chore(deps): Bump the npm_and_yarn group across 20 directories with 6 updates

[dependabot]

Bumps the npm_and_yarn group with 1 update in the / directory: micromatch.
Bumps the npm_and_yarn group with 2 updates in the /examples/blockly-angular directory: micromatch and @angular-devkit/build-angular.
Bumps the npm_and_yarn group with 2 updates in the /examples/blockly-react directory: micromatch and webpack.
Bumps the npm_and_yarn group with 2 updates in the /examples/blockly-rtc directory: micromatch and webpack.
Bumps the npm_and_yarn group with 1 update in the /examples/blockly-svelte directory: svelte.
Bumps the npm_and_yarn group with 3 updates in the /examples/custom-generator-codelab directory: micromatch, postcss and webpack.
Bumps the npm_and_yarn group with 3 updates in the /examples/custom-renderer-codelab directory: micromatch, postcss and webpack.
Bumps the npm_and_yarn group with 3 updates in the /examples/developer-tools directory: micromatch, postcss and webpack.
Bumps the npm_and_yarn group with 3 updates in the /examples/keyboard-navigation-codelab directory: micromatch, postcss and webpack.
Bumps the npm_and_yarn group with 4 updates in the /examples/sample-app directory: micromatch, postcss, webpack and webpack-dev-middleware.
Bumps the npm_and_yarn group with 4 updates in the /examples/sample-app-ts directory: micromatch, postcss, webpack and webpack-dev-middleware.
Bumps the npm_and_yarn group with 3 updates in the /plugins/block-test directory: micromatch, webpack and webpack-dev-middleware.
Bumps the npm_and_yarn group with 3 updates in the /plugins/dev-scripts directory: micromatch, webpack and webpack-dev-middleware.
Bumps the npm_and_yarn group with 1 update in the /plugins/eslint-config directory: micromatch.
Bumps the npm_and_yarn group with 3 updates in the /plugins/theme-dark directory: micromatch, webpack and webpack-dev-middleware.
Bumps the npm_and_yarn group with 3 updates in the /plugins/theme-deuteranopia directory: micromatch, webpack and webpack-dev-middleware.
Bumps the npm_and_yarn group with 2 updates in the /plugins/theme-hackermode directory: micromatch and webpack.
Bumps the npm_and_yarn group with 3 updates in the /plugins/theme-highcontrast directory: micromatch, webpack and webpack-dev-middleware.
Bumps the npm_and_yarn group with 3 updates in the /plugins/theme-modern directory: micromatch, webpack and webpack-dev-middleware.
Bumps the npm_and_yarn group with 3 updates in the /plugins/theme-tritanopia directory: micromatch, webpack and webpack-dev-middleware.

Updates micromatch from 4.0.4 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

• backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

• this is basically v4.0.5, with some README updates
• it is vulnerable to CVE-2024-4067
• Updated braces to v3.0.3 to avoid CVE-2024-4068
• does NOT break API compatibility

[4.0.6] - 2024-05-21

• Added hasBraces to check if a pattern contains braces.
• Fixes CVE-2024-4067
• BREAKS API COMPATIBILITY
• Should be labeled as a major release, but it's not.

[4.0.1 - 4.0.5]

[4.0.0] - 2019-03-20

Added

• Adds support for options.onMatch. See the readme for details
• Adds support for options.onIgnore. See the readme for details
• Adds support for options.onResult. See the readme for details

Breaking changes

• Require Node.js >= 8.6
• Removed support for passing an array of brace patterns to micromatch.braces().
• To strictly enforce closing brackets (for {, [, and (), you must now use strictBrackets=true instead of strictErrors.
• cache - caching and all related options and methods have been removed
• options.unixify was renamed to options.windows
• options.nodupes Was removed. Duplicates are always removed by default. You can override this with custom behavior by using the onMatch, onResult and onIgnore functions.
• options.snapdragon was removed, as snapdragon is no longer used.
• options.sourcemap was removed, as snapdragon is no longer used, which provided sourcemap support.

[3.0.0] - 2017-04-11

Complete overhaul, with 36,000+ new unit tests validated against actual output generated by Bash and minimatch. More specifically, 35,000+ of the tests:

• micromatch results are directly compared to bash results
• in rare cases, when micromatch and bash disagree, micromatch's results are compared to minimatch's results
• micromatch is much more accurate than minimatch, so there were cases where I had to make assumptions. I'll try to document these.

This refactor introduces a parser and compiler that are supersets of more granular parsers and compilers from other sub-modules. Each of these sub-modules has a singular responsibility and focuses on a certain type of matching that aligns with a specific part of the Bash "expansion" API.

These sub-modules work like plugins to seamlessly create the micromatch parser/compiler, so that strings are parsed in one pass, an AST is created, then a new string is generated by the compiler.

... (truncated)

Commits

• 8bd704e 4.0.8
• a0e6841 run verb to generate README documentation
• 4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
• 03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
• 814f5f7 lint
• 67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
• 113f2e3 fix: CVE numbers in CHANGELOG
• d9dbd9a feat: updated CHANGELOG
• 2ab1315 fix: use actions/setup-node@v4
• 1406ea3 feat: rework test to work on macos with node 10,12 and 14
• Additional commits viewable in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

• backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

• this is basically v4.0.5, with some README updates
• it is vulnerable to CVE-2024-4067
• Updated braces to v3.0.3 to avoid CVE-2024-4068
• does NOT break API compatibility

[4.0.6] - 2024-05-21

• Added hasBraces to check if a pattern contains braces.
• Fixes CVE-2024-4067
• BREAKS API COMPATIBILITY
• Should be labeled as a major release, but it's not.

[4.0.1 - 4.0.5]

[4.0.0] - 2019-03-20

Added

• Adds support for options.onMatch. See the readme for details
• Adds support for options.onIgnore. See the readme for details
• Adds support for options.onResult. See the readme for details

Breaking changes

• Require Node.js >= 8.6
• Removed support for passing an array of brace patterns to micromatch.braces().
• To strictly enforce closing brackets (for {, [, and (), you must now use strictBrackets=true instead of strictErrors.
• cache - caching and all related options and methods have been removed
• options.unixify was renamed to options.windows
• options.nodupes Was removed. Duplicates are always removed by default. You can override this with custom behavior by using the onMatch, onResult and onIgnore functions.
• options.snapdragon was removed, as snapdragon is no longer used.
• options.sourcemap was removed, as snapdragon is no longer used, which provided sourcemap support.

[3.0.0] - 2017-04-11

Complete overhaul, with 36,000+ new unit tests validated against actual output generated by Bash and minimatch. More specifically, 35,000+ of the tests:

• micromatch results are directly compared to bash results
• in rare cases, when micromatch and bash disagree, micromatch's results are compared to minimatch's results
• micromatch is much more accurate than minimatch, so there were cases where I had to make assumptions. I'll try to document these.

This refactor introduces a parser and compiler that are supersets of more granular parsers and compilers from other sub-modules. Each of these sub-modules has a singular responsibility and focuses on a certain type of matching that aligns with a specific part of the Bash "expansion" API.

These sub-modules work like plugins to seamlessly create the micromatch parser/compiler, so that strings are parsed in one pass, an AST is created, then a new string is generated by the compiler.

... (truncated)

Commits

• 8bd704e 4.0.8
• a0e6841 run verb to generate README documentation
• 4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
• 03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
• 814f5f7 lint
• 67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
• 113f2e3 fix: CVE numbers in CHANGELOG
• d9dbd9a feat: updated CHANGELOG
• 2ab1315 fix: use actions/setup-node@v4
• 1406ea3 feat: rework test to work on macos with node 10,12 and 14
• Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 15.2.4 to 19.1.4

Release notes

Sourced from @​angular-devkit/build-angular's releases.

v19.1.4

19.1.4 (2025-01-22)

@​angular-devkit/schematics

Commit	Description
	ensure collections can be resolved via test runner in pnpm workspaces

@​angular/build

Commit	Description
	correct path for /@ng/components on Windows
	include extracted routes in the manifest during prerendering
	only issue invalid i18n config error for duplicate subPaths with inlined locales
	replace deprecation of i18n.baseHref with a warning

@​angular/ssr

Commit	Description
	prevent route matcher error when SSR routing is not used
	properly manage catch-all routes with base href
	unblock route extraction with withEnabledBlockingInitialNavigation

v19.1.3

19.1.3 (2025-01-20)

@​angular/build

Commit	Description
	allow asset changes to reload page on incremental updates
	handle relative @ng/components
	perform full reload for templates with $localize usage

v19.1.2

19.1.2 (2025-01-17)

@​angular/build

Commit	Description
	perform incremental background file updates with component updates
	prevent full page reload on HMR updates with SSR enabled
	reset component updates on dev-server index request

v19.1.1

19.1.1 (2025-01-16)

@​angular/build

Commit	Description
	resolve HMR-prefixed files in SSR with Vite

v19.1.0

... (truncated)

Changelog

Sourced from @​angular-devkit/build-angular's changelog.

19.1.4 (2025-01-22)

@​angular-devkit/schematics

Commit	Type	Description
aa6f0d051	fix	ensure collections can be resolved via test runner in pnpm workspaces

@​angular/build

Commit	Type	Description
ff8192a35	fix	correct path for /@ng/components on Windows
14d2f7ca0	fix	include extracted routes in the manifest during prerendering
c87a38f5b	fix	only issue invalid i18n config error for duplicate subPaths with inlined locales
d50788cf9	fix	replace deprecation of i18n.baseHref with a warning

@​angular/ssr

Commit	Type	Description
bcc5fab75	fix	prevent route matcher error when SSR routing is not used
9bacf3981	fix	properly manage catch-all routes with base href
59c757781	fix	unblock route extraction with withEnabledBlockingInitialNavigation

19.1.3 (2025-01-20)

@​angular/build

Commit	Type	Description
7d8c34172	fix	allow asset changes to reload page on incremental updates
9fa29af37	fix	handle relative @ng/components
c4de34703	fix	perform full reload for templates with $localize usage

19.1.2 (2025-01-17)

@​angular/build

Commit	Type	Description
939d1612a	fix	perform incremental background file updates with component updates

... (truncated)

Commits

• ec8f589 release: cut the v19.1.4 release
• c5d9038 refactor(@​angular/ssr): update getPathSegments to use stripTrailingSlash ...
• 9bacf39 fix(@​angular/ssr): properly manage catch-all routes with base href
• 14d2f7c fix(@​angular/build): include extracted routes in the manifest during prerende...
• c87a38f fix(@​angular/build): only issue invalid i18n config error for duplicate `subP...
• bd2ab46 ci: replace platform linux with windows 11
• d50788c fix(@​angular/build): replace deprecation of i18n.baseHref with a warning
• 5165265 refactor: reduce dependencies on @angular-devkit/core
• bce32c1 test: update saucelabs browsers versions
• da08259 build: migrate @angular-devkit/build-webpack tests to rules_js
• Additional commits viewable in compare view

Updates postcss from 8.4.21 to 8.4.49

Release notes

Sourced from postcss's releases.

8.5.1

• Fixed backwards compatibility for complex cases (by @​romainmenke).

8.5 “Duke Alloces”

PostCSS 8.5 brought API to work better with non-CSS sources like HTML, Vue.js/Svelte sources or CSS-in-JS.

@​romainmenke during his work on Stylelint added Input#document in additional to Input#css.

root.source.input.document //=> "<p>Hello</p>
                           //    <style>
                           //    p {
                           //      color: green;
                           //    }
                           //    </style>"
root.source.input.css      //=> "p {
                           //      color: green;
                           //    }"

Thanks to Sponsors

This release was possible thanks to our community.

If your company wants to support the sustainability of front-end infrastructure or wants to give some love to PostCSS, you can join our supporters by:

• Tidelift with a Spotify-like subscription model supporting all projects from your lock file.
• Direct donations at GitHub Sponsors or Open Collective.

8.4.49

• Fixed custom syntax without source.offset (by @​romainmenke).

8.4.48

• Fixed position calculation in error/warnings methods (by @​romainmenke).

8.4.47

• Removed debug code.

8.4.46

• Fixed Cannot read properties of undefined (reading 'before').

8.4.45

• Removed unnecessary fix which could lead to infinite loop.

8.4.44

• Another way to fix markClean is not a function error.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.1

• Fixed backwards compatibility for complex cases (by @​romainmenke).

8.5 “Duke Alloces”

• Added Input#document for sources like CSS-in-JS or HTML (by @​romainmenke).

8.4.49

• Fixed custom syntax without source.offset (by @​romainmenke).

8.4.48

• Fixed position calculation in error/warnings methods (by @​romainmenke).

8.4.47

• Removed debug code.

8.4.46

• Fixed Cannot read properties of undefined (reading 'before').

8.4.45

• Removed unnecessary fix which could lead to infinite loop.

8.4.44

• Another way to fix markClean is not a function error.

8.4.43

• Fixed markClean is not a function error.

8.4.42

• Fixed CSS syntax error on long minified files (by @​varpstar).

Commits

• 7b02c75 Release 8.5.1 version
• 4c15339 Update dependencies
• 7efe91e Improve backwards compat for Input#document (#2000)
• 6873270 Release 8.5 version
• 4223bb9 Fix 80 columns limit
• 80e2401 Add Input#document (#1996)
• 6f86879 Update dependencies
• 85cbbec Fix pnpm version on CI
• 76caa57 Update dependencies
• 46ff246 Move to pnpm 10
• Additional commits viewable in compare view

Updates webpack from 5.76.1 to 5.97.1

Release notes

Sourced from webpack's releases.

v5.97.1

Bug Fixes

• Performance regression
• Sub define key should't be renamed when it's a defined variable

v5.97.0

Bug Fixes

• Don't crash with filesystem cache and unknown scheme
• Generate a valid code when output.iife is true and output.library.type is umd
• Fixed conflict variable name with concatenate modules and runtime code
• Merge duplicate chunks before
• Collisions in ESM library
• Use recursive search for versions of shared dependencies
• [WASM] Don't crash WebAssembly with Reference Types (sync and async)
• [WASM] Fixed wasm loading for sync and async webassembly
• [CSS] Don't add [uniqueName] to localIdentName when it is empty
• [CSS] Parsing strings on Windows
• [CSS] Fixed CSS local escaping

New Features

• Added support for injecting debug IDs
• Export the MergeDuplicateChunks plugin
• Added universal loading for JS chunks and JS worker chunks (only ES modules)
• [WASM] Added universal loading for WebAssembly chunks (only for async WebAssembly)
• [CSS] Allow initial CSS chunks to be placed anywhere - the output.cssHeadDataCompression option was deleted
• [CSS] Added universal loading for CSS chunks
• [CSS] Parse ICSS @value at-rules in CSS modules
• [CSS] Parse ICSS :import rules in CSS modules
• [CSS] Added the url and import options for CSS
• [CSS] Allow to import custom properties in CSS modules

Performance

• Faster Queue implementation, also fixed queue iterator state in dequeue method to ensure correct behavior after item removal

v5.96.1

Bug Fixes

• [Types] Add @types/eslint-scope to dependencieS
• [Types] Fixed regression in validate

v5.96.0

Bug Fixes

• Fixed Module Federation should track all referenced chunks
• Handle Data URI without base64 word
• HotUpdateChunk have correct runtime when modified with new runtime

... (truncated)

Commits

• 3612d36 chore(release): 5.97.1
• eb7ac6f fix: perf regression
• 554be24 fix: sub define key should't be renamed when it's a defined variable
• 5e0e780 refactor: issue #19030
• 58fb035 fix: sub define key should't be renamed when it's a defined variable
• af1fd12 perf: regression
• 34f19cb fix: package.json
• 0ec7f5d refactor: issue #19030
• 5e7b8a2 fix: package.json
• 644f1d1 refactor: no extra work for CSS unescaping
• Additional commits viewable in compare view

Updates webpack-dev-middleware from 5.3.4 to 7.4.2

Release notes

Sourced from webpack-dev-middleware's releases.

v7.4.2

7.4.2 (2024-08-21)

Bug Fixes

• no crash when headers are already sent (#1929) (c20f1d9)

v7.4.1

7.4.1 (2024-08-20)

Bug Fixes

• assetsInfo may be undefined (rspack) (#1927) (21f1797)

v7.4.0

7.4.0 (2024-08-15)

Features

• added the cacheImmutable option to cache immutable assets (assets with a hash in file name like image.e12ab567.jpg) (5ed629d)
• allow to configure the Cache-Control header (#1923) (f7529c3)

Bug Fixes

• support devServer: false (b443f4d)

Changelog

Sourced from webpack-dev-middleware's changelog.

7.4.2 (2024-08-21)

Bug Fixes

• no crash when headers are already sent (#1929) (c20f1d9)

7.4.1 (2024-08-20)

Bug Fixes

• assetsInfo may be undefined (rspack) (#1927) (21f1797)

7.4.0 (2024-08-15)

Features

• added the cacheImmutable option to cache immutable assets (assets with a hash in file name like image.e12ab567.jpg) (5ed629d)
• allow to configure the Cache-Control header (#1923) (f7529c3)

Bug Fixes

• support devServer: false (b443f4d)

Commits

• 5a916d8 chore(release): 7.4.2
• c20f1d9 fix: no crash when headers are already sent (#1929)
• 0f9a6c9 chore(deps-dev): bump the dependencies group with 4 updates (#1928)
• 99e9b77 chore(release): 7.4.1
• 8f9aa16 chore: ignore Rspack word
• 21f1797 fix: assetsInfo may be undefined (rspack) (#1927)
• 0034dd9 test: fix (#1926)
• 60a2bc4 chore(deps-dev): bump the dependencies group with 4 updates (#1925)
• 792ab65 chore(release): 7.4.0
• 5ed629d feat: added the cacheImmutable option to cache immutable assets (assets with ...
• Additional commits viewable in compare view

Updates micromatch from 4.0.5 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

• backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

• this is basically v4.0.5, with some README updates
• it is vulnerable to CVE-2024-4067
• Updated braces to v3.0.3 to avoid CVE-2024-4068
• does NOT break API compatibility

[4.0.6] - 2024-05-21

• Added hasBraces to check if a pattern contains braces.
• Fixes CVE-2024-4067
• BREAKS API COMPATIBILITY
• Should be labeled as a major release, but it's not.

[4.0.1 - 4.0.5]

[4.0.0] - 2019-03-20

Added

• Adds support for options.onMatch. See the readme for details
• Adds support for options.onIgnore. See the readme for details
• Adds support for options.onResult. See the readme for details

Breaking changes

• Require Node.js >= 8.6
• Removed support for passing an array of brace patterns to micromatch.braces().
• To strictly enforce closing brackets (for {, [, and (), you must now use strictBrackets=true instead of strictErrors.
• cache - caching and all related options and methods have been removed
• options.unixify was renamed to options.windows
• options.nodupes Was removed. Duplicates are always removed by default. You can override this with custom behavior by using the onMatch, onResult and onIgnore functions.
• options.snapdragon was removed, as snapdragon is no longer used.
• options.sourcemap was removed, as snapdragon is no longer used, which provided sourcemap support.

[3.0.0] - 2017-04-11

Complete overhaul, with 36,000+ new unit tests validated against actual output generated by Bash and minimatch. More specifically, 35,000+ of the tests:

• micromatch results are directly compared to bash results
• in rare cases, when micromatch and bash disagree, micromatch's results are compared to minimatch's results
• micromatch is much more accurate than minimatch, so there were cases where I had to make assumptions. I'll try to document these.

This refactor introduces a parser and compiler that are supersets of more granular parsers and compilers from other sub-modules. Each of these sub-modules has a singular responsibility and focuses on a certain type of matching that aligns with a specific part of the Bash "expansion" API.

These sub-modules work like plugins to seamlessly create the micromatch parser/compiler, so that strings are parsed in one pass, an AST is created, then a new string is generated by the compiler.

... (truncated)

Commits

• 8bd704e 4.0.8
• a0e6841 run verb to generate README documentation
• 4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
• 03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
• 814f5f7 lint
• 67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
• 113f2e3 fix: CVE numbers in CHANGELOG
• d9dbd9a feat: updated CHANGELOG
• 2ab1315 fix: use actions/setup-node@v4
• 1406ea3 feat: rework test to work on macos with node 10,12 and 14
• Additional commits viewable in compare view

Updates webpack from 5.93.0 to 5.97.1

Release notes

Sourced from webpack's releases.

v5.97.1

Bug Fixes

• Performance regression
• Sub define key should't be renamed when it's a defined variable

v5.97.0

Bug Fixes

• Don't crash with filesystem cache and unknown scheme
• Generate a valid code when output.iife is true and output.library.type is umd
• Fixed conflict variable name with concatenate modules and runtime code
• Merge duplicate chunks before
• Collisions in ESM library
• Use recursive search for versions of shared dependencies
• [WASM] Don't crash WebAssembly with Reference Types (sync and async)
• [WASM] Fixed wasm loading for sync and async webassembly
• [CSS] Don't add [uniqueName] to localIdentName when it is empty
• [CSS] Parsing strings on Windows
• [CSS] Fixed CSS local escaping

New Features

• Added support for injecting debug IDs
• Export the MergeDuplicateChunks plugin
• Added universal loading for JS chunks and JS worker chunks (only ES modules)
• [WASM] Added universal loading for WebAssembly chunks (only for async WebAssembly)
• [CSS] Allow initial CSS chunks to be placed anywhere - the output.cssHeadDataCompression option was deleted
• [CSS] Added universal loading for CSS chunks
• [CSS] Parse ICSS @value at-rules in CSS modules
• [CSS] Parse ICSS :import rules in CSS modules
• [CSS] Added the url and import options for CSS
• [CSS] Allow to import custom properties in CSS modules

Performance

• Faster Queue implementation, also fixed queue iterator state in dequeue method to ensure correct behavior after item removal

v5.96.1

Bug Fixes

• [Types] Add @types/eslint-scope to dependencieS
• [Types] Fixed regression in validate

v5.96.0

Bug Fixes

• Fixed Module Federation should track all referenced chunks
• Handle Data URI without base64 word
• HotUpdateChunk have correct runtime when modified with new runtime

... (truncated)

Commits

• 3612d36 chore(release): 5.97.1
• eb7ac6f fix: perf regression
• 554be24 fix: sub define key should't be renamed when it's a defined variable
• 5e0e780 refactor: issue #19030
• 58fb035 fix: sub define key should't be renamed when it's a defined variable
• af1fd12 perf: regression
• 34f19cb fix: package.json
• 0ec7f5d refactor: issue #19030
• 5e7b8a2 fix: package.json
• 644f1d1 refactor: no extra work for CSS unescaping
• Additional commits viewable in compare view

Updates micromatch from 4.0.7 to 4.0.8

Release notes

Sourced from micromatch's releases.

4.0.8

Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.

Changelog

Sourced from micromatch's changelog.

[4.0.8] - 2024-08-22

• backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch

[4.0.7] - 2024-05-22

• this is basically v4.0.5, with some README updates
• it is vulnerable to CVE-2024-4067
• Updated braces to v3.0.3 to avoid CVE-2024-4068
• does NOT break API compatibility

[4.0.6] - 2024-05-21

• Added hasBraces to check if a pattern contains braces.
• Fixes CVE-2024-4067
• BREAKS API COMPATIBILITY
• Should be labeled as a major release, but it's not.

[4.0.1 - 4.0.5]

[4.0.0] - 2019-03-20

Added

• Adds support for options.onMatch. See the readme for details
• Adds support for options.onIgnore. See the readme for details
• Adds support for options.onResult. See the readme for details

Breaking changes

• Require Node.js >= 8.6
• Removed support for passing an array of brace patterns to micromatch.braces().
• To strictly enforce closing brackets (for {, [, and (), you must now use strictBrackets=true instead of strictErrors.
• cache - caching and all related options and methods have been removed
• options.unixify was renamed to options.windows
• options.nodupes Was removed. Duplicates are always removed by default. You can override this with custom behavior by using the onMatch, onResult and onIgnore functions.
• options.snapdragon was removed, as snapdragon is no longer used.
• options.sourcemap was removed, as snapdragon is no longer used, which provided sourcemap support.

[3.0.0] - 2017-04-11

Complete overhaul, with 36,000+ new unit tests validated against actual output generated by Bash and minimatch. More specifically, 35,000+ of the tests:

• micromatch results are directly compared to bash results
• in rare cases, when micromatch and bash disagree, micromatch's results are compared to minimatch's results
• micromatch is much more accurate than minimatch, so there were cases where I had to make assumptions. I'll try to document these.

This refactor introduces a parser and compiler that are supersets of more granular parsers and compilers from other sub-modules. Each of these sub-modules has a singular responsibility and focuses on a certain type of matching that aligns with a specific part of the Bash "expansion" API.

These sub-modules work like plugins to seamlessly create the micromatch parser/compiler, so that strings are parsed in one pass, an AST is created, then a new string is generated by the compiler.

... (truncated)

Commits

• 8bd704e 4.0.8
• a0e6841 run verb to generate README documentation
• 4ec2884 Merge branch 'v4' into hauserkristof-feature/v4.0.8
• 03aa805 Merge pull request #266 from hauserkristof/feature/v4.0.8
• 814f5f7 lint
• 67fcce6 fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5
• 113f2e3 fix: CVE numbers in CHANGELOG
• d9dbd9a feat: updated CHANGELOG
• 2ab1315 fix: use actions/setup-node@v4
• 1406ea3 feat: rework test to work on macos with node 10,12 and 14
• Additional commits viewable in compare view

Updates webpack from 5.93.0 to 5.97.1

Release notes

Sourced from webpack's releases.

v5.97.1

Bug Fixes

• Performance regression
• Sub define key should't be renamed when it's a defined variable

v5.97.0

Bug Fixes

• Don't crash with filesystem cache and unknown scheme
• Generate a valid code when output.iife is true and output.library.type is umd
• Fixed conflict variable name with concatenate modules and runtime code
• Merge duplicate chunks before
• Collisions in ESM library
• Use recursive search for versions of shared dependencies
• [WASM] Don't crash WebAssembly with Reference Types (sync and async)
• [WASM] Fixed wasm loading for sync and async webassembly
• [CSS] Don't add [uniqueName] to localIdentName when it is empty
• [CSS] Parsing strings on Windows
• [CSS] Fixed CSS local escaping

New Features

• Added support for injecting debug IDs
• Export the MergeDuplicateChunks plugin
• Added universal loading for JS chunks and JS worker chunks (only ES modules)
• [WASM] Added universal loading for WebAssembly chunks (only for async WebAssembly)
• [CSS] Allow initial CSS chunks to be placed anywhere - the output.cssHeadDataCompression option was deleted
• [CSS] Added universal loading for CSS chunks
• [CSS] Parse ICSS @value at-rules in CSS modules
• [CSS] Parse ICSS :import rules in CSS modules
• [CSS] Added the url and import options for CSS
• [CSS] Allow to import custom properties in CSS modules

Performance

• Faster Queue implementation, also fixed queue iterator state in dequeue method to ensure correct behavior after item removal

v5.96.1

Bug Fixes

• [Types] Add @types/eslint-scope to dependencieS
• [Types] Fixed regression in validate

v5.96.0

Bug Fixes

• Fixed Module Federation should track all referenced chunks
• Handle Data URI without base64 word
• HotUpdateChunk have correct runtime when modified with new runtime

... (truncated)

Commits

• 3612d36 chore(release): 5.97.1
• eb7ac6f fix: perf regression
• 554be24 fix: sub define key should't be renamed when it's a defined variable
• 5e0e780 refactor: issue #19030
• 58fb035 fix: sub define key should't be renamed when it's a defined variable
• af1fd12 perf:...

  Description has been truncated