build(deps): [security] bump npm-registry-fetch from 4.0.3 to 4.0.5 #70

Merged

dependabot-preview[bot] merged 1 commit from dependabot/npm_and_yarn/npm-registry-fetch-4.0.5 into master

2020-07-11 21:52:36 +00:00

dependabot-preview[bot] commented

2020-07-07 19:27:46 +00:00

(Migrated from github.com)

Bumps npm-registry-fetch from 4.0.3 to 4.0.5. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Sensitive information exposure through logs in npm-registry-fetch Affected versions of npm-registry-fetch are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like ://[[:]@][:][:][/]. The password value is not redacted and is printed to stdout and also to any generated log files.

Affected versions: < 4.0.5

Commits

See full diff in compare view

Maintainer changes

This version was pushed to npm by claudiahdz, a new releaser for npm-registry-fetch since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
@dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

Update frequency (including time of day and day of week)
Pull request limits (per update run and/or open at any time)
Out-of-range updates (receive only lockfile updates, if desired)
Security updates (receive only security updates, if desired)

Bumps [npm-registry-fetch](https://github.com/npm/registry-fetch) from 4.0.3 to 4.0.5. **This update includes a security fix.** <details> <summary>Vulnerabilities fixed</summary> Sourced from <a href="https://github.com/advisories/GHSA-jmqm-f2gx-4fjv">The GitHub Security Advisory Database</a>. <blockquote> Sensitive information exposure through logs in npm-registry-fetch Affected versions of <code>npm-registry-fetch</code> are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like <code>://[[:]@][:][:][/]</code>. The password value is not redacted and is printed to stdout and also to any generated log files. Affected versions: < 4.0.5 </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/npm/registry-fetch/commits">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> This version was pushed to npm by <a href="https://www.npmjs.com/~claudiahdz">claudiahdz</a>, a new releaser for npm-registry-fetch since your current version. </details> [![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=npm-registry-fetch&package-manager=npm_and_yarn&previous-version=4.0.3&new-version=4.0.5)](https://dependabot.com/compatibility-score/?dependency-name=npm-registry-fetch&package-manager=npm_and_yarn&previous-version=4.0.3&new-version=4.0.5) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) </details>

mcataford (Migrated from github.com) reviewed 2020-07-07 19:27:46 +00:00

codecov-commenter commented

2020-07-07 19:28:37 +00:00

(Migrated from github.com)

Codecov Report

Merging #70 into master will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff            @@
##            master       #70   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            1         1           
  Lines           34        34           
  Branches         5         5           
=========================================
  Hits            34        34

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 3bbff85...98e2904. Read the comment docs.

# [Codecov](https://codecov.io/gh/mcataford/packwatch/pull/70?src=pr&el=h1) Report > Merging [#70](https://codecov.io/gh/mcataford/packwatch/pull/70?src=pr&el=desc) into [master](https://codecov.io/gh/mcataford/packwatch/commit/3dbf478f6df21f4fa8d5ef0ab79e89117f6768a3&el=desc) will **not change** coverage. > The diff coverage is `n/a`. [![Impacted file tree graph](https://codecov.io/gh/mcataford/packwatch/pull/70/graphs/tree.svg?width=650&height=150&src=pr&token=IVEisJMCje)](https://codecov.io/gh/mcataford/packwatch/pull/70?src=pr&el=tree) ```diff @@ Coverage Diff @@ ## master #70 +/- ## ========================================= Coverage 100.00% 100.00% ========================================= Files 1 1 Lines 34 34 Branches 5 5 ========================================= Hits 34 34 ``` ------ [Continue to review full report at Codecov](https://codecov.io/gh/mcataford/packwatch/pull/70?src=pr&el=continue). > **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta) > `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data` > Powered by [Codecov](https://codecov.io/gh/mcataford/packwatch/pull/70?src=pr&el=footer). Last update [3bbff85...98e2904](https://codecov.io/gh/mcataford/packwatch/pull/70?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

This repo is archived. You cannot comment on pull requests.

No reviewers

mcataford