You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#4472 Fix boolean() parsing for comparisons between inline condition expressions (@app/copilot-swe-agent)
Deprecation Warnings
#4475 Deprecate numeric-leading and dash-only variable names, dash-only mixin names, and dynamic @charset interpolation for removal in Less 5.x. Less 4 preserves the existing output while warning; migrate names to valid identifiers and use a static quoted @charset declaration. (@matthew-dean)
This version was pushed to npm by GitHub Actions, a new releaser for less since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR is currently incomplete and introduces significant stability risks. While the title and description specify updates for multiple packages, the implementation fails to include the changes for image-size and less. This is particularly critical as the image-size update is intended to resolve a known Denial of Service (DoS) security vulnerability. Furthermore, the update of @nx/next across several major versions without aligning sibling workspace dependencies or including migration scripts is highly likely to cause build failures and workspace instability. These gaps must be addressed to fulfill the PR requirements and ensure system reliability.
About this PR
The implementation is incomplete. The updates for image-size and less are entirely missing from the manifest changes, leaving the stated security objectives of this PR unfulfilled.
A major version mismatch has been introduced within the Nx ecosystem. Updating @nx/next while sibling packages remain on an older major version is highly likely to cause build or runtime errors. It is recommended to align all workspace dependencies and run necessary migration generators to handle breaking changes.
Test suggestions
Verify workspace compatibility when @nx/next is on a newer major version while sibling dependencies remain on older versions
Validate the image-size update fixes the security vulnerability (DoS) without regressing image dimension parsing
Confirm the less update compiles existing stylesheets correctly and check for deprecation warnings
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify workspace compatibility when @nx/next is on a newer major version while sibling dependencies remain on older versions
2. Validate the image-size update fixes the security vulnerability (DoS) without regressing image dimension parsing
3. Confirm the less update compiles existing stylesheets correctly and check for deprecation warnings
The reason will be displayed to describe this comment to others. Learn more.
🔴 HIGH RISK
The implementation is missing the update for image-size required to address a Denial of Service (DoS) security vulnerability. Additionally, the update for less mentioned in the requirements is not reflected in this file.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dependenciesPull requests that update a dependency filejavascriptPull requests that update javascript code
0 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependabot
Bot
added
dependencies
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
Bumps image-size to 1.2.1 and updates ancestor dependencies image-size, @nx/next and less. These dependencies need to be updated together.
Updates
image-sizefrom 1.1.1 to 1.2.1Release notes
Sourced from image-size's releases.
Commits
a4178fb1.2.1640a67dfix potential Denial of Service via specially crafted payloads9d414481.2.0405a244fixups76c5c9amention jpeg-xl in the readmea10262cAdd support for JPEG XL (#409)a7a24a3(app): Fix typo in comments (#411)9f48213update dependencies, and reformat code with eslint 964dda84refactor formats that use a ISO-BMFF containere3ea538no need to create hex strings in j2cUpdates
@nx/nextfrom 19.5.7 to 22.5.4Release notes
Sourced from @nx/next's releases.
... (truncated)
Commits
24ddad0fix(nextjs): reset daemon client after project graph creation in withNx (#34518)e3eedf9docs(misc): update the docs to use more direct language (#34264)3fcd200fix(react): remove file-loader dependency and update svgr migration (#34218)42b1f14fix(misc): deprecate setup-tailwind generators (#34097)574d841chore(core): update to latest version of tsquery (#34067)a13f5ebchore(repo): update nx to 22.4.0-beta.1 (#33968)9fb5a6cfix(linter): handle variable references in replaceOverride (#34026)6f85b83cleanup(repo): format all files (#33902)45cdecefix(nextjs): accept fileName option to generate page (#30013)f025232fix(misc): update output location of ai-migration files (#33696)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@nx/nextsince your current version.Updates
lessfrom 4.1.3 to 4.8.0Release notes
Sourced from less's releases.
... (truncated)
Changelog
Sourced from less's changelog.
... (truncated)
Commits
ebbce6dchore: release v4.8.0 (#4474)191c8a1chore: release v4.8.0 — deprecate legacy identifier forms and dynamic@charse...6b04d2dfix(mixing): resolves issue #4234 (#4473)6161ecfFix boolean() parsing for comparisons between inline condition expressions (#...937300cchore: release v4.7.0 (#4471)8e1105fFollow-up to #4462: migrate remaining@varfixtures, DRY the prelude bare-@va...4d6e67echore: release v4.6.8 (#4463)0c8db11Replace image-size with probe-image-size (#4456)aeb8027refactor: extract shared ESLint config and add lint scripts (#4459)d38b43aFix #4460: parse comparison/range syntax in container style() queries (#4461)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for less since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.