🚨 [security] Update winston 3.2.1 → 3.14.2 (minor) #142

depfu · 2024-08-15T20:25:37Z

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ winston (3.2.1 → 3.14.2) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ color (indirect, 3.0.0 → 3.2.1) · Repo

Release Notes

3.2.1

Patch Release 3.2.1

Revert color-convert back down to <2 since v2 introduced ES6 syntax.

If you need color-convert@>=2 then you'll need to have ES6 support. It's 2021, embrace it. 🙂

3.2.0

Minor Release 3.2.0

NOTE: This is the final release of color that uses ES5 syntax. For those following along, 4.0.0 was just released that switches to ES6 (const/let) syntax, which will (at some point) be followed by another major release that further switches to ES Modules entirely. This will be a sweeping change across the color package suite (color, color-string, color-convert). Keep a look out if these issues have been bothering you.

Bumps color convert to latest (fixes some issues with HCG)

Bumps mocha to latest

3.1.3

Fixes fixed alpha precision when parsing RGBA hex strings in constructor (#174)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 22 commits:

↗️ color-string (indirect, 1.5.3 → 1.9.1) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDOS)

In the npm package color-string, there is a ReDos (Regular Expression Denial of Service) vulnerability regarding an exponential time complexity for
linearly increasing input lengths for hwb() color strings.

Strings reaching more than 5000 characters would see several
milliseconds of processing time; strings reaching more than
50,000 characters began seeing 1500ms (1.5s) of processing time.

The cause was due to a the regular expression that parses
hwb() strings - specifically, the hue value - where
the integer portion of the hue value used a 0-or-more quantifier
shortly thereafter followed by a 1-or-more quantifier.

This caused excessive backtracking and a cartesian scan,
resulting in exponential time complexity given a linear
increase in input length.

Release Notes

1.9.0

Minor Release 1.9.0

Add parsing of exponential alpha values for HWB and HSL (#66)

Thanks to @babycannotsay for their contribution!

1.8.2

Patch release 1.8.2

Fix incorrect handling of optional comma in rgb() regex (#65)

Thanks to @gerdasi and @mastertheblaster for reporting and confirming the bug!

1.8.1

Patch release 1.8.1

Fix rgb alpha percentage parsing from int to float (#61)

Thanks to @clytras for their contribution!

1.7.4

Patch Release 1.7.4

Fix bug in .to.hex() output if the inputs aren't rounded numbers (#25)

1.7.1

Patch release 1.7.1

Reduce acceptable characters in keyword matching regex (#42)

Thanks to @benmccann for their contributions!

1.7.0

Minor Release 1.7.0

Add support for space-separated RGB (#58)

Removed Travis CI in favor of Github Actions

Small repository cleanup.

Thanks to @JJC1138 and @clytras for their contributions!

1.6.0

Minor release 1.6.0

#55 - Add support for space-separated HSL

Thanks @htunnicliff for the contribution :)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ fecha (indirect, 2.3.3 → 4.2.3) · Repo · Changelog

Release Notes

4.2.3 (from changelog)

Fixed bug with UTC date on daylights savings time #94

4.2.1 (from changelog)

Fixed missing source map

Fixed security y18n

Does any of this look wrong? Please let us know.

↗️ logform (indirect, 2.1.2 → 2.6.1) · Repo · Changelog

Release Notes

2.6.1

Add example files to .npmignore 28d44b2

npm audit fix 36050a2

Bump @babel/cli from 7.23.0 to 7.23.4 (#294) 5711245

Bump eslint from 8.40.0 to 8.56.0 (#301) 7673838

Bump @babel/core from 7.23.2 to 7.23.7 (#302) 232736d

Bump @babel/preset-env from 7.23.2 to 7.23.7 (#303) 91fcc55

Bump triple-beam and @types/triple-beam (#285) 85b70ca

Bump actions/setup-node from 3 to 4 (#288) 1932b73

Adding mask formatting example (#287) ded082a

v2.6.0...v2.6.1

2.6.0

Add engines.node field to package.json, matching winston dc72f30

Bump @babel/preset-env from 7.20.2 to 7.23.2 (#282) 3fa46ff

Bump @babel/cli from 7.21.5 to 7.23.0 (#279) 5bbd37c

Bump @babel/core from 7.21.8 to 7.23.2 (#283) 7829c80

Bump rimraf from 3.0.2 to 5.0.5 (#276) 60f2a57

Bump @colors/colors from 1.5.0 to 1.6.0 (#278) 4122c75

Bump actions/checkout from 3 to 4 (#281) 696fca6

Update Node versions used in CI tests to match winston 2456702

Bump safe-stable-stringify from 2.4.2 to 2.4.3 (#260) e138505

Bump @babel/cli from 7.19.3 to 7.21.5 (#268) 2f6b096

Bump eslint from 8.33.0 to 8.40.0 (#270) 9f75e6c

Bump @babel/core from 7.20.12 to 7.21.8 (#271) ac5a90d

Update version number in bug report template 3e3a0b6

Add TS version to issue template a93698c

Note TS<4.4 incompatibility per #244 f79c612

v2.5.1...v2.6.0

2.5.1

2.5.1

2023/02/07

Bugfix

The triple-beam types package has been promoted to a full dependency, by first-time contributor @carboneater (Thanks!)
in #243 to fix #242.

2.5.0

2.5.0

2023/02/06

Improvements

All the improvements in this release are from first-time contributors - thanks for your contributions!

Feature - optionally include Error.cause property by @davidnbooth in #226

Add triple beam properties to types by @robinpokorny in #194

TransformableInfo should support symbols as keys by @dancrumb in #240

Dependency updates by @dependabot

Bump @babel/cli from 7.18.6 to 7.19.3 by @dependabot in #214

Bump @babel/core from 7.18.6 to 7.20.12 by @dependabot in #212
and #237

Bump @babel/preset-env from 7.18.6 to 7.20.2 by @dependabot in #217
and #225

Bump eslint from 8.19.0 to 8.33.0 by @dependabot in #215
and #241

Bump mocha from 10.0.0 to 10.2.0 by @dependabot in #218
and #232

Bump safe-stable-stringify from 2.3.1 to 2.4.2 by @dependabot in #206
and #235

2.4.2

2.4.2

Bugfixes

This patch-level release includes a fix for a crash on attempt to uncolorize Symbol.
Thanks to @Alexsey for that first contribution in #188.

Maintainability updates:

Line break styles were changed to be LF (instead of CRLF) more consistently so that linter warnings aren't drowned out by notes about that.

Dependency updates by @dependabot

@babel/cli from 7.17.10 to 7.18.6 in #187

@babel/core from 7.18.5 to 7.18.6 in #185

@babel/preset-env from 7.18.2 to 7.18.6 in #184

eslint from 8.18.0 to 8.19.0 in #186

2.4.1

What's Changed

Feature: Implement issue templates by @maverick1872 in #149

Change TransformableInfo message prop to any by @gregbair in #178

Dependabot bumps:

Bump actions/checkout from 2 to 3 by @dependabot in #157

Bump eslint from 8.9.0 to 8.10.0 by @dependabot in #154

Bump mocha from 9.2.0 to 9.2.1 by @dependabot in #152

Bump @babel/core from 7.17.2 to 7.17.5 by @dependabot in #151

Bump @babel/cli from 7.17.0 to 7.17.6 by @dependabot in #155

Bump actions/setup-node from 2 to 3 by @dependabot in #153

Bump @babel/core from 7.17.5 to 7.18.2 by @dependabot in #177

Bump fecha from 4.2.1 to 4.2.3 by @dependabot in #165

Bump eslint from 8.10.0 to 8.16.0 by @dependabot in #175

Bump mocha from 9.2.1 to 10.0.0 by @dependabot in #167

Bump @babel/preset-env from 7.16.11 to 7.18.2 by @dependabot in #176

Bump eslint from 8.16.0 to 8.18.0 by @dependabot in #182

Bump @babel/core from 7.18.2 to 7.18.5 by @dependabot in #181

Bump @babel/cli from 7.17.6 to 7.17.10 by @dependabot in #180

New Contributors

@maverick1872 made their first contribution in #149

@gregbair made their first contribution in #178

Full Changelog: v2.4.0...v2.4.1

2.4.0

Update .npmignore 6e412cd

Update changelog for 2.4.0 release 6e9ce5d

Make use of new safe-stable-stringify 2.x features (#134) e3a8000

In CliFormat use cli levels (not npm levels). (#135) 6c677ed

Update to @colors/colors (#144) 5ee5fec

Bump assume from 2.2.0 to 2.3.0 (#145) 9371de2

Bump @babel/cli from 7.15.7 to 7.17.0 (#146) 48eee25

Bump eslint from 8.8.0 to 8.9.0 (#148) 691182a

Bump mocha from 8.4.0 to 9.2.0 (#139) 048c9df

Bump safe-stable-stringify from 1.1.0 to 2.3.1 (#141) e0d2b5e

Bump @babel/preset-env from 7.10.3 to 7.16.11 (#140) 1bb6f34

Bump fecha from 4.2.0 to 4.2.1 (#137) 2377a51

Bump ms from 2.1.2 to 2.1.3 (#138) ff0d634

Update ESLint config (#142) 0ab2982

Replace Travis CI with GitHub Actions (#136) 7e5cffc

v2.3.2...v2.4.0

2.3.2

This update, which also used up version number 2.3.1, pinned the version of the colors dependency due to vandalism by a developer of that package, as noted here.

As discussed in the winston package, all users should update to this (or a later version, should one exist) ASAP.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ triple-beam (indirect, 1.3.0 → 1.4.1) · Repo · Changelog

Release Notes

1.4.1

Relax node engines requirement to geq 14.0.0 in package.json a537d09

v1.4.0...v1.4.1

1.4.0

update package.json a592fa3

update package.json e2bdb66

Merge branch 'master' of github.com:winstonjs/triple-beam d4f8655

update npmignore a608646

Bump assume from 2.0.1 to 2.3.0 (#8) c1ba5e3

rm ts test a39f448

Fix lint config 46f21e4

Update packages 5e66571

Bump y18n from 3.2.1 to 3.2.2 (#7) a2ef367

Add GitHub Actions CI 4e5b1c1

Bump minimist, mkdirp, mocha and nyc (#6) 2347047

Exclude unnecessary files from the npm package (#5) 3f9bc1c

1.3.0...v1.4.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ winston-transport (indirect, 4.3.0 → 4.7.1) · Repo · Changelog

Release Notes

4.7.1

update dependencies 5b4d9bf

Bump mocha from 10.2.0 to 10.4.0 (#218) 17feb48

Bump eslint from 8.56.0 to 8.57.0 (#213) 719a76b

Bump @types/node from 20.11.10 to 20.12.7 (#221) c30789a

v4.7.0...v4.7.1

4.7.0

Resolve circular dependency issues downstream in Winston (#207) 377285d

Bump actions/checkout from 3 to 4 (#182) 66e8fdb

Bump deep-equal from 2.2.2 to 2.2.3 (#190) 5a5a0ca

Bump rimraf from 3.0.2 to 5.0.5 (#181) 5c14025

Bump actions/setup-node from 3 to 4 (#185) 5cefa55

Bump eslint from 8.51.0 to 8.56.0 (#199) aee4f5f

Bump @types/node from 20.8.6 to 20.11.10 (#206) 0a134d3

Bump @babel/traverse from 7.10.3 to 7.23.2 (#180) 7bbaf43

v4.6.0...v4.7.0

4.6.0

Bump deep-equal from 2.0.5 to 2.2.2 (#178) a6d22ea

Update dependencies and increase minimum node engine to 12 b81a3dc

Update CI node versions to match winston 35d171a

Bump eslint from 8.25.0 to 8.35.0 (#176) 80ba040

Bump @types/node from 18.11.0 to 18.14.6 (#177) aefef19

Bump decode-uri-component from 0.2.0 to 0.2.2 (#159) 70e5b8b

Bump eslint from 8.16.0 to 8.25.0 (#148) 0e5e4c0

Bump mocha from 10.0.0 to 10.1.0 (#150) 760fe66

Bump @types/node from 17.0.36 to 18.11.0 (#151) 09f7424

Bump logform from 2.4.1 to 2.4.2 (#126) 29684d1

Bump logform from 2.4.0 to 2.4.1 (#122) 51baf61

Bump @types/node from 17.0.21 to 17.0.36 (#115) fdf7ccc

Bump eslint from 8.10.0 to 8.16.0 (#114) 193154a

Bump mocha from 9.2.1 to 10.0.0 (#109) 8de37e4

Bump minimist from 1.2.5 to 1.2.6 (#104) c4d1124

Bump actions/setup-node from 2 to 3 (#95) 8edbd94

Bump @types/node from 17.0.15 to 17.0.21 (#94) 9cbf51f

Bump eslint from 8.8.0 to 8.10.0 (#93) f240c35

Bump mocha from 9.2.0 to 9.2.1 (#91) 49e2c8c

Bump logform from 2.3.2 to 2.4.0 (#90) 8614b9f

Bump actions/checkout from 2 to 3 (#96) 98a481d

v4.5.0...v4.6.0

4.5.0

Update .npmignore 8cbcdf3

Merge branch 'master' of github.com:winstonjs/winston-transport 22b195e

Changelog for 4.5.0 b47cfcd

Memory leak fix: do not wait process.nextTick (#81) 6566518

Update linting dependencies (#87) 46e5822

Replace Travis CI with GitHub Actions (#82) 0b7ad4f

fix(logform): removed duplicate dependency (#67) ed56cf2

Relative ref to bin file not needed; npm looks there by default (#80) 35baf39

4.4.2...v4.5.0

4.4.1

Updates to dependencies and Typescript support for last feature release.

4.4.0

Prepare for v4.4.0: update changelog, update dependencies, update Travis Node version eabd2ac

Expose LegacyTransportStream on index (#42) 46db8f3

Add handleRejections option support (#41) c7ac369

4.3.0...v4.4.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 55 commits:

🆕 @colors/colors (added, 1.6.0)

🆕 @dabh/diagnostics (added, 2.0.3)

🆕 @types/triple-beam (added, 1.3.5)

🆕 fn.name (added, 1.1.0)

🆕 safe-stable-stringify (added, 2.4.3)

🗑️ colornames (removed)

🗑️ colors (removed)

🗑️ diagnostics (removed)

🗑️ env-variable (removed)

🗑️ fast-safe-stringify (removed)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@depfu rebase
Rebases against your default branch and redoes this update

@depfu recreate
Recreates this PR, overwriting any edits that you've made to it

@depfu merge
Merges this PR once your tests are passing and conflicts are resolved

@depfu cancel merge
Cancels automatic merging of this PR

@depfu close
Closes this PR and deletes the branch

@depfu reopen
Restores the branch and reopens this PR (if it's closed)

@depfu pause
Ignores all future updates for this dependency and closes this PR

@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR

@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

depfu · 2024-10-06T06:12:10Z

Closed in favor of #144.

depfu · 2024-10-06T06:12:11Z

Closed in favor of #144.

Update winston to version 3.14.2

2bc6a2e

depfu bot added the depfu label Aug 15, 2024

depfu bot mentioned this pull request Aug 15, 2024

🚨 [security] Update winston 3.2.1 → 3.14.1 (minor) #141

Closed

depfu bot closed this Oct 6, 2024

depfu bot deleted the depfu/update/npm/winston-3.14.2 branch October 6, 2024 06:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

🚨 [security] Update winston 3.2.1 → 3.14.2 (minor) #142

🚨 [security] Update winston 3.2.1 → 3.14.2 (minor) #142

Uh oh!

depfu bot commented Aug 15, 2024

Uh oh!

depfu bot commented Oct 6, 2024

Uh oh!

depfu bot commented Oct 6, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

🚨 [security] Update winston 3.2.1 → 3.14.2 (minor) #142

🚨 [security] Update winston 3.2.1 → 3.14.2 (minor) #142

Uh oh!

Conversation

depfu bot commented Aug 15, 2024

What changed?

✳️ winston (3.2.1 → 3.14.2) · Repo · Changelog

↗️ color (indirect, 3.0.0 → 3.2.1) · Repo

Patch Release 3.2.1

Minor Release 3.2.0

↗️ color-string (indirect, 1.5.3 → 1.9.1) · Repo · Changelog

Minor Release 1.9.0

Patch release 1.8.2

Patch release 1.8.1

Patch Release 1.7.4

Patch release 1.7.1

Minor Release 1.7.0

Minor release 1.6.0

↗️ fecha (indirect, 2.3.3 → 4.2.3) · Repo · Changelog

4.2.3 (from changelog)

4.2.1 (from changelog)

↗️ logform (indirect, 2.1.2 → 2.6.1) · Repo · Changelog

Bugfix

Improvements

Dependency updates by @dependabot

Bugfixes

Maintainability updates:

Dependency updates by @dependabot

What's Changed

Dependabot bumps:

New Contributors

↗️ triple-beam (indirect, 1.3.0 → 1.4.1) · Repo · Changelog

↗️ winston-transport (indirect, 4.3.0 → 4.7.1) · Repo · Changelog

🆕 @​colors/colors (added, 1.6.0)

🆕 @​dabh/diagnostics (added, 2.0.3)

🆕 @​types/triple-beam (added, 1.3.5)

🆕 fn.name (added, 1.1.0)

🆕 safe-stable-stringify (added, 2.4.3)

🗑️ colornames (removed)

🗑️ colors (removed)

🗑️ diagnostics (removed)

🗑️ env-variable (removed)

🗑️ fast-safe-stringify (removed)

Uh oh!

depfu bot commented Oct 6, 2024

Uh oh!

depfu bot commented Oct 6, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

🆕 @colors/colors (added, 1.6.0)

🆕 @dabh/diagnostics (added, 2.0.3)

🆕 @types/triple-beam (added, 1.3.5)