[Snyk] Upgrade mocha from 2.5.3 to 6.2.1 by snyk-bot · Pull Request #1 · ajesse11x/kompose

snyk-bot · 2019-10-26T06:28:45Z

Snyk has created this PR to upgrade mocha from 2.5.3 to 6.2.1.

Warning: This is a major version upgrade, and may be a breaking change.

The recommended version is 41 versions ahead of your current version.
The recommended version was released a month ago, on 2019-09-29.

The recommended version fixes:

Severity	Title	Issue ID
	Arbitrary Code Injection	npm:growl:20160721
	Regular Expression Denial of Service (DoS)	npm:minimatch:20160620
	Regular Expression Denial of Service (ReDoS)	npm:debug:20170905
	Regular Expression Denial of Service (ReDoS)	npm:ms:20170412

Release notes

Package name: mocha
- 6.2.1 - 2019-09-29
 6.2.1 / 2019-09-29
 
 🐛 Fixes
 - #3955: tty.getWindowSize is not a function inside a "worker_threads" worker (@1999)
 - #3970: remove extraGlobals() (@juergba)
 - #3984: Update yargs-unparser to v1.6.0 (@juergba)
 - #3983: Package 'esm': spawn child-process for correct loading (@juergba)
 - #3986: Update yargs to v13.3.0 and yargs-parser to v13.1.1 (@juergba)
 📖 Documentation
 - #3886: fix styles on mochajs.org (@outsideris)
 - #3966: Remove jsdoc index.html placeholder from eleventy file structure and fix broken link in jsdoc tutorial (@Munter)
 - #3765: Add Matomo to website (@MarioDiaz98)
 - #3947: Clarify effect of .skip() (@oliversalzburg)
- 6.2.0 - 2019-07-18
 6.2.0 / 2019-07-18
 
 🎉 Enhancements
 - #3827: Do not fork child-process if no Node flags are present (@boneskull)
 - #3725: Base reporter store ref to console.log, see mocha/wiki (@craigtaub)
 🐛 Fixes
 - #3960: Don't re-initialize grep option on watch re-run (@geigerzaehler)
 - #3942: Fix "No test files found" Error when file is passed via --file (@gabegorelick)
 - #3914: Modify Mocha constructor to accept options global or globals (@pascalpp)
 - #3894: Fix parsing of config files with _mocha binary (@juergba)
 - #3834: Fix CLI parsing with default values (@boneskull, @juergba)
 - #3831: Fix --timeout/--slow string values and duplicate arguments (@boneskull, @juergba)
 📖 Documentation
 - #3906: Document option to define custom report name for XUnit reporter (@pkuczynski)
 - #3889: Adds doc links for mocha-examples (@craigtaub)
 - #3887: Fix broken links (@toyjhlee)
 - #3841: Fix anchors to configuration section (@trescube)
 🔍 Coverage
 - #3915, #3929: Increase tests coverage for --watch options (@geigerzaehler)
 🔩 Other
 - #3953: Collect test files later, prepares improvements to the --watch mode behavior (@geigerzaehler)
 - #3939: Upgrade for npm audit (@boneskull)
 - #3930: Extract runWatch into separate module (@geigerzaehler)
 - #3922: Add mocha.min.js file to stacktrace filter (@brian-lagerman)
 - #3919: Update CI config files to use Node-12.x (@plroebuck)
 - #3892: Rework reporter tests (@plroebuck)
 - #3872: Rename --exclude to --ignore and create alias (@boneskull)
 - #3963: Hide stacktrace when cli args are missing (@outsideris)
 - #3956: Do not redeclare variable in docs array example (@DanielRuf)
 - #3957: Remove duplicate line-height property in mocha.css (@DanielRuf)
- 6.1.4 - 2019-04-18
 6.1.4 / 2019-04-18
 
 🔒 Security Fixes
 - #3877: Upgrade js-yaml, addressing code injection vulnerability (@bjornstar)
- 6.1.3 - 2019-04-12
 6.1.3 / 2019-04-11
 
 🐛 Fixes
 - #3863: Fix yargs-related global scope pollution (@inukshuk)
 - #3869: Fix failure when installed w/ pnpm (@boneskull)
- 6.1.2 - 2019-04-08
 6.1.2 / 2019-04-08
 
 🐛 Fixes
 - #3867: Re-publish v6.1.1 from POSIX OS to avoid dropped executable flags (@boneskull)
- 6.1.1 - 2019-04-07
 6.1.1 / 2019-04-07
 
 🐛 Fixes
 - #3866: Fix Windows End-of-Line publishing issue (@juergba & @cspotcode)
- 6.1.0 - 2019-04-07
 6.1.0 / 2019-04-07
 
 🔒 Security Fixes
 - #3845: Update dependency "js-yaml" to v3.13.0 per npm security advisory (@plroebuck)
 🎉 Enhancements
 - #3766: Make reporter constructor support optional options parameter (@plroebuck)
 - #3760: Add support for config files with .jsonc extension (@sstephant)
 📠 Deprecations
 
 These are soft-deprecated, and will emit a warning upon use. Support will be removed in (likely) the next major version of Mocha:
 - #3719: Deprecate this.skip() for "after all" hooks (@juergba)
 🐛 Fixes
 - #3829: Use cwd-relative pathname to load config file (@plroebuck)
 - #3745: Fix async calls of this.skip() in "before each" hooks (@juergba)
 - #3669: Enable --allow-uncaught for uncaught exceptions thrown inside hooks (@givanse)
 and some regressions:
 - #3848: Fix Suite cloning by copying root property (@fatso83)
 - #3816: Guard against undefined timeout option (@boneskull)
 - #3814: Update "yargs" in order to avoid deprecation message (@boneskull)
 - #3788: Fix support for multiple node flags (@aginzberg)
 📖 Documentation
 - mochajs/mocha-examples: New repository of working examples of common configurations using mocha (@craigtaub)
 - #3850: Remove pound icon showing on header hover on docs (@jd2rogers2)
 - #3812: Add autoprefixer to documentation page CSS (@Munter)
 - #3811: Update doc examples "tests.html" (@DavidLi119)
 - #3807: Mocha website HTML tweaks (@plroebuck)
 - #3793: Update config file example ".mocharc.yml" (@cspotcode)
 🔩 Other
 - #3830: Replace dependency "findup-sync" with "find-up" for faster startup (@cspotcode)
 - #3799: Update devDependencies to fix many npm vulnerabilities (@XhmikosR)
- 6.0.2 - 2019-02-25
 6.0.2 / 2019-02-25
 
 🐛 Fixes
 
 Two more regressions fixed:
 - #3768: Test file paths no longer dropped from mocha.opts (@boneskull)
 - #3767: --require does not break on module names that look like certain node flags (@boneskull)
- 6.0.1 - 2019-02-21
 6.0.1 / 2019-02-21
 
 The obligatory round of post-major-release bugfixes.
 
 🐛 Fixes
 
 These issues were regressions.
 - #3754 - Mocha again finds test.js when run without arguments (@plroebuck)
 - #3756 - Mocha again supports third-party interfaces via --ui (@boneskull)
 - #3755 - Fix broken --watch (@boneskull)
 - #3759 - Fix unwelcome deprecation notice when Mocha run against languages (CoffeeScript) with implicit return statements; returning a non-undefined value from a describe callback is no longer considered deprecated (@boneskull)
 📖 Documentation
 - #3738 - Upgrade to @mocha/docdash@2 (@tendonstrength)
 - #3751 - Use preferred names for example config files (@Szauka)
- 6.0.0 - 2019-02-18
 6.0.0 / 2019-02-18
 
 💥 Breaking Changes
 - #3149: Drop Node.js v4.x support (@outsideris)
 - #3556: Changes to command-line options (@boneskull):
 - --grep and --fgrep are now mutually exclusive; attempting to use both will cause Mocha to fail instead of simply ignoring --grep
 - --compilers is no longer supported; attempting to use will cause Mocha to fail with a link to more information
 - -d is no longer an alias for --debug; -d is currently ignored
 - #3275: --watch-extensions no longer implies js; it must be explicitly added (@TheDancingCode)
 - #2908: tap reporter emits error messages (@chrmod)
 - #2819: When conditionally skipping in a before hook, subsequent before hooks and tests in nested suites are now skipped (@bannmoore)
 - #627: Emit filepath in "timeout exceeded" exceptions where applicable (@boneskull)
 - #3556: lib/template.html has moved to lib/browser/template.html (@boneskull)
 - #2576: An exception is now thrown if Mocha fails to parse or find a mocha.opts at a user-specified path (@plroebuck)
 - #3458: Instantiating a Base-extending reporter without a Runner parameter will throw an exception (@craigtaub)
 - #3125: For consumers of Mocha's programmatic API, all exceptions thrown from Mocha now have a code property (and some will have additional metadata). Some Error messages have changed. Please use the code property to check Error types instead of the message property; these descriptions will be localized in the future. (@craigtaub)
 📠 Deprecations
 
 These are soft-deprecated, and will emit a warning upon use. Support will be removed in (likely) the next major version of Mocha:
 - -gc users should use --gc-global instead
 - Consumers of the function exported by bin/options should now use the loadMochaOpts or loadOptions (preferred) functions exported by the lib/cli/options module
 Regarding the Mocha class constructor (from lib/mocha):
 - Use property color: false instead of useColors: false
 - Use property timeout: false instead of enableTimeouts: false
 All of the above deprecations were introduced by #3556.
 
 mocha.opts is now considered "legacy"; please prefer RC file or package.json over mocha.opts.
 
