Skip to content

Commit

Permalink
Bump deep-object-diff from 1.1.7 to 1.1.9 (#7734)
Browse files Browse the repository at this point in the history
Bumps
[deep-object-diff](https://github.com/mattphillips/deep-object-diff)
from 1.1.7 to 1.1.9.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mattphillips/deep-object-diff/releases">deep-object-diff's
releases</a>.</em></p>
<blockquote>
<h2>v1.1.9</h2>
<h2>Vulnerability patch</h2>
<p>Details outlined here: <a
href="https://github-redirect.dependabot.com/mattphillips/deep-object-diff/issues/85">#85</a>.
TLDR: The prototype of the returned diff object could be polluted but
not globally on all objects.</p>
<p>Fix: <a
href="https://github-redirect.dependabot.com/mattphillips/deep-object-diff/pull/87">mattphillips/deep-object-diff#87</a></p>
<p>Thanks <a
href="https://github.com/Retr02332"><code>@​Retr02332</code></a> for
highlighting the issue and validating the fix.</p>
<p>This vulnerability was introduced in <a
href="https://github.com/mattphillips/deep-object-diff/releases/tag/v1.1.6">https://github.com/mattphillips/deep-object-diff/releases/tag/v1.1.6</a></p>
<h2>v1.1.8</h2>
<h2>Patch</h2>
<ul>
<li>Fix typings resolution when using TypeScript 4.7+ with ESM <a
href="https://github-redirect.dependabot.com/mattphillips/deep-object-diff/issues/83">#83</a></li>
<li>improve return type for detailedDiff <a
href="https://github-redirect.dependabot.com/mattphillips/deep-object-diff/issues/72">#72</a></li>
</ul>
<h2>Credits</h2>
<p>Thanks <a href="https://github.com/Nitive"><code>@​Nitive</code></a>
and <a href="https://github.com/icholy"><code>@​icholy</code></a> for
your PRs</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/mattphillips/deep-object-diff/commits">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=deep-object-diff&package-manager=npm_and_yarn&previous-version=1.1.7&new-version=1.1.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the
default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as
the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as
the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the
default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/Shopify/polaris/network/alerts).

</details>> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
  • Loading branch information
dependabot[bot] authored Aug 17, 2023
1 parent 584e012 commit cba5c6a
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -7864,9 +7864,9 @@ deep-is@^0.1.3, deep-is@~0.1.3:
integrity sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==

deep-object-diff@^1.1.0:
version "1.1.7"
resolved "https://registry.yarnpkg.com/deep-object-diff/-/deep-object-diff-1.1.7.tgz#348b3246f426427dd633eaa50e1ed1fc2eafc7e4"
integrity sha512-QkgBca0mL08P6HiOjoqvmm6xOAl2W6CT2+34Ljhg0OeFan8cwlcdq8jrLKsBBuUFAZLsN5b6y491KdKEoSo9lg==
version "1.1.9"
resolved "https://registry.yarnpkg.com/deep-object-diff/-/deep-object-diff-1.1.9.tgz#6df7ef035ad6a0caa44479c536ed7b02570f4595"
integrity sha512-Rn+RuwkmkDwCi2/oXOFS9Gsr5lJZu/yTGpK7wAaAIE75CC+LCGEZHpY6VQJa/RoJcrmaA/docWJZvYohlNkWPA==

deepmerge@^4.2.2:
version "4.2.2"
Expand Down

0 comments on commit cba5c6a

Please sign in to comment.