Deps: Bump the patch-updates group across 1 directory with 7 updates #4096

dependabot · 2024-07-10T13:41:17Z

Bumps the patch-updates group with 7 updates in the / directory:

Package	From	To
@reduxjs/toolkit	`2.2.5`	`2.2.6`
qs	`6.12.1`	`6.12.3`
@babel/cli	`7.24.6`	`7.24.7`
@testing-library/jest-dom	`6.4.5`	`6.4.6`
@vitejs/plugin-react	`4.3.0`	`4.3.1`
eslint-plugin-react	`7.34.2`	`7.34.3`
eslint-plugin-react-refresh	`0.4.7`	`0.4.8`

Updates @reduxjs/toolkit from 2.2.5 to 2.2.6

Release notes

Sourced from @reduxjs/toolkit's releases.

v2.2.6

This bugfix release:

Brings internal useIsomorphicLayoutEffect usage in line with React Redux in React Native environments

Exports FetchBaseQueryArgs type

Fixes an issue in recent createEntityAdapter sorting perf improvements that could (in specific cases) cause Immer to throw an error

What's Changed

Fix useIsomorphicLayoutEffect usage in React Native environments by @aryaemami59 in reduxjs/redux-toolkit#4436

Add export for FetchBaseQueryArgs by @WilsonCWong in reduxjs/redux-toolkit#4465

Fix Immer current usage when calling addManyMutably more than once by @JacobShafer in reduxjs/redux-toolkit#4420

Golf a few pieces of entity adapter code by @EskiMojo14 in reduxjs/redux-toolkit#4485

Full Changelog: reduxjs/redux-toolkit@v2.2.5...v2.2.6

Commits

a9362fb v2.2.6
20d5d2b Merge pull request #4485 from reduxjs/entity-golf
93b29e1 remove a couple more unnecessary assertions
d114f81 type getCurrent to remove Draft type
f0088d3 golf a few things
09c36a2 Merge pull request #4420 from JacobShafer/fix/4411_fix_sorted_ids
b1b845a remove unused imports
dc0cb57 Merge pull request #4475 from aryaemami59/fix-ci-tests
9371a4c Fix CI tests
07614dd Merge pull request #4468 from aryaemami59/bump-vitest
Additional commits viewable in compare view

Updates qs from 6.12.1 to 6.12.3

Changelog

Sourced from qs's changelog.

6.12.3

[Fix] parse: properly account for strictNullHandling when allowEmptyArrays

[meta] fix changelog indentation

6.12.2

[Fix] parse: parse encoded square brackets (#506)

[readme] add CII best practices badge

Commits

f90cc35 v6.12.3
1bf9f7a [Fix] parse: properly account for strictNullHandling when allowEmptyArrays
7ebf48b [meta] fix changelog indentation
d0dff11 v6.12.2
f0b8d03 [Dev Deps] update @ljharb/eslint-config, object-inspect, tape
81835ff [Fix]: parse: parse encoded square brackets
db47dcc [readme] add CII best practices badge
See full diff in compare view

Updates @babel/cli from 7.24.6 to 7.24.7

Release notes

Sourced from @babel/cli's releases.

v7.24.7 (2024-06-05)

🐛 Bug Fix

babel-node

#16554 Allow extra flags in babel-node (@nicolo-ribaudo)

babel-traverse

#16522 fix: incorrect constantViolations with destructuring (@liuxingbaoyu)

babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management

#16524 fix: Transform using in switch correctly (@liuxingbaoyu)

🏠 Internal

babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#16525 Delete unused array helpers (@blakewilson)

Committers: 7

Amjad Yahia Robeen Hassan (@amjed-98)

Babel Bot (@babel-bot)

Blake Wilson (@blakewilson)

Huáng Jùnliàng (@JLHwung)

Nicolò Ribaudo (@nicolo-ribaudo)

Sukka (@SukkaW)

@liuxingbaoyu

Changelog

Sourced from @babel/cli's changelog.

v7.24.7 (2024-06-05)

🐛 Bug Fix

babel-node

#16554 Allow extra flags in babel-node (@nicolo-ribaudo)

babel-traverse

#16522 fix: incorrect constantViolations with destructuring (@liuxingbaoyu)

babel-helper-transform-fixture-test-runner, babel-plugin-proposal-explicit-resource-management

#16524 fix: Transform using in switch correctly (@liuxingbaoyu)

🏠 Internal

babel-helpers, babel-runtime-corejs2, babel-runtime-corejs3, babel-runtime

#16525 Delete unused array helpers (@blakewilson)

Commits

bf1e9a3 v7.24.7
ec0c62a fix Babel 8 commander import (#16548)
7934963 Use type: module in all package.jsons (#16535)
a21475a [Babel 8] Bump commander to 12.1.0 (#16517)
See full diff in compare view

Updates @testing-library/jest-dom from 6.4.5 to 6.4.6

Release notes

Sourced from @testing-library/jest-dom's releases.

v6.4.6

6.4.6 (2024-06-10)

Bug Fixes

Support @starting-style (#602) (fd9ee68)

Commits

fd9ee68 fix: Support @starting-style (#602)
See full diff in compare view

Updates @vitejs/plugin-react from 4.3.0 to 4.3.1

Release notes

Sourced from @vitejs/plugin-react's releases.

v4.3.1

Fix support for React Compiler with React 18

The previous version made this assumption that the compiler was only usable with React 19, but it's possible to use it with React 18 and a custom runtimeModule: https://gist.github.com/poteto/37c076bf112a07ba39d0e5f0645fec43

When using a custom runtimeModule, the plugin will not try to pre-optimize react/compiler-runtime dependency.

Reminder: Vite expect code outside of node_modules to be ESM, so you will need to update the gist with import React from 'react'.

Changelog

Sourced from @vitejs/plugin-react's changelog.

4.3.1 (2024-06-10)

Fix support for React Compiler with React 18

The previous version made this assumption that the compiler was only usable with React 19, but it's possible to use it with React 18 and a custom runtimeModule: https://gist.github.com/poteto/37c076bf112a07ba39d0e5f0645fec43

When using a custom runtimeModule, the plugin will not try to pre-optimize react/compiler-runtime dependency.

Reminder: Vite expect code outside of node_modules to be ESM, so you will need to update the gist with import React from 'react'.

Commits

1609186 release: [email protected]
ea647d1 fix: handle using compiler with React 18 (#330)
See full diff in compare view

Updates eslint-plugin-react from 7.34.2 to 7.34.3

Release notes

Sourced from eslint-plugin-react's releases.

v7.34.3

Fixed

[prop-types]: null-check rootNode before calling getScope (#3762[] @crnhrv)

[boolean-prop-naming]: avoid a crash with a spread prop (#3733[] @ljharb)

[jsx-boolean-value]: assumeUndefinedIsFalse with never must not allow explicit true value (#3757[] @6uliver)

[no-object-type-as-default-prop]: enable rule for components with many parameters (#3768[] @JulienR1)

[jsx-key]: incorrect behavior for checkKeyMustBeforeSpread with map callbacks (#3769[] @akulsr0)

#1000: jsx-eslint/eslint-plugin-react#1000 #1002: jsx-eslint/eslint-plugin-react#1002 #1005: jsx-eslint/eslint-plugin-react#1005 #100: jsx-eslint/eslint-plugin-react#100 #1010: jsx-eslint/eslint-plugin-react#1010 #1013: jsx-eslint/eslint-plugin-react#1013 #1022: jsx-eslint/eslint-plugin-react#1022 #1029: jsx-eslint/eslint-plugin-react#1029 #102: jsx-eslint/eslint-plugin-react#102 #1034: jsx-eslint/eslint-plugin-react#1034 #1038: jsx-eslint/eslint-plugin-react#1038 #1041: jsx-eslint/eslint-plugin-react#1041 #1043: jsx-eslint/eslint-plugin-react#1043 #1046: jsx-eslint/eslint-plugin-react#1046 #1047: jsx-eslint/eslint-plugin-react#1047 #1050: jsx-eslint/eslint-plugin-react#1050 #1053: jsx-eslint/eslint-plugin-react#1053 #1057: jsx-eslint/eslint-plugin-react#1057 #105: jsx-eslint/eslint-plugin-react#105 #1061: jsx-eslint/eslint-plugin-react#1061 #1062: jsx-eslint/eslint-plugin-react#1062 #1070: jsx-eslint/eslint-plugin-react#1070 #1071: jsx-eslint/eslint-plugin-react#1071 #1073: jsx-eslint/eslint-plugin-react#1073 #1076: jsx-eslint/eslint-plugin-react#1076 #1079: jsx-eslint/eslint-plugin-react#1079 #1088: jsx-eslint/eslint-plugin-react#1088 #1098: jsx-eslint/eslint-plugin-react#1098 #1101: jsx-eslint/eslint-plugin-react#1101 #1103: jsx-eslint/eslint-plugin-react#1103 #110: jsx-eslint/eslint-plugin-react#110 #1116: jsx-eslint/eslint-plugin-react#1116 #1117: jsx-eslint/eslint-plugin-react#1117 #1119: jsx-eslint/eslint-plugin-react#1119 #1121: jsx-eslint/eslint-plugin-react#1121 #1122: jsx-eslint/eslint-plugin-react#1122 #1123: jsx-eslint/eslint-plugin-react#1123 #1130: jsx-eslint/eslint-plugin-react#1130 #1131: jsx-eslint/eslint-plugin-react#1131 #1132: jsx-eslint/eslint-plugin-react#1132 #1134: jsx-eslint/eslint-plugin-react#1134

... (truncated)

Changelog

Sourced from eslint-plugin-react's changelog.

7.34.3 - 2024.06.18

Fixed

[prop-types]: null-check rootNode before calling getScope (#3762[] @crnhrv)

[boolean-prop-naming]: avoid a crash with a spread prop (#3733[] @ljharb)

[jsx-boolean-value]: assumeUndefinedIsFalse with never must not allow explicit true value (#3757[] @6uliver)

[no-object-type-as-default-prop]: enable rule for components with many parameters (#3768[] @JulienR1)

[jsx-key]: incorrect behavior for checkKeyMustBeforeSpread with map callbacks (#3769[] @akulsr0)

#3769: jsx-eslint/eslint-plugin-react#3769 #3768: jsx-eslint/eslint-plugin-react#3768 #3762: jsx-eslint/eslint-plugin-react#3762 #3757: jsx-eslint/eslint-plugin-react#3757 #3733: jsx-eslint/eslint-plugin-react#3733

Commits

cef8123 Update CHANGELOG and bump version
eb56061 [Deps] update array.prototype.tosorted
7d16666 [Dev Deps] update @babel/core, @babel/eslint-parser, `@babel/plugin-synta...
6dc7803 [Fix] jsx-key: incorrect behavior for checkKeyMustBeforeSpread with map cal...
393bfa2 [Fix] no-object-type-as-default-prop: enable rule for components with many ...
a944aa5 [Fix] jsx-boolean-value: assumeUndefinedIsFalse with never must not all...
a79beb3 [Fix] boolean-prop-naming: avoid a crash with a spread prop
e27ef81 [Fix] prop-types: null-check rootNode before calling getScope
See full diff in compare view

Updates eslint-plugin-react-refresh from 0.4.7 to 0.4.8

Release notes

Sourced from eslint-plugin-react-refresh's releases.

v0.4.8

Support export const foo = -1 with allowConstantExport (fixes #43)

Changelog

Sourced from eslint-plugin-react-refresh's changelog.

0.4.8

Support export const foo = -1 with allowConstantExport (fixes #43)

Commits

a10b96b Support export const foo = -1 with allowConstantExport (fixes #43) [publish]
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the patch-updates group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@reduxjs/toolkit](https://github.com/reduxjs/redux-toolkit) | `2.2.5` | `2.2.6` | | [qs](https://github.com/ljharb/qs) | `6.12.1` | `6.12.3` | | [@babel/cli](https://github.com/babel/babel/tree/HEAD/packages/babel-cli) | `7.24.6` | `7.24.7` | | [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `6.4.5` | `6.4.6` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `4.3.0` | `4.3.1` | | [eslint-plugin-react](https://github.com/jsx-eslint/eslint-plugin-react) | `7.34.2` | `7.34.3` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.4.7` | `0.4.8` | Updates `@reduxjs/toolkit` from 2.2.5 to 2.2.6 - [Release notes](https://github.com/reduxjs/redux-toolkit/releases) - [Commits](reduxjs/redux-toolkit@v2.2.5...v2.2.6) Updates `qs` from 6.12.1 to 6.12.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.12.1...v6.12.3) Updates `@babel/cli` from 7.24.6 to 7.24.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.24.7/packages/babel-cli) Updates `@testing-library/jest-dom` from 6.4.5 to 6.4.6 - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](testing-library/jest-dom@v6.4.5...v6.4.6) Updates `@vitejs/plugin-react` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/v4.3.1/packages/plugin-react) Updates `eslint-plugin-react` from 7.34.2 to 7.34.3 - [Release notes](https://github.com/jsx-eslint/eslint-plugin-react/releases) - [Changelog](https://github.com/jsx-eslint/eslint-plugin-react/blob/master/CHANGELOG.md) - [Commits](jsx-eslint/eslint-plugin-react@v7.34.2...v7.34.3) Updates `eslint-plugin-react-refresh` from 0.4.7 to 0.4.8 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.4.7...v0.4.8) --- updated-dependencies: - dependency-name: "@reduxjs/toolkit" dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: qs dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@babel/cli" dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@testing-library/jest-dom" dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@vitejs/plugin-react" dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: eslint-plugin-react dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: eslint-plugin-react-refresh dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates ... Signed-off-by: dependabot[bot] <[email protected]>

github-actions · 2024-07-10T13:41:35Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA ea87411.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package

Version

Score

Details

npm/@reduxjs/toolkit

2.2.6

🟢 4.4

Details

Check	Score	Reason
Code-Review	🟢 7	Found 11/15 approved changesets -- score normalized to 7
Maintained	🟢 10	30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Packaging	🟢 10	packaging workflow detected
Vulnerabilities	⚠️ 0	82 existing vulnerabilities detected

npm/qs

6.12.3

🟢 6.8

Details

Check	Score	Reason
Maintained	🟢 10	11 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 1	Found 4/28 approved changesets -- score normalized to 1
License	🟢 10	license file detected
CII-Best-Practices	🟢 5	badge detected: Passing
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	⚠️ -1	no releases found
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Security-Policy	🟢 9	security policy file detected

npm/@reduxjs/toolkit

2.2.5

🟢 4.4

Details

Check	Score	Reason
Code-Review	🟢 7	Found 11/15 approved changesets -- score normalized to 7
Maintained	🟢 10	30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Packaging	🟢 10	packaging workflow detected
Vulnerabilities	⚠️ 0	82 existing vulnerabilities detected

npm/qs

6.12.1

🟢 6.8

Details

Check	Score	Reason
Maintained	🟢 10	11 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 1	Found 4/28 approved changesets -- score normalized to 1
License	🟢 10	license file detected
CII-Best-Practices	🟢 5	badge detected: Passing
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	⚠️ -1	no releases found
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Security-Policy	🟢 9	security policy file detected

npm/@reduxjs/toolkit

^2.2.6

🟢 4.4

Details

Check	Score	Reason
Code-Review	🟢 7	Found 11/15 approved changesets -- score normalized to 7
Maintained	🟢 10	30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Packaging	🟢 10	packaging workflow detected
Vulnerabilities	⚠️ 0	82 existing vulnerabilities detected

npm/qs

^6.12.3

🟢 6.8

Details

Check	Score	Reason
Maintained	🟢 10	11 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 1	Found 4/28 approved changesets -- score normalized to 1
License	🟢 10	license file detected
CII-Best-Practices	🟢 5	badge detected: Passing
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	⚠️ -1	no releases found
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Security-Policy	🟢 9	security policy file detected

npm/@reduxjs/toolkit

^2.2.5

🟢 4.4

Details

Check	Score	Reason
Code-Review	🟢 7	Found 11/15 approved changesets -- score normalized to 7
Maintained	🟢 10	30 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 9	binaries present in source code
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Packaging	🟢 10	packaging workflow detected
Vulnerabilities	⚠️ 0	82 existing vulnerabilities detected

npm/qs

^6.12.0

🟢 6.8

Details

Check	Score	Reason
Maintained	🟢 10	11 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
Code-Review	⚠️ 1	Found 4/28 approved changesets -- score normalized to 1
License	🟢 10	license file detected
CII-Best-Practices	🟢 5	badge detected: Passing
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	⚠️ -1	no releases found
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Security-Policy	🟢 9	security policy file detected

Scanned Manifest Files

package-lock.json

package.json

@babel/cli@^7.24.7
@reduxjs/toolkit@^2.2.6
@testing-library/jest-dom@^6.4.6
@vitejs/plugin-react@^4.3.1
eslint-plugin-react@^7.34.3
eslint-plugin-react-refresh@^0.4.8
qs@^6.12.3
@babel/cli@^7.24.6
@reduxjs/toolkit@^2.2.5
@testing-library/jest-dom@^6.4.5
@vitejs/plugin-react@^4.3.0
eslint-plugin-react@^7.34.2
eslint-plugin-react-refresh@^0.4.7
qs@^6.12.0

github-actions · 2024-07-10T13:42:09Z

Conventional Commits Report

Type	Number
Dependencies	1

🚀 Conventional commits found.

…efb499365

github-actions · 2024-07-11T11:01:20Z

🔍 Vulnerabilities of `harbor-os.greenbone.net/community/gsa:pr-4096`

📦 Image Reference harbor-os.greenbone.net/community/gsa:pr-4096

digest	`sha256:598d96b3a29e8c2377c29873b43e629aed40aa0ef83853ea4a6fc4e9c2e05353`
vulnerabilities
size	67 MB
packages	193

📦 Base Image greenbone/gsad:edge

digest	`sha256:a0dff85de0d07638b385f0f792ba6d6fbf13612c825a2f0f88ace4203ef1316e`
vulnerabilities

glibc 2.31-13+deb11u10 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u10?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=2.31-13+deb11u10`
Fixed version	Not Fixed
EPSS Score	`0.11%`
EPSS Percentile	`44th percentile`

Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

Affected range	`>=2.31-13+deb11u10`
Fixed version	Not Fixed
EPSS Score	`0.35%`
EPSS Percentile	`72nd percentile`

Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.

Affected range	`>=2.31-13+deb11u10`
Fixed version	Not Fixed
EPSS Score	`2.15%`
EPSS Percentile	`89th percentile`

Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

Affected range	`>=2.31-13+deb11u10`
Fixed version	Not Fixed
EPSS Score	`1.20%`
EPSS Percentile	`85th percentile`

Description

GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

Affected range	`>=2.31-13+deb11u10`
Fixed version	Not Fixed
EPSS Score	`0.41%`
EPSS Percentile	`74th percentile`

Description

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

Affected range	`>=2.31-13+deb11u10`
Fixed version	Not Fixed
EPSS Score	`0.63%`
EPSS Percentile	`79th percentile`

Description

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.

Affected range	`>=2.31-13+deb11u10`
Fixed version	Not Fixed
EPSS Score	`0.82%`
EPSS Percentile	`82nd percentile`

Description

The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

pcre3 2:8.39-13 (deb)

pkg:deb/debian/pcre3@2:8.39-13?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=2:8.39-13`
Fixed version	Not Fixed
EPSS Score	`1.03%`
EPSS Percentile	`84th percentile`

Description

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.

Affected range	`>=2:8.39-13`
Fixed version	Not Fixed
EPSS Score	`0.65%`
EPSS Percentile	`79th percentile`

Description

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.

Affected range	`>=2:8.39-13`
Fixed version	Not Fixed
EPSS Score	`0.65%`
EPSS Percentile	`79th percentile`

Description

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.

Affected range	`>=2:8.39-13`
Fixed version	Not Fixed
EPSS Score	`0.08%`
EPSS Percentile	`36th percentile`

Description

In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used

Affected range	`>=2:8.39-13`
Fixed version	Not Fixed
EPSS Score	`0.37%`
EPSS Percentile	`73rd percentile`

Description

In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

openldap 2.4.57+dfsg-3+deb11u1 (deb)

pkg:deb/debian/[email protected]%2Bdfsg-3%2Bdeb11u1?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=2.4.57+dfsg-3+deb11u1`
Fixed version	Not Fixed
EPSS Score	`0.16%`
EPSS Percentile	`54th percentile`

Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

Affected range	`>=2.4.57+dfsg-3+deb11u1`
Fixed version	Not Fixed
EPSS Score	`0.41%`
EPSS Percentile	`74th percentile`

Description

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

Affected range	`>=2.4.57+dfsg-3+deb11u1`
Fixed version	Not Fixed
EPSS Score	`0.04%`
EPSS Percentile	`10th percentile`

Description

slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.

Affected range	`>=2.4.57+dfsg-3+deb11u1`
Fixed version	Not Fixed
EPSS Score	`0.29%`
EPSS Percentile	`69th percentile`

Description

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

sqlite3 3.34.1-3 (deb)

pkg:deb/debian/[email protected]?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=3.34.1-3`
Fixed version	Not Fixed
EPSS Score	`0.25%`
EPSS Percentile	`66th percentile`

Description

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.

Affected range	`>=3.34.1-3`
Fixed version	Not Fixed
EPSS Score	`0.22%`
EPSS Percentile	`61st percentile`

Description

A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (made via editing the Database File), it is possible to query a record, and leak subsequent bytes of memory that extend beyond the record, which could let a malicious user obtain sensitive information. NOTE: The developer disputes this as a vulnerability stating that If you give SQLite a corrupted database file and submit a query against the database, it might read parts of the database that you did not intend or expect.

Affected range	`>=3.34.1-3`
Fixed version	Not Fixed
EPSS Score	`0.43%`
EPSS Percentile	`75th percentile`

Description

A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally allowed to execute commands). This report does NOT imply any problem in the SQLite library.

shadow 1:4.8.1-1 (deb)

pkg:deb/debian/shadow@1:4.8.1-1?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=1:4.8.1-1`
Fixed version	Not Fixed
EPSS Score	`0.04%`
EPSS Percentile	`5th percentile`

Description

shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).

Affected range	`>=1:4.8.1-1`
Fixed version	Not Fixed
EPSS Score	`0.05%`
EPSS Percentile	`18th percentile`

Description

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees

Affected range	`>=1:4.8.1-1`
Fixed version	Not Fixed
EPSS Score	`0.13%`
EPSS Percentile	`48th percentile`

Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

perl 5.32.1-4+deb11u3 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u3?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=5.32.1-4+deb11u3`
Fixed version	Not Fixed
EPSS Score	`0.29%`
EPSS Percentile	`69th percentile`

Description

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

Affected range	`>=5.32.1-4+deb11u3`
Fixed version	Not Fixed
EPSS Score	`0.24%`
EPSS Percentile	`65th percentile`

Description

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

krb5 1.18.3-6+deb11u4 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u4?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=1.18.3-6+deb11u4`
Fixed version	Not Fixed
EPSS Score	`0.10%`
EPSS Percentile	`41st percentile`

Description

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

Affected range	`<1.18.3-6+deb11u5`
Fixed version	`1.18.3-6+deb11u5`
EPSS Score	`0.04%`
EPSS Percentile	`9th percentile`

Description

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

Affected range	`<1.18.3-6+deb11u5`
Fixed version	`1.18.3-6+deb11u5`
EPSS Score	`0.04%`
EPSS Percentile	`9th percentile`

Description

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

hiredis 0.14.1-1 (deb)

pkg:deb/debian/[email protected]?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=0.14.1-1`
Fixed version	Not Fixed
EPSS Score	`3.45%`
EPSS Percentile	`92nd percentile`

Description

Hiredis is a minimalistic C client library for the Redis database. In affected versions Hiredis is vulnurable to integer overflow if provided maliciously crafted or corrupted RESP mult-bulk protocol data. When parsing multi-bulk (array-like) replies, hiredis fails to check if count * sizeof(redisReply*) can be represented in SIZE_MAX. If it can not, and the calloc() call doesn't itself make this check, it would result in a short allocation and subsequent buffer overflow. Users of hiredis who are unable to update may set the maxelements context option to a value small enough that no overflow is possible.

tar 1.34+dfsg-1+deb11u1 (deb)

pkg:deb/debian/[email protected]%2Bdfsg-1%2Bdeb11u1?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=1.34+dfsg-1+deb11u1`
Fixed version	Not Fixed
EPSS Score	`0.63%`
EPSS Percentile	`79th percentile`

Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

openssl 1.1.1w-0+deb11u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u1?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=1.1.1w-0+deb11u1`
Fixed version	Not Fixed
EPSS Score	`0.07%`
EPSS Percentile	`29th percentile`

Description

OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."

libgcrypt20 1.8.7-6 (deb)

pkg:deb/debian/[email protected]?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=1.8.7-6`
Fixed version	Not Fixed
EPSS Score	`0.19%`
EPSS Percentile	`57th percentile`

Description

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

libxml2 2.9.10+dfsg-6.7+deb11u4 (deb)

pkg:deb/debian/[email protected]%2Bdfsg-6.7%2Bdeb11u4?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=2.9.10+dfsg-6.7+deb11u4`
Fixed version	Not Fixed
EPSS Score	`0.04%`
EPSS Percentile	`11th percentile`

Description

An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c.

apt 2.2.4 (deb)

pkg:deb/debian/[email protected]?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=2.2.4`
Fixed version	Not Fixed
EPSS Score	`0.16%`
EPSS Percentile	`53rd percentile`

Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

gnupg2 2.2.27-2+deb11u2 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u2?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=2.2.27-2+deb11u2`
Fixed version	Not Fixed
EPSS Score	`0.05%`
EPSS Percentile	`17th percentile`

Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

gnutls28 3.7.1-5+deb11u5 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u5?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=3.7.1-5+deb11u5`
Fixed version	Not Fixed
EPSS Score	`0.85%`
EPSS Percentile	`82nd percentile`

Description

The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.

coreutils 8.32-4+b1 (deb)

pkg:deb/debian/[email protected]%2Bb1?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=8.32-4`
Fixed version	Not Fixed
EPSS Score	`0.04%`
EPSS Percentile	`5th percentile`

Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

pcre2 10.36-2+deb11u1 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u1?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=10.36-2+deb11u1`
Fixed version	Not Fixed
EPSS Score	`0.05%`
EPSS Percentile	`21st percentile`

Description

Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input.

util-linux 2.36.1-8+deb11u2 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u2?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=2.36.1-8+deb11u2`
Fixed version	Not Fixed
EPSS Score	`0.05%`
EPSS Percentile	`17th percentile`

Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

glib2.0 2.66.8-1+deb11u4 (deb)

pkg:deb/debian/[email protected]%2Bdeb11u4?os_distro=bullseye&os_name=debian&os_version=11

Affected range	`>=2.66.8-1+deb11u4`
Fixed version	Not Fixed
EPSS Score	`0.16%`
EPSS Percentile	`52nd percentile`

Description

GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application.

* Add: Add a react hook for storing instance variables An instance variable stores the value directly and doesn't cause re-renders if it is changed. Variables returned from this hooks are comparable to instance variables for class components. * Add a test for useInstanceVariable hook * CI: Allow the dependency review workflow to write a message to the PR The dependency review workflow is able to write a summary message to the PR if it is allowed to write to the workflow. * Add: Add a useShallowEqualSelector hook The useShallowEqualSelector hooks allows to avoid re-renders if an object is selected from the redux store but its value(s) didn't change. With the standard selector which uses `===` comparison even updating an object's value to the same value will cause a re-render (because a new state object is created). This pattern can be found at https://react-redux.js.org/api/hooks#recipe-useshallowequalselector * Add: Add a usePageFilter hook to get the applied filter of a page The new usePageFilter hook allows to get the current applied filter of a page from the redux store. * Allow to change, reset and remove a page filter Update the usePageFilter hook to add additional functions to change, reset and remove a page filter. * Use useShallowEqualSelector in usePageFilter The selectors where invented for usage with mapStateToProps therefore they return objects at the moment. To avoid unnecessary re-renders the returned objects need to be compared with shallow equal. * Add tests for usePageFilter hook * Refactor FilterProvider to use usePageFilter internally At the end FilterProvider should be replaced with usePageFilter completely. * Reorder variable and hook definitions Allow for better reading flow where variables and hooks are defined at the top. * Add: CVSS 4.0 Calculator (#4036) * Add: CVSS 4.0 Calculator * Add: test for CvssV4Point0Calculator * Apply: review comments * Add: German translations * Add: Add a usePreviousValue hook Add a new hooks that allows to get the previous value after the value is changed. For example this hook can be used to check whether a filter has changed. * Add: Eslint rules * fix header * fix header in jsx files * fix gpl 2 * ignore specific year in header * adjust rule for files * Add: Support CVSS 4.0 fields in CVEs. CVSS 4.0 metrics can now be displayed in CVE details. * Add more tests. * Capitalize first letter in metric values instead of all caps for translation and consistency with the calculator. * Add: Implement a useTiming hook The hook can be used to run a function after a specific amount of time for example for doing a reload of data. * Change: withIconSize HOC to hook (#4060) * Change: withIconSize HOC to hook * add tests * improve test coverage * remove snapshot test * Bump braces from 3.0.2 to 3.0.3 Bumps [braces](https://github.com/micromatch/braces) from 3.0.2 to 3.0.3. - [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md) - [Commits](micromatch/braces@3.0.2...3.0.3) --- updated-dependencies: - dependency-name: braces dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> * Add: Add a useReload hook to make the Reload component obsolete The new useReload hook is based in useTiming. It calls a timing function before every reload to calculate the timeout before the reload. This timing function gets a isVisible argument passed. Using the argument the timing function can decide to extend the timeout when the current browser window is not visible. * Add: Add a useFilterSortBy hook The hook determines the sort field and direction of a filter and allows to change both via a returned function. The hook can be used to implement the filter changes when clicking on the different header columns of a entities list. * Add: Add a usePagination hook The hook returns functions the update a filter for getting the next, previous, first and last page for a list of entities. * Add: Add a useSelection hook The useSelection hook implements the entity selection at a entities list table. It is possible to select/deselect specific entities from the list/table, to select all entities displayed at the page or all entities for the current filter (filter without rows value applied). * Add: eslint rule camelCase * create exeptions * Add: Add new hook to determine the loading interval for entities pages Add a useEntitiesReloadInterval hook to replace in conjunction with the useReload hook the Reload component. useEntitiesReloadInterval calculates the timeout for the next reload and useReload actually calls a function after this timeout to allow reloading data. * Add: Add a BulkTags component for handling tagging of entities The BulkTags component provides dialogs and functions for tagging several entities with an existing or new tag. * Fix: Don't pass gmp object to TagDialog onSave handle The gmp object is not part of saving a tag. Therefore it shouldn't be put into the state of the TagDialog and passed to the onSave handler. * Change: Allow to show errors in the TagsDialog Allow to show errors in the TagsDialog. This may be necessary for example if a new tag can't be created. * Add: Add a useDownload hook The useDownload hook in conjunction with the Download component should replace the withDownload HOC in future. * Add a simple test for useDownload hook Combine Download with useDownload in a simple test. * Bump ws from 8.16.0 to 8.17.1 Bumps [ws](https://github.com/websockets/ws) from 8.16.0 to 8.17.1. - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@8.16.0...8.17.1) --- updated-dependencies: - dependency-name: ws dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> * Add: Toggle to enable EPSS fields The EPSS fields for CVEs and VTs can now be toggled with an option in the config.js file. This is done because no EPSS feed is provided yet, so the new fields should only be enabled for testing. * Clean up EPSS on CVE and NVT pages A superfluous fragment has been removed and consts are used for the EPSS scores and percentiles in tables for better readability. * Remove .jsx suffix from useGmp and cvelink imports * Add enableEPSS to readme * Use camelCase for EPSS local variables * Change: Use `.js` as file suffix for hooks Hooks usually don't contain JSX and therefore should use `.js` for the file suffix. Currently this is mixed up between `.jsx` and `.js`. * Change: Extract ErrorMarker from useFormValidation hook module Hooks should not contain JSX code and should be plain JS only. Therefore extract the ErrorMarker component from the useFormValidation module and use `js` file suffix for the module. * Simplify ErrorMarker component Just support the actual prop in use (`isVisible`) and drop passing a child. * Change: Refactor PortLists page to a HOC less entities page Use the PortLists page as an example on howto refactor an entities page to use the new hooks instead of the withEntitiesContainer HOC. Despite having some more lines of code it should be easier to understand then before. * Add: EPSS scoring info to results Scan results now show EPSS scores, percentiles and CVEs of their VTs if the enableEPSS option is set to true. * Change: Move useCapabilities hook to hooks directory * Remove: Remove unused useUserIsLoggedIn hook * Change: Move useUserName hook to hooks directory * Change: Move useUserSessionTimeout hook to hooks directory * Change: Move useUserTimezone hook to hooks directory * Change: Move useLicense hook to hooks directory The license feature is unused and could possibly removed completely. But until now we should get a consistent directory layout. * Change: Move useGmp hook to hooks directory * fix: dates inconsistencies in new task wizard and schedules * Automatic release to 23.1.0 * Automatic adjustments after release [skip ci] * Update to version 23.1.1-dev1 * Fix: Allow applying report configs to delta reports. * Automatic release to 23.1.1 * Automatic adjustments after release [skip ci] * Update to version 23.1.2-dev1 * Change: Update node version for build in release-pontos * Automatic release to 23.1.1 * Automatic adjustments after release [skip ci] * Update to version 23.1.2-dev1 * Deps: Bump docker/build-push-action from 5 to 6 Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 5 to 6. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](docker/build-push-action@v5...v6) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * Add: Push workflow for greenbone registry #4075 * Remove debug statement * Update useGmp import in results table and row * Add: Available optional features in Capabilities The Capabilities object now has a featureEnabled method that checks if an optional feature is enabled according to the new GET_FEATURES GMP command. This will allow toggling/modifying UI elements for these features without a redundant setting in the GSA config. * Use camelCase for capabilities, update exceptions Attributes in Capabilities now use camelCase and exceptions for snake_case in the GMP responses have been added. * Add: conditional route component for feature flag * add test * Update ConditionalRoute.jsx * Deps: Bump @testing-library/react from 15.0.6 to 16.0.0 (#4091) Bumps [@testing-library/react](https://github.com/testing-library/react-testing-library) from 15.0.6 to 16.0.0. - [Release notes](https://github.com/testing-library/react-testing-library/releases) - [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md) - [Commits](testing-library/react-testing-library@v15.0.6...v16.0.0) --- updated-dependencies: - dependency-name: "@testing-library/react" dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: daniele-mng <[email protected]> * Deps: Bump uuid from 9.0.1 to 10.0.0 (#4086) Bumps [uuid](https://github.com/uuidjs/uuid) from 9.0.1 to 10.0.0. - [Changelog](https://github.com/uuidjs/uuid/blob/main/CHANGELOG.md) - [Commits](uuidjs/uuid@v9.0.1...v10.0.0) --- updated-dependencies: - dependency-name: uuid dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: daniele-mng <[email protected]> * Deps: Bump @sentry/react from 8.7.0 to 8.13.0 (#4089) Bumps [@sentry/react](https://github.com/getsentry/sentry-javascript) from 8.7.0 to 8.13.0. - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@8.7.0...8.13.0) --- updated-dependencies: - dependency-name: "@sentry/react" dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: daniele-mng <[email protected]> * Deps: Bump prettier from 3.2.5 to 3.3.2 (#4090) Bumps [prettier](https://github.com/prettier/prettier) from 3.2.5 to 3.3.2. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.2.5...3.3.2) --- updated-dependencies: - dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: daniele-mng <[email protected]> * Deps: Bump the patch-updates group across 1 directory with 7 updates (#4096) Bumps the patch-updates group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@reduxjs/toolkit](https://github.com/reduxjs/redux-toolkit) | `2.2.5` | `2.2.6` | | [qs](https://github.com/ljharb/qs) | `6.12.1` | `6.12.3` | | [@babel/cli](https://github.com/babel/babel/tree/HEAD/packages/babel-cli) | `7.24.6` | `7.24.7` | | [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `6.4.5` | `6.4.6` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `4.3.0` | `4.3.1` | | [eslint-plugin-react](https://github.com/jsx-eslint/eslint-plugin-react) | `7.34.2` | `7.34.3` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.4.7` | `0.4.8` | Updates `@reduxjs/toolkit` from 2.2.5 to 2.2.6 - [Release notes](https://github.com/reduxjs/redux-toolkit/releases) - [Commits](reduxjs/redux-toolkit@v2.2.5...v2.2.6) Updates `qs` from 6.12.1 to 6.12.3 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.12.1...v6.12.3) Updates `@babel/cli` from 7.24.6 to 7.24.7 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.24.7/packages/babel-cli) Updates `@testing-library/jest-dom` from 6.4.5 to 6.4.6 - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](testing-library/jest-dom@v6.4.5...v6.4.6) Updates `@vitejs/plugin-react` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/v4.3.1/packages/plugin-react) Updates `eslint-plugin-react` from 7.34.2 to 7.34.3 - [Release notes](https://github.com/jsx-eslint/eslint-plugin-react/releases) - [Changelog](https://github.com/jsx-eslint/eslint-plugin-react/blob/master/CHANGELOG.md) - [Commits](jsx-eslint/eslint-plugin-react@v7.34.2...v7.34.3) Updates `eslint-plugin-react-refresh` from 0.4.7 to 0.4.8 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.4.7...v0.4.8) --- updated-dependencies: - dependency-name: "@reduxjs/toolkit" dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: qs dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@babel/cli" dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@testing-library/jest-dom" dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@vitejs/plugin-react" dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: eslint-plugin-react dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: eslint-plugin-react-refresh dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: daniele-mng <[email protected]> * Deps: Bump vite from 5.2.12 to 5.3.3 (#4100) Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 5.2.12 to 5.3.3. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.3.3/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: daniele-mng <[email protected]> * Deps: Bump typescript from 5.4.5 to 5.5.3 (#4101) Bumps [typescript](https://github.com/Microsoft/TypeScript) from 5.4.5 to 5.5.3. - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Changelog](https://github.com/microsoft/TypeScript/blob/main/azure-pipelines.release.yml) - [Commits](microsoft/TypeScript@v5.4.5...v5.5.3) --- updated-dependencies: - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Deps: Bump @typescript-eslint/eslint-plugin from 7.12.0 to 7.16.0 (#4099) Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 7.12.0 to 7.16.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v7.16.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Deps: Bump @typescript-eslint/parser from 7.12.0 to 7.16.0 (#4097) Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 7.12.0 to 7.16.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v7.16.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Fix: bug loading status button in download report dialog * Fix: Make report configs optional in alerts and reports If the report configs are not available, the report export and alert dialogs will hide the report config fields. This will make the dialogs work as expected if the report config commands are disabled. * Use withCapabilities in alert method parts Instead of passing the capabilities as a prop, use withCapabilities in the dialog part components for the alert methods SCP, Send, SMB and Verinice. * Use useCapabilities hook in alert method parts Instead of using the withCapabilities HOC, the alert method parts now use the useCapabilities hook. * Automatic release to 23.2.0 * Automatic adjustments after release [skip ci] * Update to version 23.2.1-dev1 * Fix: Disable mangling in production build minify The production build now uses terser with the "mangle" option deactivated. This addresses a false positive Lintian warning from a mangled variable name. * Automatic release to 23.2.1 * Automatic adjustments after release [skip ci] * Update to version 23.2.2-dev1 * Bump fast-xml-parser from 4.3.6 to 4.4.1 Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 4.3.6 to 4.4.1. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v4.3.6...v4.4.1) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> * add: cvss 4 calculator missing de translation * Deps: Bump eslint-plugin-react from 7.34.3 to 7.35.0 (#4118) Bumps [eslint-plugin-react](https://github.com/jsx-eslint/eslint-plugin-react) from 7.34.3 to 7.35.0. - [Release notes](https://github.com/jsx-eslint/eslint-plugin-react/releases) - [Changelog](https://github.com/jsx-eslint/eslint-plugin-react/blob/master/CHANGELOG.md) - [Commits](jsx-eslint/eslint-plugin-react@v7.34.3...v7.35.0) --- updated-dependencies: - dependency-name: eslint-plugin-react dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Deps: Bump @typescript-eslint/parser from 7.16.0 to 7.18.0 (#4114) Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 7.16.0 to 7.18.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v7.18.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: daniele-mng <[email protected]> * Deps: Bump i18next from 23.11.5 to 23.12.2 (#4117) Bumps [i18next](https://github.com/i18next/i18next) from 23.11.5 to 23.12.2. - [Release notes](https://github.com/i18next/i18next/releases) - [Changelog](https://github.com/i18next/i18next/blob/master/CHANGELOG.md) - [Commits](i18next/i18next@v23.11.5...v23.12.2) --- updated-dependencies: - dependency-name: i18next dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Deps: Bump @typescript-eslint/eslint-plugin from 7.16.0 to 8.0.0 (#4113) * Deps: Bump @typescript-eslint/eslint-plugin from 7.16.0 to 8.0.0 Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 7.16.0 to 8.0.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.0.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * update ts eslint parser version --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: daniele-mng <[email protected]> * Deps: Bump @sentry/react from 8.13.0 to 8.22.0 (#4119) Bumps [@sentry/react](https://github.com/getsentry/sentry-javascript) from 8.13.0 to 8.22.0. - [Release notes](https://github.com/getsentry/sentry-javascript/releases) - [Changelog](https://github.com/getsentry/sentry-javascript/blob/develop/CHANGELOG.md) - [Commits](getsentry/sentry-javascript@8.13.0...8.22.0) --- updated-dependencies: - dependency-name: "@sentry/react" dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Deps: Bump the patch-updates group with 9 updates (#4112) Bumps the patch-updates group with 9 updates: | Package | From | To | | --- | --- | --- | | [@reduxjs/toolkit](https://github.com/reduxjs/redux-toolkit) | `2.2.6` | `2.2.7` | | [downshift](https://github.com/downshift-js/downshift) | `9.0.6` | `9.0.7` | | [styled-components](https://github.com/styled-components/styled-components) | `6.1.11` | `6.1.12` | | [@babel/cli](https://github.com/babel/babel/tree/HEAD/packages/babel-cli) | `7.24.7` | `7.24.8` | | [@testing-library/jest-dom](https://github.com/testing-library/jest-dom) | `6.4.6` | `6.4.8` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.4.8` | `0.4.9` | | [prettier](https://github.com/prettier/prettier) | `3.3.2` | `3.3.3` | | [typescript](https://github.com/Microsoft/TypeScript) | `5.5.3` | `5.5.4` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `5.3.3` | `5.3.5` | Updates `@reduxjs/toolkit` from 2.2.6 to 2.2.7 - [Release notes](https://github.com/reduxjs/redux-toolkit/releases) - [Commits](reduxjs/redux-toolkit@v2.2.6...v2.2.7) Updates `downshift` from 9.0.6 to 9.0.7 - [Release notes](https://github.com/downshift-js/downshift/releases) - [Changelog](https://github.com/downshift-js/downshift/blob/master/CHANGELOG.md) - [Commits](downshift-js/downshift@v9.0.6...v9.0.7) Updates `styled-components` from 6.1.11 to 6.1.12 - [Release notes](https://github.com/styled-components/styled-components/releases) - [Commits](styled-components/styled-components@v6.1.11...v6.1.12) Updates `@babel/cli` from 7.24.7 to 7.24.8 - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.24.8/packages/babel-cli) Updates `@testing-library/jest-dom` from 6.4.6 to 6.4.8 - [Release notes](https://github.com/testing-library/jest-dom/releases) - [Changelog](https://github.com/testing-library/jest-dom/blob/main/CHANGELOG.md) - [Commits](testing-library/jest-dom@v6.4.6...v6.4.8) Updates `eslint-plugin-react-refresh` from 0.4.8 to 0.4.9 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.4.8...v0.4.9) Updates `prettier` from 3.3.2 to 3.3.3 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.3.2...3.3.3) Updates `typescript` from 5.5.3 to 5.5.4 - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Changelog](https://github.com/microsoft/TypeScript/blob/main/azure-pipelines.release.yml) - [Commits](microsoft/TypeScript@v5.5.3...v5.5.4) Updates `vite` from 5.3.3 to 5.3.5 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v5.3.5/packages/vite) --- updated-dependencies: - dependency-name: "@reduxjs/toolkit" dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: downshift dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: styled-components dependency-type: direct:production update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@babel/cli" dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: "@testing-library/jest-dom" dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: eslint-plugin-react-refresh dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates - dependency-name: vite dependency-type: direct:development update-type: version-update:semver-patch dependency-group: patch-updates ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Deps: Bump @vitest/ui from 1.6.0 to 2.0.5 (#4116) * Deps: Bump @vitest/ui from 1.6.0 to 2.0.5 Bumps [@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui) from 1.6.0 to 2.0.5. - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v2.0.5/packages/ui) --- updated-dependencies: - dependency-name: "@vitest/ui" dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * update dep --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: daniele-mng <[email protected]> * Add: Add opensight-ui-components and mantine for new UI Start to implement new UI components for GSA. * Add: Add new components for row and column layouts Both components are based on mantine and flexbox. They are intended to replace Layout especially in dialogs. * Add: Add useValueChange hook for form components All form components should be able to call the onChange handler with the value, name pair. Therefore introduce a generic hook to abstract the event handling. * Provide userEvent from @testing-library/user-event@14 Use latest release of userEvent. * Render theme provider for opensight-ui in tests The theme provider is required to be able to test components based on opensight-ui and mantine. * Setup ResizeObserver for components based on opensight-ui/mantine The ResizeObserver is required to be able to run the tests for opensight based components. * Add: Add a hook to load the user's capabilities from the backend The capabilities of the user are provided via a react context and therefore it should be able to load them independently from the redux store. * Add: Add hooks for handling the filter dialog state Using the new hooks allows to rewrite all filter dialogs to function components more easily. * Add theme provider for opensight-ui based components When rendering the react app the theme provider for mantine is required. * Change: Refactor all form UI components Use opensight-ui and mantine for all form components. With this change all the form components are refreshed in their visual appearance. * Change: Rework dialog components to use Modal as base Update Dialog component to use the Model component from opensight for improved UI. * Add: Implement new Menu Use opensight AppNavigation to implement a new menu. * Add: Implement new Menubar Use new AppBar from opensight. * Fix rendering of list page content Align the content of list pages at the top. * Change: Adjust login page for new UI Use new form components for updated UI at the login page. * Change: Update DialogNotification for new Dialog UI Adjust the DialogNotification component for new Dialog. * Change: Refactor TrashCan page to function component with new UI Adjust TrashCan page for new UI. * Improve dialog footer layout * Change: Update wizards for new UI Adjust layout of wizard dialogs for new UI. * Change: Adjust dashboard dialogs for new UI * Change: Adjust performance page for new UI Fix the layout of the performance page. * Change: Adjust powerfilter components for new UI elements * Change: Update create and edit dialog to new UI layout Adjust create and edit dialogs for new UI components and layout. * Change: Update usersettings dialog to new UI * Change: Update all filter dialogs for new UI Adjust the filter dialogs of all list pages. * Update menu entries Fix the CPE icon and update the menu entries to use contain necessary object properties. * Fix issue with using opensight-ui as CJS but shipping with ESM ``` SyntaxError: Unexpected token 'export' Module <snip>/node_modules/@greenbone/opensight-ui-components/lib/utils/compareHelper.js:1 seems to be an ES Module but shipped in a CommonJS package. You might want to create an issue to the package "@greenbone/opensight-ui-components" asking them to ship the file in .mjs extension or add "type": "module" in their package.json. As a temporary workaround you can try to inline the package by updating your config: // vitest.config.js export default { test: { server: { deps: { inline: [ "@greenbone/opensight-ui-components" ] } } } } ``` * Deploy compose file automatically * Deploy compose file automatically * Remove obsolete dialog components These components are obsolete since we are using the Modal component from opensight-ui/mantine now. * Use react-i18next to initialize translations for opensight-ui * Change: Don't require the to prop for Link component Actually it is optional and it is set to an empty string by default already. * Extract opensight-ui and its dependencies into an own chunk Split the required js code for opensigth-ui into an own chunk bundle for production builds. * Provide a mock implementation for window.matchMedia It seems window.matchMedia is required for the Select components now. Thus implement a mock of the API for being able to test the select components. * Change: Remove obsolete TitleBar component The TitleBar is not used anymore. * Fix, update and improve dialog tests Get the tests for the dialog components running again, drop all snapshots because with mantine they aren't stable anymore and improve testing specific component parts by adding getter functions. * Update form tests for new testing functions The getters for specific components were extracted into a testing module. * Update all powerfilter component tests Fix and update all powerfilter tests by adapting to new form components and using the testing getters. * Fix remaining web/component tests * Fix additional tests and components * Update and improve layout of alert dialog * Rename function method from clickItem to clickElement clickElement is more generic because the function allows to send a click event on arbitrary HTML elements not only select items. * Fix typo for flexbox layout `stetch` -> `stretch` * Make component testing functions more flexible Allow for querying within a specific parent element. This will allow for easier usage of the testing functions within pages tests where components like select boxes may be rendered at several places. * Extend the testing functions for querying pages tests components We need to be able to test the bulk actions. Therefore is is required to query for the table footer, the table and the check boxes within and the bulk action icons. * Fix the alert page tests * Add testing function for getting action items Action items are icons that cause some action on use clicks. * Update audit tests Testing clicking on export, start and resume for the detailspage doesn't work at the moment. The click handler is just not called. * Update cpe pages tests * Define where to find the `@gsa/testing` module Allow completion for expect, etc. in VS code. * Add testing functions for getting the dialog buttons * Fix getting the options of select components It seems queryAllByRole doesn't return the desired elements under some circumstances. Therefore use an easier query for getting the options. * Add a changeInputValue testing method Abstract fireEvent for changing the value of an input element. * Update and fix credential pages tests * Update and fix cve pages tests * Update and fix cvss calculator page tests * Drop snapshot test for dialog closebutton The snapshot test are not very useful and prone for changes which get applied without a deeper review. * Update and fix about page tests * Update and fix LDAP page tests * Update and fix tests for hosts list page * Update and fix radius page tests * Update and fix notes list page tests * Update and fix NVT list page tests * Update and fix overrides list page tests * Update and improve policies pages * Allow for easier testing of multiselect components Add testing function for easier testing the behavior of multiselect components. * Update and fix report config pages tests * Allow to display a menu entry for asset management * Update and fix report pages tests * Update and fix result pages tests * Add a testing function for getting a table header Besides getting the footer and body also allow to get the header of a table. * Update and fix scan config pages tests * Update and fix scanner dialog tests * Update and fix schedule pages tests * Update and fix ticket pages tests * Update and fix task pages tests * Update and fix tls cert list page tests * Add a testing function for getting file inputs * Update and fix target pages tests * Avoid issues causing flaky tests with pointer events When clicking on multiselects sometimes user event complained about `pointer-events` css property being `none`. Avoid this issue by not checking for `pointer-event` at all. * Fix warning about emotion css-in-js library already loaded during tests The emotion library has a check if global vi or jest is set to detect if it is running in a testing environment. Therefore just an empty vi object for the tests to keep it quiet. * Use an own language switcher component for the app header Add a draft for toggling the language between en and de via a language switcher in the app header. * Mark asset-management link as external asset-mangement is an external application and therefore internal links can't be used. * Change: powerFilter width and select loading state * fix test * add: new UI error * add dependency lucide-react * Add: ci job to run on opensight-ui branch (#4105) * Change: opensight version 0.3.0 * Add: Session timer * Add: opensight date picker * add tests * remove unused dep * split date and time components * add test * fix imports * add missing props to select timezone * Fix: Error panel in dialog (#4106) * fix: Select component label (#4107) * rebase fix --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Björn Ricks <[email protected]> Co-authored-by: Ahmed Abdelsalam <[email protected]> Co-authored-by: Ahmed <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Timo Pollmeier <[email protected]> Co-authored-by: Greenbone Bot <[email protected]> Co-authored-by: pascalholthaus <[email protected]>

dependabot bot requested a review from a team as a code owner July 10, 2024 13:41

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 10, 2024

Merge branch 'main' into dependabot/npm_and_yarn/main/patch-updates-a…

ea87411

…efb499365

daniele-mng approved these changes Jul 11, 2024

View reviewed changes

daniele-mng merged commit e9bad1b into main Jul 11, 2024
17 checks passed

daniele-mng deleted the dependabot/npm_and_yarn/main/patch-updates-aefb499365 branch July 11, 2024 12:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deps: Bump the patch-updates group across 1 directory with 7 updates #4096

Deps: Bump the patch-updates group across 1 directory with 7 updates #4096

dependabot bot commented on behalf of github Jul 10, 2024 •

edited

Loading

github-actions bot commented Jul 10, 2024 •

edited

Loading

github-actions bot commented Jul 10, 2024

github-actions bot commented Jul 11, 2024

Deps: Bump the patch-updates group across 1 directory with 7 updates #4096

Deps: Bump the patch-updates group across 1 directory with 7 updates #4096

Conversation

dependabot bot commented on behalf of github Jul 10, 2024 • edited Loading

v2.2.6

What's Changed

6.12.3

6.12.2

v7.24.7 (2024-06-05)

🐛 Bug Fix

🏠 Internal

Committers: 7

v7.24.7 (2024-06-05)

🐛 Bug Fix

🏠 Internal

v6.4.6

6.4.6 (2024-06-10)

Bug Fixes

v4.3.1

Fix support for React Compiler with React 18

4.3.1 (2024-06-10)

Fix support for React Compiler with React 18

v7.34.3

Fixed

7.34.3 - 2024.06.18

Fixed

v0.4.8

0.4.8

github-actions bot commented Jul 10, 2024 • edited Loading

Dependency Review

Snapshot Warnings

OpenSSF Scorecard

Scanned Manifest Files

github-actions bot commented Jul 10, 2024

Conventional Commits Report

github-actions bot commented Jul 11, 2024

🔍 Vulnerabilities of harbor-os.greenbone.net/community/gsa:pr-4096

dependabot bot commented on behalf of github Jul 10, 2024 •

edited

Loading

github-actions bot commented Jul 10, 2024 •

edited

Loading

🔍 Vulnerabilities of `harbor-os.greenbone.net/community/gsa:pr-4096`