build(deps-dev): bump expect from 28.1.3 to 29.4.2 by dependabot[bot] · Pull Request #66 · boilerplate-language/boilerplate-nodejs

dependabot · 2023-02-07T15:14:25Z

Bumps expect from 28.1.3 to 29.4.2.

Release notes

v29.4.2

Features

[@jest/core] Instrument significant lifecycle events with performance.mark() (#13859)

Fixes

[expect, @jest/expect] Provide type of actual as a generic argument to Matchers to allow better-typed extensions (#13848)

[jest-circus] Added explicit mention of test failing because done() is not being called in error message (#13847)

[jest-runtime] Handle CJS re-exports of node core modules from ESM (#13856)

[jest-transform] Downgrade write-file-atomic to v4 (#13853)

[jest-worker] Ignore IPC messages not intended for Jest (#13543)

Chore & Maintenance

[*] make sure to exclude .eslintcache from published module (#13832)

[docs] Cleanup incorrect links in CHANGELOG.md (#13857)

New Contributors

@benjaminjkraft made their first contribution in facebook/jest#13848

@LinusU made their first contribution in facebook/jest#13543

@SuperSodaSea made their first contribution in facebook/jest#13857

@kowalski made their first contribution in facebook/jest#13856

Full Changelog: jestjs/jest@v29.4.1...v29.4.2

v29.4.1

Features

[expect, jest-circus, @jest/types] Implement numPassingAsserts of testResults to track the number of passing asserts in a test (#13795)

[jest-core] Add newlines to JSON output (#13817)

[@jest/reporters] Automatic log folding in GitHub Actions Reporter (#13626)

Fixes

[@jest/expect-utils] toMatchObject diffs should include Symbol properties (#13810)

[jest-runtime] Handle missing replaceProperty (#13823)

[@jest/types] Add partial support for done callbacks in typings of each (#13756)

New Contributors

@jessevanassen made their first contribution in facebook/jest#13817

@ymqy made their first contribution in facebook/jest#13795

@MatteoH2O1999 made their first contribution in facebook/jest#13626

Full Changelog: jestjs/jest@v29.4.0...v29.4.1

v29.4.0

Features

[expect, @jest/expect-utils] Support custom equality testers (#13654)

... (truncated)

Changelog

Sourced from expect's changelog.

29.4.2

Features

[@jest/core] Instrument significant lifecycle events with performance.mark() (#13859)

Fixes

[expect, @jest/expect] Provide type of actual as a generic argument to Matchers to allow better-typed extensions (#13848)

[jest-circus] Added explicit mention of test failing because done() is not being called in error message (#13847)

[jest-runtime] Handle CJS re-exports of node core modules from ESM (#13856)

[jest-transform] Downgrade write-file-atomic to v4 (#13853)

[jest-worker] Ignore IPC messages not intended for Jest (#13543)

Chore & Maintenance

[*] make sure to exclude .eslintcache from published module (#13832)

[docs] Cleanup incorrect links in CHANGELOG.md (#13857)

29.4.1

Features

[expect, jest-circus, @jest/types] Implement numPassingAsserts of testResults to track the number of passing asserts in a test (#13795)

[jest-core] Add newlines to JSON output (#13817)

[@jest/reporters] Automatic log folding in GitHub Actions Reporter (#13626)

Fixes

[@jest/expect-utils] toMatchObject diffs should include Symbol properties (#13810)

[jest-runtime] Handle missing replaceProperty (#13823)

[@jest/types] Add partial support for done callbacks in typings of each (#13756)

29.4.0

Features

[expect, @jest/expect-utils] Support custom equality testers (#13654)

[jest-config, jest-worker] Use os.availableParallelism if available to calculate number of workers to spawn (#13738)

[@jest/globals, jest-mock] Add jest.replaceProperty() that replaces property value (#13496)

[jest-haste-map] ignore Sapling vcs directories (.sl/) (#13674)

[jest-resolve] Support subpath imports (#13705, #13723, #13777)

[jest-runtime] Add jest.isolateModulesAsync for scoped module initialization of asynchronous functions (#13680)

[jest-runtime] Add jest.isEnvironmentTornDown function (#13741)

[jest-test-result] Added skipped and focused status to FormattedTestResult (#13700)

[jest-transform] Support for asynchronous createTransformer (#13762)

Fixes

[jest-environment-node] Fix non-configurable globals (#13687)

... (truncated)

Commits

f0fc92e v29.4.2
ffe2352 chore: move @jest/test-utils reference (#13468)
427fe2b feat(@jest/expect): Expose type of actual to Matchers (#13848)
bc7b20c chore: make sure to exclude .eslintcache from published module (#13832)
bc84c8a v29.4.1
c78905c Implement numPassingAsserts of testCaseResult (#13795)
9fa2a46 Include symbol keys when diffing objects (#13810)
4bc0e8a v29.4.0
4fd1cb3 [Feature] Add support for custom equality testers (#13654)
fb37bd1 fix: expect.toMatchObject ignores symbol key properties (#13639)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [expect](https://github.com/facebook/jest/tree/HEAD/packages/expect) from 28.1.3 to 29.4.2. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/facebook/jest/commits/v29.4.2/packages/expect) --- updated-dependencies: - dependency-name: expect dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2023-02-07T15:14:55Z

# npm audit report

clean-css  <4.1.11
Regular Expression Denial of Service in clean-css - https://github.com/advisories/GHSA-wxhq-pm8v-cw75
fix available via `npm audit fix --force`
Will install jade@1.9.2, which is a breaking change
node_modules/clean-css
  jade  >=0.30.0
  Depends on vulnerable versions of clean-css
  Depends on vulnerable versions of constantinople
  Depends on vulnerable versions of transformers
  node_modules/jade

constantinople  <3.1.1
Severity: critical
Sandbox Bypass Leading to Arbitrary Code Execution in constantinople - https://github.com/advisories/GHSA-4vmm-mhcq-4x9j
fix available via `npm audit fix --force`
Will install jade@1.9.2, which is a breaking change
node_modules/constantinople

taffydb  *
Severity: high
TaffyDB can allow access to any data items in the DB - https://github.com/advisories/GHSA-mxhp-79qh-mcx6
fix available via `npm audit fix`
node_modules/taffydb
  jsdoc  3.2.0-dev - 3.6.11
  Depends on vulnerable versions of taffydb
  node_modules/jsdoc-api/node_modules/jsdoc
    jsdoc-api  4.0.0 - 7.1.1
    Depends on vulnerable versions of jsdoc
    node_modules/jsdoc-api

uglify-js  <=2.5.0
Severity: critical
Regular Expression Denial of Service in uglify-js - https://github.com/advisories/GHSA-c9f4-xj24-8jqx
Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js - https://github.com/advisories/GHSA-34r7-q49f-h37c
fix available via `npm audit fix --force`
Will install jade@1.9.2, which is a breaking change
node_modules/transformers/node_modules/uglify-js
  transformers  2.0.0 - 3.0.1
  Depends on vulnerable versions of uglify-js
  node_modules/transformers

8 vulnerabilities (1 low, 3 high, 4 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

github-actions · 2023-02-07T15:14:57Z

=== npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical      │ Sandbox Bypass Leading to Arbitrary Code Execution in        │
│               │ constantinople                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ constantinople                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.1.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jade                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jade > constantinople                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-4vmm-mhcq-4x9j            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service in clean-css            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ clean-css                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.1.11                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jade                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jade > clean-css                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-wxhq-pm8v-cw75            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Regular Expression Denial of Service in uglify-js            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ uglify-js                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.6.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jade                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jade > transformers > uglify-js                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-c9f4-xj24-8jqx            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical      │ Incorrect Handling of Non-Boolean Comparisons During         │
│               │ Minification in uglify-js                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ uglify-js                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.4.24                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jade                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jade > transformers > uglify-js                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-34r7-q49f-h37c            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ TaffyDB can allow access to any data items in the DB         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ taffydb                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ jsdoc-to-markdown [dev]                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ jsdoc-to-markdown > jsdoc-api > jsdoc > taffydb              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://github.com/advisories/GHSA-mxhp-79qh-mcx6            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 5 vulnerabilities (1 low, 2 high, 2 critical) in 857 scanned packages
  5 vulnerabilities require manual review. See the full report for details.

dependabot · 2023-02-15T16:07:56Z

Superseded by #67.

dependabot Bot added the dependencies Pull requests that update a dependency file label Feb 7, 2023

dependabot Bot assigned kannkyo Feb 7, 2023

dependabot Bot mentioned this pull request Feb 7, 2023

build(deps-dev): bump expect from 28.1.3 to 29.4.1 #65

Closed

dependabot Bot closed this Feb 15, 2023

dependabot Bot deleted the dependabot/npm_and_yarn/expect-29.4.2 branch February 15, 2023 16:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps-dev): bump expect from 28.1.3 to 29.4.2#66

build(deps-dev): bump expect from 28.1.3 to 29.4.2#66
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/expect-29.4.2

dependabot Bot commented on behalf of github Feb 7, 2023

Uh oh!

github-actions Bot commented Feb 7, 2023

Uh oh!

github-actions Bot commented Feb 7, 2023

Uh oh!

dependabot Bot commented on behalf of github Feb 15, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Feb 7, 2023

v29.4.2

Features

Fixes

Chore & Maintenance

New Contributors

v29.4.1

Features

Fixes

New Contributors

v29.4.0

Features

29.4.2

Features

Fixes

Chore & Maintenance

29.4.1

Features

Fixes

29.4.0

Features

Fixes

Uh oh!

github-actions Bot commented Feb 7, 2023

Uh oh!

github-actions Bot commented Feb 7, 2023

Uh oh!

dependabot Bot commented on behalf of github Feb 15, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant