mirror of
https://github.com/facebook/react.git
synced 2025-11-01 09:12:30 +00:00
ddb594843452b2cd70b12bb2a366dcafe88aad13
70 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 lauren
|
11df5224e6 |
[rcr] Generate ts defs (#31994)
This was accidentally removed in the esbuild transition. --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/facebook/react/pull/31994). * #31995 * __->__ #31994 |
||
|
lauren
|
220dece92b |
[compiler] Switch to esbuild (#31963)
This migrates the compiler's bundler to esbuild instead of rollup. Unlike React, our bundling use cases are far simpler since the majority of our packages are meant to be run on node. Rollup was adding considerable build time overhead whereas esbuild remains fast and has all the functionality we need out of the box. ### Before ``` time yarn workspaces run build yarn workspaces v1.22.22 > babel-plugin-react-compiler yarn run v1.22.22 $ rimraf dist && rollup --config --bundleConfigAsCjs src/index.ts → dist/index.js... (!) Circular dependencies # ... created dist/index.js in 15.5s ✨ Done in 16.45s. > eslint-plugin-react-compiler yarn run v1.22.22 $ rimraf dist && rollup --config --bundleConfigAsCjs src/index.ts → dist/index.js... (!) Circular dependencies # ... created dist/index.js in 9.1s ✨ Done in 10.11s. > make-read-only-util yarn run v1.22.22 warning package.json: No license field $ tsc ✨ Done in 1.81s. > react-compiler-healthcheck yarn run v1.22.22 $ rimraf dist && rollup --config --bundleConfigAsCjs src/index.ts → dist/index.js... (!) Circular dependencies # ... created dist/index.js in 8.7s ✨ Done in 10.43s. > react-compiler-runtime yarn run v1.22.22 $ rimraf dist && rollup --config --bundleConfigAsCjs src/index.ts → dist/index.js... (!) src/index.ts (1:0): Module level directives cause errors when bundled, "use no memo" in "src/index.ts" was ignored. # ... created dist/index.js in 1.1s ✨ Done in 1.82s. > snap yarn run v1.22.22 $ rimraf dist && concurrently -n snap,runtime "tsc --build" "yarn --silent workspace react-compiler-runtime build --silent" $ rimraf dist && rollup --config --bundleConfigAsCjs --silent [runtime] yarn --silent workspace react-compiler-runtime build --silent exited with code 0 [snap] tsc --build exited with code 0 ✨ Done in 5.73s. ✨ Done in 47.30s. yarn workspaces run build 75.92s user 5.48s system 170% cpu 47.821 total ``` ### After ``` time yarn workspaces run build yarn workspaces v1.22.22 > babel-plugin-react-compiler yarn run v1.22.22 $ rimraf dist && scripts/build.js ✨ Done in 1.02s. > eslint-plugin-react-compiler yarn run v1.22.22 $ rimraf dist && scripts/build.js ✨ Done in 0.93s. > make-read-only-util yarn run v1.22.22 warning package.json: No license field $ rimraf dist && scripts/build.js ✨ Done in 0.89s. > react-compiler-healthcheck yarn run v1.22.22 $ rimraf dist && scripts/build.js ✨ Done in 0.58s. > react-compiler-runtime yarn run v1.22.22 $ rimraf dist && scripts/build.js ✨ Done in 0.48s. > snap yarn run v1.22.22 $ rimraf dist && concurrently -n snap,runtime "tsc --build" "yarn --silent workspace react-compiler-runtime build" $ rimraf dist && scripts/build.js [runtime] yarn --silent workspace react-compiler-runtime build exited with code 0 [snap] tsc --build exited with code 0 ✨ Done in 4.69s. ✨ Done in 9.46s. yarn workspaces run build 9.70s user 0.99s system 103% cpu 10.329 total ``` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/facebook/react/pull/31963). * #31964 * __->__ #31963 * #31962 |
||
|
lauren
|
c784273bcc |
[compiler] Update prettier-plugin-hermes-parser (#31962)
Just updating this package. --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/facebook/react/pull/31962). * #31964 * #31963 * __->__ #31962 |
||
|
lauren
|
c8c89fab5b |
[compiler] Update rollup plugins (#31919)
Update our various compiler rollup plugins. --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/facebook/react/pull/31919). * #31927 * #31918 * #31917 * #31916 * __->__ #31919 |
||
 mofeiZ
|
b9b510df2a |
Revert "Replace deprecated dependency in eslint-plugin-react-compiler" (#31665)
Reverts facebook/react#31629 `@babel/plugin-proposal-private-methods` is not compatible with `@babel/traverse` versions < 7.25 (see https://github.com/babel/babel/issues/16851). Internally we have partners that use a less modern babel version, and we expect this to be an issue for older codebases in OSS as well. |
||
 Pavel
|
7670501b0d |
Replace deprecated dependency in eslint-plugin-react-compiler (#31629)
|
||
|
lauren
|
6f0dc2947b |
[compiler] Update hermes deps (#31586)
``` => Found "hermes-parser@0.25.1" info Reasons this module exists - "_project_#prettier-plugin-hermes-parser" depends on it - Hoisted from "_project_#prettier-plugin-hermes-parser#hermes-parser" - Hoisted from "_project_#eslint-plugin-react-compiler#hermes-parser" - Hoisted from "_project_#snap#hermes-parser" - Hoisted from "_project_#snap#babel-plugin-syntax-hermes-parser#hermes-parser" - Hoisted from "_project_#eslint-plugin-react-compiler#hermes-eslint#hermes-parser" info Disk size without dependencies: "1.49MB" info Disk size with unique dependencies: "1.82MB" info Disk size with transitive dependencies: "1.82MB" info Number of shared dependencies: 1 ✨ Done in 0.81s. ``` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/facebook/react/pull/31586). * __->__ #31586 * #31585 |
||
|
lauren
|
d2e8954d06 |
[compiler] Update react deps (#31585)
``` => Found "react@0.0.0-experimental-4beb1fd8-20241118" info Reasons this module exists - "_project_#babel-plugin-react-compiler" depends on it - Hoisted from "_project_#babel-plugin-react-compiler#react" - Hoisted from "_project_#snap#react" info Disk size without dependencies: "252KB" info Disk size with unique dependencies: "252KB" info Disk size with transitive dependencies: "252KB" info Number of shared dependencies: 0 ✨ Done in 0.60s. ``` ``` => Found "react-dom@0.0.0-experimental-4beb1fd8-20241118" info Reasons this module exists - "_project_#babel-plugin-react-compiler" depends on it - Hoisted from "_project_#babel-plugin-react-compiler#react-dom" - Hoisted from "_project_#snap#react-dom" info Disk size without dependencies: "8.04MB" info Disk size with unique dependencies: "8.17MB" info Disk size with transitive dependencies: "8.17MB" info Number of shared dependencies: 1 ✨ Done in 0.56s. ``` --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/facebook/react/pull/31585). * #31586 * __->__ #31585 |
||
|
lauren
|
603e6108f3 |
[compiler] Update react deps to experimental instead of beta (#31385)
Some tests rely on experimental APIs so let's just use react@experimental instead of beta |
||
 dependabot[bot]
|
9c525ea44a |
Bump micromatch from 4.0.5 to 4.0.8 in /compiler (#31186)
