[Snyk] Upgrade microbundle from 0.3.1 to 0.14.2 #57

snyk-bot · 2021-12-17T23:27:53Z

Snyk has created this PR to upgrade microbundle from 0.3.1 to 0.14.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 40 versions ahead of your current version.
The recommended version was released a month ago, on 2021-11-18.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Regular Expression Denial of Service (ReDoS) npm:marked:20180225	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-LODASH-73638	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-LODASH-608086	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-LODASH-450202	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Command Injection SNYK-JS-LODASH-1040724	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Arbitrary Code Execution SNYK-JS-JSYAML-174129	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Arbitrary Code Execution SNYK-JS-HANDLEBARS-534478	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JS-HANDLEBARS-480388	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Prototype Pollution SNYK-JS-HANDLEBARS-469063	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Prototype Pollution SNYK-JS-HANDLEBARS-174183	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Prototype Pollution SNYK-JS-HANDLEBARS-173692	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Remote Code Execution (RCE) SNYK-JS-HANDLEBARS-1056767	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ACORN-559469	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Uninitialized Memory Exposure npm:concat-with-sourcemaps:20180429	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Mature
Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-559764	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-559764	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-559764	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-LODASH-567746	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ISSVG-1243891	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ISSVG-1085627	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-HIGHLIGHTJS-1045326	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Prototype Pollution SNYK-JS-HANDLEBARS-1279029	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-COLORSTRING-1082939	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) npm:braces:20180219	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Arbitrary Command Injection npm:macaddress:20180511	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Arbitrary File Read SNYK-JS-MACADDRESS-567156	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Prototype Pollution SNYK-JS-LODASH-590103	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Denial of Service (DoS) SNYK-JS-JSYAML-173999	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Prototype Pollution SNYK-JS-HANDLEBARS-567742	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Prototype Pollution SNYK-JS-HANDLEBARS-534988	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: microbundle

0.14.2 - 2021-11-18
Patch Changes
- dd0bdde #904 Thanks @ rschristian! - Added missing CLI doc for 'jsxImportSource' and correcting the Examples section of the '--help' output
0.14.1 - 2021-10-14
Patch Changes
- 2a0ca88 #882 Thanks @ MiKr13! - feat: ✨ Closes #497: preserve trailing newline in mangle.json
- 26f382a #895 Thanks @ rschristian! - Completion message shows pkg's actual name, rather than safe name
0.14.0 - 2021-10-06
Minor Changes
- 1b61029 #867 Thanks @ bouchenoiremarc! - - Add support for Module Workers with a new --workers flag
Patch Changes
- 5e93a0e #853 Thanks @ developit! - Fix crash when traversing "exports" objects (#852)
- 96b85da #887 Thanks @ developit! - When using --target node, resolve "node" conditional Package Export keys, otherwise resolve "browser" keys.
- 5d0465b #875 Thanks @ dwightjack! - Preserve terser annotations in compressed bundle
- b1a6374 #858 Thanks @ bouchenoiremarc! - - Allow the minify options compress and mangle to be set as booleans
- 2980336 #865 Thanks @ rschristian! - Expands generateTypes flag to support libs with TS entrypoints
0.13.3 - 2021-06-11
Patch Changes
- 3534815 #848 Thanks @ developit! - Bugfix: re-enable support for Terser annotations like /*@ __NOINLINE__*/ (these were incorrectly being removed during the Babel pass)
0.13.2 - 2021-06-07
Patch Changes
- e3f1933 #847 Thanks @ developit! - - Upgrade to Terser 5.7 to re-enable support for reduce_funcs:false in mangle.json configuration.
- 86371f0 #784 Thanks @ rschristian! - Allows users to customize the modern output's filename using "exports" like they can with "esmodules"
0.13.1 - 2021-05-27
Patch Changes
- 54402ac #830 Thanks @ JounQin! - fix: add generateTypes cli option, check false value correctly
- edcd777 #823 Thanks @ rschristian! - Ensures ambient type declaration for CSS Modules is included in the published bundle
- d87a5dc Thanks @ developit! - - Fix --sourcemap=false to match --no-sourcemap and actually turn sourcemaps off.
- 6f1a20f #777 Thanks @ rschristian! - Fixing a bug that would cause a CSS file to be generated to match each JS build output
- 25b73d2 #834 Thanks @ cometkim! - Add support for configuration overrides using the publishConfig package.json field.
- a7f7265 #802 Thanks @ aheissenberger! - fix default extension to cjs for package.json "type":"module"
- 4f7fbc4 Thanks @ developit! - Fix transform-fast-rest to support referencing ...rest params from within closures.
- 0c91795 #841 Thanks @ rschristian! - Ensures JS format is not included in CSS filename output
0.13.0 - 2020-12-21
Minor Changes
- bd5d15e #738 Thanks @ wardpeet! - Upgrade rollup to version latest and upgrade all its dependencies
- 967f8d5 #769 Thanks @ developit! - Add --css inline option. The default CSS output for all formats is now external files (as it was supposed to be).
- 8142704 #741 Thanks @ whitetrefoil! - Use user's typescript first, fallback to bundled
Patch Changes
- 12668b9 #687 Thanks @ developit! - Add friendly microbundle-specific errors when modules can't be resolved.
- 8b60fc8 #754 Thanks @ stipsan! - Enable sourcemaps for CSS
- fdafaf7 #764 Thanks @ bakerkretzmar! - Add support for generating inline sourcemaps
- 52a1771 #768 Thanks @ developit! - Add ambient typescript declaration for CSS Modules
0.12.4 - 2020-09-28
Patch Changes
- ffcc9d9 #713 Thanks @ developit! - Support extending a UMD global by prefixing the package.json "amdName" field (eg: "global.xyz").
- 0527862 #722 Thanks @ developit! - Support "esm" (-f esm) as an alias of "es" format.
- d08f977 #702 Thanks @ wardpeet! - Use @ babel/preset-env with bugfixes instead of preset-modules to enable "Optional chaining" & "nullish coalescing" by default.
- d33a7ba #731 Thanks @ vaneenige! - Add jsxImportSource flag for new JSX runtime
- 0fec414 #716 Thanks @ wardpeet! - Don't transpile generators and async for Node
- ba1c047 #701 Thanks @ wardpeet! - re-enable unpkg alias for umd bundles as described in the readme
- 3488411 #700 Thanks @ wardpeet! - Disable warnings for node's builtin-modules when using node as a target environment.
0.12.3 - 2020-07-14
Features & Improvements
- New onStart, onError callbacks for programmatic Microbundle usage! (#668, thanks @ katywings!)
- allow multi-file output and code splitting (#674, thanks @ katywings!)
- Strip comments from output (#548)
Bug Fixes
- don't mark --alias modules as externals (#671, thanks @ katywings!)
0.12.2 - 2020-06-20
- Updated Babel and preset-env to 7.10 (#660)
- Fixed an version conflict caused by multiple copies of Babel (#664)
- Fixed globals generation when --external values include dashes (#667, thanks @ katywings!)
0.12.1 - 2020-06-15
0.12.0 - 2020-05-08
0.12.0-next.9 - 2020-05-01
0.12.0-next.8 - 2020-01-22
0.12.0-next.7 - 2020-01-06
0.12.0-next.6 - 2019-08-23
0.12.0-next.5 - 2019-08-23
0.12.0-next.4 - 2019-08-08
0.12.0-next.3 - 2019-06-17
0.12.0-next.2 - 2019-06-15
0.12.0-next.1 - 2019-06-11
0.12.0-next.0 - 2019-05-27
0.11.0 - 2019-03-04
0.10.1 - 2019-02-22
0.10.0 - 2019-02-21
0.9.0 - 2018-12-18
0.8.4 - 2018-12-17
0.8.3 - 2018-12-03
0.8.2 - 2018-12-03
0.8.1 - 2018-12-01
0.8.0 - 2018-11-30
0.7.0 - 2018-10-26
0.7.0-beta.0 - 2018-10-23
0.6.0 - 2018-07-19
0.5.1 - 2018-07-05
0.4.4 - 2018-02-21
0.4.3 - 2018-01-26
0.4.2 - 2018-01-24
0.4.1 - 2018-01-24
0.4.0 - 2018-01-23
0.3.1 - 2018-01-14

from microbundle GitHub release notes

Commit messages

Package name: microbundle

778ca3c Version Packages (github repo created but not populated with content stackblitz/core#911)
75525a3 Add Teaful as "Built with Microbundle" in README (- stackblitz/core#910)
dd0bdde fix: Ensuring CLI & docs match up with each other (Redux DevTools visible on Stackblitz stackblitz/core#904)
afa74ca [docs] Fix incorrect package exports recommendation (Can't update angular to latest dependencies stackblitz/core#903)
c04bd48 Version Packages ([Chrome] Cannot create a simple React app. stackblitz/core#900)
2a0ca88 feat: ✨ Closes Unable to import .ts file in .tsx files. stackblitz/core#497: preserve trailing newline in mangle.json (To Add External Images to Angular Project stackblitz/core#882)
26f382a fix: Corrects completion message to show the package's name, rather than the safe name (Clone from github not working stackblitz/core#895)
d94bd97 Version Packages (Enable polymer in SDK stackblitz/core#859)
96b85da Resolve using "node" export condition for --target node (The url to this repository is invalid. stackblitz/core#887)
2980336 feat: Expands generateTypes flag to support TS entries (Angular 7 + SASS extension complains about errors in correct stylesheet syntax stackblitz/core#865)
76272fd docs: Adding comment about file inclusion in TS section (Feature request: Editor SDK stackblitz/core#888)
5e93a0e Fix exports walk (Refused to display 'https://stackblitz.com/edit/zknwqv.run' in a frame because it set 'X-Frame-Options' to 'sameorigin'. stackblitz/core#852) (my repo isn't loading stackblitz/core#853)
5d0465b Fix: preserve terser annotations regexp (Server spins forever when when installing plotly.js and @types/plotly.js stackblitz/core#875)
1b61029 Rebase: Add worker-loader (lazyModules array in angular.json support stackblitz/core#867)
b1a6374 Fix: Support booleans in minify options (Settings from SDK-created embeds don't propagate when opening in new window stackblitz/core#858)
8108800 Fix typo (Running a project from github is giving me this error stackblitz/core#856)
3760f4e Version Packages (Typescript not resolving interface. stackblitz/core#851)
3534815 Bugfix: preserve Terser annotations during Babel pass (Functionality at https://stackblitz.com/github/changhuixu/session-expiration-alert is not working due to errors in compiler.umd.js stackblitz/core#848)
a5a222e Version Packages (Unable to load .tsv files stackblitz/core#846)
e3f1933 Update to Terser 5.7 (Is it possible to run React project with custom webpack configs ? stackblitz/core#847)
680c25c Fix: throw a warning when no entrypoint is found (No such file or directory stackblitz/core#843)
86371f0 feat: Support customizing the modern output via "exports" (Solving (or working around) frame-ancestors errors for OAuth2 Implicit flow stackblitz/core#784)
2b37c12 Version Packages (hideExplorer flag is not working in sdk stackblitz/core#800)
6f1a20f fix: Extra CSS files generated (While typing on Stackblitz it takes a long time to show up what we typed. stackblitz/core#777)

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade microbundle from 0.3.1 to 0.14.2. See this package in npm: https://www.npmjs.com/package/microbundle See this project in Snyk: https://app.snyk.io/org/hafixo/project/e0378820-98d6-49f6-9092-3839125436e3?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade microbundle from 0.3.1 to 0.14.2 #57

[Snyk] Upgrade microbundle from 0.3.1 to 0.14.2 #57

snyk-bot commented Dec 17, 2021

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Features & Improvements

Bug Fixes

[Snyk] Upgrade microbundle from 0.3.1 to 0.14.2 #57

Are you sure you want to change the base?

[Snyk] Upgrade microbundle from 0.3.1 to 0.14.2 #57

Conversation

snyk-bot commented Dec 17, 2021

Snyk has created this PR to upgrade microbundle from 0.3.1 to 0.14.2.

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Minor Changes

Patch Changes

Patch Changes

Features & Improvements

Bug Fixes