Skip to content

[Snyk] Upgrade chai from 4.2.0 to 4.3.5#191

Closed
snyk-bot wants to merge 1 commit into
masterfrom
snyk-upgrade-921d6bb94bc5572e1a4bd3e9d4fd94da
Closed

[Snyk] Upgrade chai from 4.2.0 to 4.3.5#191
snyk-bot wants to merge 1 commit into
masterfrom
snyk-upgrade-921d6bb94bc5572e1a4bd3e9d4fd94da

Conversation

@snyk-bot

@snyk-bot snyk-bot commented Feb 15, 2022

Copy link
Copy Markdown

Snyk has created this PR to upgrade chai from 4.2.0 to 4.3.5.

merge advice
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 6 versions ahead of your current version.
  • The recommended version was released 21 days ago, on 2022-01-25.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Prototype Pollution
SNYK-JS-PATHVAL-596926		 407/1000
Why? Proof of Concept exploit, CVSS 6		 Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: chai
  • 4.3.5 - 2022-01-25

    v4.3.4...v4.3.5

  • 4.3.4 - 2021-03-12

    This fixes broken inspect behavior with bigints (#1321) (#1383) thanks @ vapier

  • 4.3.3 - 2021-03-03

    This reintroduces Assertion as an export in the mjs file. See #1378 & #1375

  • 4.3.2 - 2021-03-03

    This fixes a regression in IE11. See #1380 & #1379

  • 4.3.1 - 2021-03-02

    This releases fixed an engine incompatibility with 4.3.0

    The 4.x.x series of releases will be compatible with Node 4.0. Please report any errors found in Node 4 as bugs, and they will be fixed.

    The 5.x.x series, when released, will drop support for Node 4.0

    This fix also ensures pathval is updated to 1.1.1 to fix CVE-2020-7751

  • 4.3.0 - 2021-02-04

    This is a minor release.

    Not many changes have got in since the last release but this one contains a very important change (#1257) which will allow jest users to get better diffs. From this release onwards, jest users will be able to see which operator was used in their diffs. The operator is a property of the AssertionError thrown when assertions fail. This flag indicates what kind of comparison was made.

    This is also an important change for plugin maintainers. Plugin maintainers will now have access to the operator flag, which they can have access to through an utilmethod calledgetOperator`.

    Thanks to all the amazing people that contributed to this release.

    New Features

    • Allow contain.oneOf to take an array of possible values (@ voliva)
    • Adding operator attribute to assertion error (#1257) (@ rpgeeganage)
    • The closeTo error message will now inform the user when a delta is required (@ eouw0o83hf)

    Docs

    • Add contains flag to oneOf documentation (@ voliva)

    Tests

    • Make sure that useProxy config is checked in overwriteProperty (@ vieiralucas)
    • Add tests for contain.oneOf (@ voliva )

    Chores

    • Update mocha to version 6.1.4
    • Add node v10 and v12 to ci (@ vieiralucas)
    • Drop support for node v4, v6 and v9 (@ vieiralucas)
    • Fix sauce config for headless chrome (@ meeber)
    • Update dev dependencies (@ meeber)
    • Removed phantomjs dependency (#1204)
  • 4.2.0 - 2018-09-26
    Read more
from chai GitHub release notes
Commit messages
Package name: chai

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

@mistaken-pull-closer

mistaken-pull-closer Bot commented Feb 15, 2022

Copy link
Copy Markdown

Thanks for your submission.

It appears that you've created a pull request using one of our repository's branches. Since this is
almost always a mistake, we're going to go ahead and close this. If it was intentional, please
let us know what you were intending and we can see about reopening it.

Thanks again!

@mistaken-pull-closer mistaken-pull-closer Bot added the invalid This doesn't seem right label Feb 15, 2022
@pull-dog

pull-dog Bot commented Feb 15, 2022 •
edited
Loading

Copy link
Copy Markdown

*Ruff* 🐶 The test environment for this pull request has been destroyed 💥 This may have happened explicitly via a command, because the environment expired, or because the pull request was closed.

What is this?

Pull Dog is a GitHub app that makes test environments for your pull requests using Docker, from a docker-compose.yml file you specify. It takes 19 seconds to set up (we counted!) and there's a free plan available.

Visit our website to learn more.

Commands
  • @pull-dog up to reprovision or provision the server.
  • @pull-dog down to delete the provisioned server.
Troubleshooting

Need help? Don't hesitate to file an issue in our repository

Configuration

{
  "isLazy": false,
  "dockerComposeYmlFilePaths": [
    "docker-compose.yml"
  ],
  "expiry": "00:00:00",
  "conversationMode": "singleComment"
}

Trace ID
No trace ID

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

invalid This doesn't seem right

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@snyk-bot