Bumps [micromatch](https://github.com/micromatch/micromatch) from 4.0.5 to 4.0.8. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/micromatch/micromatch/releases">micromatch's releases</a>.</em></p> <blockquote> <h2>4.0.8</h2> <p>Ultimate release that fixes both CVE-2024-4067 and CVE-2024-4068. We consider the issues low-priority, so even if you see automated scanners saying otherwise, don't be scared.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/micromatch/micromatch/blob/master/CHANGELOG.md">micromatch's changelog</a>.</em></p> <blockquote> <h2>[4.0.8] - 2024-08-22</h2> <ul> <li>backported CVE-2024-4067 fix (from v4.0.6) over to 4.x branch</li> </ul> <h2>[4.0.7] - 2024-05-22</h2> <ul> <li>this is basically v4.0.5, with some README updates</li> <li><strong>it is vulnerable to CVE-2024-4067</strong></li> <li>Updated braces to v3.0.3 to avoid CVE-2024-4068</li> <li>does NOT break API compatibility</li> </ul> <h2>[4.0.6] - 2024-05-21</h2> <ul> <li>Added <code>hasBraces</code> to check if a pattern contains braces.</li> <li>Fixes CVE-2024-4067</li> <li><strong>BREAKS API COMPATIBILITY</strong></li> <li>Should be labeled as a major release, but it's not.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/micromatch/micromatch/commit/8bd704ec0d9894693d35da425d827819916be920"><code>8bd704e</code></a> 4.0.8</li> <li><a href="https://github.com/micromatch/micromatch/commit/a0e68416a44da10f3e4e30845ab95af4fd286d5a"><code>a0e6841</code></a> run verb to generate README documentation</li> <li><a href="https://github.com/micromatch/micromatch/commit/4ec288484f6e8cccf597ad3d43529c31d0f7a02a"><code>4ec2884</code></a> Merge branch 'v4' into hauserkristof-feature/v4.0.8</li> <li><a href="https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade"><code>03aa805</code></a> Merge pull request <a href="https://redirect.github.com/micromatch/micromatch/issues/266">#266</a> from hauserkristof/feature/v4.0.8</li> <li><a href="https://github.com/micromatch/micromatch/commit/814f5f70efcd100ca9d29198867812a3d6ab91a8"><code>814f5f7</code></a> lint</li> <li><a href="https://github.com/micromatch/micromatch/commit/67fcce6a1077c2faf5ad0c5f998fa70202cc5dae"><code>67fcce6</code></a> fix: CHANGELOG about braces & CVE-2024-4068, v4.0.5</li> <li><a href="https://github.com/micromatch/micromatch/commit/113f2e3fa7cb30b429eda7c4c38475a8e8ba1b30"><code>113f2e3</code></a> fix: CVE numbers in CHANGELOG</li> <li><a href="https://github.com/micromatch/micromatch/commit/d9dbd9a266686f44afb38da26fe016f96d1ec04f"><code>d9dbd9a</code></a> feat: updated CHANGELOG</li> <li><a href="https://github.com/micromatch/micromatch/commit/2ab13157f416679f54e3a32b1425e184bd16749e"><code>2ab1315</code></a> fix: use actions/setup-node@v4</li> <li><a href="https://github.com/micromatch/micromatch/commit/1406ea38f3e24b29f4d4f46908d5cffcb3e6c4ce"><code>1406ea3</code></a> feat: rework test to work on macos with node 10,12 and 14</li> <li>Additional commits viewable in <a href="https://github.com/micromatch/micromatch/compare/4.0.5...4.0.8">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/react/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
2011074ab8 |
Bump json5 from 2.2.1 to 2.2.3 in /compiler (#31185)
