@stoplight/spectral - npm Package Compare versions

Comparing version 5.8.0 to 5.8.1

CHANGELOG.md

@@ -10,2 +10,8 @@ <!-- markdown-link-check-disable -->
 
+## [5.8.1] - 2021-02-11
+
+### Fixed
+
+- Address Immer potential security vulnerability, as well as update a few other dependencies [#1499](https://github.com/stoplightio/spectral/issues/1499)
+
 ## [5.8.0] - 2021-01-04
@@ -12,0 +18,0 @@

dist/consts.d.ts

 import { IParserOptions } from './types/ruleset';
 export declare const NPM_PKG_ROOT = "https://unpkg.com/";
 export declare const SPECTRAL_PKG_NAME = "@stoplight/spectral";
-export declare const SPECTRAL_PKG_VERSION = "5.8.0";
+export declare const SPECTRAL_PKG_VERSION = "5.8.1";
 export declare const DEFAULT_PARSER_OPTIONS: Readonly<Required<IParserOptions>>;

dist/consts.js

@@ -7,3 +7,3 @@ "use strict";
 exports.SPECTRAL_PKG_NAME = '@stoplight/spectral';
-exports.SPECTRAL_PKG_VERSION = '5.8.0';
+exports.SPECTRAL_PKG_VERSION = '5.8.1';
 exports.DEFAULT_PARSER_OPTIONS = Object.freeze({
@@ -10,0 +10,0 @@ incompatibleValues: types_1.DiagnosticSeverity.Error,

package.json

 {
   "name": "@stoplight/spectral",
-  "version": "5.8.0",
+  "version": "5.8.1",
   "description": "A flexible object linter with out of the box support for OpenAPI v2 and v3.",
@@ -66,8 +66,8 @@ "keywords": [
     "@stoplight/better-ajv-errors": "0.0.3",
-    "@stoplight/json": "3.9.0",
+    "@stoplight/json": "3.10.2",
     "@stoplight/json-ref-readers": "1.2.1",
-    "@stoplight/json-ref-resolver": "3.1.0",
-    "@stoplight/lifecycle": "2.3.1",
+    "@stoplight/json-ref-resolver": "3.1.1",
+    "@stoplight/lifecycle": "2.3.2",
     "@stoplight/path": "1.3.2",
-    "@stoplight/types": "^11.9.0",
+    "@stoplight/types": "11.9.0",
     "@stoplight/yaml": "4.2.1",
@@ -77,12 +77,12 @@ "abort-controller": "3.0.0",
     "ajv-oai": "1.2.0",
-    "blueimp-md5": "2.13.0",
-    "chalk": "4.0.0",
+    "blueimp-md5": "2.18.0",
+    "chalk": "4.1.0",
     "eol": "0.9.1",
     "expression-eval": "3.1.2",
-    "fast-glob": "3.2.4",
+    "fast-glob": "3.2.5",
     "jsonpath-plus": "4.0.0",
-    "lodash": "4.17.19",
+    "lodash": "4.17.20",
     "nanoid": "2.1.11",
     "nimma": "0.0.0",
-    "node-fetch": "2.6",
+    "node-fetch": "2.6.1",
     "proxy-agent": "3.1.1",
@@ -92,3 +92,3 @@ "strip-ansi": "6.0",
     "tslib": "1.13.0",
-    "yargs": "15.3.1"
+    "yargs": "15.4.1"
   },
@@ -100,4 +100,3 @@ "devDependencies": {
     "@rollup/plugin-json": "^4.1.0",
-    "@rollup/plugin-node-resolve": "^8.4.0",
-    "@types/chalk": "^2.2.0",
+    "@rollup/plugin-node-resolve": "^11.0.1",
     "@types/fetch-mock": "^7.3.1",
@@ -108,3 +107,2 @@ "@types/jest": "^26.0.4",
     "@types/nanoid": "^2.1.0",
-    "@types/nock": "^11.1.0",
     "@types/node": "~13.1",
@@ -111,0 +109,0 @@ "@types/node-fetch": "^2.5.7",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1036365

increased by0.01%

Dev dependency count

48

decreased by-4%

Worsened metrics

Number of medium supply chain risk alerts

3

increased by50%

Dependency changes

• + Added@stoplight/json@3.10.2(transitive)

• + Added@stoplight/json-ref-resolver@3.1.1(transitive)

• + Added@stoplight/lifecycle@2.3.2(transitive)

• + Added@stoplight/types@11.9.0(transitive)

• + Addedblueimp-md5@2.18.0(transitive)

• + Addedchalk@4.1.0(transitive)

• + Addeddependency-graph@0.10.0(transitive)

• + Addedfast-glob@3.2.5(transitive)

• + Addedimmer@8.0.4(transitive)

• + Addedlodash@4.17.20(transitive)

• + Addedlodash.get@4.4.2(transitive)

• + Addedlodash.set@4.3.2(transitive)

• + Addednode-fetch@2.6.1(transitive)

• + Addedyargs@15.4.1(transitive)

• - Removed@stoplight/json@3.9.0(transitive)

• - Removed@stoplight/json-ref-resolver@3.1.0(transitive)

• - Removed@stoplight/lifecycle@2.3.1(transitive)

• - Removed@stoplight/types@11.10.0(transitive)

• - Removedblueimp-md5@2.13.0(transitive)

• - Removedchalk@4.0.0(transitive)

• - Removeddependency-graph@0.8.1(transitive)

• - Removedfast-glob@3.2.4(transitive)

• - Removedimmer@5.3.6(transitive)

• - Removedlodash@4.17.19(transitive)

• - Removednode-fetch@2.6.13(transitive)

• - Removedtr46@0.0.3(transitive)

• - Removedwebidl-conversions@3.0.1(transitive)

• - Removedwhatwg-url@5.0.0(transitive)

• - Removedyargs@15.3.1(transitive)

• Updated@stoplight/json@3.10.2

• Updated@stoplight/json-ref-resolver@3.1.1

• Updated@stoplight/lifecycle@2.3.2

• Updated@stoplight/types@11.9.0

• Updatedblueimp-md5@2.18.0

• Updatedchalk@4.1.0

• Updatedfast-glob@3.2.5

• Updatedlodash@4.17.20

• Updatednode-fetch@2.6.1

• Updatedyargs@15.4.1