An enterprise-class UI components based on At UI Design and Angular. 🚀 🚀 🚀

塟愛鎵镞de栤仯

Last update: Dec 16, 2022

Related tags

Overview

此项目已经停止维护。仅供学习参考。

AT-NG

An enterprise-class UI components based on At UI Design and Angular. 🚀 🚀 🚀

at-ng is a modular front-end UI framework for developing fast and powerful web interfaces based on Angular 7+.

Latest version

8.0.2

✨ Features

Based on Angular 8 +
A npm + webpack + babel front-end development workflow
Support ES2015
CSS Style independent, make consistent user interfaces (See: AT-UI-Style)
Friendly API

🖥 Environment Support

Modern browsers and Internet Explorer 9+
Electron
NW.js

IE / Edge	Firefox	Chrome	Safari	Opera	Electron
IE11, Edge	last 2 versions	last 2 versions	last 2 versions	last 2 versions	last 2 versions

NOTICE: At-ng dependent on @angular/cdk

🔗 Links

Home Page
Angular
Webpack
AT-UI for Vue (official library)

📦 Install

Recommended use npm

npm install at-ng

🔨 Usage

Because of the style of AT-UI is independent. It's a separate project. So we should add AT-UI-Style to cli config file

++  "../node_modules/at-ng/assets/index.css",

We could also have theme system now. 🎨

Create a standalone less file named theme.less in src folder, and add the path of it to the list of styles in angular.json file.


...
  "styles": [
    ...
    "src/theme.scss"
    ...
  ]
...

Copy the scss variable file from ~node_modules/at-ng/styles/sass/variables/default to theme.scss

Here is an example of theme.scss


@import "~node_modules/at-ng/styles/sass/mixins/index";
$css-prefix: at;

/* change the brand color */
$brand-color: #c41d7f;
....

/*  config the icon font path  */
$font-path: '~node_modules/at-ng/styles/sass/fonts';

/*  import the entry file that conatins all scss files  */
@import "~node_modules/at-ng/styles/sass/entry";

Add the AtModule to your root module

@NgModule({
  imports: [
   AtModule.forRoot(),
  ]
  })

💉 Other dependencies

License

MIT

Comments

Bump jszip from 3.2.1 to 3.9.1
Bumps jszip from 3.2.1 to 3.9.1.

Changelog

Sourced from jszip's changelog.

v3.9.1 2022-04-06

Fix recursive definition of InputFileFormat introduced in 3.9.0.

v3.9.0 2022-04-04

Update types JSZip#loadAsync to accept a promise for data, and remove arguments from new JSZip() (see #752)

Update types for compressionOptions to JSZipFileOptions and JSZipGeneratorOptions (see #722)

Add types for generateInternalStream (see #774)

v3.8.0 2022-03-30

Santize filenames when files are loaded with loadAsync, to avoid "zip slip" attacks. The original filename is available on each zip entry as unsafeOriginalName. See the documentation. Many thanks to McCaulay Hudson for reporting.

v3.7.1 2021-08-05

Fix build of dist files.

Note: this version ensures the changes from 3.7.0 are actually included in the dist files. Thanks to Evan W for reporting.

v3.7.0 2021-07-23

Fix: Use a null prototype object for this.files (see #766)

This change might break existing code if it uses prototype methods on the .files property of a zip object, for example zip.files.toString(). This approach is taken to prevent files in the zip overriding object methods that would exist on a normal object.

v3.6.0 2021-02-09

Fix: redirect main to dist on browsers (see #742)

Fix duplicate require DataLengthProbe, utils (see #734)

Fix small error in read_zip.md (see #703)

v3.5.0 2020-05-31

Fix 'End of data reached' error when file extra field is invalid (see #544).

Typescript definitions: Add null to return types of functions that may return null (see #669).

Typescript definitions: Correct nodeStream's type (see #682)

Typescript definitions: Add string output type (see #666)

v3.4.0 2020-04-19

Add Typescript type definitions (see #601).

v3.3.0 2020-04-1

Change browser module resolution to support Angular packager (see #614).

v3.2.2 2019-07-04

No public changes, but a number of testing dependencies have been updated.

Tested browsers are now: Internet Explorer 11, Chrome (most recent) and Firefox (most recent). Other browsers (specifically Safari) are still supported however testing them on Saucelabs is broken and so they were removed from the test matrix.

Commits

b0a6de6 3.9.1

c00440a Changes for 3.9.1

659599c Remove recursive InputFileFormat type

d36f043 3.9.0

ae0b127 Updates for 3.9.0

983c4d5 Amend generateInternalStream typings to remove any

454030c Add type checking of d.ts file

80e2705 Adjust package.json order to make releasing easier

0cde8c0 Update documentation

6b3b5fd Extract CompressionOptions to interface

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1
Bump karma from 3.0.0 to 6.3.16
Bumps karma from 3.0.0 to 6.3.16.

Release notes

Sourced from karma's releases.

v6.3.16

6.3.16 (2022-02-10)

Bug Fixes

security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

v6.3.15

6.3.15 (2022-02-05)

Bug Fixes

helper: make mkdirIfNotExists helper resilient to concurrent calls (d9dade2), closes karma-runner/karma-coverage#434

v6.3.14

6.3.14 (2022-02-05)

Bug Fixes

remove string template from client code (91d5acd)

warn when singleRun and autoWatch are false (69cfc76)

security: remove XSS vulnerability in returnUrl query param (839578c)

v6.3.13

6.3.13 (2022-01-31)

Bug Fixes

deps: bump log4js to resolve security issue (5bf2df3), closes #3751

v6.3.12

6.3.12 (2022-01-24)

Bug Fixes

remove depreciation warning from log4js (41bed33)

v6.3.11

6.3.11 (2022-01-13)

Bug Fixes

deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

... (truncated)

Changelog

Sourced from karma's changelog.

