chore(deps): update all dependencies by renovate[bot] · Pull Request #4 · aperturerobotics/react-dropzone

renovate · 2024-05-16T05:08:44Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@types/react (source)	`^18.2.24` → `^19.0.0`	devDependencies	major
@types/react-dom (source)	`^18.2.8` → `^19.0.0`	devDependencies	major
actions/checkout	`v4.1.1` → `v6.0.2`	action	major
actions/dependency-review-action	`v3.1.5` → `v4.9.0`	action	major
actions/setup-node	`v4.0.1` → `v6.3.0`	action	major
esbuild	`^0.19.11` → `^0.27.0`	devDependencies	minor
github/codeql-action	`v3.23.0` → `v4.32.6`	action	major
node (source)	`20.11.0` → `24.14.0`		major
prettier (source)	`3.2.5` → `3.8.1`	devDependencies	minor
react (source)	`^18.2.0` → `^19.0.0`	devDependencies	major
react-dom (source)	`^18.2.0` → `^19.0.0`	devDependencies	major
rimraf	`^5.0.5` → `^6.0.0`	devDependencies	major
step-security/harden-runner	`v2.6.1` → `v2.15.1`	action	minor
typescript (source)	`5.4.5` → `5.9.3`	devDependencies	minor

Release Notes

actions/checkout (actions/checkout)

`v6.0.2`

Compare Source

Fix tag handling: preserve annotations and explicit fetch-tags by @ericsciple in #2356

What's Changed

Port v6 cleanup to v5 by @ericsciple in #2301

Full Changelog: actions/checkout@v5...v5.0.1

`v5.0.0`

Compare Source

What's Changed

Update actions checkout to use node 24 by @salmanmkc in #2226
Prepare v5.0.0 release by @salmanmkc in #2238

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: actions/checkout@v4...v5.0.0

`v4.3.1`

Compare Source

What's Changed

Port v6 cleanup to v4 by @ericsciple in #2305

Full Changelog: actions/checkout@v4...v4.3.1

`v4.3.0`

Compare Source

What's Changed

docs: update README.md by @motss in #1971
Add internal repos for checking out multiple repositories by @mouismail in #1977
Documentation update - add recommended permissions to Readme by @benwells in #2043
Adjust positioning of user email note and permissions heading by @joshmgross in #2044
Update README.md by @nebuk89 in #2194
Update CODEOWNERS for actions by @TingluoHuang in #2224
Update package dependencies by @salmanmkc in #2236
Prepare release v4.3.0 by @salmanmkc in #2237

New Contributors

@motss made their first contribution in #1971
@mouismail made their first contribution in #1977
@benwells made their first contribution in #2043
@nebuk89 made their first contribution in #2194
@salmanmkc made their first contribution in #2236

Full Changelog: actions/checkout@v4...v4.3.0

`v4.2.2`

Compare Source

url-helper.ts now leverages well-known environment variables by @jww3 in #1941
Expand unit test coverage for isGhes by @jww3 in #1946

`v4.2.1`

Compare Source

Check out other refs/* by commit if provided, fall back to ref by @orhantoy in #1924

`v4.2.0`

Compare Source

Add Ref and Commit outputs by @lucacome in #1180
Dependency updates by @dependabot- #1777, #1872

`v4.1.7`

Compare Source

Bump the minor-npm-dependencies group across 1 directory with 4 updates by @dependabot in #1739
Bump actions/checkout from 3 to 4 by @dependabot in #1697
Check out other refs/* by commit by @orhantoy in #1774
Pin actions/checkout's own workflows to a known, good, stable version. by @jww3 in #1776

`v4.1.6`

Compare Source

Check platform to set archive extension appropriately by @cory-miller in #1732

`v4.1.5`

Compare Source

Update NPM dependencies by @cory-miller in #1703
Bump github/codeql-action from 2 to 3 by @dependabot in #1694
Bump actions/setup-node from 1 to 4 by @dependabot in #1696
Bump actions/upload-artifact from 2 to 4 by @dependabot in #1695
README: Suggest user.email to be 41898282+github-actions[bot]@users.noreply.github.com by @cory-miller in #1707

`v4.1.4`

Compare Source

Disable extensions.worktreeConfig when disabling sparse-checkout by @jww3 in #1692
Add dependabot config by @cory-miller in #1688
Bump the minor-actions-dependencies group with 2 updates by @dependabot in #1693
Bump word-wrap from 1.2.3 to 1.2.5 by @dependabot in #1643

`v4.1.3`

Compare Source

Check git version before attempting to disable sparse-checkout by @jww3 in #1656
Add SSH user parameter by @cory-miller in #1685
Update actions/checkout version in update-main-version.yml by @jww3 in #1650

`v4.1.2`

Compare Source

Fix: Disable sparse checkout whenever sparse-checkout option is not present @dscho in #1598

actions/dependency-review-action (actions/dependency-review-action)

`v4.9.0`: Dependency Review Action 4.9.0

Compare Source

This feature release contains a couple of notable changes:

There is a new configuration option show_patched_versions which will add a column to the output, showing the fix version of each vulnerable dependency. Thanks @felickz!
Runs which do not display OpenSSF scorecards no longer fetch scorecard information; previously it was fetched regardless of whether or not it was displayed, causing unneccessary slowness. Great catch @jantiebot!
There are a couple of fixes to purl parsing which should improve match accuracy for allow-package-dependency lists, including case (in)sensitivity and url-encoded namespaces Thanks @juxtin!

What's Changed

Compare normalized purls to account for encoding quirks by @juxtin in #1056
Make purl comparisons case insensitive by @juxtin in #1057
Feat: Add Patched Version to Vulnerabilities summary by @felickz in #1045
fix: only get scorecard levels if user wants to see the OpenSSF scorecard by @jantiebot in #1060
Bump actions/stale from 10.1.0 to 10.2.0 by @dependabot[bot] in #1058
Bump actions/checkout from 4 to 6 by @dependabot[bot] in #1021
Updates for release 4.9.0 by @ahpook in #1064

New Contributors

@jantiebot made their first contribution in #1060

Full Changelog: actions/dependency-review-action@v4.8.3...v4.9.0

`v4.8.3`: 4.8.3

Compare Source

Dependency Review Action v4.8.3

This is a bugfix release that updates a number of upstream dependencies and includes a fix for the earlier feature that detected oversized summaries and upload them as artifacts, which could occasionally crash the action.

We have also updated the release process to use a long-lived v4 branch for the action, instead of a force-pushed tag, which aligns better with git branching strategies; the change should be transparent to end users.

What's Changed

GitHub Actions can't push to our protected main by @dangoor in #1017
Bump actions/stale from 9.1.0 to 10.1.0 by @dependabot[bot] in #995
Bump github/codeql-action from 3 to 4 by @dependabot[bot] in #1003
Bump actions/setup-node from 4 to 6 by @dependabot[bot] in #1005
Upgrade glob to address a vulnerability by @brrygrdn in #1024
Bump js-yaml by @dependabot[bot] in #1020
Addressing vulnerabilities by @Ahmed3lmallah in #1036
Bump fast-xml-parser from 5.3.3 to 5.3.5 by @dependabot[bot] in #1050
Bump fast-xml-parser from 5.3.5 to 5.3.6 by @dependabot[bot] in #1053
Properly truncate long summaries and catch errors by @juxtin in #1052
Bump spdx-expression-parse from 3.0.1 to 4.0.0 in the spdx-licenses group across 1 directory by @dependabot[bot] in #931
Changes for Release 4.8.3 by @ahpook in #1054

Full Changelog: https://github.com/actions/dependency-review-action/compare/v4.8.2..v4.8.3

`v4.8.2`

Compare Source

Minor fixes:

Fix PURL parsing for scoped packages (#1008 from @danielhardej)
Fix for large summaries (#1007 from @gitulisca)
README includes a working example for allow-dependencies-licenses (#1009 from @danielhardej)

`v4.8.1`: Dependency Review Action v4.8.1

Compare Source

What's Changed

(bug) Fix spamming link test in deprecation warning (again) by @ahpook in #1000
Bump version for 4.8.1 release by @ahpook in #1001

Full Changelog: actions/dependency-review-action@v4...v4.8.1

`v4.8.0`

Compare Source

What's Changed

Make Ruby Code Scannable by @ljones140 in #978
Batch some contributions for release by @brrygrdn in #986
- Make license lists collapsable by @jasperkamerling
- feat: add large summary handling with artifact upload by @MattMencel

New Contributors

@ljones140 made their first contribution in #978
@jasperkamerling made their first contribution in #986
@MattMencel made their first contribution in #986

Full Changelog: actions/dependency-review-action@v4...v4.8.0

`v4.7.4`

Compare Source

`v4.7.3`: 4.7.3

Compare Source

What's Changed

Add explicit permissions to workflow files by @AshelyTC in #966
Claire153/fix spamming mentioned issue by @claire153 in #974

Full Changelog: actions/dependency-review-action@v4...v4.7.3

`v4.7.2`: 4.7.2

Compare Source

What's Changed

Add Missing Languages to CodeQL Advanced Configuration by @KyFaSt in #945
Deprecate deny lists by @claire153 in #958
Address discrepancy between docs and reality by @ahpook in #960

New Contributors

@KyFaSt made their first contribution in #945
@claire153 made their first contribution in #958
@ahpook made their first contribution in #960

Full Changelog: actions/dependency-review-action@v4...v4.7.2

`v4.7.1`

Compare Source

Packages added to allow-dependencies-licenses will be allowed even if the package in question has no license information #889
License expressions (e.g. Ruby OR GPL-2.0) in the allow list are automatically discarded so that they don't invalidate the whole allow list, which should just be license identifier (e.g. Ruby)

`v4.7.0`

Compare Source

Handle complex license expressions (e.g. MIT AND GPL-2.0) in allow lists (fixes #809 and probably others)
Replace OTHER in package licenses with LicenseRef-clearlydefined-OTHER so that parsing passes

`v4.6.0`

Compare Source

What's Changed

Updating multiple dependency versions by @Ahmed3lmallah in #870
Grouping minor and patch dependabot updates to lessen the number of PRs by @Ahmed3lmallah in #876
Bump actions/stale from 9.0.0 to 9.1.0 by @dependabot in #878
Bump undici from 5.28.4 to 5.28.5 by @dependabot in #877
DR Action should link to the proxima stamp when appropriate in error messages by @AshelyTC in #891
Allow deny package removal by @ellenfieldn in #888
Fix typos by @omahs in #893
Bump esbuild from 0.19.5 to 0.25.0 by @dependabot in #900
Bump octokit and related dependencies by @RomanIakovlev in #904
Bump @babel/helpers from 7.23.2 to 7.26.10 by @dependabot in #905
Bump @octokit/plugin-paginate-rest from 9.1.5 to 9.2.2 by @dependabot in #899
Update transitive dependency spdx-license-ids by @ailox in #855
To not print OpenSSF Scorecard section if no dependencies scanned by @fabasoad in #884
Improve usage of this action in dependency-review.yml by @fabasoad in #883
Clarify comment-summary-in-pr behaviour by @Pantelis-Santorinios in #902
Prepare 4.6.0 Release candidate by @brrygrdn in #910

New Contributors

@AshelyTC made their first contribution in #891
@ellenfieldn made their first contribution in #888
@omahs made their first contribution in #893
@RomanIakovlev made their first contribution in #904
@ailox made their first contribution in #855
@fabasoad made their first contribution in #884
@Pantelis-Santorinios made their first contribution in #902
@brrygrdn made their first contribution in #910

Full Changelog: actions/dependency-review-action@v4.5.0...v4.6.0

`v4.5.0`

Compare Source

What's Changed

Bump got from 14.4.2 to 14.4.3 by @dependabot in #844
Bump nodemon from 3.1.0 to 3.1.7 by @dependabot in #847
Bump @vercel/ncc from 0.38.1 to 0.38.3 by @dependabot in #849
Overriding the cross-spawn dependency to use a safe version by @Ahmed3lmallah in #850
fix: add summary comment on failure when warn-only: true by @ebickle in #827
Prepare for 4.5.0 release by @Ahmed3lmallah in #851

New Contributors

@ebickle made their first contribution in #827

Full Changelog: actions/dependency-review-action@v4...v4.5.0

`v4.4.0`

Compare Source

What's Changed

Fix for merge_group event bug by @Ahmed3lmallah in #846

Full Changelog: actions/dependency-review-action@v4.3.5...v4.4.0

`v4.3.5`

Compare Source

What's Changed

fix: getRefs function to handle merge_group events by @louis-bompart in #766
Create pull_request_template.md by @jonjanego in #794
Update CONTRIBUTING.md by @jonjanego in #793
Bump @types/node from 20.11.28 to 20.16.0 by @dependabot in #815
Upgrade transitive micromatch library by @elireisman in #829
Do not list changed dependencies in summary by @hmaurer in #828
Update stale.yaml by @jonjanego in #832
Bump got from 14.4.1 to 14.4.2 by @dependabot in #822
Bump eslint-plugin-jest and ts-jest by @Ahmed3lmallah in #840

New Contributors

@louis-bompart made their first contribution in #766
@Ahmed3lmallah made their first contribution in #840

Full Changelog: actions/dependency-review-action@v4.3.4...v4.3.5

`v4.3.4`

Compare Source

What's Changed

Include all added dependencies in scorecard entries by @elireisman in #783
Update SPDX Expression Parsing by @febuiles in #719
- This PR is a significant refactor of SPDX expression parsing that may fix some bugs, but unfortunately there are several related known issues that remain unresolved as of this version.

