chore(deps): bump the npm_and_yarn group across 7 directories with 7 updates #7

dependabot · 2024-11-17T06:26:36Z

Bumps the npm_and_yarn group with 6 updates in the / directory:

Package	From	To
postcss	`8.4.31`	`8.4.32`
nodemailer	`6.9.9`	`6.9.10`
pdfjs-dist	`3.11.174`	`4.2.67`
braces	`3.0.2`	`3.0.3`
follow-redirects	`1.15.3`	`1.15.9`
ws	`8.14.2`	`8.18.0`

Bumps the npm_and_yarn group with 1 update in the /apps/documentation directory: next.
Bumps the npm_and_yarn group with 1 update in the /apps/marketing directory: next.
Bumps the npm_and_yarn group with 1 update in the /apps/web directory: next.
Bumps the npm_and_yarn group with 1 update in the /packages/ee directory: next.
Bumps the npm_and_yarn group with 1 update in the /packages/lib directory: next.
Bumps the npm_and_yarn group with 2 updates in the /packages/ui directory: next and pdfjs-dist.

Updates postcss from 8.4.31 to 8.4.32

Release notes

Sourced from postcss's releases.

8.4.32

Fixed postcss().process() types (by @ferreira-tb).

Changelog

Sourced from postcss's changelog.

8.4.32

Fixed postcss().process() types (by Andrew Ferreira).

Commits

a0d9f10 Release 8.4.32 version
0146b3e Add Node.js 21 to CI
2398534 Update dependencies
1918533 Merge pull request #1902 from ferreira-tb/main
395e6dc Fix ProcessOptions interface
fa8cd15 Update dependencies
199a7c4 Typo
2528047 Update EM link
See full diff in compare view

Updates nodemailer from 6.9.9 to 6.9.10

Release notes

Sourced from nodemailer's releases.

v6.9.10

6.9.10 (2024-02-22)

Bug Fixes

data-uri: Do not use regular expressions for parsing data URI schemes (12e65e9)

data-uri: Moved all data-uri regexes to use the non-regex parseDataUri method (edd5dfe)

Changelog

Sourced from nodemailer's changelog.

6.9.10 (2024-02-22)

Bug Fixes

data-uri: Do not use regular expressions for parsing data URI schemes (12e65e9)

data-uri: Moved all data-uri regexes to use the non-regex parseDataUri method (edd5dfe)

Commits

ade59e0 chore(master): release 6.9.10 [skip-ci] (#1627)
edd5dfe fix(data-uri): Moved all data-uri regexes to use the non-regex parseDataUri m...
db77249 Merge branch 'master' of github.com:nodemailer/nodemailer
12e65e9 fix(data-uri): Do not use regular expressions for parsing data URI schemes
See full diff in compare view

Updates pdfjs-dist from 3.11.174 to 4.2.67

Release notes

Sourced from pdfjs-dist's releases.

v4.2.67

This release includes a new JPX decoder, based on OpenJPEG, which improves JPX image rendering performance and correctness. Moreover, this release contains improvements for the annotation editor, font conversion and the viewer.

Note that text selection boxes for some PDF files may overlap visually. This is a known issue that we currently track in mozilla/pdf.js#17561.

Changes since v4.1.392

Bump the stable version in pdfjs.config by @timvandermeij in mozilla/pdf.js#17924

Convert the history code to use proper private methods by @timvandermeij in mozilla/pdf.js#17925

Update dependencies and translations to the most recent versions by @timvandermeij in mozilla/pdf.js#17927

Remove the tag for missing font subset when trying to find a substitution by @calixteman in mozilla/pdf.js#17930

Fix resetting of cursor-tools when closing the document (PR 17464 follow-up) by @Snuffleupagus in mozilla/pdf.js#17933

Warn when a non-embedded font has an invalid name by @calixteman in mozilla/pdf.js#17934

