Bump the npm_and_yarn group across 2 directories with 7 updates

[dependabot]

Bumps the npm_and_yarn group with 5 updates in the /client directory:

Package	From	To
async	2.6.3	2.6.4
ejs	3.1.6	3.1.9
minimatch	3.0.4	3.1.2
recursive-readdir	2.2.2	2.2.3
node-forge	1.2.1	1.3.1
Bumps the npm_and_yarn group with 2 updates in the /server directory: mongodb and mongoose.

Updates async from 2.6.3 to 2.6.4

Changelog

Sourced from async's changelog.

v2.6.4

• Fix potential prototype pollution exploit (#1828)

Commits

• c6bdaca Version 2.6.4
• 8870da9 Update built files
• 4df6754 update changelog
• 8f7f903 Fix prototype pollution vulnerability (#1828)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by hargasinski, a new releaser for async since your current version.

Updates ejs from 3.1.6 to 3.1.9

Release notes

Sourced from ejs's releases.

v3.1.9

Version 3.1.9

v3.1.8

Version 3.1.8

v3.1.7

Version 3.1.7

Commits

• aed0124 Version 3.1.9
• 7083793 Updated dev deps
• 87f1da6 Merge pull request #707 from mde/dependabot/npm_and_yarn/minimatch-3.1.2
• e41a914 Removed old changelog, please rely on git log
• 9ea36ba Merge pull request #719 from jportner/frozen-prototype-fix
• 181a537 Fall back to assignment, update test
• 58bc2eb Change approach to shadowing "toString" property for escapeXML
• 76c9c61 Bump minimatch from 3.0.4 to 3.1.2
• f818bce Merge pull request #706 from mde/dependabot/npm_and_yarn/flat-and-mocha-5.0.2
• 0fca863 Bump flat and mocha
• Additional commits viewable in compare view

Updates minimatch from 3.0.4 to 3.1.2

Commits

• 699c459 3.1.2
• 2f2b5ff fix: trim pattern
• 25d7c0d 3.1.1
• 55dda29 fix: treat nocase:true as always having magic
• 5e1fb8d 3.1.0
• f8145c5 Add 'allowWindowsEscape' option
• 570e8b1 add publishConfig for v3 publishes
• 5b7cd33 3.0.6
• 20b4b56 [fix] revert all breaking syntax changes
• 2ff0388 document, expose, and test 'partial:true' option
• Additional commits viewable in compare view

Updates recursive-readdir from 2.2.2 to 2.2.3

Changelog

Sourced from recursive-readdir's changelog.

v2.2.3 - Mon, 19 Sep 2016 21:55:22 GMT

• 1840d5a7e58e9d8b96c217b8066077fec339de21 [fixed] updated minimatch to 3.0.5 (and added caret semver range) to address vulnerability in minimatch 3.0.4

v2.1.0 - Mon, 19 Sep 2016 21:55:22 GMT

v2.0.0 - Wed, 06 Apr 2016 04:31:02 GMT

v1.3.0 - Wed, 14 Oct 2015 14:35:55 GMT

• 45abf8fde380d7b1f5dc0e798d435ed50b834d9c [added] added custom matcher function to determine whether to ignore a file
• eebc91c67abce413d6213e8f389ba4e0d32ffb63 [fixed] allow ignoring directories

v1.2.1 - Wed, 14 Jan 2015 16:49:55 GMT

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by bnb, a new releaser for recursive-readdir since your current version.

Updates node-forge from 1.2.1 to 1.3.1

Changelog

Sourced from node-forge's changelog.

1.3.1 - 2022-03-29

Fixes

• RFC 3447 and RFC 8017 allow for optional DigestAlgorithm NULL parameters for sha* algorithms and require NULL paramters for md2 and md5 algorithms.

1.3.0 - 2022-03-17

Security

• Three RSA PKCS#1 v1.5 signature verification issues were reported by Moosa Yahyazadeh (moosa-yahyazadeh@uiowa.edu).
• HIGH: Leniency in checking digestAlgorithm structure can lead to signature forgery.
  • The code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. For more information, please see "Bleichenbacher's RSA signature forgery based on implementation error" by Hal Finney.
  • CVE ID: CVE-2022-24771
  • GHSA ID: GHSA-cfm4-qjh2-4765
• HIGH: Failing to check tailing garbage bytes can lead to signature forgery.
  • The code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. For more information, please see "Bleichenbacher's RSA signature forgery based on implementation error" by Hal Finney.
  • CVE ID: CVE-2022-24772
  • GHSA ID: GHSA-x4jg-mjrx-434g
• MEDIUM: Leniency in checking type octet.
  • DigestInfo is not properly checked for proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.
  • CVE ID: CVE-2022-24773
  • GHSA ID: GHSA-2r2c-g63r-vccr

Fixed

• [asn1] Add fallback to pretty print invalid UTF8 data.
• [asn1] fromDer is now more strict and will default to ensuring all input bytes are parsed or throw an error. A new option parseAllBytes can disable this behavior.
  • NOTE: The previous behavior is being changed since it can lead to security issues with crafted inputs. It is possible that code doing custom DER parsing may need to adapt to this new behavior and optional flag.
• [rsa] Add and use a validator to check for proper structure of parsed ASN.1

... (truncated)

Commits

• a0a4a42 Release 1.3.1.
• a33830f Update changelog.
• 740954d Allow optional DigestAlgorithm parameters.
• 56f4316 Allow DigestInfo.DigestAlgorith.parameters to be optional
• cbf0bd5 Start 1.3.1-0.
• 6c5b901 Release 1.3.0.
• 0f3972a Update changelog.
• dc77b39 Fix error checking.
• bb822c0 Add advisory links.
• d4395fe Update changelog.
• Additional commits viewable in compare view

Updates mongodb from 4.16.0 to 4.17.2

Release notes

Sourced from mongodb's releases.

v4.17.2

4.17.2 (2023-11-16)

The MongoDB Node.js team is pleased to announce version 4.17.2 of the mongodb package!

Release Notes

Fix connection leak when serverApi is enabled

When enabling serverApi the driver's RTT mesurment logic (used to determine the closest node) still sent the legacy hello command "isMaster" causing the server to return an error. Unfortunately, the error handling logic did not correctly destroy the socket which would cause a leak.

Both sending the correct hello command and the error handling connection clean up logic are fixed in this change.

Bug Fixes

• NODE-5751: RTTPinger always sends legacy hello (#3923) (bc3d020)

Documentation

• Reference
• API
• Changelog

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

v4.17.1

4.17.1 (2023-08-23)

The MongoDB Node.js team is pleased to announce version 4.17.1 of the mongodb package!

Release Notes

Import of saslprep updated to correct library.

Fixes the import of saslprep to be the correct @mongodb-js/saslprep library.

Bug Fixes

• NODE-5573: fix saslprep import (#3838) (ff6c293)

Documentation

• Reference
• API
• Changelog

We invite you to try the mongodb library immediately, and report any issues to the NODE project.

v4.17.0

4.17.0 (2023-08-17)

... (truncated)

Changelog

Sourced from mongodb's changelog.

4.17.2 (2023-11-16)

Bug Fixes

• NODE-5751: RTTPinger always sends legacy hello (#3923) (bc3d020)

4.17.1 (2023-08-23)

Bug Fixes

• NODE-5573: fix saslprep import (#3838) (ff6c293)

4.17.0 (2023-08-17)

Features

• NODE-5272: do not create or drop ecc collections (#3678) (d26ad61)
• NODE-5398: use mongodb-js/saslprep instead of saslprep (#3820) (5244711)

Bug Fixes

• NODE-5262: AWS Lambda metadata detection logic is too permissive (#3683) (c0c3d99)
• NODE-5311: construct error messages for AggregateErrors in Node16+ (#3683) (98b7bdf)
• NODE-5316: prevent parallel topology creation in MongoClient.connect (#3696) (e13038d)
• NODE-5356: prevent scram auth from throwing TypeError if saslprep is not a function (#3732) (2d028af)
• NODE-5536: remove credentials from ConnectionPoolCreatedEvent options (#3812) (2910dca)

Commits

• aab9c46 chore(4.x): release 4.17.2 [skip-ci] (#3926)
• bc3d020 fix(NODE-5751): RTTPinger always sends legacy hello (#3923)
• c698918 test(NODE-5738): update data lake test scripts (#3920)
• 3934465 ci(NODE-5654): remove vars from evergreen config (#3881)
• 278523a ci(NODE-5667): remove custom dep tests against master and fix prose test 14 (...
• 85996c3 test(NODE-5618): use npm 9 on eol node versions (#3862)
• cdc3d53 chore(4.x): release 4.17.1 [skip-ci] (#3840)
• ff6c293 fix(NODE-5573): fix saslprep import (#3838)
• c83a801 chore(4.x): release 4.17.0 [skip-ci] (#3763)
• 1b59955 chore: update release automation scripts 4.x (#3824)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by dbx-node, a new releaser for mongodb since your current version.

Updates mongoose from 6.11.3 to 6.12.7

Changelog

Sourced from mongoose's changelog.

6.12.7 / 2024-03-01

• perf(model): make insertMany() lean option skip hydrating Mongoose docs #14376 #14372
• perf(document+schema): small optimizations to make init() faster #14383 #14113
• fix(connection): don't modify passed options object to openUri() #14370 #13376 #13335
• fix(ChangeStream): bubble up resumeTokenChanged changeStream event #14355 #14349 3150

7.6.9 / 2024-02-26

• fix(document): handle embedded recursive discriminators on nested path defined using Schema.prototype.discriminator #14256 #14245
• types(model): correct return type for findByIdAndDelete() #14233 #14190
• docs(connections): add note about using asPromise() with createConnection() for error handling #14364 #14266
• docs(model+query+findoneandupdate): add more details about overwriteDiscriminatorKey option to docs #14264 #14246

<<<<<<< HEAD 8.2.0 / 2024-02-22

• feat(model): add recompileSchema() function to models to allow applying schema changes after compiling #14306 #14296
• feat: add middleware for bulkWrite() and createCollection() #14358 #14263 #7893
• feat(model): add hydratedPopulatedDocs option to make hydrate recursively hydrate populated docs #14352 #4727
• feat(connection): add withSession helper #14339 #14330

8.1.3 / 2024-02-16

• fix: avoid corrupting $set-ed arrays when transaction error occurs #14346 #14340
• fix(populate): handle ref() functions that return a model instance #14343 #14249
• fix: insert version key when using insertMany even if toObject.versionKey set to false #14344
• fix(cursor): make aggregation cursor support transform option to match query cursor #14348 #14331
• docs(document): clarify that transform function option applies to subdocs #13757

8.1.2 / 2024-02-08

• fix: include virtuals in document array toString() output if toObject.virtuals set #14335 #14315
• fix(document): handle setting nested path to spread doc with extra properties #14287 #14269
• fix(populate): call setter on virtual populated path with populated doc instead of undefined #14314
• fix(QueryCursor): remove callback parameter of AggregationCursor and QueryCursor #14299 DevooKim
• types: add typescript support for arbitrary fields for the options parameter of Model functions which are of type MongooseQueryOptions #14342 #14341 FaizBShah
• types(model): correct return type for findOneAndUpdate with includeResultMetadata and lean set #14336 #14303
• types(connection): add type definition for createCollections() #14295 #14279
• docs(timestamps): clarify that replaceOne() and findOneAndReplace() overwrite timestamps #14337 #14309

8.1.1 / 2024-01-24

• fix(model): throw readable error when calling Model() with a string instead of model() #14288 #14281
• fix(document): handle setting nested path to spread doc with extra properties #14287 #14269
• types(query): add back context and setDefaultsOnInsert as Mongoose-specific query options #14284 #14282
• types(query): add missing runValidators back to MongooseQueryOptions #14278 #14275

8.1.0 / 2024-01-16

... (truncated)

Commits

• 29f57c1 chore: release 6.12.7
• d14d25b Merge pull request #14383 from Automattic/vkarpov15/gh-14113-2
• 92112dd Merge branch '6.x' into vkarpov15/gh-14113-2
• 222ad3b chore: pin tmp@0.2.1 re: raszi/node-tmp#293
• b6cb439 Merge branch '6.x' into vkarpov15/gh-14113-2
• 0af28e0 Merge pull request #14376 from Automattic/vkarpov15/gh-14372
• 5096630 style: fix lint
• 867f7b7 test: fix #13335 tests
• a9f6614 test: try fixing tests
• 635c795 perf(document+schema): small optimizations to make init() faster
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.