Bump the npm_and_yarn group across 1 directory with 4 updates by dependabot[bot] · Pull Request #3 · ithaca-protocol/ithaca-smart-contract

dependabot · 2024-04-04T17:01:20Z

Bumps the npm_and_yarn group with 4 updates in the / directory: @openzeppelin/contracts, @openzeppelin/contracts-upgradeable, follow-redirects and undici.

Updates @openzeppelin/contracts from 5.0.0 to 5.0.2

Release notes

Sourced from @openzeppelin/contracts's releases.

v5.0.2

Base64: Fix issue where dirty memory located just after the input buffer is affecting the result. (#4926)

v5.0.1

ERC2771Context and Context: Introduce a _contextPrefixLength() getter, used to trim extra information appended to msg.data.

Multicall: Make aware of non-canonical context (i.e. msg.sender is not _msgSender()), allowing compatibility with ERC2771Context.

Changelog

Sourced from @openzeppelin/contracts's changelog.

5.0.2 (2024-02-29)

Base64: Fix issue where dirty memory located just after the input buffer is affecting the result. (#4926)

5.0.1 (2023-12-07)

ERC2771Context and Context: Introduce a _contextPrefixLength() getter, used to trim extra information appended to msg.data.

Multicall: Make aware of non-canonical context (i.e. msg.sender is not _msgSender()), allowing compatibility with ERC2771Context.

Commits

dbb6104 Release v5.0.2 (#4928)
26b4b60 Port Base64 tests to truffle (#4926)
d4ec278 List every contract in each API doc section (#4848)
f7bb988 Replace Defender Admin with Transaction Proposals (#4804)
e53f81b Remove Governor's guide ERC6372 disclaimer for Tally (#4801)
01ef448 Release v5.0.1 (#4785)
9ce0340 Make Multicall context-aware
4eb67a4 Close access-control.adoc code block (#4726) (#4727)
83330a6 Add AccessManager guide (#4691) (#4724)
ab967b8 Update the "utilities" documentation page (#4678)
Additional commits viewable in compare view

Updates @openzeppelin/contracts-upgradeable from 5.0.0 to 5.0.2

Release notes

Sourced from @openzeppelin/contracts-upgradeable's releases.

v5.0.2

Base64: Fix issue where dirty memory located just after the input buffer is affecting the result. (#4926)

v5.0.1

ERC2771Context and Context: Introduce a _contextPrefixLength() getter, used to trim extra information appended to msg.data.

Multicall: Make aware of non-canonical context (i.e. msg.sender is not _msgSender()), allowing compatibility with ERC2771Context.

Changelog

Sourced from @openzeppelin/contracts-upgradeable's changelog.

5.0.2 (2024-02-29)

Base64: Fix issue where dirty memory located just after the input buffer is affecting the result. (#4926)

5.0.1 (2023-12-07)

ERC2771Context and Context: Introduce a _contextPrefixLength() getter, used to trim extra information appended to msg.data.

Multicall: Make aware of non-canonical context (i.e. msg.sender is not _msgSender()), allowing compatibility with ERC2771Context.

Commits

723f8ca Transpile dbb6104ce
1ff54db Transpile 26b4b6099
f542046 Transpile d4ec2782b
183376d Transpile f7bb9881
c104a41 Transpile e53f81b7
fbdb824 Transpile 01ef4489
757a7c8 Transpile 4eb67a40
150385f Transpile 83330a6e
9929e7e Transpile ab967b86
6cd0269 Transpile a34d986e
Additional commits viewable in compare view

Updates follow-redirects from 1.15.3 to 1.15.6

Commits

35a517c Release version 1.15.6 of the npm package.
c4f847f Drop Proxy-Authorization across hosts.
8526b4a Use GitHub for disclosure.
b1677ce Release version 1.15.5 of the npm package.
d8914f7 Preserve fragment in responseUrl.
6585820 Release version 1.15.4 of the npm package.
7a6567e Disallow bracketed hostnames.
05629af Prefer native URL instead of deprecated url.parse.
1cba8e8 Prefer native URL instead of legacy url.resolve.
72bc2a4 Simplify _processResponse error handling.
Additional commits viewable in compare view

Updates undici from 5.28.1 to 5.28.4

Release notes

Sourced from undici's releases.

v5.28.4

⚠️ Security Release ⚠️

Fixes GHSA-m4v8-wqvr-p9f7 CVE-2024-30260

Fixes GHSA-9qxr-qj54-h672 CVE-2024-30261

Full Changelog: nodejs/undici@v5.28.3...v5.28.4

v5.28.3

⚠️ Security Release ⚠️

Fixes:

CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch

Full Changelog: nodejs/undici@v5.28.2...v5.28.3

v5.28.2

What's Changed

fix: remove optional chainning for compatible with Nodejs12 and below by @bugb in nodejs/undici#2470

fix: remove node: prefix by @tsctx in nodejs/undici#2471

perf: avoid Headers initialization by @tsctx in nodejs/undici#2468

fix: handle SharedArrayBuffer correctly by @tsctx in nodejs/undici#2466

fix: Add null type to signal in RequestInit by @gebsh in nodejs/undici#2455

fix: correctly handle data URL with hashes. by @tsctx in nodejs/undici#2475

fix: check response for timinginfo allow flag by @ToshB in nodejs/undici#2477

Make call to onBodySent conditional in RetryHandler by @MzUgM in nodejs/undici#2478

refactor: better integrity check by @tsctx in nodejs/undici#2462

fix: Added support for inline URL username:password proxy auth by @matt-way in nodejs/undici#2473

build(deps-dev): bump jsdom from 22.1.0 to 23.0.0 by @dependabot in nodejs/undici#2472

build(deps-dev): bump sinon from 16.1.3 to 17.0.1 by @dependabot in nodejs/undici#2405

build(deps): bump ossf/scorecard-action from 2.2.0 to 2.3.1 by @dependabot in nodejs/undici#2396

build(deps): bump actions/setup-node from 3.8.1 to 4.0.0 by @dependabot in nodejs/undici#2395

build(deps): bump step-security/harden-runner from 2.5.0 to 2.6.0 by @dependabot in nodejs/undici#2392

build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 by @dependabot in nodejs/undici#2389

build(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 by @dependabot in nodejs/undici#2302

New Contributors

@bugb made their first contribution in nodejs/undici#2470

@gebsh made their first contribution in nodejs/undici#2455

@ToshB made their first contribution in nodejs/undici#2477

@MzUgM made their first contribution in nodejs/undici#2478

@matt-way made their first contribution in nodejs/undici#2473

Full Changelog: nodejs/undici@v5.28.1...v5.28.2

Commits

fb98306 Bumped v5.28.4
2b39440 Merge pull request from GHSA-9qxr-qj54-h672
64e3402 Merge pull request from GHSA-m4v8-wqvr-p9f7
723c4e7 Revert "build(deps-dev): bump formdata-node from 4.4.1 to 6.0.3 (#2389)"
0e9d54b skip failing test due to Node.js changes
e71cb4c Bumped v5.28.3
20c65b8 Fix tests for Node.js v20.11.0 (#2618)
8ec52cd Fix tests for Node.js v21 (#2609)
d3aa574 Merge pull request from GHSA-3787-6prv-h9w3
9a14e5f Bumped v5.28.2
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the npm_and_yarn group with 4 updates in the / directory: [@openzeppelin/contracts](https://github.com/OpenZeppelin/openzeppelin-contracts), [@openzeppelin/contracts-upgradeable](https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable), [follow-redirects](https://github.com/follow-redirects/follow-redirects) and [undici](https://github.com/nodejs/undici). Updates `@openzeppelin/contracts` from 5.0.0 to 5.0.2 - [Release notes](https://github.com/OpenZeppelin/openzeppelin-contracts/releases) - [Changelog](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/CHANGELOG.md) - [Commits](OpenZeppelin/openzeppelin-contracts@v5.0.0...v5.0.2) Updates `@openzeppelin/contracts-upgradeable` from 5.0.0 to 5.0.2 - [Release notes](https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/releases) - [Changelog](https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/blob/master/CHANGELOG.md) - [Commits](OpenZeppelin/openzeppelin-contracts-upgradeable@v5.0.0...v5.0.2) Updates `follow-redirects` from 1.15.3 to 1.15.6 - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.3...v1.15.6) Updates `undici` from 5.28.1 to 5.28.4 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v5.28.1...v5.28.4) --- updated-dependencies: - dependency-name: "@openzeppelin/contracts" dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: "@openzeppelin/contracts-upgradeable" dependency-type: direct:development dependency-group: npm_and_yarn - dependency-name: follow-redirects dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: undici dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added the dependencies Pull requests that update a dependency file label Apr 4, 2024

dependabot bot mentioned this pull request Apr 4, 2024

Bump the npm_and_yarn group across 1 directory with 4 updates #2

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the npm_and_yarn group across 1 directory with 4 updates#3

Bump the npm_and_yarn group across 1 directory with 4 updates#3
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/npm_and_yarn-66fab40dac

dependabot bot commented on behalf of github Apr 4, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Apr 4, 2024

v5.0.2

v5.0.1

5.0.2 (2024-02-29)

5.0.1 (2023-12-07)

v5.0.2

v5.0.1

5.0.2 (2024-02-29)

5.0.1 (2023-12-07)

v5.28.4

⚠️ Security Release ⚠️

v5.28.3

⚠️ Security Release ⚠️

v5.28.2

What's Changed

New Contributors

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants