha in BC2&3 #​4144 [jansol]

  • Use zero if GIF background color index is missing #​5390 [radarhere]

  • Fixed ensuring that GIF previous frame was loaded #​5386 [radarhere]

  • Valgrind fixes #​5397 [wiredfool]

  • Round down the radius in rounded_rectangle #​5382 [radarhere]

  • Fixed reading uncompressed RGB data from DDS #​5383 [radarhere]

zloirock/core-js

v3.16.3

Compare Source

  • Fixed CreateAsyncFromSyncIterator semantic in AsyncIterator.from, related to #​765
  • Added a workaround of a specific case of broken Object.prototype, #​973

v3.16.2

Compare Source

  • Added a workaround of a Closure Compiler unsafe optimization, #​972
  • One more fix crashing of Object.create(null) on WSH, #​970
  • Added Deno 1.14 compat data mapping

v3.16.1

Compare Source

  • Fixed microtask implementation on iOS Pebble, #​967
  • Fixed some entry points
  • Improved old Safari compat data

v3.16.0

Compare Source

  • Array find from last proposal moved to the stage 3, July 2021 TC39 meeting
  • Array filtering stage 1 proposal:
    • Array.prototype.filterReject replaces Array.prototype.filterOut
    • %TypedArray%.prototype.filterReject replaces %TypedArray%.prototype.filterOut
  • Added Array grouping stage 1 proposal:
    • Array.prototype.groupBy
    • %TypedArray%.prototype.groupBy
  • Work with symbols made stricter: some missed before cases of methods that should throw an error on symbols now works as they should
  • Handling @@​toPrimitive in some cases of ToPrimitive internal logic made stricter
  • Fixed work of Request with polyfilled URLSearchParams, #​965
  • Fixed possible exposing of collections elements metadata in some cases, #​427
  • Fixed crashing of Object.create(null) on WSH, #​966
  • Fixed some cases of typed arrays subclassing logic
  • Fixed a minor bug related to string conversion in RegExp#exec
  • Fixed Date.prototype.getYear feature detection
  • Fixed content of some entry points
  • Some minor optimizations and refactoring
  • Deno:
    • Added Deno support (sure, after bundling since Deno does not support CommonJS)
    • Allowed deno target in core-js-compat / core-js-builder
    • A bundle for Deno published on deno.land/x/corejs
  • Added / updated compat data / mapping:
    • Deno 1.0-1.13
    • NodeJS up to 16.6
    • iOS Safari up to 15.0
    • Samsung Internet up to 15.0
    • Opera Android up to 64
    • Object.hasOwn marked as supported from V8 9.3 and FF92
    • Date.prototype.getYear marked as not supported in IE8-
  • Added summary option to core-js-builder, see more info in the README, #​910

v3.15.2

Compare Source

  • Worked around breakage related to zone.js loaded before core-js, #​953
  • Added NodeJS 16.4 -> Chrome 91 compat data mapping

v3.15.1

Compare Source

  • Fixed cloning of regex through RegExp constructor, #​948

v3.15.0

Compare Source

  • Added RegExp named capture groups polyfill, #​521, #​944
  • Added RegExp dotAll flag polyfill, #​792, #​944
  • Added missed polyfills of Annex B features (required mainly for some non-browser engines), #​336, #​945:
    • escape
    • unescape
    • String.prototype.substr
    • Date.prototype.getYear
    • Date.prototype.setYear
    • Date.prototype.toGMTString
  • Fixed detection of forbidden host code points in URL polyfill
  • Allowed rhino target in core-js-compat / core-js-builder, added compat data for rhino 1.7.13, #​942, thanks @​gausie
  • .at marked as supported from FF90

v3.14.0

Compare Source

  • Added polyfill of stable sort in { Array, %TypedArray% }.prototype.sort, #​769, #​941
  • Fixed Safari 14.0- %TypedArray%.prototype.sort validation of arguments bug
  • .at marked as supported from V8 9.2

v3.13.1

Compare Source

  • Overwrites get-own-property-symbols third-party Symbol polyfill if it's used since it causes a stack overflow, #​774
  • Added a workaround of possible browser crash on Object.prototype accessors methods in WebKit ~ Android 4.0, #​232

v3.13.0

Compare Source

v3.12.1

Compare Source

  • Fixed some cases of Function#toString with multiple core-js instances
  • Fixed some possible String#split polyfill problems in V8 5.1

v3.12.0

Compare Source

v3.11.3

Compare Source

  • Native promise-based APIs Promise#{ catch, finally } returns polyfilled Promise instances when it's required

v3.11.2

Compare Source

  • Added a workaround of WebKit ~ iOS 10.3 Safari Promise bug, #​932
  • Promise#then of incorrect native Promise implementations with correct subclassing no longer wrapped
  • Changed the order of Promise feature detection, removed unhandled rejection tracking check in non-browser non-node platforms

v3.11.1

Compare Source

  • Made instanceof Promise and .constructor === Promise work with polyfilled Promise for all native promise-based APIs
  • Added a workaround for some buggy V8 versions ~4.5 related to fixing of %TypedArray% static methods, #​564

v3.11.0

Compare Source

v3.10.2

Compare Source

  • URL and URLSearchParams marked as supported from Safari 14.0
  • Polyfilled built-in constructors protected from calling on instances
jazzband/django-axes

v5.21.0

Compare Source

  • Add configurable lockout HTTP status code responses with the new AXES_HTTP_RESPONSE_CODE setting. [phil-bell]
django-crispy-forms/django-crispy-forms

v1.12.0

Compare Source

  • Fixed rendering of grouped checkboxes and radio inputs in the Bootstrap 4 template pack. (#​1155)
  • Introduced new input_size argument to AppendedText, PrependedText and PrependedAppendedText. This allows the size of these grouped inputs to be changed in the Bootstrap 4 template pack. (#​1114)
  • Confirmed support for Django 3.2
  • Dropped support for Python 3.5
  • Dropped support for Django 3.0

See the 1.12.0 Milestone for the full change list.

eslint/eslint

v7.32.0

Compare Source

v7.31.0

Compare Source

v7.30.0

Compare Source

v7.29.0

Compare Source

v7.28.0

Compare Source

v7.27.0

Compare Source

  • 2c0868c Chore: merge all html formatter files into html.js (#​14612) (Milos Djermanovic)
  • 9e9b5e0 Update: no-unused-vars false negative with comma operator (fixes #​14325) (#​14354) (Nitin Kumar)
  • afe9569 Chore: use includes instead of indexOf (#​14607) (Mikhail Bodrov)
  • c0f418e Chore: Remove lodash (#​14287) (Stephen Wade)
  • 52655dd Update: no-restricted-imports custom message for patterns (fixes #​11843) (#​14580) (Alex Holden)
  • 967b1c4 Chore: Fix typo in large.js (#​14589) (Ikko Ashimine)
  • 2466a05 Sponsors: Sync README with website (ESLint Jenkins)
  • fe29f18 Sponsors: Sync README with website (ESLint Jenkins)
  • 086c1d6 Chore: add more test cases for no-sequences (#​14579) (Nitin Kumar)
  • 6a2ced8 Docs: Update README team and sponsors (ESLint Jenkins)

v7.26.0

Compare Source

  • aaf65e6 Upgrade: eslintrc for ModuleResolver fix (#​14577) (Brandon Mills)
  • ae6dbd1 Fix: track variables, not names in require-atomic-updates (fixes #​14208) (#​14282) (Patrick Ahmetovic)
  • 6a86e50 Chore: remove loose-parser tests (fixes #​14315) (#​14569) (Milos Djermanovic)
  • ee3a3ea Fix: create .eslintrc.cjs for module type (#​14304) (Nitin Kumar)
  • 6791dec Docs: fix example for require-atomic-updates (#​14562) (Milos Djermanovic)
  • 388eb7e Sponsors: Sync README with website (ESLint Jenkins)
  • f071d1e Update: Add automated suggestion to radix rule for parsing decimals (#​14291) (Bryan Mishkin)
  • 0b6a3f3 New: Include XO style guide in eslint --init (#​14193) (Federico Brigante)

v7.25.0

Compare Source

  • 5df5e4a Update: highlight last write reference for no-unused-vars (fixes #​14324) (#​14335) (Nitin Kumar)
  • 0023872 Docs: Add deprecated note to working-with-rules-deprecated page (#​14344) (Michael Novotny)
  • 36fca70 Chore: Upgrade eslump to 3.0.0 (#​14350) (Stephen Wade)
  • 59b689a Chore: add node v16 (#​14355) (薛定谔的猫)
  • 35a1f5e Sponsors: Sync README with website (ESLint Jenkins)
  • fb0a92b Chore: rename misspelled identifier in test (#​14346) (Tobias Nießen)
  • f2babb1 Docs: update pull request template (#​14336) (Nitin Kumar)
  • 02dde29 Docs: Fix anchor in 'docs/developer-guide/working-with-rules.md' (#​14332) (Nate-Wilkins)
  • 07d14c3 Chore: remove extraneous command from lint-staged config (#​14314) (James George)
  • 41b3570 Update: lint code block with same extension but different content (#​14227) (JounQin)
  • eb29996 Docs: add more examples with arrow functions for no-sequences rule (#​14313) (Nitin Kumar)

v7.24.0

Compare Source

vuejs/eslint-plugin-vue

v7.16.0

Compare Source

✨ Enhancements

  • #​1596 Added vue/valid-v-memo rule that enforce valid v-memo directives.
  • #​1599 Updated vue/no-unsupported-features rule to support Vue 3.2 syntaxes.

🐛 Bug Fixes

  • #​1602 Fixed false positives for namespace component in vue/script-setup-uses-vars rule.

⚙ Updates

  • #​1598 Updated vue/no-restricted-v-bind and vue/valid-v-bind rules to support attr modifier.

All commits: v7.15.2 -> v7.16.0

v7.15.2

Compare Source

🐛 Bug Fixes

  • #​1600 Fixed false positives in vue/no-use-computed-property-like-method rule.

All commits: v7.15.1 -> v7.15.2

v7.15.1

Compare Source

🐛 Bug Fixes

  • #​1590 Fixed message typo in vue/no-reserved-keys rule.
  • #​1591 Fixed false positives for type-only defineProps in vue/require-default-prop rule.

All commits: v7.15.0 -> v7.15.1

v7.15.0

Compare Source

✨ Enhancements

  • #​1234 Added vue/no-use-computed-property-like-method rule that disallows to use computed property like method.
  • #​1586 Added vue/block-lang rule rule that disallows the use of languages other than those available in the your application for the lang attribute of block elements.
  • #​1576 Updated some rules to support style CSS variable injection.
    • vue/comma-spacing rule.
    • vue/dot-notation rule.
    • vue/eqeqeq rule.
    • vue/func-call-spacing rule.
    • vue/no-extra-parens rule.
    • vue/no-restricted-syntax rule.
    • vue/no-useless-concat rule.
    • vue/prefer-template rule.
    • vue/space-in-parens rule.
    • vue/space-infix-ops rule.
    • vue/space-unary-ops rule.
    • vue/template-curly-spacing rule.

🐛 Bug Fixes

  • #​1584 Fixed false positives for call expression in vue/no-mutating-props rule.

⚙ Updates

All commits: v7.14.0 -> v7.15.0

v7.14.0

Compare Source

✨ Enhancements

  • #​1568 Added vue/require-expose rule that enforces the component to explicitly declare the exposed properties to the component using expose.
  • #​1566 Updated vue/no-unused-properties rule to support expose
  • #​1574 Updated some rules to support style CSS vars injection.
    • vue/no-parsing-error rule.
    • vue/no-unused-properties rule.
    • vue/script-setup-uses-vars rule.
    • vue/no-unsupported-features rule.
  • #​1565 Improved report location of vue/valid-v-xxx rules.

🐛 Bug Fixes

  • #​1569 Fixed false positives for <script setup> in vue/no-lifecycle-after-await rule.
  • #​1569 Fixed false positives for <script setup> in vue/no-watch-after-await rule.
  • #​1569 Fixed false positives for <script setup> in vue/no-restricted-call-after-await rule.
  • #​1575 Downgraded to semver compatible with Node v8.

All commits: v7.13.0 -> v7.14.0

v7.13.0

Compare Source

✨ Enhancements

  • Supports <script setup>
    • #​1529 Added vue/script-setup-uses-vars rule that will find variables in <script setup> used in <template> and mark them as used.
    • #​1559 Added vue/no-export-in-script-setup rule that disallows ES export in <script setup>.
    • #​1560 Added vue/valid-define-props rule that reports defineProps compiler macros in the following cases:
      • defineProps are referencing locally declared variables.
      • defineProps has both a literal type and an argument. e.g. defineProps<{/*props*/}>({/*props*/})
      • defineProps has been called multiple times.
      • Props are defined in both defineProps and export default {}.
      • Props are not defined in either defineProps or export default {}.
    • #​1561 Added vue/valid-define-emits rule that reports defineEmits compiler macros in the following cases:
      • defineEmits are referencing locally declared variables.
      • defineEmits has both a literal type and an argument. e.g. defineEmits<(e: 'foo')=>void>(['bar'])
      • defineEmits has been called multiple times.
      • Custom events are defined in both defineEmits and export default {}.
      • Custom events are not defined in either defineEmits or export default {}.
    • #​1532, #​1559 Upgraded vue-eslint-parser.
    • Updated rules to support <script setup>.
      • #​1531 vue/no-mutating-props rule.
      • #​1535 vue/no-reserved-keys rule.
      • #​1533 vue/no-async-in-computed-properties rule.
      • #​1534 vue/no-side-effects-in-computed-properties rule.
      • #​1536 vue/require-prop-type-constructor rule.
      • #​1539 vue/no-lifecycle-after-await rule.
      • #​1538 vue/require-valid-default-prop rule.
      • #​1542 vue/return-in-emits-validator rule.
      • #​1545 vue/require-default-prop rule.
      • #​1540 vue/no-setup-props-destructure rule.
      • #​1541 vue/no-watch-after-await rule.
      • #​1543 vue/no-template-shadow rule.
      • #​1544 vue/prop-name-casing rule.
      • #​1546 vue/require-prop-types rule.
      • #​1548 vue/require-explicit-emits rule.
      • #​1549 vue/custom-event-name-casing rule.
      • #​1550 vue/no-boolean-default rule.
      • #​1551 vue/no-restricted-call-after-await rule.
      • #​1552 vue/no-restricted-props rule.
      • #​1553 vue/no-unregistered-components rule.
      • #​1554 vue/no-unsupported-features rule.
      • #​1555 vue/no-unused-properties rule.
      • #​1556 vue/no-unused-refs rule.
      • #​1557 vue/require-emit-validator rule.
      • #​1558 vue/require-name-property rule.
  • #​1543 Updated vue/no-template-shadow rule to support setup().
  • #​1556 Updated vue/no-unused-refs rule to support setup().

🐛 Bug Fixes

  • #​1527 Changed the indent rule so that the union type has the same indent as the binary expression.

⚙️ Updates

  • #​1528 Deprecated vue/experimental-script-setup-vars rule.

All commits: v7.12.1 -> v7.13.0

v7.12.1

Compare Source

🐛 Bug Fixes

  • #​1525 Fixed false positives for trailing comma with import in vue/script-indent rule.

All commits: v7.12.0 -> v7.12.1

v7.12.0

Compare Source

✨ Enhancements

  • #​1520 Improved vue/script-indent rule to support TypeScript syntax.
  • #​1481 Improved vue/script-indent rule and vue/html-indent rule to support ES2022 Class Fields syntax. (When using espree v8+.)

🐛 Bug Fixes

  • #​1521 Fixed wrong auto-fix in vue/no-deprecated-slot-attribute rule and vue/no-deprecated-slot-scope-attribute rule.
  • #​1522 Fixed false positives for default with type Function in vue/no-deprecated-props-default-this rule.

⚙️ Updates

  • #​1481 Supports ES2022 Class Fields. (When using espree v8+.)

All commits: v7.11.1 -> v7.12.0

v7.11.1

Compare Source

🐛 Bug Fixes

  • #​1515 Fixed crash when using objectsInObjects option in vue/object-curly-spacing rule.

v7.11.0

Compare Source

✨ Enhancements

New Rules:
  • #​1506 Added vue/no-this-in-before-route-enter rule that disallow this usage in a beforeRouteEnter method.
  • #​1510 Added vue/no-deprecated-v-is rule that disallow deprecated v-is directive (in Vue.js 3.1.0+).
Other changes in Rules:
  • #​1501 Made vue/no-deprecated-destroyed-lifecycle rule to auto-fixable.

⚙️ Updates

  • #​1509 Added supports for is="vue:" (Vue 3.1.0+).

All commits: v7.10.0 -> v7.11.0

v7.10.0

Compare Source

✨ Enhancements

New Rules:
  • #​1487 Added vue/require-emit-validator rule that enforce the validator definition in emits.
Other changes in Rules:
  • #​1493 Changed vue/this-in-template rule to support autofix.

⚙ Updates

  • #​1484 Changed vue/attribute-hyphenation rule to ignore SVG attributes.

All commits: v7.9.0 -> v7.10.0

v7.9.0

Compare Source

✨ Enhancements

New Rules:
  • #​1466 Added vue/no-invalid-model-keys rule that disallow invalid model option keys.
  • #​1474 Added vue/no-unused-refs rule that reports refs that are defined using the ref attribute in <template> but are not used via $refs.
Other changes in Rules:
  • #​1465 Added singleline.allowFirstLine option to vue/max-attributes-per-line rule.