6.3.16 (2022-02-10)

Bug Fixes

security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

6.3.15 (2022-02-05)

Bug Fixes

helper: make mkdirIfNotExists helper resilient to concurrent calls (d9dade2), closes karma-runner/karma-coverage#434

6.3.14 (2022-02-05)

Bug Fixes

remove string template from client code (91d5acd)

warn when singleRun and autoWatch are false (69cfc76)

security: remove XSS vulnerability in returnUrl query param (839578c)

6.3.13 (2022-01-31)

Bug Fixes

deps: bump log4js to resolve security issue (5bf2df3), closes #3751

6.3.12 (2022-01-24)

Bug Fixes

remove depreciation warning from log4js (41bed33)

6.3.11 (2022-01-13)

Bug Fixes

deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

6.3.10 (2022-01-08)

Bug Fixes

logger: create parent folders if they are missing (0d24bd9), closes #3734

... (truncated)

Commits

ab4b328 chore(release): 6.3.16 [skip ci]

ff7edbb fix(security): mitigate the "Open Redirect Vulnerability"

c1befa0 chore(release): 6.3.15 [skip ci]

d9dade2 fix(helper): make mkdirIfNotExists helper resilient to concurrent calls

653c762 ci: prevent duplicate CI tasks on creating a PR

c97e562 chore(release): 6.3.14 [skip ci]

91d5acd fix: remove string template from client code

69cfc76 fix: warn when singleRun and autoWatch are false

839578c fix(security): remove XSS vulnerability in returnUrl query param

db53785 chore(release): 6.3.13 [skip ci]

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1
Bump url-parse from 1.4.7 to 1.5.7
Bumps url-parse from 1.4.7 to 1.5.7.

Commits

8b3f5f2 1.5.7

ef45a13 [fix] Readd the empty userinfo to url.href (#226)

88df234 [doc] Add soft deprecation notice

78e9f2f [security] Fix nits

e6fa434 [security] Add credits for incorrect handling of userinfo vulnerability

4c9fa23 1.5.6

7b0b8a6 Merge pull request #223 from unshiftio/fix/at-sign-handling-in-userinfo

e4a5807 1.5.5

193b44b [minor] Simplify whitespace regex

319851b [fix] Remove CR, HT, and LF

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1
Bump karma from 3.0.0 to 6.3.14
Bumps karma from 3.0.0 to 6.3.14.

Release notes

Sourced from karma's releases.

v6.3.14

6.3.14 (2022-02-05)

Bug Fixes

remove string template from client code (91d5acd)

warn when singleRun and autoWatch are false (69cfc76)

security: remove XSS vulnerability in returnUrl query param (839578c)

v6.3.13

6.3.13 (2022-01-31)

Bug Fixes

deps: bump log4js to resolve security issue (5bf2df3), closes #3751

v6.3.12

6.3.12 (2022-01-24)

Bug Fixes

remove depreciation warning from log4js (41bed33)

v6.3.11

6.3.11 (2022-01-13)

Bug Fixes

deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

v6.3.10

6.3.10 (2022-01-08)

Bug Fixes

logger: create parent folders if they are missing (0d24bd9), closes #3734

v6.3.9

6.3.9 (2021-11-16)

Bug Fixes

restartOnFileChange option not restarting the test run (92ffe60), closes #27 #3724

... (truncated)

Changelog

Sourced from karma's changelog.

6.3.14 (2022-02-05)

Bug Fixes

remove string template from client code (91d5acd)

warn when singleRun and autoWatch are false (69cfc76)

security: remove XSS vulnerability in returnUrl query param (839578c)

6.3.13 (2022-01-31)

Bug Fixes

deps: bump log4js to resolve security issue (5bf2df3), closes #3751

6.3.12 (2022-01-24)

Bug Fixes

remove depreciation warning from log4js (41bed33)

6.3.11 (2022-01-13)

Bug Fixes

deps: pin colors package to 1.4.0 due to security vulnerability (a5219c5)

6.3.10 (2022-01-08)

Bug Fixes

logger: create parent folders if they are missing (0d24bd9), closes #3734

6.3.9 (2021-11-16)

Bug Fixes

restartOnFileChange option not restarting the test run (92ffe60), closes #27 #3724

6.3.8 (2021-11-07)

Bug Fixes

reporter: warning if stack trace contains generated code invocation (4f23b14)

... (truncated)

Commits

c97e562 chore(release): 6.3.14 [skip ci]

91d5acd fix: remove string template from client code

69cfc76 fix: warn when singleRun and autoWatch are false

839578c fix(security): remove XSS vulnerability in returnUrl query param

db53785 chore(release): 6.3.13 [skip ci]

5bf2df3 fix(deps): bump log4js to resolve security issue

36ad678 chore(release): 6.3.12 [skip ci]

41bed33 fix: remove depreciation warning from log4js

c985155 docs: create security.md

c96f0c5 chore(release): 6.3.11 [skip ci]

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1
Bump follow-redirects from 1.7.0 to 1.14.7
Bumps follow-redirects from 1.7.0 to 1.14.7.

Commits

2ede36d Release version 1.14.7 of the npm package.

8b347cb Drop Cookie header across domains.

6f5029a Release version 1.14.6 of the npm package.

af706be Ignore null headers.

d01ab7a Release version 1.14.5 of the npm package.

40052ea Make compatible with Node 17.

86f7572 Fix: clear internal timer on request abort to avoid leakage

2e1eaf0 Keep Authorization header on subdomain redirects.

2ad9e82 Carry over Host header on relative redirects (#172)

77e2a58 Release version 1.14.4 of the npm package.

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1
Bump url-parse from 1.4.7 to 1.5.3
Bumps url-parse from 1.4.7 to 1.5.3.

Commits

ad44493 [dist] 1.5.3

c798461 [fix] Fix host parsing for file URLs (#210)

201034b [dist] 1.5.2

2d9ac2c [fix] Sanitize only special URLs (#209)

fb128af [fix] Use 'null' as origin for non special URLs

fed6d9e [fix] Add a leading slash only if the URL is special

94872e7 [fix] Do not incorrectly set the slashes property to true

81ab967 [fix] Ignore slashes after the protocol for special URLs

ee22050 [ci] Use GitHub Actions

d2979b5 [fix] Special case the file: protocol (#204)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1
Bump url-parse from 1.4.7 to 1.5.1
Bumps url-parse from 1.4.7 to 1.5.1.

Commits

eb6d9f5 [dist] 1.5.1

750d8e8 [fix] Fixes relative path resolving #199 #200 (#201)

3ac7774 [test] Make test consistent for browser testing

267a0c6 [dist] 1.5.0

d1e7e88 [security] More backslash fixes (#197)

d99bf4c [ignore] Remove npm-debug.log from .gitignore

422c8b5 [pkg] Replace nyc with c8

933809d [pkg] Move coveralls to dev dependencies

190b216 [pkg] Add .npmrc

ce3783f [test] Do not test on all available versions of Edge and Safari

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1
Bump highlight.js from 9.15.8 to 10.1.2
Bumps highlight.js from 9.15.8 to 10.1.2.

Release notes

Sourced from highlight.js's releases.

10.1.2

Fixes:

fix(night) Prevent object prototype values from being returned by getLanguage (#2636) night

10.1.1

Fixes:

Resolve issue on Node 6 due to dangling comma (#2608) [Edwin Hoogerbeets][]

Resolve index.d.ts is not a module error (#2603) [Josh Goebel][]

10.1.0

Just your typical minor release. Plenty of fixes and enhancements, few new themes.

Some deprecations language maintainers might want to pay attention to:

htmlbars grammar is now deprecated. Use handlebars instead. (#2344) [Nils Knappmeier][]

when using highlightBlock result.re deprecated. Use result.relevance instead. (#2552) [Josh Goebel][]

ditto for result.second_best.re => result.second_best.relevance (#2552)

lexemes is now deprecated in favor of keywords.$pattern key (#2519) [Josh Goebel][]

endSameAsBegin is now deprecated. (#2261) [Josh Goebel][]

10.0.2

Fixes a serious potential freeze/infinite loop issue. Everyone on version 10 should upgrade.

Remove support for AMD module loading, which never truly worked properly anyways.

10.0.1

Fixes: sublanguage with no rule matches causes text to disappear in final output. (#2506).

10.0.0

Welcome to version 10.0. This a major release and therefore will contain breaking changes.

Breaking Changes

Our normal minor releases try to never break anything, holding all breaking changes for major releases. We tried to squeeze in as many as we could this time so that after 10.0 ships we'll be back to quiet sailing for a while before we need to push version 11. That said, we're very conservative about what we consider a breaking change.

i.e., if there it could possibly break things for anyone, it's typically a breaking change. The fact is a vast majority of users should upgrade and probably not notice any changes at all.

See VERSION_10_BREAKING_CHANGES.md for a comprehensive list of breaking changes, but here is a summary... if you use:

Core highlight.js lib on the client (with no extra CDN languages)

Just keep doing that.

If you're using darkula.css, you'll need to change that to darcula.css

... (truncated)

Changelog

Sourced from highlight.js's changelog.

Version 10.1.2

Fixes:

fix(night) Prevent object prototype values from being returned by getLanguage (#2636) night

Version 10.1.1

Fixes:

Resolve issue on Node 6 due to dangling comma (#2608) Edwin Hoogerbeets

Resolve index.d.ts is not a module error (#2603) Josh Goebel

Version 10.1.0

New themes:

NNFX and NNFX-dark by [Jim Mason][]

lioshi by [lioshi][]

Parser Engine:

(parser) Now escapes quotes in text content when escaping HTML (#2564) Josh Goebel

(parser) Adds keywords.$pattern key to grammar definitions (#2519) Josh Goebel

(parser) Adds SHEBANG utility mode Josh Goebel

(parser) Adds registerAliases method (#2540) [Taufik Nurrohman][]

(enh) Added on:begin callback for modes (#2261) Josh Goebel

(enh) Added on:end callback for modes (#2261) Josh Goebel

(enh) Added ability to programatically ignore begin and end matches (#2261) Josh Goebel

(enh) Added END_SAME_AS_BEGIN mode to replace endSameAsBegin parser attribute (#2261) Josh Goebel

(fix) fixMarkup would rarely destroy markup when useBR was enabled (#2532) Josh Goebel

Deprecations:

htmlbars grammar is now deprecated. Use handlebars instead. (#2344) [Nils Knappmeier][]

when using highlightBlock result.re deprecated. Use result.relevance instead. (#2552) Josh Goebel

ditto for result.second_best.re => result.second_best.relevance (#2552)

lexemes is now deprecated in favor of keywords.$pattern key (#2519) Josh Goebel

endSameAsBegin is now deprecated. (#2261) Josh Goebel

Language Improvements:

fix(groovy) strings are not allowed inside ternary clauses (#2217) Josh Goebel

... (truncated)

Commits

edd73d2 bump v10.1.2

7241013 (parser) use null prototype objects for languages/aliases (#2636)

93fd0d7 bump v10.1.1; (chore) add changelog for 10.1.1

c5783d2 (chore) clean up types just a little

a4ee4e4 (chore) declare ambient modules for lib/core & languges

0656588 (chore) removed dangling comma (#2612)

b1bce6e (chore) more import below metadata comment

74de6ea (chore) bump copyright

b2d19b0 bump v10.1.0

84f7fa3 (chore) upgrade some dev stuff to newer versions

Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by isagalaev, a new releaser for highlight.js since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1
Bump handlebars from 4.1.2 to 4.7.6
Bumps handlebars from 4.1.2 to 4.7.6.

Changelog

Sourced from handlebars's changelog.

v4.7.6 - April 3rd, 2020

Chore/Housekeeping:

#1672 - Switch cmd parser to latest minimist (@dougwilson

Compatibility notes:

Restored Node.js compatibility

Commits

v4.7.5 - April 2nd, 2020

Chore/Housekeeping:

~~Node.js version support has been changed to v6+~~ Reverted in 4.7.6

Compatibility notes:

~~Node.js < v6 is no longer supported~~ Reverted in 4.7.6

Commits

v4.7.4 - April 1st, 2020

Chore/Housekeeping:

#1666 - Replaced minimist with yargs for handlebars CLI (@aorinevo, @AviVahl & @fabb)

Compatibility notes:

No incompatibilities are to be expected

Commits

v4.7.3 - February 5th, 2020

Chore/Housekeeping:

#1644 - Download links to aws broken on handlebarsjs.com - access denied (@Tea56)

Fix spelling and punctuation in changelog - d78cc73

Bugfixes:

Add Type Definition for Handlebars.VERSION, Fixes #1647 - 4de51fe

Include Type Definition for runtime.js in Package - a32d05f

Compatibility notes:

Commits

e6ad93e v4.7.6

2bf4fc6 Update release notes

b64202b Update release-notes.md

c2f1e62 Switch cmd parser to latest minimist

08e9a11 Revert "chore: set Node.js compatibility to v6+"

1fd2ede v4.7.5

3c9c2f5 Update release notes

16487a0 chore: downgrade yargs to v14

309d2b4 chore: set Node.js compatibility to v6+

645ac73 test: fix integration tests

Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by erisds, a new releaser for handlebars since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1
Bump marked from 0.5.2 to 0.7.0
Bumps marked from 0.5.2 to 0.7.0.

Release notes

Sourced from marked's releases.

0.7.0

Security

Sanitize paragraph and text tokens #1504

Fix ReDOS for links with backticks (issue #1493) #1515

Breaking Changes

Deprecate sanitize and sanitizer options #1504

Move fences to CommonMark #1511

Move tables to GFM #1511

Remove tables option #1511

Single backtick in link text needs to be escaped #1515

Fixes

Fix parentheses around a link #1509

Fix headings (issue #1510) #1511

Tests

Run tests with correct options #1511

0.6.3

Fixes

Fix nested blockquotes #1464

Fix <em> issue with mixed content #1451

revert #1464 #1497

Fix breaks: true #1507

Docs

add docs for workers #1432

Add security policy #1492

Update supported spec versions #1491

Update test folder descriptions #1506

DevOps

Use latest commit for demo master #1457

Update tests to commonmark 0.29 #1465

Update tests to GFM 0.29 #1470

Fix commonmark spec 57 and 40 (headings) #1475

0.6.2

Security

Link redos #1426

Text redos #1460

Fixes

Links parens #1435

Commits

26ae990 Release v0.7.0 (#1519)

204926c 0.7.0

15a6b4f 🗜️ minify [skip ci]

0ee3aa9 Merge pull request #1515 from UziTech/link-label-security

cc9efe4 🗜️ minify [skip ci]

e987a4d fix tests

ded5e24 update link

7faa999 add test

ac1e57c use correct options in specs (#1511)

63935f9 🗜️ minify [skip ci]

Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by tonybrix, a new releaser for marked since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1
Bump elliptic from 6.4.1 to 6.5.3
Bumps elliptic from 6.4.1 to 6.5.3.

Commits

8647803 6.5.3

856fe4d signature: prevent malleability and overflows

6048941 6.5.2

9984964 package: bump dependencies

ec735ed utils: leak less information in getNAF()

71e4e8e 6.5.1

7ec66ff short: add infinity check before multiplying

ee7970b travis: really move on

637d021 travis: move on

5ed0bab package: update deps

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 1

Bump json5 and @angular-devkit/build-angular

Bumps json5 to 2.2.3 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates json5 from 1.0.1 to 2.2.3

Release notes

Sourced from json5's releases.

v2.2.3

Fix: [email protected] is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1

Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0

New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

v2.1.3 [code, diff]

Fix: An out of memory bug when parsing numbers has been fixed. (#228, #229)

v2.1.2

Fix: Bump minimist to v1.2.5. (#222)

v2.1.1

New: package.json and package.json5 include a module property so bundlers like webpack, rollup and parcel can take advantage of the ES Module build. (#208)

Fix: stringify outputs \0 as \\x00 when followed by a digit. (#210)

Fix: Spelling mistakes have been fixed. (#196)

v2.1.0

New: The index.mjs and index.min.mjs browser builds in the dist directory support ES6 modules. (#187)

v2.0.1

Fix: The browser builds in the dist directory support ES5. (#182)

v2.0.0

Major: JSON5 officially supports Node.js v6 and later. Support for Node.js v4 has been dropped. Since Node.js v6 supports ES5 features, the code has been rewritten in native ES5, and the dependence on Babel has been eliminated.

New: Support for Unicode 10 has been added.

New: The test framework has been migrated from Mocha to Tap.

New: The browser build at dist/index.js is no longer minified by default. A minified version is available at dist/index.min.js. (#181)

Fix: The warning has been made clearer when line and paragraph separators are

... (truncated)

Changelog

Sourced from json5's changelog.

v2.2.3 [code, diff]

Fix: [email protected] is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2 [code, diff]

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0 [code, diff]

New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

v2.1.3 [code, diff]

Fix: An out of memory bug when parsing numbers has been fixed. (#228, #229)

v2.1.2 [code, diff]

Fix: Bump minimist to v1.2.5. (#222)

v2.1.1 [code, [diff][d2.1.1]]

... (truncated)

Commits

c3a7524 2.2.3
94fd06d docs: update CHANGELOG for v2.2.3
3b8cebf docs(security): use GitHub security advisories
f0fd9e1 docs: publish a security policy
6a91a05 docs(template): bug -> bug report
14f8cb1 2.2.2
10cc7ca docs: update CHANGELOG for v2.2.2
7774c10 fix: add proto to objects and arrays
edde30a Readme: slight tweak to intro
97286f8 Improve example in readme
Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 0.800.0 to 15.0.4

Release notes

Sourced from @angular-devkit/build-angular's releases.

v15.0.4

15.0.4 (2022-12-14)

@angular-devkit/build-angular

Commit Description

display actionable error when a style does not exist in Karma builder

downlevel class private methods when targeting Safari <=v15

include sources in generated Sass source maps

only set ngDevMode when script optimizations are enabled

update css-loader to 6.7.3

update locale setting snippet to use globalThis.

Special Thanks

Alan Agius and Charles Lyding

v15.0.3

15.0.3 (2022-12-07)

@angular-devkit/build-angular

Commit Description

default preserve symlinks to Node.js value for esbuild

downlevel class fields with Safari <= v15 for esbuild

downlevel class properties when targeting Safari <=v15

prevent optimization adding unsupported ECMASCript features

Special Thanks

Charles Lyding, Dominic Elm and Paul Gschwendtner

v15.0.2

15.0.2 (2022-11-30)

@angular-devkit/build-angular

Commit Description

correctly set Sass quietDeps and verbose options

@ngtools/webpack

Commit Description

elide unused type references

Special Thanks

Alan Agius and Juuso Valkeejärvi

v15.0.1

15.0.1 (2022-11-23)

@schematics/angular

Commit Description

show warning when a TS Config is not found during migrations

@angular/cli

Commit	Description
	display actionable error when a style does not exist in Karma builder
	downlevel class private methods when targeting Safari <=v15
	include sources in generated Sass source maps
	only set ngDevMode when script optimizations are enabled
	update `css-loader` to `6.7.3`
	update locale setting snippet to use `globalThis`.

Commit	Description
	default preserve symlinks to Node.js value for esbuild
	downlevel class fields with Safari <= v15 for esbuild
	downlevel class properties when targeting Safari <=v15
	prevent optimization adding unsupported ECMASCript features

Commit	Description
	correctly set Sass quietDeps and verbose options

Commit	Description
	elide unused type references

Commit	Description
	show warning when a TS Config is not found during migrations

... (truncated)

Changelog

Sourced from @angular-devkit/build-angular's changelog.

15.0.4 (2022-12-14)

@angular-devkit/build-angular

Commit Type Description

ccc8e0350 fix display actionable error when a style does not exist in Karma builder

507f756c3 fix downlevel class private methods when targeting Safari <=v15

a0da91dba fix include sources in generated

9fd356234 fix only set ngDevMode when script optimizations are enabled

8e85f4728 fix update css-loader to 6.7.3

b2d4415ca fix update locale setting snippet to use globalThis.

Special Thanks

Alan Agius and Charles Lyding

15.1.0-next.2 (2022-12-08)

@schematics/angular

Commit Type Description

5b18ce154 feat add guardType as an alias of implements in guard schematic

49b313f27 fix add missing import for functional interceptor spec

2f92fe7e5 fix add missing semicolon in functional guard/resolver/interceptor

@angular-devkit/build-angular

Commit Type Description

97716969c fix default preserve symlinks to Node.js value for esbuild

cf2f30afc fix downlevel class fields with Safari <= v15 for esbuild

25eaaa24b fix downlevel class properties when targeting Safari <=v15

7a063238b fix explicitly send options to JS transformer workers

ef99a68b4 fix prevent optimization adding unsupported ECMASCript features

Special Thanks

Alan Agius, Charles Lyding, Cédric Exbrayat, Dominic Elm, Doug Parker and Paul Gschwendtner

15.0.3 (2022-12-07)

Commit	Type	Description
ccc8e0350	fix	display actionable error when a style does not exist in Karma builder
507f756c3	fix	downlevel class private methods when targeting Safari <=v15
a0da91dba	fix	include sources in generated
9fd356234	fix	only set ngDevMode when script optimizations are enabled
8e85f4728	fix	update `css-loader` to `6.7.3`
b2d4415ca	fix	update locale setting snippet to use `globalThis`.

Commit	Type	Description
5b18ce154	feat	add `guardType` as an alias of `implements` in guard schematic
49b313f27	fix	add missing import for functional interceptor spec
2f92fe7e5	fix	add missing semicolon in functional guard/resolver/interceptor

Commit	Type	Description
97716969c	fix	default preserve symlinks to Node.js value for esbuild
cf2f30afc	fix	downlevel class fields with Safari <= v15 for esbuild
25eaaa24b	fix	downlevel class properties when targeting Safari <=v15
7a063238b	fix	explicitly send options to JS transformer workers
ef99a68b4	fix	prevent optimization adding unsupported ECMASCript features

... (truncated)

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @angular-devkit/build-angular since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies

opened by dependabot[bot] 0

Bump express from 4.17.1 to 4.18.2
Bumps express from 4.17.1 to 4.18.2.

Release notes

Sourced from express's releases.

4.18.2

Fix regression routing a large stack in a single route

deps: [email protected]

deps: [email protected]

perf: remove unnecessary object clone

deps: [email protected]

4.18.1

Fix hanging on large stack of sync routes

4.18.0

Add "root" option to res.download

Allow options without filename in res.download

Deprecate string and non-integer arguments to res.status

Fix behavior of null/undefined as maxAge in res.cookie

Fix handling very large stacks of sync middleware

Ignore Object.prototype values in settings through app.set/app.get

Invoke default with same arguments as types in res.format

Support proper 205 responses using res.send

Use http-errors for res.format error

deps: [email protected]

Fix error message for json parse whitespace in strict

Fix internal error when inflated body exceeds limit

Prevent loss of async hooks context

Prevent hanging when request already read

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

Add priority option

Fix expires option to reject invalid dates

deps: [email protected]

Replace internal eval usage with Function constructor

Use instance methods on process to check for listeners

deps: [email protected]

Remove set content headers that break response

deps: [email protected]

deps: [email protected]

deps: [email protected]

Prevent loss of async hooks context

deps: [email protected]

deps: [email protected]

Fix emitted 416 error missing headers property

Limit the headers removed for 304 response

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

... (truncated)

Changelog

Sourced from express's changelog.

4.18.2 / 2022-10-08

Fix regression routing a large stack in a single route

deps: [email protected]

deps: [email protected]

perf: remove unnecessary object clone

deps: [email protected]

4.18.1 / 2022-04-29

Fix hanging on large stack of sync routes

4.18.0 / 2022-04-25

Add "root" option to res.download

Allow options without filename in res.download

Deprecate string and non-integer arguments to res.status

Fix behavior of null/undefined as maxAge in res.cookie

Fix handling very large stacks of sync middleware

Ignore Object.prototype values in settings through app.set/app.get

Invoke default with same arguments as types in res.format

Support proper 205 responses using res.send

Use http-errors for res.format error

deps: [email protected]

Fix error message for json parse whitespace in strict

Fix internal error when inflated body exceeds limit

Prevent loss of async hooks context

Prevent hanging when request already read

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

deps: [email protected]

Add priority option

Fix expires option to reject invalid dates

deps: [email protected]

Replace internal eval usage with Function constructor

Use instance methods on process to check for listeners

deps: [email protected]

Remove set content headers that break response

deps: [email protected]

deps: [email protected]

deps: [email protected]

Prevent loss of async hooks context

deps: [email protected]

deps: [email protected]

... (truncated)

Commits

8368dc1 4.18.2

61f4049 docs: replace Freenode with Libera Chat

bb7907b build: [email protected]

f56ce73 build: [email protected]

24b3dc5 deps: [email protected]

689d175 deps: [email protected]

340be0f build: [email protected]

33e8dc3 docs: use Node.js name style

644f646 build: [email protected]

ecd7572 build: [email protected]

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
Bump qs from 6.5.2 to 6.5.3
Bumps qs from 6.5.2 to 6.5.3.

Changelog

Sourced from qs's changelog.

6.5.3

[Fix] parse: ignore __proto__ keys (#428)

[Fix] utils.merge: avoid a crash with a null target and a truthy non-array source

[Fix] correctly parse nested arrays

[Fix] stringify: fix a crash with strictNullHandling and a custom filter/serializeDate (#279)

[Fix] utils: merge: fix crash when source is a truthy primitive & no options are provided

[Fix] when parseArrays is false, properly handle keys ending in []

[Fix] fix for an impossible situation: when the formatter is called with a non-string value

[Fix] utils.merge: avoid a crash with a null target and an array source

[Refactor] utils: reduce observable [[Get]]s

[Refactor] use cached Array.isArray

[Refactor] stringify: Avoid arr = arr.concat(...), push to the existing instance (#269)

[Refactor] parse: only need to reassign the var once

[Robustness] stringify: avoid relying on a global undefined (#427)

[readme] remove travis badge; add github actions/codecov badges; update URLs

[Docs] Clean up license text so it’s properly detected as BSD-3-Clause

[Docs] Clarify the need for "arrayLimit" option

[meta] fix README.md (#399)

[meta] add FUNDING.yml

[actions] backport actions from main

[Tests] always use String(x) over x.toString()

[Tests] remove nonexistent tape option

[Dev Deps] backport from main

Commits

298bfa5 v6.5.3

ed0f5dc [Fix] parse: ignore __proto__ keys (#428)

691e739 [Robustness] stringify: avoid relying on a global undefined (#427)

1072d57 [readme] remove travis badge; add github actions/codecov badges; update URLs

12ac1c4 [meta] fix README.md (#399)

0338716 [actions] backport actions from main

5639c20 Clean up license text so it’s properly detected as BSD-3-Clause

51b8a0b add FUNDING.yml

45f6759 [Fix] fix for an impossible situation: when the formatter is called with a no...

f814a7f [Dev Deps] backport from main

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
Bump decode-uri-component from 0.2.0 to 0.2.2
Bumps decode-uri-component from 0.2.0 to 0.2.2.

Release notes

Sourced from decode-uri-component's releases.

v0.2.2

Prevent overwriting previously decoded tokens 980e0bf

https://github.com/SamVerschueren/decode-uri-component/compare/v0.2.1...v0.2.2

v0.2.1

Switch to GitHub workflows 76abc93

Fix issue where decode throws - fixes #6 746ca5d

Update license (#1) 486d7e2

Tidelift tasks a650457

Meta tweaks 66e1c28

https://github.com/SamVerschueren/decode-uri-component/compare/v0.2.0...v0.2.1

Commits

a0eea46 0.2.2

980e0bf Prevent overwriting previously decoded tokens

3c8a373 0.2.1

76abc93 Switch to GitHub workflows

746ca5d Fix issue where decode throws - fixes #6

486d7e2 Update license (#1)

a650457 Tidelift tasks

66e1c28 Meta tweaks

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0
Bump engine.io and karma
Bumps engine.io to 6.2.1 and updates ancestor dependency karma. These dependencies need to be updated together.

Updates engine.io from 3.2.1 to 6.2.1

Release notes

Sourced from engine.io's releases.

6.2.1

:warning: This release contains an important security fix :warning:

A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:

Error: read ECONNRESET at TCP.onStreamRead (internal/stream_base_commons.js:209:20) Emitted 'error' event on Socket instance at: at emitErrorNT (internal/streams/destroy.js:106:8) at emitErrorCloseNT (internal/streams/destroy.js:74:3) at processTicksAndRejections (internal/process/task_queues.js:80:21) { errno: -104, code: 'ECONNRESET', syscall: 'read' }

Please upgrade as soon as possible.

Bug Fixes

catch errors when destroying invalid upgrades (#658) (425e833)

6.2.0

Features

add the "maxPayload" field in the handshake details (088dcb4)

So that clients in HTTP long-polling can decide how many packets they have to send to stay under the maxHttpBufferSize value.

This is a backward compatible change which should not mandate a new major revision of the protocol (we stay in v4), as we only add a field in the JSON-encoded handshake data:

0{"sid":"lv_VI97HAXpY6yYWAAAC","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":5000,"maxPayload":1000000}

Links

Diff: https://github.com/socketio/engine.io/compare/6.1.3...6.2.0

Client release: 6.2.0

ws version: ~8.2.3

6.1.3

Bug Fixes

typings: allow CorsOptionsDelegate as cors options (#641) (a463d26)

uws: properly handle chunked content (#642) (3367440)

... (truncated)

Changelog

Sourced from engine.io's changelog.

6.2.1 (2022-11-20)

:warning: This release contains an important security fix :warning:

A malicious client could send a specially crafted HTTP request, triggering an uncaught exception and killing the Node.js process:

Error: read ECONNRESET at TCP.onStreamRead (internal/stream_base_commons.js:209:20) Emitted 'error' event on Socket instance at: at emitErrorNT (internal/streams/destroy.js:106:8) at emitErrorCloseNT (internal/streams/destroy.js:74:3) at processTicksAndRejections (internal/process/task_queues.js:80:21) { errno: -104, code: 'ECONNRESET', syscall: 'read' }

Please upgrade as soon as possible.

Bug Fixes

catch errors when destroying invalid upgrades (#658) (425e833)

3.6.0 (2022-06-06)

Bug Fixes

add extension in the package.json main entry (#608) (3ad0567)

do not reset the ping timer after upgrade (1f5d469), closes socketio/socket.io-client-swift#1309

Features

decrease the default value of maxHttpBufferSize (58e274c)

This change reduces the default value from 100 mb to a more sane 1 mb.

This helps protect the server against denial of service attacks by malicious clients sending huge amounts of data.

See also: https://github.com/advisories/GHSA-j4f2-536g-r55m

increase the default value of pingTimeout (f55a79a)

... (truncated)

Commits

24b847b chore(release): 6.2.1

425e833 fix: catch errors when destroying invalid upgrades (#658)

99adb00 chore(deps): bump xmlhttprequest-ssl and engine.io-client in /examples/latenc...

d196f6a chore(deps): bump minimatch from 3.0.4 to 3.1.2 (#660)

7c1270f chore(deps): bump nanoid from 3.1.25 to 3.3.1 (#659)

535a01d ci: add Node.js 18 in the test matrix

1b71a6f docs: remove "Vanilla JS" highlight from README (#656)

917d1d2 refactor: replace deprecated String.prototype.substr() (#646)

020801a chore: add changelog for version 3.6.0

ed1d6f9 test: make test script work on Windows (#643)

Additional commits viewable in compare view

Updates karma from 3.0.0 to 6.4.1

Release notes

Sourced from karma's releases.

v6.4.1

6.4.1 (2022-09-19)

Bug Fixes

pass integrity value (63d86be)

v6.4.0

6.4.0 (2022-06-14)

Features

support SRI verification of link tags (dc51a2e)

support SRI verification of script tags (6a54b1c)

v6.3.20

6.3.20 (2022-05-13)

Bug Fixes

prefer IPv4 addresses when resolving domains (e17698f), closes #3730

v6.3.19

6.3.19 (2022-04-19)

Bug Fixes

client: error out when opening a new tab fails (099b85e)

v6.3.18

6.3.18 (2022-04-13)

Bug Fixes

deps: upgrade socket.io to v4.4.1 (52a30bb)

v6.3.17

6.3.17 (2022-02-28)

Bug Fixes

deps: update colors to maintained version (#3763) (fca1884)

v6.3.16

... (truncated)

Changelog

Sourced from karma's changelog.

6.4.1 (2022-09-19)

Bug Fixes

pass integrity value (63d86be)

6.4.0 (2022-06-14)

Features

support SRI verification of link tags (dc51a2e)

support SRI verification of script tags (6a54b1c)

6.3.20 (2022-05-13)

Bug Fixes

prefer IPv4 addresses when resolving domains (e17698f), closes #3730

6.3.19 (2022-04-19)

Bug Fixes

client: error out when opening a new tab fails (099b85e)

6.3.18 (2022-04-13)

Bug Fixes

deps: upgrade socket.io to v4.4.1 (52a30bb)

6.3.17 (2022-02-28)

Bug Fixes

deps: update colors to maintained version (#3763) (fca1884)

6.3.16 (2022-02-10)

Bug Fixes

security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

... (truncated)

Commits

0013121 chore(release): 6.4.1 [skip ci]

63d86be fix: pass integrity value

84f7cc3 chore(release): 6.4.0 [skip ci]

f2d0663 docs: add integrity parameter

dc51a2e feat: support SRI verification of link tags

6a54b1c feat: support SRI verification of script tags

5e71cf5 chore(release): 6.3.20 [skip ci]

e17698f fix: prefer IPv4 addresses when resolving domains

60f4f79 build: add Node 16 and 18 to the CI matrix

6ff5aaf chore(release): 6.3.19 [skip ci]

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies
opened by dependabot[bot] 0

Bump loader-utils and @angular-devkit/build-angular

Bumps loader-utils to 3.2.1 and updates ancestor dependency @angular-devkit/build-angular. These dependencies need to be updated together.

Updates loader-utils from 1.2.3 to 3.2.1

Release notes

Sourced from loader-utils's releases.

v3.2.1

3.2.1 (2022-11-11)

Bug Fixes

ReDoS problem (#224) (d2d752d)

v3.2.0

3.2.0 (2021-11-11)

Features

hash uniformity for base digests (451858b)

v3.1.3

3.1.3 (2021-11-04)

Bug Fixes

crash with md4 hash (#198) (ef084d4)

v3.1.2

3.1.2 (2021-11-04)

Bug Fixes

bug with unicode characters (#196) (0426405)

v3.1.1

3.1.1 (2021-11-04)

Bug Fixes

base64 and unicode characters (02b1f3f)

v3.1.0

3.1.0 (2021-10-29)

Features

added md4 (wasm version) and md4-native (crypto module version) algorithms (cbf9d1d)

v3.0.0

3.0.0 (2021-10-20)

... (truncated)

Changelog

Sourced from loader-utils's changelog.

3.2.1 (2022-11-11)

Bug Fixes

ReDoS problem (#224) (d2d752d)

3.2.0 (2021-11-11)

Features

hash uniformity for base digests (451858b)

3.1.3 (2021-11-04)

Bug Fixes

crash with md4 hash (#198) (ef084d4)

3.1.2 (2021-11-04)

Bug Fixes

bug with unicode characters (#196) (0426405)

3.1.1 (2021-11-04)

Bug Fixes

base64 and unicode characters (02b1f3f)

3.1.0 (2021-10-29)

Features

added md4 (wasm version) and md4-native (crypto module version) algorithms (cbf9d1d)

3.0.0 (2021-10-20)

⚠ BREAKING CHANGES

minimum supported Node.js version is 12.13.0 (93a87ce)

use xxhash64 by default for [hash]/[contenthash] and getHashDigest API

[emoji] was removed without replacements, please use custom function if you need this

... (truncated)

Commits

a3fd3ca chore(release): 3.2.1
d2d752d fix: ReDoS problem (#224)
52cd134 chore(deps): bump minimist from 1.2.5 to 1.2.6 (#209)
9fe2381 chore: add .gitattributes for normalizing end of lines - fixes #203 (#204)
a282654 chore(release): 3.2.0
f2a524b chore(deps): update (#200)
451858b feat: hash uniformity for base digests
f7dbfe1 chore(release): 3.1.3
ef084d4 fix: crash with md4 hash (#198)
097f5c3 chore(release): 3.1.2
Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 0.800.0 to 15.0.0

Release notes

Sourced from @angular-devkit/build-angular's releases.

v15.0.0

15.0.0 (2022-11-16)

Breaking Changes

@angular/cli

The Angular CLI no longer supports 16.10.x, 16.11.x and 16.12.x. Current supported versions of Node.js are 14.20.x, 16.13.x and 18.10.x.

Node.js versions older than 14.20 are no longer supported.

The 'path' option in schematics schema no longer has a special meaning. Use 'workingDirectory' smart default provider should be used instead.

@schematics/angular

Removed unusedappDir option from Universal and App-Shell schematic. This option can safely be removed if present since it no longer has effect.

analyticsSharing option in the global angular configuration has been removed without replacement. This option was used to configure the Angular CLI to access to your own users' CLI usage data.

If this option is used, it can be removed using ng config --global cli.analyticsSharing undefined.

analytics APIs have been removed without replacement from @angular-devkit/core and @angular-devkit/architect.

@angular-devkit/build-angular
TypeScript versions older than 4.8.2 are no longer supported.

The server builder bundleDependencies option has been removed. This option was used pre Ivy. Currently, using this option is unlikely to produce working server bundles.

The externalDependencies option can be used instead to exclude specific node_module packages from the final bundle.
Deprecated support for tilde import has been removed. Please update the imports by removing the ~.

Before
@import "~font-awesome/scss/font-awesome";
After
@import "font-awesome/scss/font-awesome";
By default the CLI will use Sass modern API, While not recommended, users can still opt to use legacy API by setting NG_BUILD_LEGACY_SASS=1.
Internally the Angular CLI now always set the TypeScript target to ES2022 and useDefineForClassFields to false unless the target is set to ES2022 or later in the TypeScript configuration. To control ECMA version and features use the Browerslist configuration.

require.context are no longer parsed. Webpack specific features are not supported nor guaranteed to work in the future.

Producing ES5 output is no longer possible. This was needed for Internet Explorer which is no longer supported. All browsers that Angular supports work with ES2015+

server builder bundleDependencies option now only accept a boolean value.

Deprecated support for Stylus has been removed. The Stylus package has never reached a stable version and its usage in the Angular CLI is minimal. It's recommended to migrate to another CSS preprocessor that the Angular CLI supports.
@angular-devkit/core

Workspace projects with missing root is now an error.

@ngtools/webpack

TypeScript versions older than 4.8.2 are no longer supported.

@schematics/angular

Commit Description

add migration to remove require calls from karma builder main file

Added --project-root option to the library schematics

drop polyfills.ts file from new templates

enable error on unknown properties and elements in tests

Commit	Description
	add migration to remove require calls from karma builder main file
	Added --project-root option to the library schematics
	drop `polyfills.ts` file from new templates
	enable error on unknown properties and elements in tests

... (truncated)

Changelog

Sourced from @angular-devkit/build-angular's changelog.

15.0.0 (2022-11-16)

Breaking Changes

@angular/cli

The Angular CLI no longer supports 16.10.x, 16.11.x and 16.12.x. Current minimum versions of Node.js are 14.20.0, 16.13.0 and 18.10.0.

Node.js versions older than 14.20 are no longer supported.

The 'path' option in schematics schema no longer has a special meaning. Use 'workingDirectory' smart default provider should be used instead.

@schematics/angular

Removed unused appDir option from Universal and App-Shell schematic. This option can safely be removed if present since it no longer has effect.

analyticsSharing option in the global angular configuration has been removed without replacement. This option was used to configure the Angular CLI to access to your own users' CLI usage data.

If this option is used, it can be removed using ng config --global cli.analyticsSharing undefined.

analytics APIs have been removed without replacement from @angular-devkit/core and @angular-devkit/architect.

@angular-devkit/build-angular
TypeScript versions older than 4.8.2 are no longer supported.

The server builder bundleDependencies option has been removed. This option was used pre Ivy. Currently, using this option is unlikely to produce working server bundles.

The externalDependencies option can be used instead to exclude specific node_module packages from the final bundle.
Deprecated support for tilde import has been removed. Please update the imports by removing the ~.

Before
@import '~font-awesome/scss/font-awesome';
After
@import 'font-awesome/scss/font-awesome';
By default the CLI will use Sass modern API, While not recommended, users can still opt to use legacy API by setting NG_BUILD_LEGACY_SASS=1.
Internally the Angular CLI now always set the TypeScript target to ES2022 and useDefineForClassFields to false unless the target is set to ES2022 or later in the TypeScript configuration. To control ECMA version and features use the Browerslist configuration.

require.context are no longer parsed. Webpack specific features are not supported nor guaranteed to work in the future.

Producing ES5 output is no longer possible. This was needed for Internet Explorer which is no longer supported. All browsers that Angular supports work with ES2015+

server builder bundleDependencies option now only accept a boolean value.

... (truncated)

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @angular-devkit/build-angular since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language