build(deps): bump xml2js from 0.4.19 to 0.5.0 #1408
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Bumps [xml2js](https://github.com/Leonidas-from-XIV/node-xml2js) from 0.4.19 to 0.5.0. - [Release notes](https://github.com/Leonidas-from-XIV/node-xml2js/releases) - [Commits](Leonidas-from-XIV/node-xml2js@0.4.19...0.5.0) --- updated-dependencies: - dependency-name: xml2js dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description of your changes
One of the dependencies in our tree requires an update due to a prototype pollution type of issue. This is an indirect development only dependency, as such it's not part of the Powertools utilities shipped to npm and to our customers.
Regardless of that, we want to keep things as in order as possible and would like to remove it by updating it to a patched version.
Dependabot tried to open a similar PR and do the update, however even though a patch was applied the dependency was not updated and recreating the PR fails. In the meanwhile, the package at the second level of depth of our dependency tree has updated the problematic dependency, so it's reasonable to perform the update of the lock file manually.
The PR will be merged only when the unit tests below are green as well as having a positive integration test result posted below.
Related issues, RFCs
Issue number: N/A
Checklist
Breaking change checklist
Is it a breaking change?: NO
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.