🐛 Bug Fixes

  • #​1469 Fixed false negative in as expression for vue/require-valid-default-prop rule.

All commits: v7.8.0 -> v7.9.0

nodejs/node

v12.22.5

Compare Source

This is a security release.

Notable Changes
  • CVE-2021-3672/CVE-2021-22931: Improper handling of untypical characters in domain names (High)
    • Node.js was vulnerable to Remote Code Execution, XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library which can lead to the output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22931.
  • CVE-2021-22930: Use after free on close http2 on stream canceling (High)
    • Node.js was vulnerable to a use after free attack where an attacker might be able to exploit memory corruption to change process behavior. This release includes a follow-up fix for CVE-2021-22930 as the issue was not completely resolved by the previous fix. You can read more about it at https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22930.
  • CVE-2021-22939: Incomplete validation of rejectUnauthorized parameter (Low)
    • If the Node.js HTTPS API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. You can read more about it at https://nvd.nist.gov/vuln/detail/CVE-2021-22939.
Commits

v12.22.4

Compare Source

This is a security release.

Notable Changes
  • CVE-2021-22930: Use after free on close http2 on stream canceling (High)
Commits

v12.22.3

Compare Source

Notable Changes

Node.js 12.22.2 introduced a regression in the Windows installer on non-English locales that is being fixed in this release. There is no need to download this release if you are not using the Windows installer.

Commits

v12.22.2

Compare Source

This is a security release.

Notable Changes

Vulnerabilities fixed:

  • CVE-2021-22918: libuv upgrade - Out of bounds read (Medium)
    • Node.js is vulnerable to out-of-bounds read in libuv's uv__idna_toascii() function which is used to convert strings to ASCII. This is called by Node's dns module's lookup() function and can lead to information disclosures or crashes. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22918
  • CVE-2021-22921: Windows installer - Node Installer Local Privilege Escalation (Medium)
    • Node.js is vulnerable to local privilege escalation attacks under certain conditions on Windows platforms. More specifically, improper configuration of permissions in the installation directory allows an attacker to perform two different escalation attacks: PATH and DLL hijacking. You can read more about it in https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22921
  • CVE-2021-27290: npm upgrade - ssri Regular Expression Denial of Service (ReDoS) (High)
  • CVE-2021-23362: npm upgrade - hosted-git-info Regular Expression Denial of Service (ReDoS) (Medium)
Commits
psf/requests

v2.26.0

Compare Source

Improvements

  • Requests now supports Brotli compression, if either the brotli or brotlicffi package is installed. (#​5783)

  • Session.send now correctly resolves proxy configurations from both the Session and Request. Behavior now matches Session.request. (#​5681)

Bugfixes

  • Fixed a race condition in zip extraction when using Requests in parallel from zip archive. (#​5707)

Dependencies

  • Instead of chardet, use the MIT-licensed charset_normalizer for Python3 to remove license ambiguity for projects bundling requests. If chardet is already installed on your machine it will be used instead of charset_normalizer to keep backwards compatibility. (#​5797)

    You can also install chardet while installing requests by specifying [use_chardet_on_py3] extra as follows:

    pip install "requests[use_chardet_on_py3]"

    Python2 still depends upon the chardet module.

  • Requests now supports idna 3.x on Python 3. idna 2.x will continue to be used on Python 2 installations. (#​5711)

Deprecations

  • The requests[security] extra has been converted to a no-op install. PyOpenSSL is no longer the recommended secure option for Requests. (#​5867)

  • Requests has officially dropped support for Python 3.5. (#​5867)

sphinx-doc/sphinx

v3.5.4

=====================================

Dependencies

Bugs fixed

  • #​9078: autodoc: Async staticmethods and classmethods are considered as non async coroutine-functions with Python3.10

  • #​8870, #​9001, #​9051: html theme: The style are not applied with docutils-0.17

    • toctree captions
    • The content of sidebar directive
    • figures
vuejs/vue

v2.6.14

Compare Source

Bug Fixes
Features

v2.6.13

Compare Source

Bug Fixes
Features
Performance Improvements
vuejs/vue-router

v3.5.2

Compare Source

Bug Fixes

Configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This MR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this MR, check this box.

This MR has been generated by Renovate Bot.

Edited by Delta10 Bot

Merge request reports