Skip to content

chore(deps-dev): bump pug from 2.0.4 to 3.0.1#2690

Merged
trentm merged 1 commit intomainfrom
dependabot/npm_and_yarn/pug-3.0.1
May 18, 2022
Merged

chore(deps-dev): bump pug from 2.0.4 to 3.0.1#2690
trentm merged 1 commit intomainfrom
dependabot/npm_and_yarn/pug-3.0.1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github May 12, 2022 •
edited
Loading

Bumps pug from 2.0.4 to 3.0.1.

Release notes

Sourced from pug's releases.

pug-code-gen@3.0.1

Bug Fixes

  • Update with to resolve core-js deprecation notice (#3259)

pug-runtime@3.0.1

Bug Fixes

  • Properly handle non-string values when rethrowing errors (#3269)

pug@3.0.1

Bug Fixes

  • Sanitise the pretty option (#3314)

    If a malicious attacker could control the pretty option, it was possible for them to achieve remote code execution on the server rendering the template. All pug users should upgrade as soon as possible, see #3312 for more details.

pug-attrs@3.0.0

Breaking Changes

  • Drop support for node 6 and 8 (#3243)

pug-code-gen@3.0.0

Breaking Changes

  • Drop support for node 6 and 8 (#3243)

New Features

  • Support EachOf nodes (#3179)

pug-load@3.0.0

Breaking Changes

  • read plugins must now return Buffer if you want to support filters that use renderBuffer (#3213)

  • Drop support for node 6 and 8 (#3243)

New Features

  • File nodes now get a raw property that is a Buffer, in addition to the str (#3213)

pug-runtime@3.0.0

Breaking Changes

  • Drop support for node 6 and 8 (#3243)

Bug Fixes

  • wrap setting err.message with a try/catch (#2996)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by pug-bot, a new releaser for pug since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label May 12, 2022
@github-actions github-actions bot added agent-nodejs Make available for APM Agents project planning. community triage labels May 12, 2022
@ghost
Copy link
Copy Markdown

ghost commented May 12, 2022 •
edited by ghost
Loading

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2022-05-18T22:26:57.371+0000

  • Duration: 20 min 13 sec

Test stats 🧪

Test Results
Failed 0
Passed 255015
Skipped 0
Total 255015

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • run module tests for <modules> : Run TAV tests for one or more modules, where <modules> can be either a comma separated list of modules (e.g. memcached,redis) or the string literal ALL to test all modules

  • run benchmark tests : Run the benchmark test only.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@trentm trentm self-assigned this May 12, 2022
@trentm trentm mentioned this pull request May 17, 2022
Merged
@trentm
Copy link
Copy Markdown
Member

trentm commented May 18, 2022 •
edited
Loading

Currently this depends on us getting #2698 in first. There is a SNAFU here:

  • On one hand the 'hapi' package (in our devDependencies) uses npm-shrinkwrap.json to specify some deps that are not in its package.json. E.g. the "bourne" package. At the time this 'hapi' package was developed (it is deprecated now), the package-lock handling in npm would include entries for packages like this.
  • Eventually npm's package-lock handling would mark these entries as "extraneous": true -- perhaps around the same time lockfileVersion: 2 was added (changing the package-lock file structure).
  • Sometime (I think in npm v8, the npm version that comes by default with node 16 and above), package-lock updates would drop those extraneous entries:
-    "node_modules/hapi/node_modules/bourne": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/bourne/-/bourne-1.1.1.tgz",
-      "integrity": "sha512-Ou0l3W8+n1FuTOoIfIrCk9oF9WVWc+9fKoAl67XQr9Ws0z7LgILRZ7qtc9xdT4BveSKtnYXfKPgn8pFAqeQRew==",
-      "extraneous": true
-    },

What this means is that package-lock updates from an npm v8 or later will create a package-lock file that when used by an older npm (e.g. by an older node for CI testing) will no longer install those "extraneous" entries, and the install will be broken.

Said more concretely, any update to this project's package-lock file by npm v8 or later (this includes dependabot PRs like this one) creates a package-lock file that results in a broken npm install in node v14 or lower:

% node --version
v14.19.1
% npm install
...
% node
Welcome to Node.js v14.19.1.
Type ".help" for more information.
> require('hapi')
Uncaught Error: Cannot find module 'bourne'
Require stack:
- /Users/trentm/el/apm-agent-nodejs19/node_modules/hapi/node_modules/statehood/lib/index.js
- /Users/trentm/el/apm-agent-nodejs19/node_modules/hapi/lib/core.js
- /Users/trentm/el/apm-agent-nodejs19/node_modules/hapi/lib/server.js
- /Users/trentm/el/apm-agent-nodejs19/node_modules/hapi/lib/index.js
- <repl>
    at Function.Module._resolveFilename (internal/modules/cjs/loader.js:902:15)
    at Function.Module._load (internal/modules/cjs/loader.js:746:27)
    at Module.require (internal/modules/cjs/loader.js:974:19)
    at require (internal/modules/cjs/helpers.js:101:18) {
  code: 'MODULE_NOT_FOUND',
  requireStack: [
    '/Users/trentm/el/apm-agent-nodejs19/node_modules/hapi/node_modules/statehood/lib/index.js',
    '/Users/trentm/el/apm-agent-nodejs19/node_modules/hapi/lib/core.js',
    '/Users/trentm/el/apm-agent-nodejs19/node_modules/hapi/lib/server.js',
    '/Users/trentm/el/apm-agent-nodejs19/node_modules/hapi/lib/index.js',
    '<repl>'
  ]
}
>

@dependabot
chore(deps-dev): bump pug from 2.0.4 to 3.0.1
99f7ec0 
Bumps [pug](https://github.com/pugjs/pug) from 2.0.4 to 3.0.1.
- [Release notes](https://github.com/pugjs/pug/releases)
- [Commits](https://github.com/pugjs/pug/compare/pug@2.0.4...pug@3.0.1)

---
updated-dependencies:
- dependency-name: pug
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/npm_and_yarn/pug-3.0.1 branch from 4addddd to 99f7ec0 Compare May 18, 2022 22:26
@trentm trentm removed the triage label May 18, 2022
@trentm
Copy link
Copy Markdown
Member

trentm commented May 18, 2022

We already test with pug@3 (via .tav.yml) so this is an easy update to take.

@trentm trentm merged commit 27588b7 into main May 18, 2022
@trentm trentm deleted the dependabot/npm_and_yarn/pug-3.0.1 branch May 18, 2022 23:10
astorm pushed a commit that referenced this pull request May 19, 2022
@dependabot
chore(deps-dev): bump pug from 2.0.4 to 3.0.1 (#2690)
ac19339
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@trentm trentm trentm approved these changes

Assignees

@trentm trentm

Labels

agent-nodejs Make available for APM Agents project planning. community dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@trentm