Update dependency gh-pages to v5 [SECURITY] #1456

renovate · 2024-04-23T01:11:21Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
gh-pages	`4.0.0` -> `5.0.0`

GitHub Vulnerability Alerts

CVE-2022-37611

Prototype pollution vulnerability in tschaub gh-pages via the partial variable in util.js.

Release Notes

tschaub/gh-pages (gh-pages)

`v5.0.0`

Compare Source

Potentially breaking change: the publish method now always returns a promise. Previously, it did not return a promise in some error cases. This should not impact most users.

Updates to the development dependencies required a minimum Node version of 14 for the tests. The library should still work on Node 12, but tests are no longer run in CI for version 12. A future major version of the library may drop support for version 12 altogether.

#438 - Remove quotation marks (@Vicropht)
#459 - Bump async from 2.6.4 to 3.2.4 (@tschaub)
#454 - Bump email-addresses from 3.0.1 to 5.0.0 (@tschaub)
#455 - Bump actions/setup-node from 1 to 3 (@tschaub)
#453 - Bump actions/checkout from 2 to 3 (@tschaub)
#445 - Update README to clarify project site configuration requirements with tools like CRA, webpack, Vite, etc. (@Nezteb)
#452 - Assorted updates (@tschaub)

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

github-actions · 2024-04-23T01:11:44Z

depcheck Result

List up libraries that are defined in dependencies and devDependencies in package.json but not used in your codes.

Unused dependencies

- @popperjs/core
- @sentry/react
- @typescript-eslint/eslint-plugin
- babel-loader
- babel-polyfill
- classnames
- flexboxgrid
- gatsby-legacy-polyfills
- gatsby-plugin-flexsearch
- gatsby-plugin-twitter
- gatsby-react-router-scroll
- html-minifier
- intersection-observer
- md5
- preact
- preact-render-to-string
- react-body-classname
- react-dom
- rimraf
- sass
- typescript

Unused devdependencies

- @babel/core
- @babel/eslint-parser
- @babel/plugin-syntax-typescript
- @babel/preset-typescript
- @storybook/addon-a11y
- @storybook/addon-controls
- @storybook/addon-essentials
- @storybook/addon-info
- @storybook/addon-interactions
- @storybook/addon-knobs
- @storybook/addon-links
- @storybook/addon-storysource
- @storybook/addon-viewport
- @storybook/builder-webpack5
- @storybook/manager-webpack5
- @textlint-rule/textlint-rule-no-duplicate-abbr
- @types/jest
- @types/react-test-renderer
- @types/responselike
- axe-core
- babel-plugin-transform-runtime
- core-js
- cross-env
- css-loader
- eslint
- eslint-config-airbnb
- eslint-import-resolver-webpack
- eslint-plugin-import
- eslint-plugin-jsx-a11y
- eslint-plugin-react
- gh-pages
- husky
- identity-obj-proxy
- jest
- jest-environment-jsdom
- markdownlint-cli2
- memlab
- netlify-cli
- netlify-lambda
- nyc
- prettier
- react-test-renderer
- sass-loader
- start-server-and-test
- stylelint
- stylelint-config-recess-order
- stylelint-config-recommended-scss
- stylelint-config-standard
- stylelint-scss
- textlint
- textlint-filter-rule-allowlist
- textlint-filter-rule-comments
- textlint-rule-aws-spellcheck
- textlint-rule-ja-no-inappropriate-words
- textlint-rule-no-mixed-zenkaku-and-hankaku-alphabet
- textlint-rule-no-start-duplicated-conjunction
- textlint-rule-preset-smarthr
- textlint-rule-prh
- textlint-rule-terminology
- ts-jest
- yaml-lint

Missing

- colors
  - /github/workspace/src/styles/_hover.scss

- @algolia/transporter
  - /github/workspace/src/components/SearchBox/index.tsx

- @algolia/client-search
  - /github/workspace/src/components/SearchBox/index.tsx

- qs
  - /github/workspace/scripts/benchmark.js

- https
  - /github/workspace/scripts/uploadScreenShot.ts

- sharp
  - /github/workspace/functions/src/ogp.js

coveralls · 2024-04-23T01:14:56Z

Pull Request Test Coverage Report for Build 8793226463

Details

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 85.64%

Totals
Change from base Build 8678908044:	0.0%
Covered Lines:	251
Relevant Lines:	281

💛 - Coveralls

github-actions · 2024-04-23T01:15:56Z

Memlab leaks report

page-load [7.2MB] (baseline) [s1] > action-on-page [8.2MB] (target) [s2] > revert [9.2MB] (final) [s3]  
------2 clusters------

--Similar leaks in this run: 1634--
--Retained size of leaked objects: 176.1KB--
[<synthetic>] (synthetic) @1 [10.4MB]
  --2 (shortcut)--->  [Window / https://blog.tubone-project24.xyz] (object) @6257 [64.3KB]
  --setTimeout (property)--->  [<closure>] (closure) @48141 [72 bytes]
  --context (internal)--->  [<function scope>] (object) @254703 [20 bytes]
  --previous (internal)--->  [<function scope>] (object) @86135 [30.1KB]
  --n (variable)--->  [t] (closure) @99125 [1.3KB]
  --context (internal)--->  [<function scope>] (object) @216755 [42.5KB]
  --n (variable)--->  [Object] (object) @263757 [42.4KB]
  --9077 (element)--->  [Object] (object) @139167 [24 bytes]
  --exports (property)--->  [r] (closure) @98635 [2.7KB]
  --hasData (property)--->  [<closure>] (closure) @100121 [80 bytes]
  --context (internal)--->  [<function scope>] (object) @99075 [1.5KB]
  --e (variable)--->  [Object] (object) @99077 [1KB]
  --2 (element)--->  [Object] (object) @342939 [76 bytes]
  --aaAutocomplete (property)--->  [d] (object) @367981 [348 bytes]
  --$node (property)--->  [$] (object) @368833 [188 bytes]
  --0 (element)--->  [Detached HTMLSpanElement] (native) @327491 [676 bytes]
  --7 (element)--->  [Detached HTMLDivElement] (native) @327719 [5.7KB]
  --8 (element)--->  [Detached HTMLDivElement] (native) @328077 [484 bytes]
  --6 (element)--->  [Detached HTMLHRElement] (native) @327717 [356 bytes]
  --6 (element)--->  [Detached HTMLDivElement] (native) @327693 [484 bytes]
  --8 (element)--->  [Detached HTMLHRElement] (native) @327691 [356 bytes]
  --6 (element)--->  [Detached HTMLDivElement] (native) @328297 [572 bytes]
  --6 (element)--->  [Detached HTMLAnchorElement] (native) @328213 [1.9KB]
  --11 (element)--->  [Detached HTMLAnchorElement] (native) @328201 [1.9KB]
  --11 (element)--->  [Detached HTMLAnchorElement] (native) @328187 [1.9KB]
  --11 (element)--->  [Detached HTMLAnchorElement] (native) @328167 [1.9KB]
  --11 (element)--->  [Detached HTMLAnchorElement] (native) @328263 [1.9KB]
  --13 (element)--->  [Detached InternalNode] (native) @29480 [400 bytes]
  --1 (element)--->  [Detached InternalNode] (native) @41758 [344 bytes]
  --4 (element)--->  [Detached ElementIntersectionObserverData] (native) @29478 [72 bytes]

--Similar leaks in this run: 479--
--Retained size of leaked objects: 50.2KB--
[<synthetic>] (synthetic) @1 [10.4MB]
  --2 (shortcut)--->  [Window / https://blog.tubone-project24.xyz] (object) @6257 [64.3KB]
  --___replace (property)--->  [<closure>] (closure) @48475 [76 bytes]
  --context (internal)--->  [<function scope>] (object) @210579 [724 bytes]
  --i (variable)--->  [Module] (object) @97687 [6.3KB]
  --get version (property)--->  [version] (closure) @259771 [80 bytes]
  --context (internal)--->  [<function scope>] (object) @137663 [6.5KB]
  --Qn (variable)--->  [y] (object) @403339 [368 bytes]
  --props (property)--->  [Object] (object) @412183 [28 bytes]
  --children (property)--->  [Object] (object) @412185 [296 bytes]
  --props (property)--->  [Object] (object) @426025 [56 bytes]
  --children (property)--->  [Object] (object) @426283 [1.2KB]
  --__ (property)--->  [Object] (object) @444765 [1.1KB]
  --__ (property)--->  [Object] (object) @444775 [940 bytes]
  --__ (property)--->  [Object] (object) @444791 [736 bytes]
  --__d (property)--->  [Detached HTMLDivElement] (native) @328177 [468 bytes]
  --5 (element)--->  [Detached HTMLDivElement] (native) @328175 [384 bytes]
  --5 (element)--->  [Detached HTMLDivElement] (native) @328173 [384 bytes]
  --5 (element)--->  [Detached HTMLDivElement] (native) @328171 [8KB]
  --5 (element)--->  [Detached HTMLDivElement] (native) @328169 [7.2KB]
  --6 (element)--->  [Detached HTMLDivElement] (native) @328161 [5.9KB]
  --5 (element)--->  [Detached HTMLDivElement] (native) @328159 [4.8KB]
  --6 (element)--->  [Detached HTMLSpanElement] (native) @328147 [664 bytes]
  --9 (element)--->  [Detached InternalNode] (native) @30812 [240 bytes]
  --1 (element)--->  [Detached InternalNode] (native) @30804 [184 bytes]
  --3 (element)--->  [Detached InternalNode] (native) @30810 [88 bytes]
  --1 (element)--->  [Detached InternalNode] (native) @39860 [88 bytes]
  --1 (element)--->  [Detached Attr] (native) @35258 [88 bytes]

github-actions · 2024-04-23T01:16:05Z

Deploy Preview

Deploy path: /home/runner/work/blog/blog/public
Functions path: /home/runner/work/blog/blog/functions/src
Configuration path: /home/runner/work/blog/blog/netlify.toml
Deploying to draft URL...

Netlify Build
────────────────────────────────────────────────────────────────

❯ Version
@netlify/build 29.36.1

❯ Flags
auth: TTs786GkKycSkoas9uwxVwTtamK0txQzpvHwXleU3OQ
deployId: 66270ba20460f76960664144
dir: ./public
functions: ./functions/src
open: false
prod: false
prodIfUnlocked: false
site: 3751ef40-b145-4249-9657-39d3fb04ae81
skipFunctionsCache: false

❯ Current directory
/home/runner/work/blog/blog

❯ Config file
/home/runner/work/blog/blog/netlify.toml

❯ Context
dev

Build logs: https://app.netlify.com/sites/pensive-lamport-5822d2/deploys/66270ba20460f76960664144
Function logs: https://app.netlify.com/sites/pensive-lamport-5822d2/functions?scope=deploy:66270ba20460f76960664144
Website draft URL: https://66270ba20460f76960664144--pensive-lamport-5822d2.netlify.app

If everything looks good on your draft URL, deploy it to your main site URL with the --prod flag.
netlify deploy --prod

github-actions · 2024-04-23T01:16:20Z

Bundle Analyzer URL

https://66270ba20460f76960664144--pensive-lamport-5822d2.netlify.app/webpack-bundle-analyser

github-actions · 2024-04-23T01:16:46Z

Storybook Preview

Deploy path: /home/runner/work/blog/blog/storybook-static
Functions path: /home/runner/work/blog/blog/functions/src
Configuration path: /home/runner/work/blog/blog/netlify.toml
Deploying to draft URL...

Netlify Build
────────────────────────────────────────────────────────────────

❯ Version
@netlify/build 29.36.1

❯ Flags
auth: EPJJ6iiVJKf1WzATp10YTzbujNbkSqWDiVl-3kCXA-Y
deployId: 66270beff876e359d919e42c
dir: ./storybook-static
open: false
prod: false
prodIfUnlocked: false
site: 905285ac-8339-48d2-86d8-8d639370a095
skipFunctionsCache: false

❯ Current directory
/home/runner/work/blog/blog

❯ Config file
/home/runner/work/blog/blog/netlify.toml

❯ Context
dev

Build logs: https://app.netlify.com/sites/blog-storybook/deploys/66270beff876e359d919e42c
Function logs: https://app.netlify.com/sites/blog-storybook/functions?scope=deploy:66270beff876e359d919e42c
Website draft URL: https://66270beff876e359d919e42c--blog-storybook.netlify.app

If everything looks good on your draft URL, deploy it to your main site URL with the --prod flag.
netlify deploy --prod

github-actions · 2024-04-23T01:17:54Z

Lighthouse Score

Desktop

performance: 99
accessibility: 100
best-practices: 100
seo: 92
pwa: 100

Mobile

performance: 78
accessibility: 100
best-practices: 96
seo: 93
pwa: 100

Update dependency gh-pages to v5 [SECURITY]

6364fa7

renovate bot requested a review from tubone24 as a code owner April 23, 2024 01:11

renovate bot added the renovate label Apr 23, 2024

github-actions bot added the packages label Apr 23, 2024

github-actions bot temporarily deployed to development April 23, 2024 01:11 Inactive

github-actions bot temporarily deployed to development-storybook April 23, 2024 01:12 Inactive

github-actions bot pushed a commit that referenced this pull request Apr 23, 2024

[file upload] Added file for PR #1456

50e4da3

github-actions bot pushed a commit that referenced this pull request Apr 23, 2024

[file upload] Added file for PR #1456

a972331

github-actions bot pushed a commit that referenced this pull request Apr 23, 2024

[file upload] Added file for PR #1456

68f173f

github-actions bot pushed a commit that referenced this pull request Apr 23, 2024

[file upload] Added file for PR #1456

1e6bc54

github-actions bot pushed a commit that referenced this pull request Apr 23, 2024

[file upload] Added file for PR #1456

28ed65a

tubone24 approved these changes May 4, 2024

View reviewed changes

tubone24 merged commit ef6ee6d into master May 4, 2024
34 checks passed

tubone24 deleted the renovate-npm-gh-pages-vulnerability branch May 4, 2024 09:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update dependency gh-pages to v5 [SECURITY] #1456

Update dependency gh-pages to v5 [SECURITY] #1456

renovate bot commented Apr 23, 2024

github-actions bot commented Apr 23, 2024

coveralls commented Apr 23, 2024

github-actions bot commented Apr 23, 2024

github-actions bot commented Apr 23, 2024

github-actions bot commented Apr 23, 2024

github-actions bot commented Apr 23, 2024

github-actions bot commented Apr 23, 2024

Update dependency gh-pages to v5 [SECURITY] #1456

Update dependency gh-pages to v5 [SECURITY] #1456

Conversation

renovate bot commented Apr 23, 2024

GitHub Vulnerability Alerts

CVE-2022-37611

Release Notes

v5.0.0

Configuration

github-actions bot commented Apr 23, 2024

depcheck Result

coveralls commented Apr 23, 2024

Pull Request Test Coverage Report for Build 8793226463

Details

💛 - Coveralls

github-actions bot commented Apr 23, 2024

Memlab leaks report

github-actions bot commented Apr 23, 2024

Deploy Preview

github-actions bot commented Apr 23, 2024

Bundle Analyzer URL

github-actions bot commented Apr 23, 2024

Storybook Preview

github-actions bot commented Apr 23, 2024

Lighthouse Score

Desktop

Mobile

`v5.0.0`