chore(deps): update all non-major dependencies

[open-turo-bot]

This PR contains the following updates:

Package	Type	Update	Change
alessandrojcm/commitlint-pre-commit-hook	repository	minor	v9.11.0 -> v9.13.0
eslint (source)	devDependencies	minor	8.56.0 -> 8.57.0
node		patch	20.11.0 -> 20.11.1
rhysd/actionlint	repository	patch	v1.6.26 -> v1.6.27

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

---

Release Notes

alessandrojcm/commitlint-pre-commit-hook (alessandrojcm/commitlint-pre-commit-hook)

v9.13.0

Compare Source

Features

• bump the commitlint group with 2 updates (61f9e97)
• bump the commitlint group with 2 updates (28ca409)
• converted to ESM (a203e19)

v9.12.0

Compare Source

Features

• bump the commitlint group with 2 updates (cf4cb1e)
• bump the commitlint group with 2 updates (076334a)
• bump the commitlint group with 2 updates (0e51133)
• bump the commitlint group with 2 updates (7075f07)

eslint/eslint (eslint)

v8.57.0

Compare Source

Features

• 1120b9b feat: Add loadESLint() API method for v8 (#​18098) (Nicholas C. Zakas)
• dca7d0f feat: Enable eslint.config.mjs and eslint.config.cjs (#​18066) (Nitin Kumar)

Bug Fixes

• 2196d97 fix: handle absolute file paths in FlatRuleTester (#​18064) (Nitin Kumar)
• 69dd1d1 fix: Ensure config keys are printed for config errors (#​18067) (Nitin Kumar)
• 9852a31 fix: deep merge behavior in flat config (#​18065) (Nitin Kumar)
• 4c7e9b0 fix: allow circular references in config (#​18056) (Milos Djermanovic)

Documentation

• 84922d0 docs: Show prerelease version in dropdown (#​18139) (Nicholas C. Zakas)
• 5b8c363 docs: Switch to Ethical Ads (#​18117) (Milos Djermanovic)
• 77dbfd9 docs: show NEXT in version selectors (#​18052) (Milos Djermanovic)

Chores

• 1813aec chore: upgrade @​eslint/js@​8.57.0 (#​18143) (Milos Djermanovic)
• 5c356bb chore: package.json update for @​eslint/js release (Jenkins)
• f4a1fe2 test: add more tests for ignoring files and directories (#​18068) (Nitin Kumar)
• 42c0aef ci: Enable CI for v8.x branch (#​18047) (Milos Djermanovic)

nodejs/node (node)

v20.11.1: 2024-02-14, Version 20.11.1 'Iron' (LTS), @​RafaelGSS prepared by @​marco-ippolito

Compare Source

Notable changes

This is a security release.

Notable changes

• CVE-2024-21892 - Code injection and privilege escalation through Linux capabilities- (High)
• CVE-2024-22019 - http: Reading unprocessed HTTP request with unbounded chunk extension allows DoS attacks- (High)
• CVE-2024-21896 - Path traversal by monkey-patching Buffer internals- (High)
• CVE-2024-22017 - setuid() does not drop all privileges due to io_uring - (High)
• CVE-2023-46809 - Node.js is vulnerable to the Marvin Attack (timing variant of the Bleichenbacher attack against PKCS#1 v1.5 padding) - (Medium)
• CVE-2024-21891 - Multiple permission model bypasses due to improper path traversal sequence sanitization - (Medium)
• CVE-2024-21890 - Improper handling of wildcards in --allow-fs-read and --allow-fs-write (Medium)
• CVE-2024-22025 - Denial of Service by resource exhaustion in fetch() brotli decoding - (Medium)
• undici version 5.28.3
• libuv version 1.48.0
• OpenSSL version 3.0.13+quic1

Commits

• [7079c062bb] - crypto: disable PKCS#1 padding for privateDecrypt (Michael Dawson) nodejs-private/node-private#525
• [186a6e1ffb] - deps: fix GHSA-f74f-cvh7-c6q6/CVE-2024-24806 (Santiago Gimeno) #​51737
• [686da19abb] - deps: disable io_uring support in libuv by default (Tobias Nießen) nodejs-private/node-private#529
• [f7b44bfbce] - deps: update archs files for openssl-3.0.13+quic1 (Node.js GitHub Bot) #​51614
• [7a30fecea2] - deps: upgrade openssl sources to quictls/openssl-3.0.13+quic1 (Node.js GitHub Bot) #​51614
• [480fc169a8] - fs: protect against modified Buffer internals in possiblyTransformPath (Tobias Nießen) nodejs-private/node-private#497
• [77ac7c3153] - http: add maximum chunk extension size (Paolo Insogna) nodejs-private/node-private#519
• [ed7d149675] - lib: use cache fs internals against path traversal (RafaelGSS) nodejs-private/node-private#516
• [89bd5fc38f] - lib: update undici to v5.28.3 (Matteo Collina) nodejs-private/node-private#539
• [d01dd4291d] - permission: fix wildcard when children > 1 (Rafael Gonzaga) #​51209
• [40ff37dfcc] - src: fix HasOnly(capability) in node::credentials (Tobias Nießen) nodejs-private/node-private#505
• [3f6addd590] - src,deps: disable setuid() etc if io_uring enabled (Tobias Nießen) nodejs-private/node-private#529
• [d6da413aa4] - test,doc: clarify wildcard usage (RafaelGSS) nodejs-private/node-private#517
• [c213910aea] - zlib: pause stream if outgoing buffer is full (Matteo Collina) nodejs-private/node-private#541

rhysd/actionlint (rhysd/actionlint)

v1.6.27

Compare Source

• Add macOS 14 runner labels for Apple Silicon support. The following labels are added. (thanks @​harryzcy, #​392)
  • macos-14
  • macos-14-xlarge
  • macos-14-large
• Remove ubuntu-18.04 runner label from runners list since it is no longer supported. (#​363)
• Allow glob patterns in self-hosted-runner.labels configuration. For example, the following configuration defines any runner labels prefixed with private-linux-. (thanks @​kishaningithub, #​378)

  self-hosted-runner:
      labels:
        - private-linux-*

• Fix a race condition bug when -format option is used for linting multiple workflow files. Thanks @​ReinAchten-TomTom for your help on the investigation. (#​370)
• Fix a race condition due to conflicts between some goroutine which starts to run shellcheck process and other goroutine which starts to wait until all processes finish.
• The popular actions data set was updated to the latest and the following actions were newly added. (thanks @​jmarshall, #​380)
  • google-github-actions/auth
  • google-github-actions/get-secretmanager-secrets
  • google-github-actions/setup-gcloud
  • google-github-actions/upload-cloud-storage
  • pulumi/actions
  • pypa/gh-action-pypi-publish
• Add support for larger runner labels. The following labels are added. (thanks @​therealdwright, #​371)
  • windows-latest-8-cores
  • ubuntu-latest-4-cores
  • ubuntu-latest-8-cores
  • ubuntu-latest-16-cores
• The following WebHook types are supported for pull_request event.
  • enqueued
  • dequeued
  • milestoned
  • demilestoned
• Explain how to control shellckeck behavior in the shellcheck rule document. Use SHELLCHECK_OPTS environment variable to pass arguments to shellcheck. See the shellcheck's official document for more details.

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[github-actions]

Release notes preview

No new release will be created.

If you are expecting a release, you will need to either fix a bug or add a feature.
Chores, CI, docs, refactoring, style and other changes will not trigger a release.