Remove the mkdirp dependency in favor of the built-in Node.js fs.mkdirSync by @timvandermeij in mozilla/pdf.js#17935

Improve type definitions for the viewer by @ex37 in mozilla/pdf.js#17879

Fix the "must check that invisible fields are made visible" scripting integration test by @timvandermeij in mozilla/pdf.js#17940

Remove the rimraf dependency in favor of the built-in Node.js fs.rmSync in the test folder by @timvandermeij in mozilla/pdf.js#17938

[api-minor] Update the minimum supported Safari version to 16.4 by @Snuffleupagus in mozilla/pdf.js#17942

Fix the "must check that a field has the correct value when a choice is changed" scripting integration test by @timvandermeij in mozilla/pdf.js#17947

[api-minor] Add a jpx decoder based on OpenJPEG 2.5.2 by @calixteman in mozilla/pdf.js#17946

Bump library version to 4.2 by @Snuffleupagus in mozilla/pdf.js#17949

Build the openjpeg-based decoder in a web environment in order to avoid issues when used in node by @calixteman in mozilla/pdf.js#17954

Fix JpxImage API issues (PR 17946 follow-up) by @timvandermeij in mozilla/pdf.js#17951

[JPX] Throw an exception with the error messages returned by openjpeg by @calixteman in mozilla/pdf.js#17956

[Editor] Provide an element to render in the annotation layer after a freetext has been edited (bug 1890535) by @calixteman in mozilla/pdf.js#17914

Remove waitForTimeout usage from the helper functions by @timvandermeij in mozilla/pdf.js#17966

Remove some event listeners with signal in the viewer by @Snuffleupagus in mozilla/pdf.js#17964

[Editor] Don't show the context menu when resizing by @calixteman in mozilla/pdf.js#17973

Correctly update the xref table when an annotation is deleted by @calixteman in mozilla/pdf.js#17970

Update dependencies and translations to the most recent versions by @timvandermeij in mozilla/pdf.js#17972

Improve jpx decoding by around 20% in enabling simd support when compiling OpenJPEG by @calixteman in mozilla/pdf.js#17983

[api-minor] Remove the image-related error message prefixes by @Snuffleupagus in mozilla/pdf.js#17979

Use the pdf.js warn when using jpx decoder by @calixteman in mozilla/pdf.js#17985

Extend the globally cached image main-thread copying to "complex" images as well (PR 17428 follow-up) by @Snuffleupagus in mozilla/pdf.js#17978

Update JpxImage.parseImageProperties to support TypedArray data in IMAGE_DECODERS builds by @Snuffleupagus in mozilla/pdf.js#17977

Add signal-support in the EventBus, and utilize it in the viewer (PR 17964 follow-up) by @Snuffleupagus in mozilla/pdf.js#17967

Set correctly the change property for the event triggered when a choice list is changed by @calixteman in mozilla/pdf.js#17999

Remove all waitForTimeout usage from the annotation integration tests by @timvandermeij in mozilla/pdf.js#17969

Validate explicit destinations on the worker-thread to prevent DataCloneError (issue 17981) by @Snuffleupagus in mozilla/pdf.js#17984

Allow to insert several annotations under the same parent in the structure tree by @calixteman in mozilla/pdf.js#17986

Always enable smoothing when rendering downscaled image by @calixteman in mozilla/pdf.js#17868

Simplify the way to pass the glyph drawing instructions from the worker to the main thread by @calixteman in mozilla/pdf.js#18015

Validate additional font-dictionary properties by @Snuffleupagus in mozilla/pdf.js#18014

Add more validation of width-data by @Snuffleupagus in mozilla/pdf.js#18017

Reduce code-duplication when caching data in CompiledFont.getPathJs by @Snuffleupagus in mozilla/pdf.js#18018

Re-factor SimpleLinkService to extend PDFLinkService by @Snuffleupagus in mozilla/pdf.js#18013

[api-minor] Move the page reference/number caching into the API by @Snuffleupagus in mozilla/pdf.js#18001

v4.1.392

This release features improvements, bugfixes and optimizations for accessibility, annotation rendering, annotation editing, font rendering, form handling, image rendering, text selection and the viewer.

... (truncated)

Commits

49b3881 Merge pull request #18001 from Snuffleupagus/api-pageRefCache
150964d Remove unnecessary check from PDFLinkService.goToDestination (PR 17984 foll...
f6cd039 [api-minor] Move the page reference/number caching into the API
fa69d9a Inline the helper method in PDFLinkService.goToDestination
3052e99 Merge pull request #18013 from Snuffleupagus/SimpleLinkService-extends-PDFLin...
2b2ade7 Merge pull request #18018 from Snuffleupagus/CompiledFont-tweak-caching
627fe2d Merge pull request #18017 from Snuffleupagus/validate-widths
85ff8f3 Reduce code-duplication when caching data in CompiledFont.getPathJs
d411a07 Add more validation of width-data
234067e Merge pull request #18014 from Snuffleupagus/validate-font-properties
Additional commits viewable in compare view

Updates braces from 3.0.2 to 3.0.3

Commits

74b2db2 3.0.3
88f1429 update eslint. lint, fix unit tests.
415d660 Snyk js braces 6838727 (#40)
190510f fix tests, skip 1 test in test/braces.expand
716eb9f readme bump
a5851e5 Merge pull request #37 from coderaiser/fix/vulnerability
2092bd1 feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/...
9f5b4cf fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
98414f9 remove funding file
665ab5d update keepEscaping doc (#27)
Additional commits viewable in compare view

Updates follow-redirects from 1.15.3 to 1.15.9

Commits

e4e55c7 Release version 1.15.9 of the npm package.
31a1abf Attempt much more gentle detection.
d2aaa97 Fix url field.
62558f0 Release version 1.15.8 of the npm package.
a8d1cee Return subtlety.
458ca8e Fix native URL test for Node 20.
ca49e44 Handle KeepAlive connections in tests.
f3711d7 Test on Node 20 and 22.
fda0faf Fix typo.
760757f Release version 1.15.7 of the npm package.
Additional commits viewable in compare view

Updates ws from 8.14.2 to 8.18.0

Release notes

Sourced from ws's releases.

8.18.0

Features

Added support for Blob (#2229).

8.17.1

Bug fixes

Fixed a DoS vulnerability (#2231).

A request with a number of headers exceeding the[server.maxHeadersCount][] threshold could be used to crash a ws server.

const http = require('http');
const WebSocket = require('ws');
const wss = new WebSocket.Server({ port: 0 }, function () {
const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
const headers = {};
let count = 0;
for (let i = 0; i < chars.length; i++) {
if (count === 2000) break;
for (let j = 0; j &lt; chars.length; j++) {
  const key = chars[i] + chars[j];
  headers[key] = 'x';
if (++count === 2000) break;
}

}
headers.Connection = 'Upgrade';
headers.Upgrade = 'websocket';
headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';
headers['Sec-WebSocket-Version'] = '13';
const request = http.request({
headers: headers,
host: '127.0.0.1',
port: wss.address().port
});
request.end();
});

The vulnerability was reported by Ryan LaPointe in websockets/ws#2230.

... (truncated)

Commits

976c53c [dist] 8.18.0
59b9629 [feature] Add support for Blob (#2229)
0d1b5e6 [security] Use more descriptive text for 2017 vulnerability link
15f11a0 [security] Add new DoS vulnerability to SECURITY.md
3c56601 [dist] 8.17.1
e55e510 [security] Fix crash when the Upgrade header cannot be read (#2231)
6a00029 [test] Increase code coverage
ddfe4a8 [perf] Reduce the amount of crypto.randomFillSync() calls
b73b118 [dist] 8.17.0
29694a5 [test] Use the highWaterMark variable
Additional commits viewable in compare view