chore(deps): update npm

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
chokidar	3.5.3 -> 3.6.0					resolutions	minor
jquery (source)	3.6.3 -> 3.7.1					dependencies	minor
node (source)	>= v16.19.1 -> >= 16.20.2					engines	minor
trim-newlines	4.0.2 -> 4.1.1					resolutions	minor

---

Release Notes

paulmillr/chokidar (chokidar)

v3.6.0

Compare Source

What's Changed

• fix readyCount logic by @​JLHwung in https://github.com/paulmillr/chokidar/pull/1288
• handle MustScanSubDirs by @​MarcCelani-at in https://github.com/paulmillr/chokidar/pull/1197
• update fs.FSWatcher types to satisfy nodejs versions >= 16; fixes #​1299 by @​ben-polinsky in https://github.com/paulmillr/chokidar/pull/1300

New Contributors

• @​Mutahhar made their first contribution in https://github.com/paulmillr/chokidar/pull/1226
• @​zqianem made their first contribution in https://github.com/paulmillr/chokidar/pull/1242
• @​JLHwung made their first contribution in https://github.com/paulmillr/chokidar/pull/1288
• @​MarcCelani-at made their first contribution in https://github.com/paulmillr/chokidar/pull/1197
• @​ben-polinsky made their first contribution in https://github.com/paulmillr/chokidar/pull/1300

Full Changelog: paulmillr/chokidar@3.5.3...3.6.0

jquery/jquery (jquery)

v3.7.1: jQuery 3.7.1 Released: Reliable Table Row Dimensions

Compare Source

https://blog.jquery.com/2023/08/28/jquery-3-7-1-released-reliable-table-row-dimensions/

v3.7.0: jQuery 3.7.0: Staying in Order

Compare Source

https://blog.jquery.com/2023/05/11/jquery-3-7-0-released-staying-in-order/

v3.6.4: jQuery 3.6.4 Released: Selector Forgiveness

Compare Source

https://blog.jquery.com/2023/03/08/jquery-3-6-4-released-selector-forgiveness/

nodejs/node (node)

v16.20.2: 2023-08-09, Version 16.20.2 'Gallium' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-32002: Policies can be bypassed via Module._load (High)
• CVE-2023-32006: Policies can be bypassed by module.constructor.createRequire (Medium)
• CVE-2023-32559: Policies can be bypassed via process.binding (Medium)
• OpenSSL Security Releases
  • OpenSSL security advisory 14th July.
  • OpenSSL security advisory 19th July.
  • OpenSSL security advisory 31st July

More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.

Commits

• [40c3958a5a] - deps: update archs files for OpenSSL-1.1.1v (RafaelGSS) #​49043
• [a9ac9da89a] - deps: fix openssl crypto clean (RafaelGSS) #​49043
• [362d4c7494] - deps: upgrade openssl sources to OpenSSL_1_1_1v (RafaelGSS) #​49043
• [d8ccfe9ad4] - policy: handle Module.constructor and main.extensions bypass (RafaelGSS) nodejs-private/node-private#445
• [242aaa0caa] - policy: disable process.binding() when enabled (Tobias Nießen) nodejs-private/node-private#459

v16.20.1: 2023-06-20, Version 16.20.1 'Gallium' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
• CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
• CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
• CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
• CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
• OpenSSL Security Releases
  • OpenSSL security advisory 28th March.
  • OpenSSL security advisory 20th April.
  • OpenSSL security advisory 30th May
• c-ares vulnerabilities:
  • GHSA-9g78-jv2r-p7vc
  • GHSA-8r8p-23f3-64c2
  • GHSA-54xr-f67r-4pc4
  • GHSA-x6mf-cxr9-8q6v

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

• [5a92ea7a3b] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen)
• [5df04e893a] - deps: set CARES_RANDOM_FILE for c-ares (Richard Lau) #​48156
• [c171cbd124] - deps: update c-ares to 1.19.1 (RafaelGSS) #​48115
• [155d3aac02] - deps: update archs files for OpenSSL-1.1.1u+quic (RafaelGSS) #​48369
• [8d4c8f8ebe] - deps: upgrade openssl sources to OpenSSL_1_1_1u (RafaelGSS) #​48369
• [1a5c9284eb] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#426
• [e42ff4b018] - http: disable request smuggling via empty headers (Paolo Insogna) nodejs-private/node-private#429
• [10042683c8] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#408
• [a6f4e87bc9] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#416
• [b77000f4d7] - test: allow SIGBUS in signal-handler abort test (Michaël Zasso) #​47851

v16.20.0: 2023-03-29, Version 16.20.0 'Gallium' (LTS), @​BethGriggs

Compare Source

Notable Changes

• deps:
  • update undici to 5.20.0 (Node.js GitHub Bot) #​46711
  • update c-ares to 1.19.0 (Michaël Zasso) #​46415
  • upgrade npm to 8.19.4 (npm team) #​46677
  • update corepack to 0.17.0 (Node.js GitHub Bot) #​46842
• (SEMVER-MINOR) src: add support for externally shared js builtins (Michael Dawson) #​44376

Commits

• [de6dd67790] - crypto: avoid hang when no algorithm available (Richard Lau) #​46237
• [4617512788] - crypto: ensure auth tag set for chacha20-poly1305 (Ben Noordhuis) #​46185
• [24972164fc] - deps: update undici to 5.20.0 (Node.js GitHub Bot) #​46711
• [85f88c6a8d] - deps: V8: cherry-pick 90be99f (Michaël Zasso) #​46646
• [b4ebe6d47b] - deps: update c-ares to 1.19.0 (Michaël Zasso) #​46415
• [56cbc7fdda] - deps: V8: cherry-pick c2792e5 (Jiawen Geng) #​44961
• [7af9bdb31e] - deps: upgrade npm to 8.19.4 (npm team) #​46677
• [962a7471b5] - deps: update corepack to 0.17.0 (Node.js GitHub Bot) #​46842
• [748bc96e35] - deps: update corepack to 0.16.0 (Node.js GitHub Bot) #​46710
• [a467782499] - deps: update corepack to 0.15.3 (Node.js GitHub Bot) #​46037
• [1913b6763d] - deps: update corepack to 0.15.2 (Node.js GitHub Bot) #​45635
• [809371a15f] - module: require.resolve.paths returns null with node schema (MURAKAMI Masahiko) #​45147
• [086bb2f8d4] - Revert "src: let http2 streams end after session close" (Rich Trott) #​46721
• [6a01d39120] - (SEMVER-MINOR) src: add support for externally shared js builtins (Michael Dawson) #​44376
• [d081032a60] - test: fix test-net-connect-reset-until-connected (Vita Batrla) #​46781
• [efe1be47ec] - test: skip test depending on overlapped-checker when not available (Antoine du Hamel) #​45015
• [fc47d58abe] - test: remove cjs loader from stack traces (Geoffrey Booth) #​44197
• [cf76d0790d] - test: fix WPT title when no META title is present (Filip Skokan) #​46804
• [0d1485b924] - test: fix default WPT titles (Filip Skokan) #​46778
• [088e9cde3d] - test: add WPTRunner support for variants and generating WPT reports (Filip Skokan) #​46498
• [908c4dff44] - test: mark test-crypto-key-objects flaky on Linux (Richard Lau) #​46684
• [768e56227e] - tools: make utils.SearchFiles deterministic (Bruno Pitrus) #​44496

sindresorhus/trim-newlines (trim-newlines)

v4.1.1

Compare Source

v4.1.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.