 🎉 Enhancements
 - #3726: Add ability to unload files from require cache (@plroebuck)
 Enhancements introduced in #3556:
 - Mocha now supports "RC" files in JS, JSON, YAML, or package.json-based (using mocha property) format
 - .mocharc.js, .mocharc.json, .mocharc.yaml or .mocharc.yml are valid "rc" file names and will be automatically loaded
 - Use --config /path/to/rc/file to specify an explicit path
 - Use --package /path/to/package.json to specify an explicit package.json to read the mocha prop from
 - Use --no-config or --no-package to completely disable loading of configuration via RC file and package.json, respectively
 - Configurations are merged as applicable using the priority list:
 1. Command-line arguments
 2. RC file
 3. package.json
 4. mocha.opts
 5. Mocha's own defaults
 - Check out these example config files
 - Node/V8 flag support in mocha executable:
 - Support all allowed node flags as supported by the running version of node (also thanks to @demurgos)
 - Support any V8 flag by prepending --v8- to the flag name
 - All flags are also supported via config files, package.json properties, or mocha.opts
 - Debug-related flags (e.g., --inspect) now imply --no-timeouts
 - Use of e.g., --debug will automatically invoke --inspect if supported by running version of node
 - Support negation of any Mocha-specific command-line flag by prepending --no- to the flag name
 - Interfaces now have descriptions when listed using --interfaces flag
 - Mocha constructor supports all options
 - --extension is now an alias for --watch-extensions and affects non-watch-mode test runs as well. For example, to run only test/*.coffee (not test/*.js), you can do mocha --require coffee-script/register --extensions coffee.
 - #3552: tap reporter is now TAP13-capable (@plroebuck & @mollstam)
 - #3535: Mocha's version can now be queried programmatically via public property Mocha.prototype.version (@plroebuck)
 - #3428: xunit reporter shows diffs (@mlucool)
 - #2529: Runner now emits a retry event when tests are retried (reporters can listen for this) (@catdad)
 - #2962, #3111: In-browser notification support; warn about missing prereqs when --growl supplied (@plroebuck)
 🐛 Fixes
 - #3737: Fix falsy values from options globals (@plroebuck)
 - #3707: Fix encapsulation issues for Suite#_onlyTests and Suite#_onlySuites (@vkarpov15)
 - #3711: Fix diagnostic messages dealing with plurality and markup of output (@plroebuck)
 - #3723: Fix "reporter-option" to allow comma-separated options (@boneskull)
 - #3722: Fix code quality and performance of lookupFiles and files (@plroebuck)
 - #3650, #3654: Fix noisy error message when no files found (@craigtaub)
 - #3632: Tests having an empty title are no longer confused with the "root" suite (@juergba)
 - #3666: Fix missing error codes (@vkarpov15)
 - #3684: Fix exiting problem in Node.js v11.7.0+ (@addaleax)
 - #3691: Fix --delay (and other boolean options) not working in all cases (@boneskull)
 - #3692: Fix invalid command-line argument usage not causing actual errors (@boneskull)
 - #3698, #3699: Fix debug-related Node.js options not working in all cases (@boneskull)
 - #3700: Growl notifications now show the correct number of tests run (@outsideris)
 - #3686: Avoid potential ReDoS when diffing large objects (@cyjake)
 - #3715: Fix incorrect order of emitted events when used programmatically (@boneskull)
 - #3706: Fix regression wherein --reporter-option/--reporter-options did not support comma-separated key/value pairs (@boneskull)
 - Fix missing mocharc.json in published package (@boneskull)
 - #3356: --no-timeouts and --timeout 0 now does what you'd expect (@boneskull)
 - #3475: Restore --no-exit option (@boneskull)
 - #3570: Long-running tests now respect SIGINT (@boneskull)
 - #2944: --forbid-only and --forbid-pending now "fail fast" when encountered on a suite (@outsideris)
 - #1652, #2951: Fix broken clamping of timeout values (@plroebuck)
 - #2095, #3521: Do not log stdout: prefix in browser console (@Bamieh)
 - #3595: Fix mochajs.org deployment problems (@papandreou)
 - #3518: Improve utils.isPromise() (@fabiosantoscode)
 - #3320: Fail gracefully when non-extensible objects are thrown in async tests (@fargies)
 - #2475: XUnit does not duplicate test result numbers in "errors" and "failures"; "failures" will always be zero (@mlucool)
 - #3398, #3598, #3457, #3617: Fix regression wherein --bail would not execute "after" nor "after each" hooks (@juergba)
 - #3580: Fix potential exception when using XUnit reporter programmatically (@Lana-Light)
 - #1304: Do not output color to TERM=dumb (@plroebuck)
 📖 Documentation
 - #3525: Improvements to .github/CONTRIBUTING.md (@markowsiak)
 - #3466: Update description of slow option (@finfin)
 - #3405: Remove references to bower installations (@goteamtim)
 - #3361: Improvements to --watch docs (@benglass)
 - #3136: Improve docs around globbing and shell expansion (@akrawchyk)
 - #2819: Update docs around skips and hooks (@bannmoore)
 - Many improvements by @outsideris
 - #3652: Switch from Jekyll to Eleventy (@Munter)
 🔩 Other
 - #3677: Add error objects for createUnsupportedError and createInvalidExceptionError (@boneskull)
 - #3733: Removed unnecessary processing in post-processing hook (@wanseob)
 - #3730: Update nyc to latest version (@coreyfarrell)
 - #3648, #3680: Fixes to support latest versions of unexpected and unexpected-sinon (@sunesimonsen)
 - #3638: Add meta tag to site (@MartijnCuppens)
 - #3653: Fix parts of test suite failing to run on Windows (@boneskull)
 - #3557: Use ms userland module instead of hand-rolled solution (@gizemkeser)
 - Many CI fixes and other refactors by @plroebuck
 - Test refactors by @outsideris
- 6.0.0-1 - 2019-01-02
```
 </li>
 <li>
 6.0.0-0 - <a href="">2019-01-01</a>
 
 </li>
 <li>
 5.2.0 - <a href="">2018-05-18</a>
 
 </li>
 <li>
 5.1.1 - <a href="">2018-04-18</a>
 
 </li>
 <li>
 5.1.0 - <a href="">2018-04-12</a>
 
 </li>
 <li>
 5.0.5 - <a href="">2018-03-23</a>
 
 </li>
 <li>
 5.0.4 - <a href="">2018-03-07</a>
 
 </li>
 <li>
 5.0.3 - <a href="">2018-03-07</a>
 
 </li>
 <li>
 5.0.2 - <a href="">2018-03-06</a>
 
 </li>
 <li>
 5.0.1 - <a href="">2018-02-13</a>
 
 </li>
 <li>
 5.0.0 - <a href="">2018-01-18</a>
 
 </li>
 <li>
 4.1.0 - <a href="">2017-12-29</a>
 
 </li>
 <li>
 4.0.1 - <a href="">2017-10-06</a>
 
 </li>
 <li>
 4.0.0 - <a href="">2017-10-03</a>
 
 </li>
 <li>
 3.5.3 - <a href="">2017-09-11</a>
 
 </li>
 <li>
 3.5.2 - <a href="">2017-09-10</a>
 
 </li>
 <li>
 3.5.1 - <a href="">2017-09-10</a>
 
 </li>
 <li>
 3.5.0 - <a href="">2017-07-31</a>
 
 </li>
 <li>
 3.4.2 - <a href="">2017-05-24</a>
 
 </li>
 <li>
 3.4.1 - <a href="">2017-05-14</a>
 
 </li>
 <li>
 3.3.0 - <a href="">2017-04-24</a>
 
 </li>
 <li>
 3.2.0 - <a href="">2016-11-24</a>
 
 </li>
 <li>
 3.1.2 - <a href="">2016-10-11</a>
 
 </li>
 <li>
 3.1.1 - <a href="">2016-10-10</a>
 
 </li>
 <li>
 3.1.0 - <a href="">2016-09-27</a>
 
 </li>
 <li>
 3.0.2 - <a href="">2016-08-08</a>
 
 </li>
 <li>
 3.0.1 - <a href="">2016-08-04</a>
 
 </li>
 <li>
 3.0.0 - <a href="">2016-08-01</a>
 
 </li>
 <li>
 3.0.0-2 - <a href="">2016-07-26</a>
 
 </li>
 <li>
 3.0.0-1 - <a href="">2016-07-08</a>
 
 </li>
 <li>
 3.0.0-0 - <a href="">2016-07-03</a>
 
 </li>
 <li>
 2.5.3 - <a href="">2016-05-25</a>
 
 </li>
</ul>
```

------------

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade mocha from 2.5.3 to 6.2.1. See this package in NPM: https://www.npmjs.com/package/mocha See this project in Snyk: https://app.snyk.io/org/ajesse11x/project/22b05c4f-cc9a-4abb-86fc-c67046243258?utm_source=github&utm_medium=upgrade-pr

Conversation

snyk-bot commented Oct 26, 2019

6.2.1 / 2019-09-29

🐛 Fixes

📖 Documentation

6.2.0 / 2019-07-18

🎉 Enhancements

🐛 Fixes

📖 Documentation

🔍 Coverage

🔩 Other

6.1.4 / 2019-04-18

🔒 Security Fixes

6.1.3 / 2019-04-11

🐛 Fixes

6.1.2 / 2019-04-08

🐛 Fixes

6.1.1 / 2019-04-07

🐛 Fixes

6.1.0 / 2019-04-07

🔒 Security Fixes

🎉 Enhancements

📠 Deprecations

🐛 Fixes

📖 Documentation

🔩 Other

6.0.2 / 2019-02-25

🐛 Fixes

6.0.1 / 2019-02-21

🐛 Fixes

📖 Documentation

6.0.0 / 2019-02-18

💥 Breaking Changes

📠 Deprecations

🎉 Enhancements

🐛 Fixes

📖 Documentation

🔩 Other

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant