Bump the npm_and_yarn group across 1 directory with 53 updates

[dependabot]

Bumps the npm_and_yarn group with 33 updates in the / directory:

Package	From	To
firebase	5.5.4	10.9.0
jquery	3.3.1	3.5.0
materialize-css	1.0.0-rc.2	1.0.0
vue	2.5.17	3.0.0
node-notifier	5.2.1	8.0.1
shelljs	0.7.8	0.8.5
vue-template-compiler	2.5.17	2.7.16
webpack-dev-server	2.11.3	5.2.1
async	2.6.1	2.6.4
browserify-sign	4.0.4	4.2.3
chownr	1.0.1	1.1.1
postcss	5.2.18	8.5.6
autoprefixer	7.2.6	10.4.21
css-loader	0.28.11	7.1.2
optimize-css-assets-webpack-plugin	3.2.0	6.0.1
postcss-import	11.1.0	16.1.1
postcss-loader	2.1.6	8.1.1
postcss-url	7.3.2	10.1.3
vue-loader	13.7.3	17.4.2
decode-uri-component	0.2.0	0.2.2
ejs	2.6.1	removed
webpack-bundle-analyzer	2.13.1	4.10.2
fsevents	1.2.4	1.2.13
minimatch	3.0.4	3.0.8
minimist	0.0.8	1.2.8
mkdirp	0.5.1	0.5.6
loader-utils	1.1.0	1.4.2
html-webpack-plugin	2.30.1	5.6.3
y18n	3.2.1	3.2.2
serialize-javascript	1.5.0	1.9.1
set-value	2.0.0	2.0.1
union-value	1.0.0	1.0.1
websocket-extensions	0.1.3	0.1.4

Updates firebase from 5.5.4 to 10.9.0

Commits

• 1eb302f Version Packages (#8063)
• b498867 Merge master into release
• ce88e71 snapshot listeners source from cache (#7982)
• 6d487d7 Prevent using authTokenSyncURL if the string begins with a double slash (#8060)
• b4d59d6 Merge master into release
• 2b22838 Fix glob pattern to work with Node 20 and its NPM version (#8059)
• feb5038 Update CI node.js versions to 20.x (#8055)
• 245dd26 Enforce authTokenSyncURL being a path and not a url. (#8056)
• e60188d Version Packages (#8046)
• 7e2efbf Merge master into release
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for firebase since your current version.

Updates jquery from 3.3.1 to 3.5.0

Release notes

Sourced from jquery's releases.

jQuery 3.5.0 Released!

See the blog post: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ and the upgrade guide: https://jquery.com/upgrade-guide/3.5/

NOTE: Despite being a minor release, this update includes a breaking change that we had to make to fix a security issue ( CVE-2020-11022). Please follow the blog post & the upgrade guide for more details.

Commits

• 7a0a850 3.5.0
• 8570a08 Release: Update AUTHORS.txt
• da3dd85 Ajax: Do not execute scripts for unsuccessful HTTP responses
• 065143c Ajax: Overwrite s.contentType with content-type header value, if any
• 1a4f10d Tests: Blacklist one focusin test in IE
• 9e15d6b Event: Use only one focusin/out handler per matching window & document
• 966a709 Manipulation: Skip the select wrapper for <option> outside of IE 9
• 1d61fd9 Manipulation: Make jQuery.htmlPrefilter an identity function
• 04bf577 Selector: Update Sizzle from 2.3.4 to 2.3.5
• 7506c9c Build: Resolve Travis config warnings
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by mgol, a new releaser for jquery since your current version.

Updates materialize-css from 1.0.0-rc.2 to 1.0.0

Release notes

Sourced from materialize-css's releases.

1.0.0 (September 9th, 2018)

• 🎉 1.0.0 has been released! 🎉
• Full Changelog here

Changelog

Sourced from materialize-css's changelog.

1.0.0 (September 9th, 2018)

• Full Changelog here

Commits

• 80e8ed3 1.0.0 Release
• 18ab01a Merge branch 'v1-dev' of github.com:Dogfalo/materialize into v1-dev
• 80c6881 Normalize plugin export structure
• 03ec731 added upgrade button and fixed topnav docs
• efa0aee Add version field to M
• 55951c2 Patreon update september
• ca9beaf Autofill label bugfix in navbar search
• e025754 patreon update
• 206a9bd Fixed typo in tooltips docs page.
• 5759200 themes meta description
• Additional commits viewable in compare view

Updates vue from 2.5.17 to 3.0.0

Changelog

Sourced from vue's changelog.

