Bump micromatch from 4.0.5 to 4.0.8#181

Open

dependabot[bot] wants to merge 1 commit intomaster from

dependabot/npm_and_yarn/micromatch-4.0.8

Open

Bump micromatch from 4.0.5 to 4.0.8 #181
dependabot[bot] wants to merge 1 commit intomaster from
dependabot/npm_and_yarn/micromatch-4.0.8

Conversation

@dependabot

Copy link

Contributor

@dependabot dependabot bot commented on behalf of github Aug 23, 2024 •

edited

Loading

Bumps micromatch from 4.0.5 to 4.0.8.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024年08月22日

backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024年05月22日

this is basically v4.0.5, with some README updates

it is vulnerable to CVE-2024-4067

Updated braces to v3.0.3 to avoid CVE-2024-4068

does NOT break API compatibility

[4.0.6] - 2024年05月21日

Added hasBraces to check if a pattern contains braces.

Fixes CVE-2024-4067

BREAKS API COMPATIBILITY

Should be labeled as a major release, but it's not.

Commits

8bd704e 4.0.8
a0e6841 run verb to generate README documentation
4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
814f5f7 lint
67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
113f2e3 fix: CVE numbers in CHANGELOG
d9dbd9a feat: updated CHANGELOG
2ab1315 fix: use actions/setup-node@v4
1406ea3 feat: rework test to work on macos with node 10,12 and 14
Additional commits viewable in compare view

Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot dependabot bot added the dependencies label

Aug 23, 2024

@cb-heimdall

Copy link

cb-heimdall commented Aug 23, 2024 •

edited

Loading

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 `0/1`	Denominator calculation Show calculation `1` if user is bot 0 `1` if user is external 0 From `.codeflow.yml` 1 Additional review requirements Show calculation Max 0	0
From `CODEOWNERS`	0
Global minimum	0
Max	1

1 if commit is unverified 0

Sum 1

1 similar comment

@cb-heimdall

Copy link

cb-heimdall commented Aug 23, 2024

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 `0/1`	Denominator calculation Show calculation `1` if user is bot 0 `1` if user is external 0 From `.codeflow.yml` 1 Additional review requirements Show calculation Max 0	0
From `CODEOWNERS`	0
Global minimum	0
Max	1

1 if commit is unverified 0

Sum 1

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/micromatch-4.0.8 branch from fc0586b to df5fdbf Compare

August 29, 2024 18:31

@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/micromatch-4.0.8 branch from df5fdbf to e0a8eb8 Compare

September 5, 2024 22:13

@dependabot


 Bump micromatch from 4.0.5 to 4.0.8

cf8d0a2

Bumps [micromatch](https://github.com/micromatch/micromatch) from 4.0.5 to 4.0.8.
- [Release notes](https://github.com/micromatch/micromatch/releases)
- [Changelog](https://github.com/micromatch/micromatch/blob/4.0.8/CHANGELOG.md)
- [Commits](micromatch/micromatch@4.0.5...4.0.8)
---
updated-dependencies:
- dependency-name: micromatch
 dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>