Full Changelog: actions/dependency-review-action@v4.3.3...v4.3.4

`v4.3.3`: Notes for v4.3.3

Compare Source

What's Changed

Allow slashes in purl package names by @juxtin in #765
use the v3 version of the deps.dev API by @josieang in #741
PR with suggestions - [Improvement]: Help streamline / simplify dependency review action README by @am-stead in #773
fix show-openssf-scorecard-levels input by @ramann in #776
Updates to the contribution guidelines by @jonjanego in #778
Create issue templates by @jonjanego in #777
Fix the max comment length issue by @jhutchings1 and @elireisman in #767
Bump project version to 4.3.3 in prep for a release by @elireisman in #781

New Contributors

@josieang made their first contribution in #741
@am-stead made their first contribution in #773
@ramann made their first contribution in #776

Full Changelog: actions/dependency-review-action@v4.3.2...v4.3.3

`v4.3.2`

Compare Source

What's Changed

Fix package-url parsing for allow-dependencies-licenses by @juxtin in #761

Full Changelog: actions/dependency-review-action@v4.3.1...v4.3.2

`v4.3.1`

Compare Source

What's Changed

This release fixes some bugs related to package-url parsing that were introduced in 4.3.0. See #753.

Full Changelog: actions/dependency-review-action@V4.3.0...v4.3.1

`v4.3.0`

Compare Source

New Features

The deny-packages option can now be used without a version number to exclude all versions of a package.

What's Changed

Fix action variable name for scorecard by @lukehinds in #735
Fix extra https:// in summary by @jhutchings1 in #748
Bump typescript from 5.3.3 to 5.4.5 by @dependabot in #744
Bump eslint-plugin-github from 4.10.1 to 4.10.2 by @dependabot in #737
Show denied packages with red X by @juxtin in #750
deny-packages configuration option can deny specified version or all packages by @febuiles and @bteng22 in #733

New Contributors

@bteng22 made their first contribution in #733
@lukehinds made their first contribution in #735

Full Changelog: actions/dependency-review-action@v4.2.5...V4.3.0

`v4.2.5`: 4.2.5

Compare Source

What's Changed

Fixed a bug where some configuration options in external files were not being properly picked up -- #722
Bump eslint from 8.56.0 to 8.57.0

Full Changelog: actions/dependency-review-action@v4.2.4...v4.2.5

`v4.2.4`

Compare Source

What's Changed

Fixed a bug in the output of OpenSSF cards for GitHub Actions.

New Contributors

@sporkmonger made their first contribution in #721

Full Changelog: actions/dependency-review-action@v4.2.3...v4.2.4

`v4.2.3`: 4.2.3

Compare Source

What's Changed

Set comment as output by @jsoref in #698
Add support for calculating OpenSSF Scorecards by @jhutchings1 in #709
Add outputs for the changes data by @laughedelic in #707

New Contributors

@jhutchings1 made their first contribution in #709
@laughedelic made their first contribution in #707

Full Changelog: actions/dependency-review-action@v4.1.3...v4.2.3

`v4.1.3`: 4.1.3

Compare Source

Fixes a bug in 4.1.2 that would introduce comments in every pull request, regardless of the user's configuration (see #697).

Full Changelog: actions/dependency-review-action@v4.1.2...v4.1.3

`v4.1.2`: 4.1.2

Compare Source

What's Changed

Expose dependency comment content by @jsoref in #696

Full Changelog: actions/dependency-review-action@v4.1.1...v4.1.2

`v4.1.1`: 4.1.1

Compare Source

What's Changed

Bump undici to fix GHSA-wqq4-5wpv-mx2g
Bump @types/node from 20.11.17 to 20.11.19 by @dependabot in #693

Full Changelog: actions/dependency-review-action@v4.1.0...v4.1.1

`v4.1.0`: 4.1.0

Compare Source

What's Changed

Add warn-only by @tgrall in #432

Added a new configuration option (warn-only, boolean) that makes the action always succeed while still displaying found vulnerabilities in the log.

Create stale.yaml by @jonjanego in #671
Use manual codeql config by @juxtin in #678
Multiple dependency updates (see the changelog below for more information)

New Contributors

@jonjanego made their first contribution in #671
@tgrall made their first contribution in #432

Full Changelog: actions/dependency-review-action@v4...v4.1.0

`v4.0.0`

Compare Source

Update action to Node 20 by @takost in #639
Dependabot updates, see the full changelog for more details.

New Contributors

@takost made their first contribution in #639

Full Changelog: actions/dependency-review-action@v3.1.5...v4.0.0

actions/setup-node (actions/setup-node)

`v6.3.0`

Compare Source

What's Changed

Enhancements:

Support parsing devEngines field by @susnux in #1283

When using node-version-file: package.json, setup-node now prefers devEngines.runtime over engines.node.

Dependency updates:

Fix npm audit issues by @gowridurgad in #1491
Replace uuid with crypto.randomUUID() by @trivikr in #1378
Upgrade minimatch from 3.1.2 to 3.1.5 by @dependabot in #1498

Bug fixes:

Remove hardcoded bearer for mirror-url @marco-ippolito in #1467
Scope test lockfiles by package manager and update cache tests by @gowridurgad in #1495

New Contributors

@susnux made their first contribution in #1283

Full Changelog: actions/setup-node@v6...v6.3.0

`v6.2.0`

[Compare Source](http

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate bot force-pushed the renovate/all branch 4 times, most recently from e88c77e to 6f3965f Compare May 23, 2024 20:17

renovate bot force-pushed the renovate/all branch 3 times, most recently from 77c15dc to 9973f2d Compare May 31, 2024 11:10

renovate bot force-pushed the renovate/all branch 6 times, most recently from ba891b8 to f69fde3 Compare June 7, 2024 15:20

renovate bot force-pushed the renovate/all branch 4 times, most recently from 13b63c1 to 87d300e Compare June 13, 2024 16:06

renovate bot force-pushed the renovate/all branch 2 times, most recently from 6f97cf9 to 6849a65 Compare June 20, 2024 20:09

renovate bot force-pushed the renovate/all branch 4 times, most recently from 14dbe85 to c045671 Compare July 2, 2024 03:45

renovate bot force-pushed the renovate/all branch 7 times, most recently from d112979 to 69273cc Compare July 12, 2024 10:01

renovate bot force-pushed the renovate/all branch 4 times, most recently from 26b3972 to 142deb2 Compare August 19, 2024 19:10

renovate bot force-pushed the renovate/all branch 4 times, most recently from 4615341 to 95d80aa Compare August 24, 2024 00:07

renovate bot force-pushed the renovate/all branch 3 times, most recently from 94e1ed7 to 01db553 Compare August 30, 2024 10:48

renovate bot force-pushed the renovate/all branch 5 times, most recently from 7e2aa1b to a65f7eb Compare September 16, 2024 10:56

renovate bot force-pushed the renovate/all branch 5 times, most recently from cd68fa0 to b331236 Compare September 22, 2024 04:35

renovate bot force-pushed the renovate/all branch 5 times, most recently from 5dfee52 to d757c5f Compare September 30, 2024 15:14

renovate bot force-pushed the renovate/all branch 3 times, most recently from 58111d7 to 62880c4 Compare October 3, 2024 22:51

chore(deps): update all dependencies

d26c981

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update all dependencies#4

chore(deps): update all dependencies#4
renovate[bot] wants to merge 1 commit intoaperturefrom
renovate/all

renovate bot commented May 16, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Conversation

renovate bot commented May 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

What's Changed

⚠️ Minimum Compatible Runner Version

What's Changed

What's Changed

New Contributors

v4.9.0: Dependency Review Action 4.9.0

What's Changed

New Contributors

v4.8.3: 4.8.3

Dependency Review Action v4.8.3

What's Changed

v4.8.1: Dependency Review Action v4.8.1

What's Changed

What's Changed

New Contributors

v4.7.3: 4.7.3

What's Changed

v4.7.2: 4.7.2

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

What's Changed

v4.3.3: Notes for v4.3.3

What's Changed

New Contributors

What's Changed

What's Changed

New Features

What's Changed

New Contributors

v4.2.5: 4.2.5

What's Changed

What's Changed

New Contributors

v4.2.3: 4.2.3

What's Changed

New Contributors

v4.1.3: 4.1.3

v4.1.2: 4.1.2

What's Changed

v4.1.1: 4.1.1

What's Changed

v4.1.0: 4.1.0

What's Changed

New Contributors

New Contributors

What's Changed

Enhancements:

Dependency updates:

Bug fixes:

New Contributors

Configuration

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

renovate bot commented May 16, 2024 •

edited

Loading

`v4.9.0`: Dependency Review Action 4.9.0

`v4.8.3`: 4.8.3

`v4.8.1`: Dependency Review Action v4.8.1

`v4.7.3`: 4.7.3

`v4.7.2`: 4.7.2

`v4.3.3`: Notes for v4.3.3

`v4.2.5`: 4.2.5

`v4.2.3`: 4.2.3

`v4.1.3`: 4.1.3

`v4.1.2`: 4.1.2

`v4.1.1`: 4.1.1

`v4.1.0`: 4.1.0