🚨 [security] [backend] Update nodemon 2.0.13 → 3.1.7 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ nodemon (2.0.13 → 3.1.7) · Repo

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ anymatch (indirect, 3.1.2 → 3.1.3) · Repo

Release Notes

3.1.3

Fixes:

• Keep trailing slash on paths
• Add TypeScript overload for test string being null

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 5 commits:

• 3.1.3
• Merge pull request #50 from micromatch/phated/keep-trailing-sep
• fix: Keep trailing slash on paths
• Merge pull request #42 from Alucelx/master
• add a override of teststring is null

↗️ binary-extensions (indirect, 2.2.0 → 2.3.0) · Repo

Release Notes

2.3.0

• Add afdesign, afphoto, and afpub (#30) 11b0135

v2.2.0...v2.3.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 3 commits:

• 2.3.0
• Meta tweaks
• Add `afdesign`, `afphoto`, and `afpub` (#30)

↗️ braces (indirect, 3.0.2 → 3.0.3) · Repo · Changelog

Security Advisories 🚨

🚨 Uncontrolled resource consumption in braces

The NPM package braces fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Commits

See the full diff on Github. The new version differs by 12 commits:

• 3.0.3
• update eslint. lint, fix unit tests.
• Snyk js braces 6838727 (#40)
• fix tests, skip 1 test in test/braces.expand
• readme bump
• Merge pull request #37 from coderaiser/fix/vulnerability
• feature: braces: add maxSymbols (https://github.com/micromatch/braces/issues/36#issuecomment-2110820796)
• fix: vulnerability (https://security.snyk.io/vuln/SNYK-JS-BRACES-6838727)
• remove funding file
• update keepEscaping doc (#27)
• Failing test cases for issue \#29 (#30)
• Create FUNDING.yml

↗️ chokidar (indirect, 3.5.2 → 3.6.0) · Repo · Changelog

Release Notes

3.6.0

What's Changed

• fix readyCount logic by @JLHwung in #1288
• handle MustScanSubDirs by @MarcCelani-at in #1197
• update fs.FSWatcher types to satisfy nodejs versions >= 16; fixes #1299 by @ben-polinsky in #1300

New Contributors

• @Mutahhar made their first contribution in #1226
• @zqianem made their first contribution in #1242
• @JLHwung made their first contribution in #1288
• @MarcCelani-at made their first contribution in #1197
• @ben-polinsky made their first contribution in #1300

Full Changelog: 3.5.3...3.6.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 38 commits:

• Release 3.6.0.
• Add github ci autopublish
• Merge pull request #1300 from ben-polinsky/fix-fswatcher-types-1299
• fix formatting
• update fs.FSWatcher types to satisfy node versions >= 16; fixes #1299
• Merge pull request #1197 from MarcCelani-at/handleMustScanSubDirs
• Merge pull request #1288 from JLHwung/fix-ready-count
• ready call # is unfortunately platform specific
• fix readyCount logic
• Adjust funding field in pkg
• Enable GitHub Sponsors
• Merge pull request #1242 from zqianem/fix/tests
• Fix test case using unsupported option for Node 8
• Fix `close` tests
• Merge pull request #1226 from Mutahhar/patch-1
• Update README.md
• Merge pull request #1198 from XhmikosR/rm-unused-deps
• Merge pull request #1199 from XhmikosR/patch-1
• Update CI config
• Remove unused devDependencies
• move to constants
• handle MustScanSubDirs
• Release 3.5.3.
• Funding.
• Merge pull request #1159 from alan-agius4/patch-1
• style: delete yarn.lock
• Merge pull request #1158 from alan-agius4/test-async
• Merge pull request #1157 from alan-agius4/fix-chain-return
• ci: add `dtslint` in the lint workflow
• style: fix dts lint issue
• build: add missing `typescript`
• test: update `close` method test
• fix: improve `add` and `unwatch` TypeScript definitions
• Merge pull request #1010 from nicks/nicks/symlink
• Merge pull request #1142 from mcecode/update-chokidar-cli-link
• Update chokidar-cli link in README.md
• Merge pull request #1140 from iheyunfei/types/0816
• types: use correct type def for ignored option

↗️ fill-range (indirect, 7.0.1 → 7.1.1) · Repo

Commits

See the full diff on Github. The new version differs by 7 commits:

• 7.1.1
• ensure that maxLen is passed down, to handle zero-padding
• update eslint. lint.
• Delete FUNDING.yml
• Create FUNDING.yml
• 7.0.1
• fix regressions

↗️ fsevents (indirect, 2.3.2 → 2.3.3) · Repo

Release Notes

2.3.3

Released to npm as v2.3.3

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

• Release v2.3.3
• Update nodejs.yml (#392)
• readme
• Merge pull request #384 from aleksanb/subdirs
• Handle MustScanSubDirs for large projects
• Update README.md (#371)
• Update README.md (#364)

↗️ is-glob (indirect, 4.0.2 → 4.0.3) · Repo

Commits

See the full diff on Github. The new version differs by 3 commits:

• 4.0.3
• fix: Improve performance (#15)
• chore(ci): Switch to GitHub Actions for CI (#16)

↗️ minimatch (indirect, 3.0.4 → 3.1.2) · Repo · Changelog

Security Advisories 🚨

🚨 minimatch ReDoS vulnerability

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Commits

See the full diff on Github. The new version differs by 17 commits:

• 3.1.2
• fix: trim pattern
• 3.1.1
• fix: treat nocase:true as always having magic
• 3.1.0
• Add 'allowWindowsEscape' option
• add publishConfig for v3 publishes
• 3.0.6
• [fix] revert all breaking syntax changes
• document, expose, and test 'partial:true' option
• ci: tests and makework
• full test coverage, adding tests, deleting dead code
• Credit @yetingli for the regexp improvement
• 3.0.5
• Improve redos protection, add many tests
• Use master branch for travis badge
• update travis

↗️ picomatch (indirect, 2.3.0 → 2.3.1) · Repo · Changelog

Release Notes

2.3.1

Fixed

• Fixes bug when a pattern containing an expression after the closing parenthesis (/!(*.d).{ts,tsx}) was incorrectly converted to regexp (9f241ef).

Changed

• Some documentation improvements (f81d236, 421e0e7).

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 13 commits:

• 2.3.1
• Merge pull request #102 from micromatch/ISSUE-93_incorrect_extglob_expanding
• fix: support stars in negation extglobs with expression after closing parenthesis
• Merge pull request #85 from XhmikosR/codeql
• Merge pull request #91 from XhmikosR/patch-1
• Merge pull request #94 from peterblazejewicz/patch-1
• Merge pull request #98 from mojavelinux/document-automatic-lookbehind-detection
• document that lookbehind detection is automatic
• delete funding.yml
• Update README.md
• Create FUNDING.yml
• Fix .eslintrc.json
• Add CodeQL Action

↗️ semver (indirect, 5.7.1 → 7.6.3) · Repo · Changelog

Security Advisories 🚨

🚨 semver vulnerable to Regular Expression Denial of Service

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

🚨 semver vulnerable to Regular Expression Denial of Service

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

🚨 semver vulnerable to Regular Expression Denial of Service

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ touch (indirect, 3.1.0 → 3.1.1) · Repo

Commits

See the full diff on Github. The new version differs by 3 commits:

• 3.1.1
• properly support sub-second stat times
• remove nopt dep

↗️ undefsafe (indirect, 2.0.3 → 2.0.5) · Repo

Commits

See the full diff on Github. The new version differs by 2 commits:

• chore: adding semver release
• fix: remove debug and add tests

🆕 simple-update-notifier (added, 2.0.0)

🗑️ @​sindresorhus/is (removed)

🗑️ @​szmarczak/http-timer (removed)

🗑️ abbrev (removed)

🗑️ ansi-align (removed)

🗑️ ansi-regex (removed)

🗑️ ansi-styles (removed)

🗑️ boxen (removed)

🗑️ cacheable-request (removed)

🗑️ camelcase (removed)

🗑️ chalk (removed)

🗑️ ci-info (removed)

🗑️ cli-boxes (removed)

🗑️ clone-response (removed)

🗑️ color-convert (removed)

🗑️ color-name (removed)

🗑️ configstore (removed)

🗑️ crypto-random-string (removed)

🗑️ decompress-response (removed)

🗑️ deep-extend (removed)

🗑️ defer-to-connect (removed)

🗑️ dot-prop (removed)

🗑️ duplexer3 (removed)

🗑️ emoji-regex (removed)

🗑️ end-of-stream (removed)

🗑️ escape-goat (removed)

🗑️ get-stream (removed)

🗑️ global-dirs (removed)

🗑️ got (removed)

🗑️ graceful-fs (removed)

🗑️ has-yarn (removed)

🗑️ http-cache-semantics (removed)

🗑️ import-lazy (removed)

🗑️ imurmurhash (removed)

🗑️ ini (removed)

🗑️ is-ci (removed)

🗑️ is-fullwidth-code-point (removed)

🗑️ is-installed-globally (removed)

🗑️ is-npm (removed)

🗑️ is-obj (removed)

🗑️ is-path-inside (removed)

🗑️ is-typedarray (removed)

🗑️ is-yarn-global (removed)

🗑️ json-buffer (removed)

🗑️ keyv (removed)

🗑️ latest-version (removed)

🗑️ lowercase-keys (removed)

🗑️ lru-cache (removed)

🗑️ make-dir (removed)

🗑️ mimic-response (removed)

🗑️ nopt (removed)

🗑️ normalize-url (removed)

🗑️ once (removed)

🗑️ p-cancelable (removed)

🗑️ package-json (removed)

🗑️ prepend-http (removed)

🗑️ pump (removed)

🗑️ pupa (removed)

🗑️ rc (removed)

🗑️ registry-auth-token (removed)

🗑️ registry-url (removed)

🗑️ responselike (removed)

🗑️ semver-diff (removed)

🗑️ signal-exit (removed)

🗑️ string-width (removed)

🗑️ strip-ansi (removed)

🗑️ strip-json-comments (removed)

🗑️ to-readable-stream (removed)

🗑️ type-fest (removed)

🗑️ typedarray-to-buffer (removed)

🗑️ unique-string (removed)

🗑️ update-notifier (removed)

🗑️ url-parse-lax (removed)

🗑️ widest-line (removed)

🗑️ wrap-ansi (removed)

🗑️ wrappy (removed)

🗑️ write-file-atomic (removed)

🗑️ xdg-basedir (removed)

🗑️ yallist (removed)

---

👉 No CI detected

You don't seem to have any Continuous Integration service set up!

Without a service that will test the Depfu branches and pull requests, we can't inform you if incoming updates actually work with your app. We think that this degrades the service we're trying to provide down to a point where it is more or less meaningless.

This is fine if you just want to give Depfu a quick try. If you want to really let Depfu help you keep your app up-to-date, we recommend setting up a CI system:

* [Circle CI](https://circleci.com), [Semaphore ](https://semaphoreci.com) and [Github Actions](https://docs.github.com/actions) are all excellent options. * If you use something like Jenkins, make sure that you're using the Github integration correctly so that it reports status data back to Github. * If you have already set up a CI for this repository, you might need to check your configuration. Make sure it will run on all new branches. If you don’t want it to run on every branch, you can whitelist branches starting with `depfu/`.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)