Bumps [json5](https://github.com/json5/json5) from 2.2.1 to 2.2.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/json5/json5/releases">json5's releases</a>.</em></p> <blockquote> <h2>v2.2.3</h2> <ul> <li>Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (<a href="https://redirect.github.com/json5/json5/issues/299">#299</a>)</li> </ul> <h2>v2.2.2</h2> <ul> <li>Fix: Properties with the name <code>__proto__</code> are added to objects and arrays. (<a href="https://redirect.github.com/json5/json5/issues/199">#199</a>) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (<a href="https://redirect.github.com/json5/json5/issues/295">#295</a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/json5/json5/blob/main/CHANGELOG.md">json5's changelog</a>.</em></p> <blockquote> <h3>v2.2.3 [<a href="https://github.com/json5/json5/tree/v2.2.3">code</a>, <a href="https://github.com/json5/json5/compare/v2.2.2...v2.2.3">diff</a>]</h3> <ul> <li>Fix: json5@2.2.3 is now the 'latest' release according to npm instead of v1.0.2. (<a href="https://redirect.github.com/json5/json5/issues/299">#299</a>)</li> </ul> <h3>v2.2.2 [<a href="https://github.com/json5/json5/tree/v2.2.2">code</a>, <a href="https://github.com/json5/json5/compare/v2.2.1...v2.2.2">diff</a>]</h3> <ul> <li>Fix: Properties with the name <code>__proto__</code> are added to objects and arrays. (<a href="https://redirect.github.com/json5/json5/issues/199">#199</a>) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (<a href="https://redirect.github.com/json5/json5/issues/295">#295</a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/json5/json5/commit/c3a75242772a5026a49c4017a16d9b3543b62776"><code>c3a7524</code></a> 2.2.3</li> <li><a href="https://github.com/json5/json5/commit/94fd06d82eeed225fa172f6fb2ca27375cbd2e39"><code>94fd06d</code></a> docs: update CHANGELOG for v2.2.3</li> <li><a href="https://github.com/json5/json5/commit/3b8cebf0c474a8b20c78bd75c89cca0c4dce84ce"><code>3b8cebf</code></a> docs(security): use GitHub security advisories</li> <li><a href="https://github.com/json5/json5/commit/f0fd9e194dde282caff114a110f4fac635f3a62c"><code>f0fd9e1</code></a> docs: publish a security policy</li> <li><a href="https://github.com/json5/json5/commit/6a91a05fffeda16ff6b3b5008b6b340d42d31ec0"><code>6a91a05</code></a> docs(template): bug -> bug report</li> <li><a href="https://github.com/json5/json5/commit/14f8cb186e8abdfaccf6527171da7b1224374650"><code>14f8cb1</code></a> 2.2.2</li> <li><a href="https://github.com/json5/json5/commit/10cc7ca9169b59c5e0f5afc03dbd870cd06bcc46"><code>10cc7ca</code></a> docs: update CHANGELOG for v2.2.2</li> <li><a href="https://github.com/json5/json5/commit/7774c1097993bc3ce9f0ac4b722a32bf7d6871c8"><code>7774c10</code></a> fix: add <strong>proto</strong> to objects and arrays</li> <li><a href="https://github.com/json5/json5/commit/edde30abd8b22facf2c06c72586b9f6edf12700d"><code>edde30a</code></a> Readme: slight tweak to intro</li> <li><a href="https://github.com/json5/json5/commit/97286f8bd542c89dcee096bc05dd28ed2dfc1e16"><code>97286f8</code></a> Improve example in readme</li> <li>Additional commits viewable in <a href="https://github.com/json5/json5/compare/v2.2.1...v2.2.3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/react/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Lauren Tan
|
db240980a3 |
[playground] Decouple playground from compiler
Currently the playground is setup as a linked workspace for the
compiler which complicates our yarn workspace setup and means that snap
can sometimes pull in a different version of react than was otherwise
specified.
There's no real reason to have these workspaces combined so let's split
them up.
ghstack-source-id:
|
||
|
dependabot[bot]
|
d0772d5866 |
Bump axios from 1.7.1 to 1.7.4 in /compiler (#30694)
Bumps [axios](https://github.com/axios/axios) from 1.7.1 to 1.7.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>Release v1.7.4</h2> <h2>Release notes:</h2> <h3>Bug Fixes</h3> <ul> <li><strong>sec:</strong> CVE-2024-39338 (<a href="https://redirect.github.com/axios/axios/issues/6539">#6539</a>) (<a href="https://redirect.github.com/axios/axios/issues/6543">#6543</a>) (<a href="https://github.com/axios/axios/commit/6b6b605eaf73852fb2dae033f1e786155959de3a">6b6b605</a>)</li> <li><strong>sec:</strong> disregard protocol-relative URL to remediate SSRF (<a href="https://redirect.github.com/axios/axios/issues/6539">#6539</a>) (<a href="https://github.com/axios/axios/commit/07a661a2a6b9092c4aa640dcc7f724ec5e65bdda">07a661a</a>)</li> </ul> <h3>Contributors to this release</h3> <ul> <li><!-- raw HTML omitted --> <a href="https://github.com/levpachmanov" title="+47/-11 ([#6543](https://github.com/axios/axios/issues/6543) )">Lev Pachmanov</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/hainenber" title="+49/-4 ([#6539](https://github.com/axios/axios/issues/6539) )">Đỗ Trọng Hải</a></li> </ul> <h2>Release v1.7.3</h2> <h2>Release notes:</h2> <h3>Bug Fixes</h3> <ul> <li><strong>adapter:</strong> fix progress event emitting; (<a href="https://redirect.github.com/axios/axios/issues/6518">#6518</a>) (<a href="https://github.com/axios/axios/commit/e3c76fc9bdd03aa4d98afaf211df943e2031453f">e3c76fc</a>)</li> <li><strong>fetch:</strong> fix withCredentials request config (<a href="https://redirect.github.com/axios/axios/issues/6505">#6505</a>) (<a href="https://github.com/axios/axios/commit/85d4d0ea0aae91082f04e303dec46510d1b4e787">85d4d0e</a>)</li> <li><strong>xhr:</strong> return original config on errors from XHR adapter (<a href="https://redirect.github.com/axios/axios/issues/6515">#6515</a>) (<a href="https://github.com/axios/axios/commit/8966ee7ea62ecbd6cfb39a905939bcdab5cf6388">8966ee7</a>)</li> </ul> <h3>Contributors to this release</h3> <ul> <li><!-- raw HTML omitted --> <a href="https://github.com/DigitalBrainJS" title="+211/-159 ([#6518](https://github.com/axios/axios/issues/6518) [#6519](https://github.com/axios/axios/issues/6519) )">Dmitriy Mozgovoy</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/ValeraS" title="+3/-3 ([#6515](https://github.com/axios/axios/issues/6515) )">Valerii Sidorenko</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/prianyu" title="+2/-2 ([#6505](https://github.com/axios/axios/issues/6505) )">prianYu</a></li> </ul> <h2>Release v1.7.2</h2> <h2>Release notes:</h2> <h3>Bug Fixes</h3> <ul> <li><strong>fetch:</strong> enhance fetch API detection; (<a href="https://redirect.github.com/axios/axios/issues/6413">#6413</a>) (<a href="https://github.com/axios/axios/commit/4f79aef81b7c4644328365bfc33acf0a9ef595bc">4f79aef</a>)</li> </ul> <h3>Contributors to this release</h3> <ul> <li><!-- raw HTML omitted --> <a href="https://github.com/DigitalBrainJS" title="+3/-3 ([#6413](https://github.com/axios/axios/issues/6413) )">Dmitriy Mozgovoy</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v1.x/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/axios/axios/compare/v1.7.3...v1.7.4">1.7.4</a> (2024-08-13)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>sec:</strong> CVE-2024-39338 (<a href="https://redirect.github.com/axios/axios/issues/6539">#6539</a>) (<a href="https://redirect.github.com/axios/axios/issues/6543">#6543</a>) (<a href="https://github.com/axios/axios/commit/6b6b605eaf73852fb2dae033f1e786155959de3a">6b6b605</a>)</li> <li><strong>sec:</strong> disregard protocol-relative URL to remediate SSRF (<a href="https://redirect.github.com/axios/axios/issues/6539">#6539</a>) (<a href="https://github.com/axios/axios/commit/07a661a2a6b9092c4aa640dcc7f724ec5e65bdda">07a661a</a>)</li> </ul> <h3>Contributors to this release</h3> <ul> <li><!