8000 Bump pbkdf2 from 3.0.17 to 3.1.3 by dependabot[bot] · Pull Request #233 · Uniswap/v2-core · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

Bump pbkdf2 from 3.0.17 to 3.1.3 #233

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Bump pbkdf2 from 3.0.17 to 3.1.3 #233

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
@dependabot dependabot bot commented on behalf of github Jun 24, 2025

Bumps pbkdf2 from 3.0.17 to 3.1.3.

Changelog

Sourced from pbkdf2's changelog.

v3.1.3 - 2025-06-20

Commits

  • Only apps should have lockfiles 8b06730
  • [lint] fix whitespace 9a76e2f
  • [lint] fix parens/curlies/semis/etc 6fd84bf
  • [meta] add auto-changelog 796c38d
  • [Tests] fix tests in node 17 3661fb0
  • Revert "[Tests] fix tests in node < 3" 7431b57
  • [Tests] fix tests in node < 3 eb9f97a
  • [Fix] ensure unknown algorithms throw + known ones match node 26d4fd3
  • [Tests] add GHA, always run nyc 513906a
  • [lint] fix a few more rules ab04da8
  • [lint] switch to eslint 89694cf
  • [Tests] add coverage d0d534b
  • [Refactor] use to-buffer e3102a8
  • [readme] improve badges fca0c9d
  • [Tests] remove unused travis file a2c7d93
  • [meta] switch from files to npmignore 7f31fbc
  • [Tests] use .nycrc 8d628e8
  • [Refactor] minor tweaks fc61005
  • [Deps] update create-hmac, safe-buffer, sha.js ae2a7d0
  • [Fix] pin create-hash, ripemd160 due to breaking changes e079968
  • [Tests] fix tests in node 3 45fbcf3
  • [meta] skip publishing benchmarks 19ea57b
  • [Dev Deps] add missing peer dep 645e252

v3.1.2 - 2021-04-09

Commits

v3.1.1 - 2020-06-04

Commits

v3.1.0 - 2020-06-03

Merged

Commits

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by ljharb, a new releaser for pbkdf2 since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump pbkdf2 from 3.0.17 to 3.1.3
ed6e6af 
Bumps [pbkdf2](https://github.com/crypto-browserify/pbkdf2) from 3.0.17 to 3.1.3.
- [Changelog](https://github.com/browserify/pbkdf2/blob/master/CHANGELOG.md)
- [Commits](browserify/pbkdf2@v3.0.17...v3.1.3)

---
updated-dependencies:
- dependency-name: pbkdf2
  dependency-version: 3.1.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 24, 2025
@socket-security Socket Security
Copy link

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addedhasown@​2.0.2671007052100
Addedhas-tostringtag@​1.0.2671008151100
Addedhas-property-descriptors@​1.0.2671007851100
Addedset-function-length@​1.2.2661008351100
Addedavailable-typed-arrays@​1.0.7671008351100
Addedgopd@​1.2.0671007752100
Addedes-define-property@​1.0.1671008151100
Addedtyped-array-buffer@​1.0.3661007751100
Addedwhich-typed-array@​1.1.19661009053100
Addedis-typed-array@​1.1.15671008954100
Addedes-errors@​1.3.01001008376100
Addeddefine-data-property@​1.1.41001009076100
Addedpossible-typed-array-names@​1.1.01001008077100
Addedcall-bind@​1.0.81001008777100
Addeddunder-proto@​1.0.11001008478100
Addedmath-intrinsics@​1.1.01001008378100
Addedget-proto@​1.0.11001008278100
Addedcall-bind-apply-helpers@​1.0.21001008778100
Addedes-object-atoms@​1.1.11001008678100
Addedcall-bound@​1.0.41001008479100
Updatedto-buffer@​1.1.1 ⏵ 1.2.190 -1010079 +1389100
Addedget-intrinsic@​1.3.0991009180100
Updatedpbkdf2@​3.0.17 ⏵ 3.1.391 -8100 +7583 +789100

View full report

@socket-security Socket Security
Copy link

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert (click for details)
Warn High
Socket optimized override available for available-typed-arrays@1.0.7.

cleanup available: Run npx socket optimize

From: yarn.lock → npm/available-typed-arrays@1.0.7

ℹ Read more on: This package | This alert | Using Socket CLI to optimize dependencies

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Run `npx socket optimize` in your repository to optimize your dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/available-typed-arrays@1.0.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Socket optimized override available for es-define-property@1.0.1.

cleanup available: Run npx socket optimize

From: yarn.lock → npm/es-define-property@1.0.1

ℹ Read more on: This package | This alert | Using Socket CLI to optimize dependencies

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Run `npx socket optimize` in your repository to optimize your dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/es-define-property@1.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Socket optimized override available for gopd@1.2.0.

cleanup available: Run npx socket optimize

From: yarn.lock → npm/gopd@1.2.0

ℹ Read more on: This package | This alert | Using Socket CLI to optimize dependencies

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Run `npx socket optimize` in your repository to optimize your dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/gopd@1.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Socket optimized override available for has-property-descriptors@1.0.2.

cleanup available: Run npx socket optimize

From: yarn.lock → npm/has-property-descriptors@1.0.2

ℹ Read more on: This package | This alert | Using Socket CLI to optimize dependencies

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Run `npx socket optimize` in your repository to optimize your dependencies.

< B93F p dir="auto"> Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/has-property-descriptors@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Socket optimized override available for has-tostringtag@1.0.2.

cleanup available: Run npx socket optimize

From: yarn.lock → npm/has-tostringtag@1.0.2

ℹ Read more on: This package | This alert | Using Socket CLI to optimize dependencies

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Run `npx socket optimize` in your repository to optimize your dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/has-tostringtag@1.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Socket optimized override available for hasown@2.0.2.

cleanup available: Run npx socket optimize

From: yarn.lock → npm/hasown@2.0.2

ℹ Read more on: This package | This alert | Using Socket CLI to optimize dependencies

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Run `npx socket optimize` in your repository to optimize your dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/hasown@2.0.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Socket optimized override available for is-typed-array@1.1.15.

cleanup available: Run npx socket optimize

From: yarn.lock → npm/is-typed-array@1.1.15

ℹ Read more on: This package | This alert | Using Socket CLI to optimize dependencies

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Run `npx socket optimize` in your repository to optimize your dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/is-typed-array@1.1.15. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Socket optimized override available for set-function-length@1.2.2.

cleanup available: Run npx socket optimize

From: yarn.lock → npm/set-function-length@1.2.2

ℹ Read more on: This package | This alert | Using Socket CLI to optimize dependencies

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Run `npx socket optimize` in your repository to optimize your dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/set-function-length@1.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Socket optimized override available for typed-array-buffer@1.0.3.

cleanup available: Run npx socket optimize

From: yarn.lock → npm/typed-array-buffer@1.0.3

ℹ Read more on: This package | This alert | Using Socket CLI to optimize dependencies

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Run `npx socket optimize` in your repository to optimize your dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/typed-array-buffer@1.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Socket optimized override available for which-typed-array@1.1.19.

cleanup available: Run npx socket optimize

From: yarn.lock → npm/which-typed-array@1.1.19

ℹ Read more on: This package | This alert | Using Socket CLI to optimize dependencies

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Run `npx socket optimize` in your repository to optimize your dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/which-typed-array@1.1.19. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants
0