chore(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Type	Update
@typescript-eslint/eslint-plugin	5.59.11 -> 5.60.0					devDependencies	minor
@typescript-eslint/parser	5.59.11 -> 5.60.0					devDependencies	minor
node	20.3.0 -> 20.3.1						patch
node	20.3.0 -> 20.3.1					engines	patch
node	20.3.0-alpine -> 20.3.1-alpine					final	patch
node	20.3.0-alpine -> 20.3.1-alpine					stage	patch
pnpm (source)	8.6.2 -> 8.6.3					packageManager	patch

---

Release Notes

typescript-eslint/typescript-eslint (@​typescript-eslint/eslint-plugin)

v5.60.0

Compare Source

Features

• eslint-plugin: [restrict-plus-operands] add allow* options (#​6161) (def09f8)

5.59.11 (2023-06-12)

Note: Version bump only for package @​typescript-eslint/eslint-plugin

5.59.10 (2023-06-12)

Note: Version bump only for package @​typescript-eslint/eslint-plugin

5.59.9 (2023-06-05)

Note: Version bump only for package @​typescript-eslint/eslint-plugin

5.59.8 (2023-05-29)

Note: Version bump only for package @​typescript-eslint/eslint-plugin

5.59.7 (2023-05-22)

Note: Version bump only for package @​typescript-eslint/eslint-plugin

5.59.6 (2023-05-15)

Note: Version bump only for package @​typescript-eslint/eslint-plugin

5.59.5 (2023-05-08)

Note: Version bump only for package @​typescript-eslint/eslint-plugin

5.59.4 (2023-05-08)

Note: Version bump only for package @​typescript-eslint/eslint-plugin

5.59.3 (2023-05-08)

Note: Version bump only for package @​typescript-eslint/eslint-plugin

5.59.2 (2023-05-01)

Note: Version bump only for package @​typescript-eslint/eslint-plugin

5.59.1 (2023-04-24)

Bug Fixes

• eslint-plugin: [prefer-regexp-exec] skip malformed regexes (#​6935) (05ed60e)
• eslint-plugin: [unified-signatures] no parameters function (#​6940) (2970861)

typescript-eslint/typescript-eslint (@​typescript-eslint/parser)

v5.60.0

Compare Source

Note: Version bump only for package @​typescript-eslint/parser

5.59.11 (2023-06-12)

Note: Version bump only for package @​typescript-eslint/parser

5.59.10 (2023-06-12)

Note: Version bump only for package @​typescript-eslint/parser

5.59.9 (2023-06-05)

Note: Version bump only for package @​typescript-eslint/parser

5.59.8 (2023-05-29)

Note: Version bump only for package @​typescript-eslint/parser

5.59.7 (2023-05-22)

Note: Version bump only for package @​typescript-eslint/parser

5.59.6 (2023-05-15)

Note: Version bump only for package @​typescript-eslint/parser

5.59.5 (2023-05-08)

Note: Version bump only for package @​typescript-eslint/parser

5.59.4 (2023-05-08)

Note: Version bump only for package @​typescript-eslint/parser

5.59.3 (2023-05-08)

Note: Version bump only for package @​typescript-eslint/parser

5.59.2 (2023-05-01)

Note: Version bump only for package @​typescript-eslint/parser

5.59.1 (2023-04-24)

Note: Version bump only for package @​typescript-eslint/parser

nodejs/node

v20.3.1: 2023-06-20, Version 20.3.1 (Current), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

• CVE-2023-30581: mainModule.__proto__ Bypass Experimental Policy Mechanism (High)
• CVE-2023-30584: Path Traversal Bypass in Experimental Permission Model (High)
• CVE-2023-30587: Bypass of Experimental Permission Model via Node.js Inspector (High)
• CVE-2023-30582: Inadequate Permission Model Allows Unauthorized File Watching (Medium)
• CVE-2023-30583: Bypass of Experimental Permission Model via fs.openAsBlob() (Medium)
• CVE-2023-30585: Privilege escalation via Malicious Registry Key manipulation during Node.js installer repair process (Medium)
• CVE-2023-30586: Bypass of Experimental Permission Model via Arbitrary OpenSSL Engines (Medium)
• CVE-2023-30588: Process interuption due to invalid Public Key information in x509 certificates (Medium)
• CVE-2023-30589: HTTP Request Smuggling via Empty headers separated by CR (Medium)
• CVE-2023-30590: DiffieHellman does not generate keys after setting a private key (Medium)
• OpenSSL Security Releases
  • OpenSSL security advisory 28th March.
  • OpenSSL security advisory 20th April.
  • OpenSSL security advisory 30th May

More detailed information on each of the vulnerabilities can be found in June 2023 Security Releases blog post.

Commits

• [dac08dafc9] - crypto: handle cert with invalid SPKI gracefully (Tobias Nießen) nodejs-private/node-private#​393
• [d274c3babc] - crypto,https,tls: disable engines if perms enabled (Tobias Nießen) nodejs-private/node-private#​409
• [5621c1de38] - deps: update archs files for openssl-3.0.9-quic1 (Node.js GitHub Bot) #​48402
• [771caa9f1c] - deps: upgrade openssl sources to quictls/openssl-3.0.9-quic1 (Node.js GitHub Bot) #​48402
• [0459bf9c99] - doc,test: clarify behavior of DH generateKeys (Tobias Nießen) nodejs-private/node-private#​426
• [27e20501aa] - http: disable request smuggling via empty headers (Paolo Insogna) nodejs-private/node-private#​427
• [9c17e335f1] - msi: do not create AppData\Roaming\npm (Tobias Nießen) nodejs-private/node-private#​408
• [b51124c637] - permission: handle fs path traversal (RafaelGSS) nodejs-private/node-private#​403
• [ebc5927adc] - permission: handle fs.openAsBlob (RafaelGSS) nodejs-private/node-private#​405
• [c39a43bff5] - permission: handle fs.watchFile (RafaelGSS) nodejs-private/node-private#​404
• [d0a8264ec9] - policy: handle mainModule.__proto__ bypass (RafaelGSS) nodejs-private/node-private#​416
• [3df13d5a79] - src,permission: restrict inspector when pm enabled (RafaelGSS) nodejs-private/node-private#​410

pnpm/pnpm

v8.6.3

Compare Source

Patch Changes

• When running a script in multiple projects, the script outputs should preserve colours #​2148.
• Don't crash when the APPDATA env variable is not set on Windows #​6659.
• Don't fail when a package is archived in a tarball with malformed tar headers #​5362.
• Peer dependencies of subdependencies should be installed, when node-linker is set to hoisted #​6680.
• Throw a meaningful error when applying a patch to a dependency fails.
• pnpm update --global --latest should work #​3779.
• pnpm license ls should work even when there is a patched git protocol dependency #​6595

Our Gold Sponsors

Our Silver Sponsors

---

Configuration

📅 Schedule: Branch creation - "on saturday" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.