Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build(deps): bump json5, @tarojs/cli and @tarojs/webpack-runner #7

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Feb 20, 2023

Bumps json5 to 2.2.3 and updates ancestor dependencies json5, json5, @tarojs/cli and @tarojs/webpack-runner. These dependencies need to be updated together.

Updates json5 from 2.2.0 to 2.2.3

Release notes

Sourced from json5's releases.

v2.2.3

v2.2.2

  • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1

Changelog

Sourced from json5's changelog.

v2.2.3 [code, diff]

v2.2.2 [code, diff]

  • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

Commits
  • c3a7524 2.2.3
  • 94fd06d docs: update CHANGELOG for v2.2.3
  • 3b8cebf docs(security): use GitHub security advisories
  • f0fd9e1 docs: publish a security policy
  • 6a91a05 docs(template): bug -> bug report
  • 14f8cb1 2.2.2
  • 10cc7ca docs: update CHANGELOG for v2.2.2
  • 7774c10 fix: add proto to objects and arrays
  • edde30a Readme: slight tweak to intro
  • 97286f8 Improve example in readme
  • Additional commits viewable in compare view

Updates json5 from 1.0.1 to 2.2.3

Release notes

Sourced from json5's releases.

v2.2.3

v2.2.2

  • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1

Changelog

Sourced from json5's changelog.

v2.2.3 [code, diff]

v2.2.2 [code, diff]

  • Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

Commits
  • c3a7524 2.2.3
  • 94fd06d docs: update CHANGELOG for v2.2.3
  • 3b8cebf docs(security): use GitHub security advisories
  • f0fd9e1 docs: publish a security policy
  • 6a91a05 docs(template): bug -> bug report
  • 14f8cb1 2.2.2
  • 10cc7ca docs: update CHANGELOG for v2.2.2
  • 7774c10 fix: add proto to objects and arrays
  • edde30a Readme: slight tweak to intro
  • 97286f8 Improve example in readme
  • Additional commits viewable in compare view

Updates @tarojs/cli from 3.3.11 to 3.6.1

Release notes

Sourced from @​tarojs/cli's releases.

chore(release): publish 3.6.1

特性

小程序

  • 迁移plugin-inject到主仓 (6390b29)
  • advanced: 虚拟列表支持 enhanced 属性 fix #13217 (55de2b6)
  • vue support fragment fix (c0aa4e0)

H5

  • h5: 更新 navigator 组件支持参数 (f6af1ea)
  • h5: 优化 ScrollViewContext 支持 (77a5063)

修复

小程序

H5

  • h5: 为 vue 适配器映射 tap & click 事件 fix #13210 (591dd76)
  • h5: 修复 vue2 v-model 语法使用 (406dfc4)
  • h5: lint styles (1b272b1)

RN

  • postcss-pxtransform: 修复px值在transform过程中重复执行问题 (#13243) (63c8dab)

chore(release): publish 3.6.0

两个月前,我们发布了 Taro v3.6 的 canary 版本,在技术委员会和社区范围内提供跨端路由库、跨框架组件等主要能力和重要修复的测试,并发起社区投票正式确定了当前版本的代号 —— Reach。

taro-3.6.jpg

日前 Taro v3.6 正式版本已经发布,下文将围绕 3.6 版本内的跨端、平台能力支持等多个方面展开,快速了解在 v3.6 中各个重要特性。

一、跨端能力支持

支持各类跨端能力,抹平多端研发之间的体验差异,是 Taro 一直以来尝试去实现的,基于 Taro 3 适配多端前端 UI 框架的逻辑,通过在小程序端模拟实现框架所需的 BOM / DOM API 就能达成对于各类跨端能力的适配。

1. 支持路由库

在 Web BOM 中,History & Location 对象是重要组成部分,它们是实现前端路由的关键。Taro 为支持前端路由库的使用,在运行时中引入了 histroy location 对象的实现,同时尽可能与 Web 端规范对齐。通过在 window 对象上访问到 historylocation 对象,并支持监听 hashchangepopstate 事件,为跨端使用路由库提供基础。

// 统称: 页面路由状态
window.history
</tr></table> 

... (truncated)

Commits
  • bc113c8 chore(release): publish 3.6.1
  • 4e3cad3 fix(components): VirtualList restCount可能是负数
  • 63c8dab fix(postcss-pxtransform): 修复px值在transform过程中重复执行问题 (#13243)
  • 19c7432 @​ZakaryCode fix(ci): update dependabot use sbom-tool
  • 330ad7b Merge pull request #12655 from NervJS/dependabot/npm_and_yarn/vue/runtime-cor...
  • 4d24e43 build(deps-dev): remove useless deps-dev
  • 59f6e57 Merge remote-tracking branch 'origin/next' into dependabot/npm_and_yarn/vue/r...
  • 35dee7d build(deps-dev): update vue deps-dev
  • e9c8218 chore: 调整代码格式
  • 1d99a34 chore: 使用 URL 类重写 location 部分实现
  • Additional commits viewable in compare view

Updates @tarojs/webpack-runner from 3.3.11 to 3.6.1

Release notes

Sourced from @​tarojs/webpack-runner's releases.

chore(release): publish 3.6.1

特性

小程序

  • 迁移plugin-inject到主仓 (6390b29)
  • advanced: 虚拟列表支持 enhanced 属性 fix #13217 (55de2b6)
  • vue support fragment fix (c0aa4e0)

H5

  • h5: 更新 navigator 组件支持参数 (f6af1ea)
  • h5: 优化 ScrollViewContext 支持 (77a5063)

修复

小程序

H5

  • h5: 为 vue 适配器映射 tap & click 事件 fix #13210 (591dd76)
  • h5: 修复 vue2 v-model 语法使用 (406dfc4)
  • h5: lint styles (1b272b1)

RN

  • postcss-pxtransform: 修复px值在transform过程中重复执行问题 (#13243) (63c8dab)

chore(release): publish 3.6.0

两个月前,我们发布了 Taro v3.6 的 canary 版本,在技术委员会和社区范围内提供跨端路由库、跨框架组件等主要能力和重要修复的测试,并发起社区投票正式确定了当前版本的代号 —— Reach。

taro-3.6.jpg

日前 Taro v3.6 正式版本已经发布,下文将围绕 3.6 版本内的跨端、平台能力支持等多个方面展开,快速了解在 v3.6 中各个重要特性。

一、跨端能力支持

支持各类跨端能力,抹平多端研发之间的体验差异,是 Taro 一直以来尝试去实现的,基于 Taro 3 适配多端前端 UI 框架的逻辑,通过在小程序端模拟实现框架所需的 BOM / DOM API 就能达成对于各类跨端能力的适配。

1. 支持路由库

在 Web BOM 中,History & Location 对象是重要组成部分,它们是实现前端路由的关键。Taro 为支持前端路由库的使用,在运行时中引入了 histroy location 对象的实现,同时尽可能与 Web 端规范对齐。通过在 window 对象上访问到 historylocation 对象,并支持监听 hashchangepopstate 事件,为跨端使用路由库提供基础。

// 统称: 页面路由状态
window.history
</tr></table> 

... (truncated)

Commits
  • bc113c8 chore(release): publish 3.6.1
  • 4e3cad3 fix(components): VirtualList restCount可能是负数
  • 63c8dab fix(postcss-pxtransform): 修复px值在transform过程中重复执行问题 (#13243)
  • 19c7432 @​ZakaryCode fix(ci): update dependabot use sbom-tool
  • 330ad7b Merge pull request #12655 from NervJS/dependabot/npm_and_yarn/vue/runtime-cor...
  • 4d24e43 build(deps-dev): remove useless deps-dev
  • 59f6e57 Merge remote-tracking branch 'origin/next' into dependabot/npm_and_yarn/vue/r...
  • 35dee7d build(deps-dev): update vue deps-dev
  • e9c8218 chore: 调整代码格式
  • 1d99a34 chore: 使用 URL 类重写 location 部分实现
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [json5](https://github.com/json5/json5) to 2.2.3 and updates ancestor dependencies [json5](https://github.com/json5/json5), [json5](https://github.com/json5/json5), [@tarojs/cli](https://github.com/NervJS/taro) and [@tarojs/webpack-runner](https://github.com/NervJS/taro). These dependencies need to be updated together.


Updates `json5` from 2.2.0 to 2.2.3
- [Release notes](https://github.com/json5/json5/releases)
- [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md)
- [Commits](json5/json5@v2.2.0...v2.2.3)

Updates `json5` from 1.0.1 to 2.2.3
- [Release notes](https://github.com/json5/json5/releases)
- [Changelog](https://github.com/json5/json5/blob/main/CHANGELOG.md)
- [Commits](json5/json5@v2.2.0...v2.2.3)

Updates `@tarojs/cli` from 3.3.11 to 3.6.1
- [Release notes](https://github.com/NervJS/taro/releases)
- [Commits](NervJS/taro@v3.3.11...v3.6.1)

Updates `@tarojs/webpack-runner` from 3.3.11 to 3.6.1
- [Release notes](https://github.com/NervJS/taro/releases)
- [Commits](NervJS/taro@v3.3.11...v3.6.1)

---
updated-dependencies:
- dependency-name: json5
  dependency-type: indirect
- dependency-name: json5
  dependency-type: indirect
- dependency-name: "@tarojs/cli"
  dependency-type: direct:development
- dependency-name: "@tarojs/webpack-runner"
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Feb 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants