This repository was archived by the owner on Jul 3, 2024. It is now read-only.
Update dependency stylelint to v15 [SECURITY] #163
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
13.13.1->15.10.1GitHub Vulnerability Alerts
GHSA-f7xj-rg7h-mc87
Summary
Our
meowdependency (which we use for our CLI) depended on[email protected]. A vulnerability in this version ofsemverwas recently identified and surfaced bynpm audit:Regular Expression Denial of Service - GHSA-c2qf-rxjj-qqgw
Details
Original post by the reporter:
"my npm audit show the report
semver <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - GHSA-c2qf-rxjj-qqgw
No fix available
And my dependencies tree for semver show your package
├─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └─┬ [email protected]
│ └── [email protected] deduped
I found that [email protected] contains normalize-package-data@5 and I can fix this vulnerability because it uses semver@7. But I can't update meow to the new major version because your package doesn't allow it."
Update your package to use the 'meow' version >=10"
PoC
N/A
Impact
We anticipate the impact to be low as Stylelint is a dev tool and
meowis only used on the CLI pathway.Release Notes
stylelint/stylelint (stylelint)
v15.10.1Compare Source
semvervulnerability (#7043) (@romainmenke).v15.10.0Compare Source
media-query-no-invalid(#6963) (@romainmenke).extendsconfig option (#6998) (@fpetrakov).erroredproperties instylelint.lint()return value (#6983) (@ybiquitous).{selector,value}-no-vendor-prefixperformance (#7016) (@jeddy3).custom-property-patternperformance (#7009) (@jeddy3).function-linear-gradient-no-nonstandard-directionfalse positives for<color-interpolation-method>(#6987) (@romainmenke).function-name-caseperformance (#7010) (@jeddy3).function-no-unknownperformance (#7004) (@jeddy3).function-url-quotesperformance (#7011) (@jeddy3).hue-degree-notationfalse negatives foroklch(#7015) (@romainmenke).hue-degree-notationperformance (#7012) (@jeddy3).media-feature-name-no-unknownfalse positives forenvironment-blending,nav-controls,prefers-reduced-data, andvideo-color-gamut(#6978) (@romainmenke).media-feature-name-no-vendor-prefixpositions for*-device-pixel-ratio(#6977) (@romainmenke).no-descending-specificityperformance (#7026) (@romainmenke).no-duplicate-at-import-rulesfalse negatives for imports withsupportsandlayerconditions (#7001) (@romainmenke).selector-anb-no-unmatchableperformance (#7042) (@romainmenke).selector-id-patternperformance (#7013) (@jeddy3).selector-pseudo-class-no-unknownfalse negatives for pseudo-elements with matching names (#6964) (@Mouvedia).selector-pseudo-element-no-unknownperformance (#7007) (@jeddy3).selector-type-caseperformance (#7041) (@romainmenke).selector-type-no-unknownperformance (#7027) (@romainmenke).unit-disallowed-listfalse negatives with percentages (#7018) (@romainmenke).v15.9.0Compare Source
insideFunctions: {"function": int}tonumber-max-precision(#6932) (@romainmenke).declaration-block-no-redundant-longhand-propertiesautofix forborder-radiusshorthand (#6958) (@mattxwang).declaration-block-no-redundant-longhand-propertiesautofix forborder-widthshorthand (#6956) (@mattxwang).declaration-block-no-redundant-longhand-propertiesautofix forgrid-columnandgrid-row(#6957) (@mattxwang).v15.8.0Compare Source
media-feature-name-value-no-unknown(#6906) (@romainmenke)..mjsconfiguration files (#6910) (@ybiquitous).--print-configdescription in CLI help (#6914) (@ybiquitous).allowEmptyInputoption in configuration files (#6929) (@ybiquitous).custom-property-no-missing-var-functionperformance (#6922) (@romainmenke).function-calc-no-unspaced-operatorperformance (#6923) (@romainmenke).function-linear-gradient-no-nonstandard-directionperformance (#6924) (@romainmenke).function-no-unknownfalse positives for SCSS functions with namespace (#6921) (@romainmenke).max-nesting-deptherror for at-rules in Sass syntax (#6909) (@ybiquitous).selector-anb-no-unmatchableperformance (#6925) (@romainmenke).v8-compile-cachedependency (#6907) (@ybiquitous).v15.7.0Compare Source
splitList: booleantoselector-nested-pattern(#6896) (@is2ei).unit-no-unknownfalse positives forunicode-rangedescriptors (#6892) (@romainmenke).v15.6.3Compare Source
alpha-value-notationfalse positives forcolor()(#6885) (@romainmenke).alpha-value-notationperformance with improved benchmark script (#6864) (@romainmenke).at-rule-property-required-listperformance (#6865) (@romainmenke).color-*performance (#6868) (@romainmenke).length-zero-no-unitfalse positives on new math functions (#6871) (@romainmenke).stringformatter for unexpected truncation on non-ASCII characters (#6861) (@Max10240).unit-no-unknownfalse positives for the second and subsequentimage-set()withxdescriptor (#6879) (@romainmenke).v15.6.2Compare Source
alpha-value-notationfalse negatives foroklab(),oklch(), andcolor()(#6844) (@romainmenke).declaration-block-no-redundant-longhand-propertiesautofix withcubic-bezier()(#6841) (@romainmenke).function-no-unknownfalse positives for unspaced operators against nested brackets (#6842) (@romainmenke).function-url-quotesfalse positives for SCSSwith()construct (#6847) (@ybiquitous).media-feature-name-no-unknownfalse positives fornotandor(#6838) (@romainmenke).v15.6.1Compare Source
declaration-block-no-redundant-longhand-propertiesautofix fortransition(#6815) (@mattxwang).githubformatter for missing final newline (#6822) (@konomae).selector-pseudo-class-no-unknownfalse positive for:modal(#6811) (@Yasir761).v15.6.0Compare Source
allowEmptyInput,cache,fixoptions to configuration object (#6778) (@mattxwang).ignore: ["with-var-inside"]tocolor-function-notation(#6802) (@mattxwang).declaration-block-no-duplicate-propertiesautofix for 3 or more duplicates (#6801) (@mattxwang).declaration-block-no-duplicate-propertiesfalse positives with optionignore: ["consecutive-duplicates-with-different-syntaxes"](#6797) (@romainmenke).declaration-block-no-duplicate-propertiessyntax error (#6792) (@yoyo837).declaration-block-no-redundant-longhand-propertiesautofix forgrid-template(#6777) (@mattxwang).function-url-quotesautofix for comments in SCSS function (#6800) (@ybiquitous).v15.5.0Compare Source
ignore: ["consecutive-duplicates-with-different-syntaxes"]todeclaration-block-no-duplicate-properties(#6772) (@kimulaco).ignoreProperties: []todeclaration-block-no-duplicate-custom-properties(#6773) (@mattxwang).ignorePropertiesfordeclaration-block-no-duplicate-properties(#6764) (@ybiquitous).block-no-emptyfalse positives with non-whitespace characters (#6782) (@ybiquitous).color-function-notationfalse positives for namespaced imports (#6774) (@mattxwang).custom-property-empty-line-beforefalse positives for CSS-in-JS (#6767) (@ybiquitous).media-feature-range-notationparse error (#6760) (@fpetrakov).v15.4.0Compare Source
--quiet-deprecation-warningsflag (#6724) (@mattxwang).-calias for--config(#6720) (@sidverma32).media-feature-range-notationautofix (#6742) (@romainmenke).no-unknown-custom-propertiesrule (#6731) (@jameschensmith).function-url-quotesautofix for double-slash comments in SCSS maps (#6745) (@jgerigmeyer).isPathIgnored()utility's performance (#6728) (@ybiquitous).rule-selector-property-disallowed-listsecondary options (#6723) (@mattxwang).declaration-block-no-redundant-longhand-propertieswith basic keywords (#6748) (@mattxwang).v15.3.0Compare Source
configurationCommentconfiguration property (#6629) (@ifitzpatrick).selector-anb-no-unmatchablerule (#6678) (@mattxwang).*-no-redundant-*false negatives forinsetshorthand (#6699) (@rayrw).function-url-quotesautofix for multipleurl()(#6711) (@ybiquitous).value-keyword-casefalse positives for Level 4 system colours (#6712) (@thewilkybarkid).v15.2.0Compare Source
messageArgsto 76 rules (#6589) (@kizu).PluginandRuleContext(#6664) (@henryruhs).overrides.extendsorder when including same rules (#6660) (@kuoruan).annotation-no-unknownfalse positives for CSS-in-JS template literals (#6666) (@hudochenkov).declaration-property-value-no-unknownfalse positives for at-rule descriptors (#6669) (@FloEdelmann).declaration-property-value-no-unknownparse error foralpha(opacity=n)to report as violation (#6650) (@romainmenke).function-name-casefalse positives for CSS-in-JS template literals (#6666) (@hudochenkov).function-no-unknownfalse positives for CSS-in-JS template literals (#6666) (@hudochenkov).unit-no-unknownfalse positives for CSS-in-JS template literals (#6666) (@hudochenkov).value-keyword-casefalse positives for CSS-in-JS template literals (#6666) (@hudochenkov).v15.1.0Compare Source
declaration-block-no-redundant-longhand-propertiesautofix (#6580) (@mattxwang).declaration-property-value-no-unknownfalse positives forenv()(#6646) (@romainmenke).function-calc-no-unspaced-operatorTypeError on emptycalc()(#6634) (@romainmenke).customSyntaxinference (#6645) (@ybiquitous).v15.0.0Compare Source
Migrating to
15.0.0guide.syntaxoption (#6420) (@fpetrakov). (BREAKING)extendsinoverridesto merge to be consistent withpluginsbehaviour (#6380) (@jasikpark). (BREAKING)declaration-property-value-no-unknownrule (#6511) (@jeddy3).media-feature-name-unit-allowed-listrule (#6550) (@mattxwang).function-url-quotesautofix (#6558) (@mattxwang).ignore: ["custom-elements"]toselector-max-type(#6588) (@muddv).ignoreFunctions: []tounit-disallowed-list(#6592) (@mattxwang).declaration-property-unit-allowed-list(#6570) (@mattxwang).overrides.filesin config to allow basename glob patterns (#6547) (@ybiquitous).at-rule-no-unknownfalse positives for@scroll-timeline(#6554) (@mattxwang).function-no-unknownfalse positives for interpolation and backticks in CSS-in-JS (#6565) (@hudochenkov).keyframe-selector-notationfalse positives for named timeline ranges (#6605) (@kimulaco).property-no-unknownfalse negatives for newer custom syntaxes (#6553) (@43081j).selector-attribute-quotesfalse positives for "never" (#6571) (@mattxwang).selector-not-notationautofix for "simple" option (#6608) (@Mouvedia).v14.16.1Compare Source
customSyntaxresolution withconfigBasedir(#6536) (@ybiquitous).declaration-block-no-duplicate-propertiesautofix for!important(#6528) (@sidx1024).function-no-unknownfalse positives forscroll,-webkit-gradient,color-stop,from, andto(#6539) (@Mouvedia).value-keyword-casefalse positives for mixed caseignoreFunctionsoption (#6517) (@kimulaco).outputin Node.js API lint result when any rule containsdisableFix: true(#6543) (@adrianjost).v14.16.0Compare Source
media-feature-range-notationrule (#6497) (@jeddy3).json(#6480) (@ybiquitous).v14.15.0Compare Source
--globby-optionsflag (#6437) (@sidverma32).at-rule-disallowed-list,declaration-property-unit-disallowed-list,declaration-property-value-disallowed-list,function-disallowed-list, andproperty-disallowed-list(#6463) (@chloerice).checkAgainstRule(#6466) (@aaronccasanova).checkAgainstRulewith custom rules (#6460) (@aaronccasanova).stringformatter colorized (#6443) (@ybiquitous).import-lazypackage to fit bundlers (#6449) (@phoenisx).v14.14.1Compare Source
declaration-block-no-redundant-longhand-propertiesfalse positives forinheritkeyword (#6419) (@kimulaco).shorthand-property-no-redundant-valuesmessage to be consistent (#6417) (@fpetrakov).unit-no-unknownfalse positives for*vi&*vbviewport units (#6428) (@sidverma32).v14.14.0Compare Source
*-patterncustom message formatting (#6391) (@ybiquitous).block-no-emptyfalse positives forreportNeedlessDisables(#6381) (@ybiquitous).printf-like formatting for custom messages (#6389) (@ybiquitous).unit-no-unknownfalse positives for font-relative length units (#6374) (@ybiquitous).severityoption (#6384) (@kimulaco).file-entry-cacheimport (#6393) (@adidahiya).v14.13.0Compare Source
cacheStrategyoption (#6357) (@kaorun343).selector-pseudo-element-no-unknownfalse positives for::highlightpseudo-element (#6367) (@jathak).v14.12.1Compare Source
font-weight-notationmessages (#6350) (@ybiquitous).v14.12.0Compare Source
--ignore-pathflags (#6345) (@kimulaco).declaration-block-no-duplicate-propertiesautofix (#6296) (@fpetrakov).font-weight-notationautofix (#6347) (@ybiquitous).ignore: ["inside-block"]andsplitListtoselector-disallowed-list(#6334) (@mattmanuel90).ignorePseudoClassesoption ofselector-pseudo-class-no-unknown(#6316) (@ybiquitous).ignorePseudoElementsoption ofselector-pseudo-element-no-unknown(#6317) (@ybiquitous).ignoreSelectorsoption ofselector-no-vendor-prefix(#6327) (@ybiquitous).ignoreTypesoption ofselector-type-case(#6326) (@ybiquitous).*-no-unknownfalse positives for container queries (#6318) (@fpetrakov).font-family-name-quotesfalse positives for interpolation and shorthand (#6335) (@kimulaco).time-min-millisecondsincorrect location for matching violating times (#6319) (@kawaguchi1102).v14.11.0Compare Source
ignoreAfterCombinators: []toselector-max-universal(#6275).createPlugintype definition (#6264).alpha-value-notationfalse negatives for SVG properties (#6284).keyframes-name-patternfalse positives for interpolation (#6265).selector-nested-patternend positions (#6259).selector-no-qualifying-typemessage, positions, and false positives (#6260).selector-no-vendor-prefixend positions (#6261).selector-pseudo-class-allowed-listend positions and message (#6262).selector-pseudo-class-disallowed-listend positions and message (#6263).selector-pseudo-element-allowed-listend positions and message (#6270).selector-pseudo-element-disallowed-listend positions and message (#6270).shorthand-property-no-redundant-valuesmessage (#6272).time-min-millisecondsend positions (#6273).v14.10.0Compare Source
LinterResultAPI (#6166).meta.fixableproperty to each rule (#6181).annotation-no-unknownrule (#6155).keyframe-selector-notationrule (#6164).percentage-unless-within-keyword-only-blockprimary option tokeyframe-selector-notation(#6194).githubformatter (#6150).stringandverboseformatters (#6153).verboseandgithubformatters (#6183).false(#6250).at-rule-*end positions (#6163).declaration-block-no-redundant-longhand-propertiesend positions (#6219).declaration-property-value-allowed-listfalse positives for multiple match (#6190).declaration-property-value-disallowed-listfalse negatives for multiple match (#6188).named-grid-areas-no-invalidend positions (#6205).no-descending-specificityfalse positives for pseudo-classes (#6195).no-unknown-animationsend positions (#6221).no-unknown-animationsfalse positives for SCSS interpolation (#6185).number-max-precisionend positions (#6184).property-*end positions (#6174).rule-selector-property-disallowed-listend positions (#6222).selector-attribute-name-disallowed-listend positions (#6223).selector-attribute-operator-allowed-listend positions (#6224).selector-attribute-operator-disallowed-listend positions (#6225).selector-attribute-quotesend positions (#6226).selector-class-patternend positions (#6227).selector-combinator-allowed-listandselector-combinator-disallowed-listend positions (#6229).selector-disallowed-listend positions (#6230).selector-id-patternend positions (#6231).selector-not-notationend positions (#6201).selector-pseudo-element-colon-notationend positions (#6235).string-no-newlineend positions (#6218).unit-*start and end positions (#6169).value-no-vendor-prefixend positions (#6173).v14.9.1Compare Source
selector-max-specificityfalse positives for:nth-child(#6140).v14.9.0Compare Source
import-notationrule (#6102).no-duplicate-selectorsfalse positives for SCSS/Less nested interpolations (#6118).no-descending-specificityandselector-max-specificityfalse positives for:is()and:where()(#6131).v14.8.5Compare Source
no-duplicate-selectorsfalse positives with Less syntax (#6111).v14.8.4Compare Source
no-duplicate-selectorserror with non-standard selectors (#6106).v14.8.3Compare Source
at-rule-no-unknownfalse positives for@layer(#6093).length-zero-no-unitautofix for.0values (#6098).media-feature-name-no-unknownfalse positives fordisplay-mode(#6073).no-descending-specificityend positions (#6049).no-duplicate-*end positions (#6047).no-invalid-*end positions (#6072).no-invalid-position-at-import-rulefalse positives for@layer(#6094).v14.8.2Compare Source
function-calc-no-unspaced-operatorfalse positives for non-standard variables (#6053).selector-*-no-unknownend positions (#6046).v14.8.1Compare Source
declaration-block-no-*end positions that avoid errors (#6040).function-calc-no-unspaced-operatorfalse positives and memory leak (#6045).named-grid-areas-no-invalidfalse positives for arealess templates (#6042).v14.8.0Compare Source
keyframe-block-no-duplicate-selectorsrule (#6024).property-*-listsupport for vendor prefixes (#6025).at-rule-*-listend positions (#6032).at-rule-no-unknownend positions (#6026).function-linear-gradient-no-nonstandard-directionfalse negative about-ms-linear-gradient(#6031).function-no-unknownend positions (#6038).property-no-unknownend positions (#6039).v14.7.1Compare Source
/* stylelint-disable */comments (#6018).font-family-name-quotesfalse positives forui-*generic system font keywords (#6017).v14.7.0Compare Source
selector-not-notationrule (#5975).font-weight-notationfalse positives for Sass functions and column position (#6005).v14.6.1Compare Source
custom-property-patternTypeError for "Cannot destructure property..." (#5982).selector-type-casefalse positives for SVG elements (#5973).unit-no-unknownfalse positives for large/small/dynamic viewport units (#5970).v14.6.0Compare Source
declaration-property-max-valuesrule (#5920).*-no-importantcolumn position (#5957).custom-property-patternfalse positives for interpolation in property name (#5949).font-family-name-quotescolumn position (#5955).selector-pseudo-*-no-unknownfalse positives and negatives (#5959).selector-pseudo-class-no-unknownfalse positives and negatives (#5956).v14.5.3Compare Source
*-listinvalid option warnings for strings (#5934).v14.5.2Compare Source
*-listfalse negatives for invalid options (#5924).custom-property-patternfalse positives for interpolation insidevar()(#5925).declaration-property-value-*-listcolumn position (#5926).v14.5.1Compare Source
function-no-unknownENOENT and TypeErrors (#5916).function-no-unknownfalse positives for interpolation (#5914).v14.5.0Compare Source
ignoreFunctions: []tofunction-no-unknown(#5901).v14.4.0Compare Source
function-no-unknownrule (#5865).font-family-name-quotesautofix (#5806).custom-property-patternfalse negatives for custom properties withinvar()(#5867).no-descending-specificityparseError for double-slash comments within selector lists (#5891).selector-pseudo-element-colon-notationfalse positives for escaped colons (#5879).v14.3.0Compare Source
meta.urlto rules and plugins (#5845).ignore: ["rules"] / ["at-rules"]toblock-opening-brace-*-after(#5830).ignoreSelectors: []toproperty-case(#5822).ignoreFunctions: []tounit-allowed-list(#5857).camelCaseSvgKeywordstovalue-keyword-case- use this option if you want legacy camel case SVG keywords likecurrentColor(#5849).font-family-no-missing-generic-family-keywordfalse positives forrevertandrevert-layer(#5852).no-descending-specificityfalse positives for the::-moz-focus-innerpseudo-element (#5831).value-keyword-casefalse negatives for SVG keywords likecurrentcolor(#5849).v14.2.0Compare Source
cwdoption to Node.js API (#5721).resolveConfigoption to Node.js API (#5734).customSyntaxrequire handling (#5763).color-function-notationfalse positives for variables and color functions (#5793)color-namedfalse positives for hex with alpha-channel and false negatives for modern syntax (#5718).declaration-empty-line-beforesupport for HTML files (#5689).indentationTypeError for syntaxes that use Document node type (#5771).v14.1.0Compare Source
--output-fileflag (#5672).ConfigurationErrortype (#5696).rule-selector-property-disallowed-listrule (#5679).ignore: ["consecutive-duplicates-with-same-prefixless-values"]todeclaration-block-no-duplicate-properties(#5609).ignorePseudoClasses: []tomax-nesting-depth(#5620).color-function-notationfalse positives for hex coloursConfiguration
📅 Schedule: Branch creation - "" in timezone UTC, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.