3.0.0 (2020-09-18)

3.0.0-rc.13 (2020-09-18)

Bug Fixes

• hmr: make hmr working with class components (#2144) (422f05e)
• reactivity: avoid length mutating array methods causing infinite updates (#2138) (f316a33), closes #2137
• suspense: should discard unmount effects of invalidated pending branch (5bfcad1)
• types: component instance inference without props (#2145) (57bdaa2)

Code Refactoring

• watch APIs default to trigger pre-flush (49bb447), closes vuejs/vue-next#1706

Features

• runtime-core: support using inject() inside props default functions (58c31e3)
• watch: support dot-delimited path in watch option (1c9a0b3)

BREAKING CHANGES

• watch APIs now default to use flush: 'pre' instead of flush: 'post'. This change affects watch, watchEffect, the watch component option, and this.$watch. See (49bb447) for more details.

3.0.0-rc.12 (2020-09-16)

Bug Fixes

• reactivity: effect should only recursively self trigger with explicit options (3810de7), closes #2125
• runtime-core: ensure root stable fragments inherit elements for moving (bebd44f), closes #2134
• runtime-core: should still do full traverse of stable fragment children in dev + hmr (dd40ad8)
• runtime-core/async-component: fix error component when there are no error handlers (c7b4a37), closes #2129
• types/tsx: optional props from Mixin/Extends are treated as required (#2048) (89e9ab8)

Features

• compiler-sfc: additionalData support for css preprocessors (#2126) (066d514)

3.0.0-rc.11 (2020-09-15)

... (truncated)

Commits

• See full diff in compare view

Updates node-notifier from 5.2.1 to 8.0.1

Changelog

Sourced from node-notifier's changelog.

v8.0.1

• fixes possible injection issue for notify-send

v8.0.0

Breaking changes:

• Expire time for notify-send is made to match macOS and Windows with default time of 10 seconds. The API is changed to take seconds as input and converting it to milliseconds before passing it on to notify-send. See #341.

v7.0.2

• Updates dependencies
• Fixes issue with haning Windows notifications when disabled (#335)

v7.0.1

• Fixes import of uuid, removes deprecation warnings

v7.0.0

Features

• NotifySend support for app-name (#299, see docs)

Breaking Changes

• All notify messages now have auto bound context to make it easier to pass as variables/arguments (#306)
• Updated snoreToast to version 0.7.0 with new input features (#293)
• Breaking snoreToast: Sanitizing data now changes "timedout" to "timeout"

v6.0.0

Breaking Changes

• Dropped support for node v6. As of v6 we currently support node versions 8, 10, and 12 (latest).
• Updated to the latest version of SnoreToast. This removes support for the wait option in that environment as it is now always on. Prepares the way for other new features added to the WindowsToaster.

Other

• Update to latest version of dependencies.

v5.4.3

• Reverts breaking dependency upgrades from v5.4.2 as some dependencies has removed Node 6 which is a breaking change.

v5.4.2

• Updates dependencies

... (truncated)

Commits

• 5d62799 v8.0.1
• 0c4a80d chore: adds changelog
• f5a7bc6 fix: test cases
• b9d148d patch: fixes possible injection issue for notify-send
• c374fe1 v8.0.0
• 25ffe15 Bumps dependencies
• ee7916a Merge pull request #341 from mikaelbr/timeoutNotifySend
• e3decb2 Updates documentation
• 860c06e feat: implements proper timeout/wait behaviour for notify-send
• 1c74ea9 v7.0.2
• Additional commits viewable in compare view

Updates shelljs from 0.7.8 to 0.8.5

Release notes

Sourced from shelljs's releases.

v0.8.5

This was a small security fix for #1058.

v0.8.4

Small patch release to fix a circular dependency warning in node v14. See #973.

v0.8.3

Closed issues:

• Shelljs print stderr to console even if exec-only "silent" is true #905
• refactor: remove common.state.tempDir #902
• Can't suppress stdout for echo #899
• exec() doesn't apply the arguments correctly #895
• shell.exec('npm pack') painfully slow #885
• shelljs.exec cannot find app.asar/node_modules/shelljs/src/exec-child.js #881
• test infra: mocks and skipOnWin conflict #862
• Support for shell function completion on IDE #859
• echo command shows options in stdout #855
• silent does not always work #851
• Appveyor installs the latest npm, instead of the latest compatible npm #844
• Force symbolic link (ln -sf) does not overwrite/recreate existing destination #830
• inconsistent result when trying to echo to a file #798
• Prevent require()ing executable-only files #789
• Cannot set property to of [object String] which has only a getter #752
• which() should check executability before returning a value #657
• Bad encoding experience #456
• phpcs very slow #440
• Error shown when triggering a sigint during shelljs.exec if process.on sigint is defined #254
• .to\(file\) does not mute STDIO output #146
• Escaping shell arguments to exec() #143
• Allow multiple string arguments for exec() #103
• cp does not recursively copy from readonly location #98
• Handling permissions errors on file I/O #64

Merged pull requests:

• Add test case for sed on empty file #904 (wyardley)
• refactor: don't expose tempdir in common.state #903 (nfischer)
• chore(ci): fix codecov on travis #897 (nfischer)
• chore(npm): add ci-or-install script #896 (nfischer)
• Fix silent exec #892 (nfischer)
• chore(appveyor): run entire test matrix #886 (nfischer)
• docs: remove gitter badge #880 (nfischer)
• grep includes the i flag #876 (ppsleep)
• Fix(which): match only executable files (#657) #874 (termosa)
• chore: rename some tests #871 (nfischer)
• Fix cp from readonly source #870 (nfischer)
• chore: bump dev dependencies and add package-lock #864 (nfischer)
• fix(mocks): fix conflict between mocks and skip #863 (nfischer)
• chore: output npm version in travis #850 (nfischer)

... (truncated)

Changelog

Sourced from shelljs's changelog.

v0.8.5 (2022-01-13)

Full Changelog

This was a small security fix for #1058.

v0.8.4 (2020-04-24)

Full Changelog

Small patch release to fix a circular dependency warning in node v14. See #973.

v0.8.3 (2018-11-13)

Full Changelog

Closed issues:

• Shelljs print stderr to console even if exec-only "silent" is true #905
• refactor: remove common.state.tempDir #902
• Can't suppress stdout for echo #899
• exec() doesn't apply the arguments correctly #895
• shell.exec('npm pack') painfully slow #885
• shelljs.exec cannot find app.asar/node_modules/shelljs/src/exec-child.js #881
• test infra: mocks and skipOnWin conflict #862
• Support for shell function completion on IDE #859
• echo command shows options in stdout #855
• silent does not always work #851
• Appveyor installs the latest npm, instead of the latest compatible npm #844
• Force symbolic link (ln -sf) does not overwrite/recreate existing destination #830
• inconsistent result when trying to echo to a file #798
• Prevent require()ing executable-only files #789
• Cannot set property to of [object String] which has only a getter #752
• which() should check executability before returning a value #657
• Bad encoding experience #456
• phpcs very slow #440
• Error shown when triggering a sigint during shelljs.exec if process.on sigint is defined #254
• .to\(file\) does not mute STDIO output #146
• Escaping shell arguments to exec() #143
• Allow multiple string arguments for exec() #103
• cp does not recursively copy from readonly location #98
• Handling permissions errors on file I/O #64

Merged pull requests:

• Add test case for sed on empty file #904 (wyardley)
• refactor: don't expose tempdir in common.state #903 (nfischer)
• chore(ci): fix codecov on travis #897 (nfischer)
• chore(npm): add ci-or-install script #896 (nfischer)
• Fix silent exec #892 (nfischer)
• chore(appveyor): run entire test matrix #886 (nfischer)
• docs: remove gitter badge #880 (nfischer)
• grep includes the i flag #876 (ppsleep)

... (truncated)

Commits

• 70668a4 0.8.5
• d919d22 fix(exec): lockdown file permissions (#1060)
• fcf1651 0.8.4
• a1111ee Silence potentially upcoming circular dependency warning (#973)
• d4d1317 0.8.3
• db317bf Add test case for sed on empty file (#904)
• 0d5ecb6 docs(changelog): updated by Nate Fischer [ci skip]
• 6b3c7b1 refactor: don't expose tempdir in common.state (#903)
• 4bd22e7 chore(ci): fix codecov on travis (#897)
• 2b3b781 fix: silent exec (#892)
• Additional commits viewable in compare view

Updates vue-template-compiler from 2.5.17 to 2.7.16

Release notes

Sourced from vue-template-compiler's releases.

v2.7.16 "Swan Song"

This is the final release for Vue 2.

Vue 2 will reach End of Life on December 31st, 2023. For more details, please read this blog post.

Please refer to CHANGELOG.md for details.

v2.7.16-beta.2

Please refer to CHANGELOG.md for details.

v2.7.16-beta.1

Please refer to CHANGELOG.md for details.

v2.7.15

Please refer to CHANGELOG.md for details.

v2.7.14

Please refer to CHANGELOG.md for details.

v2.7.13

Please refer to CHANGELOG.md for details.

v2.7.12

Please refer to CHANGELOG.md for details.

v2.7.11

Please refer to CHANGELOG.md for details.

v2.7.10

Please refer to CHANGELOG.md for details.

v2.7.9

Please refer to CHANGELOG.md for details.

v2.7.8

Please refer to CHANGELOG.md for details.

v2.7.7

Please refer to CHANGELOG.md for details.

v2.7.6

Please refer to CHANGELOG.md for details.

v2.7.5

Please refer to CHANGELOG.md for details.

v2.7.4

Please refer to CHANGELOG.md for details.

v2.7.3

... (truncated)

Changelog

Sourced from vue-template-compiler's changelog.

2.7.16 Swan Song (2023-12-24)

Bug Fixes

• lifecycle: ensure component effect scopes are disconnected (56ce7f8), closes #13134

2.7.16-beta.2 (2023-12-14)

Bug Fixes

• account for nested render calls (db9c566), closes #13131
• types: export more types for v3 alignment (jsx / component options) (895669f), closes #13078 #13128

2.7.16-beta.1 (2023-12-08)

Bug Fixes

• compiler-sfc: check template ref usage, (#12985) (83d9535), closes #12984
• compiler-sfc: fix rewriteDefault edge cases (25f97a5), closes #13060 #12892 #12906
• keep-alive: fix keep-alive memory leak (2632249), closes #12827
• keep-alive: fix memory leak without breaking transition tests (e0747f4)
• props: should not unwrap props that are raw refs (08382f0), closes #12930
• shallowReactive: should track value if already reactive when set in shallowReactive (0ad8e8d)
• style: always set new styles (f5ef882), closes #12901 #12946
• types: fix shallowRef's return type (#12979) (a174c29), closes #12978
• types: fix type augmentation and compiler-sfc types w/moduleResolution: bundler (#13107) (de0b97b), closes #13106
• types: provide types for built-in components (3650c12), closes #13002
• types: type VNodeChildren should allow type number (#13067) (24fcf69), closes #12973
• utils: unwrap refs when stringifying values in template (ae3e4b1), closes #12884 #12888
• watch: new property addition should trigger deep watcher with getter (6d857f5), closes #12967 #12972

2.7.15 (2023-10-23)

Bug Fixes

• compiler-sfc: add semicolon after defineProps statement (#12879) (51fef2c)
• compiler-sfc: fix macro usage in multi-variable declaration (#12873) (d27c128)
• compiler-sfc: Optimize the value of emitIdentifier (#12851) (bb59751)
• compiler-sfc: Resolve object expression parsing errors in v-on (#12862) (b8c8b3f)
• lifecycle: scope might changed when call hook (#13070) (74ca5a1)

... (truncated)

Commits

• 13f4e7d release: v2.7.16
• 56ce7f8 fix(lifecycle): esnure component effect scopes are disconnected
• 305e4ae release: v2.7.16-beta.2
• 3e1037e chore: bump vitest to 1.0.4
• db9c566 fix: account for nested render calls
• 895669f fix(types): export more types for v3 alignment (jsx / component options)
• 73bdf14 release: v2.7.16-beta.1
• e0747f4 fix(keep-alive): fix memory leak without breaking transition tests
• 2632249 fix(keep-alive): fix keep-alive memory leak
• 3650c12 fix(types): provide types for built-in components
• Additional commits viewable in compare view

Updates webpack-dev-server from 2.11.3 to 5.2.1

Release notes

Sourced from webpack-dev-server's releases.

v5.2.1

5.2.1 (2025-03-26)

Security

• cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header
• requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

• prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)
• take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

v5.2.0

5.2.0 (2024-12-11)

Features

• added getClientEntry and getClientHotEntry methods to get clients entries (dc642a8)

Bug Fixes

• speed up initial client bundling (145b5d0)

v5.1.0

5.1.0 (2024-09-03)

Features

• add visual progress indicators (a8f40b7)
• added the app option to be Function (by default only with connect compatibility frameworks) (3096148)
• allow the server option to be Function (#5275) (02a1c6d)
• http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

Bug Fixes

• check the platform property to determinate the target (#5269) (c3b532c)
• ipv6 output (#5270) (06005e7)
• replace rimraf with rm (#5162) (1a1561f)
• replace default gateway (#5255) (f5f0902)
• support devServer: false (#5272) (8b341cb)

v5.0.4

5.0.4 (2024-03-19)

... (truncated)

Changelog

Sourced from webpack-dev-server's changelog.

5.2.1 (2025-03-26)

Security

• cross-origin requests are not allowed unless allowed by Access-Control-Allow-Origin header
• requests with an IP addresses in the Origin header are not allowed to connect to WebSocket server unless configured by allowedHosts or it different from the Host header

The above changes may make the dev server not work if you relied on such behavior, but unfortunately they carry security risks, so they were considered as fixes.

Bug Fixes

• prevent overlay for errors caught by React error boundaries (#5431) (8c1abc9)
• take the first network found instead of the last one, this restores the same behavior as 5.0.4 (#5411) (ffd0b86)

5.2.0 (2024-12-11)

Features

• added getClientEntry and getClientHotEntry methods to get clients entries (dc642a8)

Bug Fixes

• speed up initial client bundling (145b5d0)

5.1.0 (2024-09-03)

Features

• add visual progress indicators (a8f40b7)
• added the app option to be Function (by default only with connect compatibility frameworks) (3096148)
• allow the server option to be Function (#5275) (02a1c6d)
• http2 support for connect and connect compatibility frameworks which support HTTP2 (#5267) (6509a3f)

Bug Fixes

• check the platform property to determinate the target (#5269) (c3b532c)
• ipv6 output (#5270) (06005e7)
• replace rimraf with rm (#5162) (1a1561f)
• replace default gateway (#5255) (f5f0902)
• support devServer: false (#5272) (8b341cb)

5.0.4 (2024-03-19)

Bug Fixes

... (truncated)

Commits

• 0d22a08 chore(release): 5.2.1
• 6045b1e chore(deps): update (#5444)
• ffd0b86 fix: take the first network found instead of the last one, this restores the ...
• 9ea7b08 ci: update dependency-review-action (#5442)
• 5c9378b Merge commit from fork
• d2575ad Merge commit from fork
• 8c1abc9 fix: prevent overlay for errors caught by React error boundaries (#5431)
• 5a39c70 ci: update codecov/codecov-action to v5 (#5406)
• 55220a8 chore(deps-dev): bump the dependencies group across 1 directory with 4 update...
• 09f6f8e chore(deps): bump the dependencies group across 1 directory with 2 updates (#...
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by evilebottnawi, a new releaser for webpack-dev-server since your current version.

Updates @firebase/util from 0.2.2 to 1.9.4

Changelog

Sourced from @​firebase/util's changelog.

1.9.4

Patch Changes

• 434f8418c #7963 (fixes #7962) - Fix isSafari() throwing on React Native

1.9.3

Patch Changes

• c59f537b1 #7019 - Modify base64 decoding logic to throw on invalid input, rather than silently truncating it.

1.9.2

Patch Changes

• d071bd1ac #7007 (fixes #7005) - Move exports.default fields to always be the last field. This fixes a bug caused in 9.17.0 that prevented some bundlers and frameworks from building.

1.9.1

Patch Changes

• 0bab0b7a7 #6981 - Added browser CJS entry points (expected by Jest when using JSDOM mode).

1.9.0

Minor Changes

• 06dc1364d #6901 - Allow users to specify their environment as node or browser to override Firebase's runtime environment detection and force the SDK to act as if it were in the respective environment.

Patch Changes

• d4114a4f7 #6874 (fixes #6838) - Reformat a comment that causes compile errors in some build toolchains.

1.8.0

Minor Changes

• 1625f7a95 #6799 - Update TypeScript version to 4.7.4.

Patch Changes

• c20633ed3 #6841 - Fix for third party window content that cannot access IndexedDB if the browser is set to never accept third party cookies on Firefox.

1.7.3

Patch Changes

• 4af28c1a4 #6682 - Upgrade TypeScript to 4.7.4.

... (truncated)

Commits

• 9fa0e9f Version Packages (#7995)
• 434f841 Fix isSafari() throwing on React Native (fixes #7962) (#7963)
• ebc694a Comment changes for OSS (#7778)
• 2be12d7 [CI] update chrome install steps for Auth builds. (#7602)
• 2e7e548 Version Packages (#7069)
• c59f537 Improve decodeBase64() to throw on invalid input rather than silently accept ...
• 3d605f8 Version Packages (#7008)
• d071bd1 Fix exports fields (#7007)
• 3323f68 Version Packages (#6995)
• 0bab0b7 Add CJS browser entry points for all packages (#6981)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by google-wombot, a new releaser for @​firebase/util since your current version.

Updates async from 2.6.1 to 2.6.4

Changelog

Sourced from async's changelog.

v2.6.4

• Fix potential prototype pollution exploit (#1828)

v2....

Description has been truncated