Skip to content

⬆️ Updates pretty-quick to v4 - #585

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/pretty-quick-4.x
Open

⬆️ Updates pretty-quick to v4#585
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/pretty-quick-4.x

Conversation

@renovate

@renovate renovate Bot commented Jan 17, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
pretty-quick ^3.1.0 → ^4.2.2 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

prettier/pretty-quick (pretty-quick)

v4.2.2

Compare Source

Patch Changes

Full Changelog: prettier/pretty-quick@v4.2.1...v4.2.2

v4.2.1

Compare Source

Patch Changes

Full Changelog: prettier/pretty-quick@v4.2.0...v4.2.1

v4.2.0

Compare Source

Minor Changes

v4.1.1

Compare Source

Patch Changes

v4.1.0

Compare Source

Minor Changes

v4.0.0

Compare Source

Major Changes

v3.3.1

Compare Source

Patch Changes

v3.3.0

Compare Source

Minor Changes
  • #​180 93924ab Thanks @​SukkaW! - refactor: replace chalk and multimatch with their lightweight and performant alternatives
Patch Changes

v3.2.1

Compare Source

Patch Changes

v3.2.0

Compare Source

Minor Changes

v3.1.4

Compare Source

Patch Changes

v3.1.3

Compare Source

Bug Fixes

v3.1.2

Compare Source

Bug Fixes
  • check for supportedExtenions after filtering ignored files (#​143) (5cb47e6)

v3.1.1

Compare Source

Bug Fixes

Configuration

📅 Schedule: (in timezone Europe/Moscow)

  • Branch creation
    • "after 10pm every weekday,before 5am every weekday,every weekend"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate

renovate Bot commented Jan 17, 2024

Copy link
Copy Markdown
Contributor Author

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm WARN old lockfile 
npm WARN old lockfile The npm-shrinkwrap.json file was created with an old version of npm,
npm WARN old lockfile so supplemental metadata must be fetched from the registry.
npm WARN old lockfile 
npm WARN old lockfile This is a one-time fix-up, please be patient...
npm WARN old lockfile 
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR! 
npm ERR! While resolving: github-action-screenshot@0.0.0-dev
npm ERR! Found: prettier@2.8.8
npm ERR! node_modules/prettier
npm ERR!   dev prettier@"^2.1.2" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer prettier@"^3.0.0" from pretty-quick@4.0.0
npm ERR! node_modules/pretty-quick
npm ERR!   dev pretty-quick@"^4.0.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /tmp/renovate/cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate/cache/others/npm/_logs/2024-01-17T22_03_45_356Z-debug-0.log

@auto-assign
auto-assign Bot requested a review from AlexRogalskiy January 17, 2024 22:04
@github-actions

github-actions Bot commented Jan 17, 2024

Copy link
Copy Markdown

Thanks for the PR!

This section of the codebase is owner by https://github.com/AlexRogalskiy/ - if they write a comment saying "LGTM" then it will be merged.

@github-actions

github-actions Bot commented Jan 17, 2024

Copy link
Copy Markdown

🏷️ [bumpr] Next version:v1.12.1 Changes:v1.12.0...AlexRogalskiy:renovate/pretty-quick-4.x

github-actions[bot]
github-actions Bot reviewed Jan 17, 2024
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Scan Summary

Tool Critical High Medium Low Status
Dependency Scan (universal) 3 21 9 0 ❌
Secrets Audit 0 421 0 0 ❌

Recommendation

Please review the findings from Code scanning alerts before approving this pull request. You can also configure the build rules or add suppressions to customize this bot 👍

@renovate
renovate Bot force-pushed the renovate/pretty-quick-4.x branch from 268eba7 to 0b234fc Compare March 4, 2025 17:14
@renovate

renovate Bot commented Mar 4, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json
npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn old lockfile
npm warn old lockfile The npm-shrinkwrap.json file was created with an old version of npm,
npm warn old lockfile so supplemental metadata must be fetched from the registry.
npm warn old lockfile
npm warn old lockfile This is a one-time fix-up, please be patient...
npm warn old lockfile
npm error code ERESOLVE
npm error ERESOLVE unable to resolve dependency tree
npm error
npm error While resolving: github-action-screenshot@0.0.0-dev
npm error Found: prettier@2.8.8
npm error node_modules/prettier
npm error   dev prettier@"^2.1.2" from the root project
npm error
npm error Could not resolve dependency:
npm error peer prettier@"^3.0.0" from pretty-quick@4.2.2
npm error node_modules/pretty-quick
npm error   dev pretty-quick@"^4.2.2" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-10-20T21_05_12_197Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-10-20T21_05_12_197Z-debug-0.log

@socket-security

socket-security Bot commented Mar 4, 2025 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn Critical
Critical CVE: npm form-data uses unsafe random function in form-data for choosing boundary

CVE: GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary (CRITICAL)

Affected versions: < 2.5.4; >= 3.0.0 < 3.0.4; >= 4.0.0 < 4.0.4

Patched version: 2.5.4

From: package-lock.json → npm/form-data@2.3.3

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/form-data@2.3.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Critical
Critical CVE: Handlebars.js has JavaScript Injection via AST Type Confusion

CVE: GHSA-2w6w-674q-4c4q Handlebars.js has JavaScript Injection via AST Type Confusion (CRITICAL)

Affected versions: >= 4.0.0 < 4.7.9

Patched version: 4.7.9

From: package-lock.json → npm/@semantic-release/release-notes-generator@7.3.5 → npm/handlebars@4.7.7

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/handlebars@4.7.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Critical
Critical CVE: npm json-schema is vulnerable to Prototype Pollution

CVE: GHSA-896r-f27r-55mw json-schema is vulnerable to Prototype Pollution (CRITICAL)

Affected versions: < 0.4.0

Patched version: 0.4.0

From: package-lock.json → npm/json-schema@0.2.3

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/json-schema@0.2.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn Critical
Critical CVE: Prototype Pollution in npm minimist

CVE: GHSA-xvch-5gv4-984h Prototype Pollution in minimist (CRITICAL)

Affected versions: >= 1.0.0 < 1.2.6; < 0.2.4

Patched version: 1.2.6

From: package-lock.json → npm/cz-conventional-changelog@3.3.0 → npm/jest@27.0.0-next.2 → npm/jest-circus@26.6.3 → npm/@semantic-release/release-notes-generator@7.3.5 → npm/minimist@1.2.5

ℹ Read more on: This package | This alert | What is a critical CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known critical CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/minimist@1.2.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm npm is 94.0% likely obfuscated

Confidence: 0.94

Location: Package overview

From: package-lock.json → npm/@semantic-release/npm@5.3.5 → npm/npm@6.14.11

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@6.14.11. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

github-actions[bot]
github-actions Bot reviewed Mar 4, 2025
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Scan Summary

Tool Critical High Medium Low Status
Dependency Scan (universal) 3 21 9 0 ❌
Secrets Audit 0 423 0 0 ❌

Recommendation

Please review the findings from Code scanning alerts before approving this pull request. You can also configure the build rules or add suppressions to customize this bot 👍

@renovate
renovate Bot force-pushed the renovate/pretty-quick-4.x branch from 0b234fc to a4034b1 Compare March 4, 2025 21:15
github-actions[bot]
github-actions Bot reviewed Mar 4, 2025
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Scan Summary

Tool Critical High Medium Low Status
Dependency Scan (universal) 3 21 9 0 ❌
Secrets Audit 0 422 0 0 ❌

Recommendation

Please review the findings from Code scanning alerts before approving this pull request. You can also configure the build rules or add suppressions to customize this bot 👍

@renovate
renovate Bot force-pushed the renovate/pretty-quick-4.x branch from a4034b1 to bea3511 Compare June 2, 2025 03:28
github-actions[bot]
github-actions Bot reviewed Jun 2, 2025
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Scan Summary

Tool Critical High Medium Low Status
Dependency Scan (universal) 3 20 9 0 ❌
Secrets Audit 0 425 0 0 ❌

Recommendation

Please review the findings from Code scanning alerts before approving this pull request. You can also configure the build rules or add suppressions to customize this bot 👍

@renovate
renovate Bot force-pushed the renovate/pretty-quick-4.x branch from bea3511 to 2aff16a Compare June 2, 2025 12:01
github-actions[bot]
github-actions Bot reviewed Jun 2, 2025
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Scan Summary

Tool Critical High Medium Low Status
Dependency Scan (universal) 3 20 9 0 ❌
Secrets Audit 0 423 0 0 ❌

Recommendation

Please review the findings from Code scanning alerts before approving this pull request. You can also configure the build rules or add suppressions to customize this bot 👍

@renovate
renovate Bot force-pushed the renovate/pretty-quick-4.x branch from 2aff16a to 5eebec8 Compare April 29, 2026 10:19
@socket-security

socket-security Bot commented Apr 29, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedeslint@​7.19.09110010050100
Addedjest@​27.0.0-next.21001006891100
Addedexpect@​26.6.21001007492100
Addedcz-conventional-changelog@​3.3.0991008975100
Addedgit-cz@​4.7.610010010080100
Addedhusky@​4.3.88310010080100
Addedeslint-plugin-github@​4.1.11001008287100
Addedeslint-plugin-import@​2.22.19710010084100
Addededitorconfig-checker@​3.3.09710010087100
Addedeslint-config-prettier@​6.15.010010010088100
Addedjest-circus@​26.6.3991009092100
Addedeslint-plugin-prettier@​3.3.110010010090100
Addedlint-staged@​10.5.49810010093100
Addedeslint-plugin-jest@​23.20.09910010097100

View full report

github-actions[bot]
github-actions Bot reviewed Apr 29, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Scan Summary

Tool Critical High Medium Low Status
Secrets Audit 0 423 0 0 ❌

Recommendation

Please review the findings from Code scanning alerts before approving this pull request. You can also configure the build rules or add suppressions to customize this bot 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments
@AlexRogalskiy AlexRogalskiy Awaiting requested review from AlexRogalskiy

Assignees

No one assigned

Labels

security findings

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants