Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update all patch dependencies #191

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 16, 2024

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
@module-federation/rsbuild-plugin (source) ^0.8.2 -> ^0.8.5 age adoption passing confidence
@rsbuild/core (source) ^1.1.10 -> ^1.1.12 age adoption passing confidence
@rsbuild/core (source) 1.1.10 -> 1.1.12 age adoption passing confidence
@rsbuild/plugin-svelte (source) ^1.0.5 -> ^1.0.7 age adoption passing confidence
@rspack/cli (source) 1.1.6 -> 1.1.8 age adoption passing confidence
@rspack/core (source) 1.1.6 -> 1.1.8 age adoption passing confidence
@types/react (source) ^18.3.16 -> ^18.3.18 age adoption passing confidence
@vanilla-extract/webpack-plugin (source) ^2.3.15 -> ^2.3.16 age adoption passing confidence
tailwindcss (source) ^3.4.16 -> ^3.4.17 age adoption passing confidence
tailwindcss (source) 4.0.0-beta.6 -> 4.0.0-beta.8 age adoption passing confidence
terser-webpack-plugin 5.3.10 -> 5.3.11 age adoption passing confidence

Release Notes

module-federation/core (@​module-federation/rsbuild-plugin)

v0.8.5

Compare Source

Patch Changes

v0.8.4

Compare Source

Patch Changes

v0.8.3

Compare Source

Patch Changes
web-infra-dev/rsbuild (@​rsbuild/core)

v1.1.12

Compare Source

What's Changed

Bug Fixes 🐞
Document 📖

Full Changelog: web-infra-dev/rsbuild@v1.1.11...v1.1.12

v1.1.11

Compare Source

What's Changed

New Features 🎉
Bug Fixes 🐞
Document 📖
Other Changes

New Contributors

Full Changelog: web-infra-dev/rsbuild@v1.1.10...v1.1.11

web-infra-dev/rspack (@​rspack/cli)

v1.1.8

Security Vulnerability Report

Overview

This is a re-release version of v1.1.6

On 12/19/2024, 02:01 (UTC), we discovered that our npm packages @rspack/core and @rspack/cli were maliciously attacked. The attacker released v1.1.7 using a compromised npm token, which contained malicious code. We took immediate action upon discovering the issue.

Impact

  • Affected versions: @rspack/core and @rspack/cli v1.1.7
  • Duration: 12/19/2024, 02:01 (UTC), lasting approximately 1 hour
  • Malicious code impact: After npm install, the postinstall script in package.json runs malicious code in dist/util/support.js. See Malicious code analysis for more details.

Actions Taken

Upon discovery, we immediately deprecated the affected v1.1.7, redirected the npm latest tag to v1.1.6, and reset all related tokens.
Subsequently, we released a secure new version v1.1.8.

Recommended Actions

If you installed v1.1.7 during the affected period, please:

  1. Update to the latest safe version immediately: @rspack/core and @rspack/cli to >= 1.1.8
  2. Check your system for any unusual activity

Apology and Commitment

We deeply apologize for the risks caused by this incident. To prevent similar incidents from happening again, we will implement stricter token management protocols and enhance our security review processes.

If you have any questions or discover any suspicious activity, please create an issue or send an email to: [email protected]

We will continue to follow and respond to community feedback.

vanilla-extract-css/vanilla-extract (@​vanilla-extract/webpack-plugin)

v2.3.16

Compare Source

Patch Changes
tailwindlabs/tailwindcss (tailwindcss)

v3.4.17

Compare Source

webpack-contrib/terser-webpack-plugin (terser-webpack-plugin)

v5.3.11

Compare Source


Configuration

📅 Schedule: Branch creation - "* 0-3 * * 1" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/all-patch branch 4 times, most recently from 2777ae2 to 78f5634 Compare December 21, 2024 14:52
@renovate renovate bot force-pushed the renovate/all-patch branch from 78f5634 to a593455 Compare December 22, 2024 14:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants