V6.4.0 all security prs - #3178
Closed
zerbitx wants to merge 84 commits into
Closed
Conversation
Copy link
Copy Markdown
Collaborator
Sorry, something went wrong.
Snyk has created this PR to upgrade sass from 1.63.4 to 1.93.2. See this package in yarn: sass See this project in Snyk: https://app.snyk.io/org/devspace/project/432c6c4d-5f97-4566-9a1a-0ff3240f0c2d?utm_source=github&utm_medium=referral&page=upgrade-pr
Snyk has created this PR to upgrade classnames from 2.3.2 to 2.5.1. See this package in yarn: classnames See this project in Snyk: https://app.snyk.io/org/devspace/project/432c6c4d-5f97-4566-9a1a-0ff3240f0c2d?utm_source=github&utm_medium=referral&page=upgrade-pr
Snyk has created this PR to upgrade docusaurus-plugin-sass from 0.2.3 to 0.2.6. See this package in yarn: docusaurus-plugin-sass See this project in Snyk: https://app.snyk.io/org/devspace/project/432c6c4d-5f97-4566-9a1a-0ff3240f0c2d?utm_source=github&utm_medium=referral&page=upgrade-pr
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-JSYAML-13961110
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-JSYAML-13961110
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-EXPRESS-14157151
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-EXPRESS-14157151
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-QS-14724253
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-REACTROUTER-14908286
Bumps [react-timeago](https://github.com/naman34/react-timeago) from 4.4.0 to 8.3.0. - [Release notes](https://github.com/naman34/react-timeago/releases) - [Changelog](https://github.com/nmn/react-timeago/blob/master/CHANGELOG.md) - [Commits](https://github.com/naman34/react-timeago/commits) --- updated-dependencies: - dependency-name: react-timeago dependency-version: 8.3.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [whatwg-fetch](https://github.com/github/fetch) from 2.0.3 to 3.6.20. - [Release notes](https://github.com/github/fetch/releases) - [Changelog](https://github.com/JakeChampion/fetch/blob/main/CHANGELOG.md) - [Commits](JakeChampion/fetch@v2.0.3...v3.6.20) --- updated-dependencies: - dependency-name: whatwg-fetch dependency-version: 3.6.20 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [url-loader](https://github.com/webpack-contrib/url-loader) from 2.1.0 to 4.1.1. - [Release notes](https://github.com/webpack-contrib/url-loader/releases) - [Changelog](https://github.com/webpack-contrib/url-loader/blob/master/CHANGELOG.md) - [Commits](webpack-contrib/url-loader@v2.1.0...v4.1.1) --- updated-dependencies: - dependency-name: url-loader dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github.com/pkg/sftp](https://github.com/pkg/sftp) from 1.13.1 to 1.13.10. - [Release notes](https://github.com/pkg/sftp/releases) - [Commits](pkg/sftp@v1.13.1...v1.13.10) --- updated-dependencies: - dependency-name: github.com/pkg/sftp dependency-version: 1.13.10 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [terser-webpack-plugin](https://github.com/webpack/terser-webpack-plugin) from 1.4.6 to 5.3.16. - [Release notes](https://github.com/webpack/terser-webpack-plugin/releases) - [Changelog](https://github.com/webpack/terser-webpack-plugin/blob/main/CHANGELOG.md) - [Commits](webpack/minimizer-webpack-plugin@v1.4.6...v5.3.16) --- updated-dependencies: - dependency-name: terser-webpack-plugin dependency-version: 5.3.16 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github.com/evanphx/json-patch](https://github.com/evanphx/json-patch) from 4.12.0+incompatible to 5.9.11+incompatible. - [Release notes](https://github.com/evanphx/json-patch/releases) - [Commits](evanphx/json-patch@v4.12.0...v5.9.11) --- updated-dependencies: - dependency-name: github.com/evanphx/json-patch dependency-version: 5.9.11+incompatible dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [tslint](https://github.com/palantir/tslint) from 5.20.1 to 6.1.3. - [Release notes](https://github.com/palantir/tslint/releases) - [Changelog](https://github.com/palantir/tslint/blob/master/CHANGELOG.md) - [Commits](palantir/tslint@5.20.1...6.1.3) --- updated-dependencies: - dependency-name: tslint dependency-version: 6.1.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [sw-precache-webpack-plugin](https://github.com/goldhand/sw-precache-webpack-plugin) from 0.11.5 to 1.0.0. - [Changelog](https://github.com/goldhand/sw-precache-webpack-plugin/blob/master/CHANGELOG.md) - [Commits](goldhand/sw-precache-webpack-plugin@v0.11.5...v1.0.0) --- updated-dependencies: - dependency-name: sw-precache-webpack-plugin dependency-version: 1.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github.com/joho/godotenv](https://github.com/joho/godotenv) from 1.3.0 to 1.5.1. - [Release notes](https://github.com/joho/godotenv/releases) - [Commits](joho/godotenv@v1.3.0...v1.5.1) --- updated-dependencies: - dependency-name: github.com/joho/godotenv dependency-version: 1.5.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.29.0 to 0.35.0. - [Commits](kubernetes/apimachinery@v0.29.0...v0.35.0) --- updated-dependencies: - dependency-name: k8s.io/apimachinery dependency-version: 0.35.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github.com/go-resty/resty/v2](https://github.com/go-resty/resty) from 2.7.0 to 2.17.1. - [Release notes](https://github.com/go-resty/resty/releases) - [Commits](go-resty/resty@v2.7.0...v2.17.1) --- updated-dependencies: - dependency-name: github.com/go-resty/resty/v2 dependency-version: 2.17.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-DIFF-14917201
…erfile to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-ALPINE323-OPENSSL-15120869 - https://snyk.io/vuln/SNYK-ALPINE323-OPENSSL-15120870 - https://snyk.io/vuln/SNYK-ALPINE323-OPENSSL-15120871 - https://snyk.io/vuln/SNYK-ALPINE323-OPENSSL-15120872 - https://snyk.io/vuln/SNYK-ALPINE323-OPENSSL-15120873
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-ALPINE322-OPENSSL-15121226 - https://snyk.io/vuln/SNYK-ALPINE322-OPENSSL-15121226 - https://snyk.io/vuln/SNYK-ALPINE322-OPENSSL-15120884 - https://snyk.io/vuln/SNYK-ALPINE322-OPENSSL-15120885 - https://snyk.io/vuln/SNYK-ALPINE322-OPENSSL-15120886
…nerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-ALPINE316-ZLIB-2976176 - https://snyk.io/vuln/SNYK-ALPINE316-MUSL-8720632 - https://snyk.io/vuln/SNYK-ALPINE316-MUSL-8720632 - https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314624 - https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314641
…lities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-ALPINE316-ZLIB-2976176 - https://snyk.io/vuln/SNYK-ALPINE316-MUSL-8720632 - https://snyk.io/vuln/SNYK-ALPINE316-MUSL-8720632 - https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314624 - https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314641
…k.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-QS-15268416
…-cluster/package-lock.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-QS-15268416
…json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-QS-15268416
The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-ALPINE316-ZLIB-2976176 - https://snyk.io/vuln/SNYK-ALPINE316-MUSL-8720632 - https://snyk.io/vuln/SNYK-ALPINE316-MUSL-8720632 - https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314624 - https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314641
…rabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-ALPINE316-ZLIB-2976176 - https://snyk.io/vuln/SNYK-ALPINE316-MUSL-8720632 - https://snyk.io/vuln/SNYK-ALPINE316-MUSL-8720632 - https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314624 - https://snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314641
…e97ee2ca5' into v6.4.0-alpha
…696ce7c29' into v6.4.0-alpha
…696d80af4' into v6.4.0-alpha
…d49366a72' into v6.4.0-alpha
…91c80ad2c' into v6.4.0-alpha
…605dccfef' into v6.4.0-alpha
…f851fc130' into v6.4.0-alpha
Copy link
Copy Markdown
✅ Deploy Preview for devspace-docs canceled.
|
Sorry, something went wrong.
zerbitx
force-pushed
the
v6.4.0-all-security-prs
branch
3 times, most recently
from
34e54cc to
57c7e12
Compare
April 6, 2026 16:01
Signed-off-by: Ryan Swanson <ryan.swanson@loft.sh>
zerbitx
force-pushed
the
v6.4.0-all-security-prs
branch
from
57c7e12 to
18d2664
Compare
April 6, 2026 16:05
Lint fixes or exclusions
zerbitx
force-pushed
the
v6.4.0-all-security-prs
branch
4 times, most recently
from
53717bc to
ce3084c
Compare
April 6, 2026 19:17
Signed-off-by: Ryan Swanson <ryan.swanson@loft.sh>
zerbitx
force-pushed
the
v6.4.0-all-security-prs
branch
2 times, most recently
from
09a0beb to
d211ad8
Compare
April 6, 2026 19:57
Signed-off-by: Ryan Swanson <ryan.swanson@loft.sh>
zerbitx
force-pushed
the
v6.4.0-all-security-prs
branch
from
d211ad8 to
a394027
Compare
April 6, 2026 21:39
- honor configured `initialSync` unless `--download-on-initial-sync` is explicitly set - avoid `devspacehelper` replacement races by installing via a temp path and atomic move - drain initial watcher noise for `initialSync: disabled` - relax portforward nginx assertions to match current upstream content - harden terminal restart parsing against concurrent output corruption - harden build e2e image lookup for untagged Docker images, including `.dockerignore` cases - refresh embedded asset metadata
zerbitx
force-pushed
the
v6.4.0-all-security-prs
branch
from
5e82ddf to
2ed9abe
Compare
April 7, 2026 16:36
Signed-off-by: Ryan Swanson <ryan.swanson@loft.sh>
zerbitx
force-pushed
the
v6.4.0-all-security-prs
branch
from
2ed9abe to
c08b852
Compare
April 7, 2026 17:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v6.4.0-alpha — Merged Security & Dependency PRs
This PR aims to consolidate all of the automated PRs (at the time this was created) to get them building together and test them for the next minor release. 🤞
Contains 38 PRs (13 dependabot + 25 Snyk).
Dependabot (13)
Snyk (25)