Bump typescript from 4.5.4 to 4.9.5 in /cer-graphql by dependabot[bot] · Pull Request #386 · UoA-eResearch/hub-stack

dependabot · 2023-02-06T07:03:41Z

Bumps typescript from 4.5.4 to 4.9.5.

Release notes

TypeScript 4.9.5

For release notes, check out the release announcement.

Downloads are available on:

npm

NuGet package

Changes:

69e88ef5513a81acf69ec78f4af1f927da0d0584 Port ignore deprecations to 4.9 (#52419)

daf4e817a18def96b70ac34703b158ff0e6d58df Port timestamp fix to 4.9 (#52426)

TypeScript 4.9.4

For release notes, check out the release announcement.

For the complete list of fixed issues, check out the

fixed issues query for Typescript v4.9.4.

Downloads are available on:

npm

NuGet package

Changes:

e2868216f637e875a74c675845625eb15dcfe9a2 Bump version to 4.9.4 and LKG.

eb5419fc8d980859b98553586dfb5f40d811a745 Cherry-pick #51704 to release 4.9 (#51712)

b4d382b9b12460adf2da4cc0d1429cf19f8dc8be Cherry-pick changes for narrowing to tagged literal types.

e7a02f43fce47e1a39259ada5460bcc33c8e98b5 Port of #51626 and #51689 to release-4.9 (#51627)

1727912f0437a7f367d90040fc4b0b4f3efd017a Cherry-pick fix around visitEachChild to release-4.9. (#51544)

This list of changes was auto generated.

TypeScript 4.9

For release notes, check out the release announcement.

Downloads are available on:

npm

NuGet package

Changes:

93bd577458d55cd720b2677705feab5c91eb12ce Bump version to 4.9.3 and LKG.

107f832b80df2dc97748021cb00af2b6813db75b Update LKG.

31bee5682df130a14ffdd5742f994dbe7313dd0e Cherry-pick PR #50977 into release-4.9 (#51363) [ #50872 ]

1e2fa7ae15f8530910fef8b916ec8a4ed0b59c45 Update version to 4.9.2-rc and LKG.

7ab89e5c6e401d161f31f28a6c555a3ba530910e Merge remote-tracking branch 'origin/main' into release-4.9

e5cd686defb1a4cbdb36bd012357ba5bed28f371 Update package-lock.json

8d40dc15d1b9945837e7860320fdccfe27c40cad Update package-lock.json

... (truncated)

Commits

ccf3d3c Bump version to '4.9.5' and LKG.
69e88ef Port ignore deprecations to 4.9 (#52419)
daf4e81 Port timestamp fix to 4.9 (#52426)
e286821 Bump version to 4.9.4 and LKG.
eb5419f Cherry-pick #51704 to release 4.9 (#51712)
b4d382b Cherry-pick changes for narrowing to tagged literal types.
e7a02f4 Port of #51626 and #51689 to release-4.9 (#51627)
1727912 Cherry-pick fix around visitEachChild to release-4.9. (#51544)
93bd577 Bump version to 4.9.3 and LKG.
107f832 Update LKG.
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [cypress-commands](https://github.com/Lakitna/cypress-commands) from 1.1.0 to 2.0.1. - [Release notes](https://github.com/Lakitna/cypress-commands/releases) - [Changelog](https://github.com/Lakitna/cypress-commands/blob/develop/CHANGELOG.md) - [Commits](Lakitna/cypress-commands@1.1.0...2.0.1) --- updated-dependencies: - dependency-name: cypress-commands dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

* generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * article simplification * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * case-studys page refactor * fixed width cards, minor article change * changed equipment page * changes to events * changed fundings page * changes to service page * changes to software page * changes to subhubs and standard card * set image height * removed app-cards from featured component * removed old cards components * fixed featured layout * better spacing on featured component * fixed lock icon size * fixed article layout * fixed mobile card width * fixed clickable cards * generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * article simplification * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * case-studys page refactor * fixed width cards, minor article change * changed equipment page * changes to events * changed fundings page * changes to service page * changes to software page * changes to subhubs and standard card * set image height * removed app-cards from featured component * removed old cards components * fixed featured layout * better spacing on featured component * fixed lock icon size * fixed article layout * fixed mobile card width * fixed clickable cards * generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * article simplification * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * case-studys page refactor * fixed width cards, minor article change * changed equipment page * changes to events * changed fundings page * changes to service page * changes to software page * changes to subhubs and standard card * set image height * removed app-cards from featured component * removed old cards components * fixed featured layout * better spacing on featured component * fixed lock icon size * fixed article layout * fixed mobile card width * fixed clickable cards * generated new components * first version of contact card * changed card title color * fixed elevation * first version of org unit card * first version of document card * moved cards module and components * changed mouse pointer on card * minor change to article page * Revert "minor change to article page" This reverts commit 4c66bf8. * fixed width cards, minor article change * fixed clickable cards * minor fixes * article layout fixes * fixes for case studies layout * more layout fixes * fixed unit tests * fix for equipment table * upgraded e2e test with cypress types, fixed e2e tests * fixed inconsistent bottom margin * mat-icon white on subhub child card * added missing case study references * fixed 3 column layout being too narrow * fixed you-might-be-interested-in id * fixed featured layout * fixed missing funding purpose * fixed body media error * fix nulls error on subhub pages * fixed title underline * Revert "fixed title underline" This reverts commit d92ba98. * fixed subhub child card underline Co-authored-by: Rose McColl <rosemccoll@hotmail.com>

…stack-local

…ypress-commands-2.0.1

…search-hub-web/cypress-commands-2.0.1 Bump cypress-commands from 1.1.0 to 2.0.1 in /research-hub-web

* initial commit for content graph * added resolver and adjustments, highlight node on hover * update lockfile version * minor fixes for null checks * added auth guard to graph route * first version of node info box * added node highlighting * improved details list and highlighting * first version of graph legend in drawer * layout fixes * layout improvements * renamed graph-legend to graph-filter * added legend, added dev env * added graph link to footer * fixed capitalisation * some fixes for unit tests * more fixes for tests * exclude GraphFilter test for now * added graph API to CSP headers (dev) * renamed graph-container * refactored graph into component * tidy up field order * changed loading behaviour, removed route resolver * fixed canvas width, colour changes * fixed color legend and search box * minor improvements * many UI improvements, added contentful link to env files * updated test and prod environment files with graph api url * some fixes for unit tests * more fixes for unit tests * minor improvements for node details UI * added graph api to csp headers in cloudfront functions * rebuild package-lock.json * added esbuild dep

* Add token references for CI build * Add missing package * Fix npm shrinkwrap issue * Fix wrong org id * Update readme * Update documentation * Add indentation and minor fixes to README * FIx minor heading issue with readme Co-authored-by: Lukas Trombach <19306765+Trombach@users.noreply.github.com>

Co-authored-by: rosemcc <rosemccoll@hotmail.com> Co-authored-by: Lukas Trombach <19306765+Trombach@users.noreply.github.com>

* chore: version update * CHORE: update versions * HOTFIX * Chore: version changes Co-authored-by: Rose <31844476+rosemcc@users.noreply.github.com> Co-authored-by: rosemcc <rosemccoll@hotmail.com> Co-authored-by: Lukas Trombach <lukas.trombach@auckland.ac.nz> Co-authored-by: Lukas Trombach <19306765+Trombach@users.noreply.github.com> Co-authored-by: etan221 <eric.tan@auckland.ac.nz>

Change feedback button text

* add initial modules and components * update search lambda * update and add new graphQL queries * add capability type to standard card * add components to routes * add capability list * reuse article default banner for capability card for now * add capability display name to pipe * first version of capability page * make tests runnable * add capability page type to search types * add navbar link to subhub * add capability list unit test * make e2e tests runnable * fix unit test * fix unit tests * add capability unit test * decapitalised navbar link * added new card background for capability * add capability e2e tests and fixture * fix capability not showing in search results * fix e2e test * add capability type to content graph * remove navbar link to be added later * fix standard card default image loading * lowercase sign in/out * move support materials to the top * fix unit test * fix navbar e2e test * move contacts to the top * minor fix for standard images * simplify standard card component * add comment explaining image height

update package versions

Bumps [typescript](https://github.com/Microsoft/TypeScript) from 4.5.4 to 4.9.5. - [Release notes](https://github.com/Microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v4.5.4...v4.9.5) --- updated-dependencies: - dependency-name: typescript dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/linting.yml

+    name: Run linters
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v2
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v1
+        with:
+          node-version: 14
+
+      - name: Install Node.js dependencies
+        working-directory: ./research-hub-web
+        run: npm ci
+
+      - name: Install Angular CLI
+        run: npm install -g @angular/cli
+
+      - name: ng lint
+        working-directory: ./research-hub-web
+        run: ng lint


In general, this issue is fixed by explicitly setting a permissions block for the workflow or for individual jobs so that GITHUB_TOKEN has only the minimal scopes required. For this linting workflow, all steps operate on the checked-out code and do not need to write back to the repository or manage issues/PRs, so granting only contents: read is sufficient.

The best fix without changing functionality is to add a permissions section at the top level of the workflow, right after the name: Lint line (or before jobs:). This will apply to all jobs in the workflow, including run-linters, and ensure that the GITHUB_TOKEN is limited to reading repository contents. No additional imports, actions, or methods are required—this is a purely declarative change to the YAML configuration.

Concretely, in .github/workflows/linting.yml, add:

permissions: contents: read

directly under the existing name: Lint line. All other lines remain unchanged.

.github/workflows/sentry.yml

+    name: Create Sentry Release
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out Git repository
+        uses: actions/checkout@v2
+      - name: Get Branch
+        id: var
+        run: echo ::set-output name=branch::${GITHUB_REF#refs/*/}
+      - name: Output Branch
+        run: echo ${{ steps.var.outputs.branch }}
+      - name: Notify Sentry
+        # https://github.com/getsentry/action-release
+        uses: getsentry/action-release@v1.1.6
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: university-of-auckland-7o
+          SENTRY_PROJECT: research-hub
+        with:
+          environment: ${{ steps.var.outputs.branch }}


In general, the problem is fixed by explicitly specifying minimal GITHUB_TOKEN permissions via a permissions: block, either at the workflow root (applies to all jobs) or within the specific job. Since there is only one job here, adding permissions under that job is straightforward and documents what the workflow actually needs.

The safest minimal change without altering existing functionality is to add permissions: contents: read to the sentry-release job. This job uses actions/checkout (which works with contents: read) and getsentry/action-release, which talks to Sentry using SENTRY_AUTH_TOKEN and does not need to write back to the GitHub repository. No other scopes (like issues, pull-requests, or packages) appear necessary based on the shown steps.

Concretely:

Edit .github/workflows/sentry.yml.

Under jobs: sentry-release: name: Create Sentry Release, insert a permissions: block with contents: read at the same indentation level as runs-on.

No imports or external dependencies are needed; this is pure workflow configuration.

.github/workflows/sentry.yml

+        run: echo ${{ steps.var.outputs.branch }}
+      - name: Notify Sentry
+        # https://github.com/getsentry/action-release
+        uses: getsentry/action-release@v1.1.6


hub-search-proxy/handler.js

+
+module.exports.search = async (event, context) => {
+    try {
+        console.log(`Received query: ${event.body}`);


In general, to fix log injection when logging user-provided data to plain-text logs, remove or neutralize control characters (especially \n and \r) from the user-controlled portion before logging, and keep the overall log format unchanged. For HTML logs, you would encode HTML entities instead; here the context is plain text (console.log), so we should strip line breaks.

The best targeted fix here is to sanitize event.body right before it is interpolated into the log message. We can introduce a local variable, e.g. sanitizedBody, that is derived from event.body by converting it to a string (defensive) and removing \r and \n characters using String.prototype.replace with a regular expression. Then we log that sanitized value instead of the raw event.body. This avoids changing how the rest of the function works and preserves existing functionality, since parsing still uses the original event.body. Concretely, in hub-search-proxy/handler.js, around line 53, we should replace the single console.log line with two lines: one computing sanitizedBody and one logging it. No new imports or external libraries are needed.

rosemcc and others added 30 commits November 8, 2021 14:13

Merge branch 'master' into expandable-page-part

92ae5b6

unit tests with mat harness, some cleanups

30077a9

remove unneeded expansion-panel style overrides

5b3e5a5

hide summary in mobile view

05c67dd

Merge branch 'master' into content-pages-refactor

2a23346

merge changes to article.component

a823c0c

Merge branch 'master' into content-pages-refactor

f644f4e

more changes

9b16683

fixes and 404 redirect

11e269c

move cypress-commands and jasmine to dev dependencies, remove browser…

3ecf0eb

…stack-local

Merge branch 'master' into dependabot/npm_and_yarn/research-hub-web/c…

c632cc1

…ypress-commands-2.0.1

Merge pull request #171 from UoA-eResearch/dependabot/npm_and_yarn/re…

bc92bbb

…search-hub-web/cypress-commands-2.0.1 Bump cypress-commands from 1.1.0 to 2.0.1 in /research-hub-web

breadcrumb refactor

24bf09c

final changes to article

b97f2c8

final changes to case study

f1eaefd

removed unused import from article

47b7122

final changes to equipment

af1fdf3

final changes to event

b0d934f

final changes to funding

e5f8f17

changes to subhub component

9c21a36

changes to service

68bd9f9

changes to software

ed7868d

fix scrolling home page image on iOS

0e533f0

reduce logo height on smaller screens

caded95

numbered lists on mobile safari

4021ed8

fix for dynamic routing

bce4a6c

Merge branch 'master' into content-pages-refactor

7fa37c8

provide other storage options for localforage

598aad3

rosemcc and others added 22 commits March 21, 2022 12:14

Merge remote-tracking branch 'origin/prod' into rc2.6.1

b2ade0c

chore: version update

65df05a

fix router issue in unit test

040de04

Merge branch 'hotfix-unittest'

fa7301f

Merge branch 'master' into rc2.6.1

ac37094

Merge branch 'rc2.6.1'

6744388

chore: update dependabot reviewers

ef4f4ac

avoid contentful export size limit error

2bb642f

Merge branch 'hotfix-search-proxy-bulk-loading'

d241d84

use query for feedback link in footer (#281)

28a3bc8

hotfix unit tests

5f6d96a

Chore: version changes (#286)

62edd81

new landscape logo (#299)

2b4321c

Co-authored-by: rosemcc <rosemccoll@hotmail.com> Co-authored-by: Lukas Trombach <19306765+Trombach@users.noreply.github.com>

Change feedback button text

7e60ebf

Merge pull request #320 from UoA-eResearch/change-feedback-button-text

39c4f2f

Change feedback button text

update package versions

0dd43ee

Merge pull request #369 from UoA-eResearch/rc2.8.0

ee96dc4

update package versions

dependabot bot added the dependencies Pull requests that update a dependency file label Feb 6, 2023

dependabot bot requested review from cakr322, devslashnoel and eric-el-tan February 6, 2023 07:03

dependabot bot mentioned this pull request Feb 6, 2023

Bump typescript from 4.5.4 to 4.9.4 in /cer-graphql #373

Closed

lugn621 force-pushed the dependabot/npm_and_yarn/cer-graphql/typescript-4.9.5 branch from 1ee543b to 61a30f3 Compare April 2, 2026 02:11

github-advanced-security bot found potential problems Apr 2, 2026

View reviewed changes

@@ -50,7 +50,8 @@
             module.exports.search = async (event, context) => {
                 try {
-                    console.log(`Received query: ${event.body}`);
+                    const sanitizedBody = String(event.body).replace(/[\r\n]/g, '');
+                    console.log(`Received query: ${sanitizedBody}`);
                     const requestBody = JSON.parse(event.body);
                     let queryString = '';
                     let size = 10;

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump typescript from 4.5.4 to 4.9.5 in /cer-graphql#386

Bump typescript from 4.5.4 to 4.9.5 in /cer-graphql#386
dependabot[bot] wants to merge 2111 commits intomasterfrom
dependabot/npm_and_yarn/cer-graphql/typescript-4.9.5

dependabot bot commented on behalf of github Feb 6, 2023 •

edited

Loading

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

@@ -1,4 +1,6 @@
             name: Lint
+            permissions:
+              contents: read
             on:
               # Trigger the workflow on push or pull request,

Conversation

dependabot bot commented on behalf of github Feb 6, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

TypeScript 4.9.5

Changes:

TypeScript 4.9.4

Changes:

TypeScript 4.9

Changes:

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

Check warning

Uh oh!

Check warning

Uh oh!

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

dependabot bot commented on behalf of github Feb 6, 2023 •

edited

Loading