Update dependency isomorphic-git to v1 [SECURITY] #71
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
renovate
bot
force-pushed
the
renovate/npm-isomorphic-git-vulnerability
branch
from
0e69729 to
8920d2d
Compare
renovate
bot
force-pushed
the
renovate/npm-isomorphic-git-vulnerability
branch
from
8920d2d to
14ce083
Compare
renovate
bot
force-pushed
the
renovate/npm-isomorphic-git-vulnerability
branch
from
14ce083 to
1a6209e
Compare
renovate
bot
force-pushed
the
renovate/npm-isomorphic-git-vulnerability
branch
from
1a6209e to
5a2dc5d
Compare
renovate
bot
force-pushed
the
renovate/npm-isomorphic-git-vulnerability
branch
from
5a2dc5d to
3bb0b7b
Compare
renovate
bot
force-pushed
the
renovate/npm-isomorphic-git-vulnerability
branch
from
3bb0b7b to
f258ea8
Compare
renovate
bot
force-pushed
the
renovate/npm-isomorphic-git-vulnerability
branch
from
f258ea8 to
943894d
Compare
renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^0.51.6->^1.0.0GitHub Vulnerability Alerts
CVE-2021-30483
isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.
Release Notes
isomorphic-git/isomorphic-git
v1.8.2Compare Source
Bug Fixes
v1.8.1Compare Source
Bug Fixes
v1.8.0Compare Source
Features
v1.7.8Compare Source
Bug Fixes
isogitCLI throws "Error [ERR_REQUIRE_ESM]: Must use import to load ES Module" in Node 13+ (f2e3805)v1.7.7Compare Source
Bug Fixes
v1.7.6Compare Source
Bug Fixes
singleBranch: true(#1225) (e66a6c2)v1.7.5Compare Source
Bug Fixes
v1.7.4Compare Source
Bug Fixes
v1.7.3Compare Source
Bug Fixes
v1.7.2Compare Source
Performance Improvements
v1.7.1Compare Source
Bug Fixes
v1.7.0Compare Source
Features
v1.6.0Compare Source
Features
v1.5.0Compare Source
Features
v1.4.4Compare Source
Performance Improvements
v1.4.3Compare Source
Performance Improvements
v1.4.2Compare Source
Performance Improvements
v1.4.1Compare Source
Performance Improvements
v1.4.0Compare Source
Features
v1.3.2Compare Source
Bug Fixes
v1.3.1Compare Source
Bug Fixes
httpargument is missing (#1092) (6564ea5)v1.3.0Compare Source
Features
v1.2.0Compare Source
Features
v1.1.6Compare Source
Bug Fixes
v1.1.5Compare Source
Bug Fixes
v1.1.4Compare Source
Bug Fixes
v1.1.3Compare Source
Bug Fixes
v1.1.2Compare Source
Bug Fixes
v1.1.1Compare Source
Bug Fixes
http(1a4a8f8)v1.1.0Compare Source
Features
v1.0.0Compare Source
I recommend you read the NICE RELEASE NOTES first.
These are the auto-generated release notes, which are exhaustive if not pretty.
1.0.0 (2020-02-26)
Bug Fixes
chore
readObjectandwriteObjecttypings (#1023) (9f905d9)onAuththe replacement forusername,password,token, andoauth2format(#1051) (e344578)signcommand (#1007) (a549b2b)patternparam withfilterparam (#1004) (fe6d98a)logcommand (#1005) (2ae9b78)Features
BREAKING CHANGES
Ehas been removed and replaced byErrors. The errors are typed so if you use aninstanceofcomparison in thecatchstatement, auto-completion on their.dataproperty works. There are fewer errors total, they have shorter names, and thus the resulting gzip bundle is smaller despite the addition of 28 new classes. Lastly, the distinction betweenFailandErrorhas been removed since it was subjective.Here's the complete breakdown of which
Errorsclasses replaced whichEcodes:AlreadyExistsErrorreplacesAddingRemoteWouldOverwrite,NoteAlreadyExistsError,RefExistsErrorAmbiguousErrorreplacesAmbiguousShortOidCheckoutConflictErrorreplacesCheckoutConflictErrorCommitNotFetchedErrorreplacesCommitNotFetchedErrorEmptyServerResponseErrorreplacesEmptyServerResponseFailFastForwardErrorreplacesFastForwardFailGitPushErrorreplacesGitPushErrorHttpErrorreplacesHTTPErrorInternalErrorreplacesInternalFailInvalidFilepathErrorreplacesDirectorySeparatorsErrorInvalidOidErrorreplacesCorruptShallowOidFail,NotAnOidFailInvalidRefNameErrorreplacesInvalidRefNameErrorMaxDepthErrorreplacesMaxSearchDepthExceededMergeNotSupportedErrorreplacesMergeNotSupportedFailMissingNameErrorreplacesMissingAuthorError,MissingCommitterError,MissingTaggerErrorMissingParameterErrorreplacesMissingRequiredParameterErrorNoRefspecErrorreplacesNoRefspecConfiguredErrorNotFoundErrorreplacesExpandRefError,FileReadError,GitRootNotFoundError,ReadObjectFail,RefNotExistsError,ResolveRefError,ShortOidNotFound,TreeOrBlobNotFoundErrorObjectTypeErrorreplacesDirectoryIsAFileError,ObjectTypeAssertionFail,ObjectTypeAssertionInPathFail,ObjectTypeAssertionInTreeFail,ObjectTypeUnknownFail,ResolveCommitError,ResolveTreeErrorParseErrorreplacesAssertServerResponseFail,UnparseableServerResponseFailPushRejectedErrorreplacesPushRejectedNonFastForward,PushRejectedTagExistsRemoteCapabilityErrorreplacesRemoteDoesNotSupportDeepenNotFail,RemoteDoesNotSupportDeepenRelativeFail,RemoteDoesNotSupportDeepenSinceFail,RemoteDoesNotSupportShallowFailSmartHttpErrorreplacesRemoteDoesNotSupportSmartHTTPUnknownTransportErrorreplacesUnknownTransportErrorUrlParseErrorreplacesRemoteUrlParseErrorUserCanceledErrorreplacesUserCancelledErrorThe following error codes are no longer used / have no equivalent:
AcquireLockFileFail,BranchDeleteError,CoreNotFound,DoubleReleaseLockFileFail,InvalidDepthParameterError,InvalidParameterCombinationError,MismatchRefValueError,NoHeadCommitError,NotImplementedFail,ObjectTypeAssertionInRefFail,PluginSchemaViolation,PluginUndefined,PluginUnrecognizedauthor.date,committer.date,tagger.dateparameters were removed in favor ofauthor.timestamp,comitter.timestamp,tagger.timestampin order to be clear about what is actually written and better reflect the return types inreadCommit,log, andreadTag.username,password,token, andoauth2formatparams were removed and replaced with theonAuthcallback. SinceonAuthalso replaced thecredentialManagerplugin, this means now there is a single way to do authentication instead of two..gitsince sometimes that actually makes things worse, and subverts user expectations. Accordingly, thenoGitSuffixparameter has been removed since it's the default behavior. Furthermore, theUser-Agentis now totally in the user's hands, because it is just a minefield, and I'm done trying to make sense of it. I added a Headers page to the docs documenting what I know about User-Agent + GitHub + CORS + Chrome bugs.verifyfunction has been removed, and thesignatureproperty of TagObject renamed togpgsigto match CommitObject. Sincelog,readCommit, andreadTagall include thegpgsigand signingpayloadin their return values now, it is simpler and more efficient to do the verification outside ofisomorphic-git. See the documentation for theonSignparameter for complete code examples.newSubmoduleBehaviorparameter has been removed and is now the default and only behavior, because it is good. And thenoSubmodulesparameter has been removed and is also the default and only behavior. (This only affects you if you a) liked seeing the console warnings or b) were usingstatusMatrixto traverse submodules for some reason.)pushfunction now throws if any of the refs on the remote were not updated successfully. It also returns a nicely typed result object organized by ref, rather than a loose collection of strings organized by outcome.fetchandpushfunctions now respect previously ignored git config settings like:branch.${ref}.pushRemote,remote.pushDefault,remote.${remote}.pushurl, andbranch.${ref}.merge. (Note thepullcommand already respectedbranch.${ref}.mergebutfetchdid not.)mainfile and a browser HTTP client hard-coded into themodulefile. The HTTP clients are now in their own files; users pick one, import it, and provide it to functions that make requests.readObjectandwriteObjecthave been updated to use the same object schemas used inreadCommit,readTree, andreadTag. And they are actually documented now in the docs. (The main change is trees are simply arrays now, rather than objects with a.entriesproperty.) The types returned byreadObjectalso form a proper discriminated union so TypeScript will infer the type of.objectgiven.formatand.type.authUsernameandauthPasswordare removed in favor ofusernameandpassword.plugins.sethas been replaced byplugins.fs,plugins.emitter,plugins.credentialManager,plugins.pgp, andplugins.http.tokenandoauth2formatproperties have been removed from the GitAuth interface, which makes it much simpler and and eliminates a dozen GitErrors handling specific edge cases.A
headersproperty has been added to the GitAuth interface. This makesonAuthmuch more powerful because you can inject whatever HTTP headers you want.The
onAuthFailedcallback now lets you return a GitAuth object. This means you can keep retrying to authenticate as many times as you like.A
cancelproperty has been added to the GitAuth interface. This means you gracefully give up authenticating and the function will throw an E.UserCancelledError instead of an E.HTTPError.fsandemitterparams have been removed. They've been superseded by thefsandemitterplugins.internal-apisare no longer included in the npm package. I never really intended that; they were just for running unit tests. Also, I renameddist/for-future/isomorphic-git/index.jstodist/index.jsanddist/for-node/isomorphic-git/index.jstodist/index.cjs.And I removed the
jasminefallback. I'm sorryjestuses native modules, but it's just too good not to use and maintaining a fallback test runner is an added complication.messageevents were trimmed. This was lossy and removed valuable information, such as an'\r'by itself, which is a signal to update the existing line instead of appending a new one. Therawmessageevent was added as a temporary workaround to expose the untrimmed data. Therawmessageevent has been removed and from now on,messageevents emit the full untrimmed data.Bufferobjects now instead returnUint8Arrayobjects. This is so we can eventually drop the bloatedBufferbrowser polyfill.signcommand was deprecated a while ago (back whencommitgot asigningKeyparam) and has now been removed.autoTranslateSSHfeature has been removed since it's kind of hacky, and it's trivial to implement your own version using thedata.suggestionproperty of theUnknownTransportErrorwhen something fails.signingargument ofloghas been removed, andlognow returns an array of objects with the same interface as those returned fromreadCommit. Also, thelogfunction will throw now instead of returning errors as objects inside the result array. This greatly simplifies the TS definition (which previously consisted of 3 different overloaded variations) so that we can generate the TS definitions directly from the JSDoc in the future.patternparam added two dependencies to the project (globrex and globalyzer) for very little benefit since we haven't ended up using globbing anywhere else in the library. The same result can be achieved via the new function parameterfilterwhich lets you provide the pattern-matching logic yourself.fastCheckoutfunction has been renamedcheckoutand the oldcheckoutfunction has been removed entirely.walkBeta2function has been renamedwalkand thewalkBeta1function has been removed entirely.corehas been replaced byplugins.createCoreandplugins.deleteCore.v0.78.5Compare Source
Bug Fixes
v0.78.4Compare Source
Bug Fixes
Performance Improvements
v0.78.3Compare Source
Bug Fixes
v0.78.2Compare Source
Bug Fixes
v0.78.1Compare Source
Bug Fixes
v0.78.0Compare Source
Features
v0.77.1Compare Source
Bug Fixes
v0.77.0Compare Source
Features
v0.76.0Compare Source
Features
v0.75.1Compare Source
Bug Fixes
v0.75.0Compare Source
Features
v0.74.0Compare Source
Features
v0.73.3Compare Source
Bug Fixes
v0.73.2Compare Source
Bug Fixes
v0.73.1Compare Source
Performance Improvements
v0.73.0Compare Source
Features
v0.72.1Compare Source
Bug Fixes
v0.72.0Compare Source
Features
v0.71.0Compare Source
Features
v0.70.9Compare Source
Bug Fixes
v0.70.8Compare Source
Bug Fixes
v0.70.7Compare Source
Bug Fixes
v0.70.6Compare Source
Bug Fixes
v0.70.5Compare Source
Bug Fixes
v0.70.4Compare Source
Bug Fixes
v0.70.3Compare Source
Bug Fixes
v0.70.2Compare Source
Performance Improvements
v0.70.1Compare Source
Bug Fixes
noUpdateHeadlogic and add missing TS types (#910) (e30bbed)v0.70.0Compare Source
Features
v0.69.0Compare Source
Features
v0.68.0Compare Source
Features
v0.67.5Compare Source
Bug Fixes
.populateHashis called without calling.populateStatfirst (#895) (6d3238a)v0.67.4Compare Source
Bug Fixes
v0.67.3Compare Source
Performance Improvements
v0.67.2Compare Source
Bug Fixes
v0.67.1Compare Source
Bug Fixes
v0.67.0Compare Source
Features
v0.66.0Compare Source
Features
v0.65.1Compare Source
Bug Fixes
v0.65.0Compare Source
Features
v0.64.6Compare Source
Bug Fixes
v0.64.5Compare Source
Bug Fixes
v0.64.4Compare Source
Bug Fixes
v0.64.3Compare Source
Bug Fixes
v0.64.2Compare Source
Bug Fixes
v0.64.1Compare Source
Bug Fixes
v0.64.0Compare Source
Features
v0.63.0Compare Source
Features
v0.62.0Compare Source
Features
v0.61.0Compare Source
Features
v0.60.2Compare Source
Bug Fixes
v0.60.1Compare Source
Bug Fixes
v0.60.0Compare Source
Features
v0.59.0Compare Source
Features
v0.58.2Compare Source
Bug Fixes
v0.58.1Compare Source
Performance Improvements
v0.58.0Compare Source
Features
v0.57.1Compare Source
Bug Fixes
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.