-- raw HTML omitted --> <a href="https://github.com/levpachmanov" title="+47/-11 ([#6543](https://github.com/axios/axios/issues/6543) )">Lev Pachmanov</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/hainenber" title="+49/-4 ([#6539](https://github.com/axios/axios/issues/6539) )">Đỗ Trọng Hải</a></li> </ul> <h2><a href="https://github.com/axios/axios/compare/v1.7.2...v1.7.3">1.7.3</a> (2024-08-01)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>adapter:</strong> fix progress event emitting; (<a href="https://redirect.github.com/axios/axios/issues/6518">#6518</a>) (<a href="https://github.com/axios/axios/commit/e3c76fc9bdd03aa4d98afaf211df943e2031453f">e3c76fc</a>)</li> <li><strong>fetch:</strong> fix withCredentials request config (<a href="https://redirect.github.com/axios/axios/issues/6505">#6505</a>) (<a href="https://github.com/axios/axios/commit/85d4d0ea0aae91082f04e303dec46510d1b4e787">85d4d0e</a>)</li> <li><strong>xhr:</strong> return original config on errors from XHR adapter (<a href="https://redirect.github.com/axios/axios/issues/6515">#6515</a>) (<a href="https://github.com/axios/axios/commit/8966ee7ea62ecbd6cfb39a905939bcdab5cf6388">8966ee7</a>)</li> </ul> <h3>Contributors to this release</h3> <ul> <li><!-- raw HTML omitted --> <a href="https://github.com/DigitalBrainJS" title="+211/-159 ([#6518](https://github.com/axios/axios/issues/6518) [#6519](https://github.com/axios/axios/issues/6519) )">Dmitriy Mozgovoy</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/ValeraS" title="+3/-3 ([#6515](https://github.com/axios/axios/issues/6515) )">Valerii Sidorenko</a></li> <li><!-- raw HTML omitted --> <a href="https://github.com/prianyu" title="+2/-2 ([#6505](https://github.com/axios/axios/issues/6505) )">prianYu</a></li> </ul> <h2><a href="https://github.com/axios/axios/compare/v1.7.1...v1.7.2">1.7.2</a> (2024-05-21)</h2> <h3>Bug Fixes</h3> <ul> <li><strong>fetch:</strong> enhance fetch API detection; (<a href="https://redirect.github.com/axios/axios/issues/6413">#6413</a>) (<a href="https://github.com/axios/axios/commit/4f79aef81b7c4644328365bfc33acf0a9ef595bc">4f79aef</a>)</li> </ul> <h3>Contributors to this release</h3> <ul> <li><!-- raw HTML omitted --> <a href="https://github.com/DigitalBrainJS" title="+3/-3 ([#6413](https://github.com/axios/axios/issues/6413) )">Dmitriy Mozgovoy</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/abd24a7367726616e60dfc04cb394b4be37cf597"><code>abd24a7</code></a> chore(release): v1.7.4 (<a href="https://redirect.github.com/axios/axios/issues/6544">#6544</a>)</li> <li><a href="https://github.com/axios/axios/commit/6b6b605eaf73852fb2dae033f1e786155959de3a"><code>6b6b605</code></a> fix(sec): CVE-2024-39338 (<a href="https://redirect.github.com/axios/axios/issues/6539">#6539</a>) (<a href="https://redirect.github.com/axios/axios/issues/6543">#6543</a>)</li> <li><a href="https://github.com/axios/axios/commit/07a661a2a6b9092c4aa640dcc7f724ec5e65bdda"><code>07a661a</code></a> fix(sec): disregard protocol-relative URL to remediate SSRF (<a href="https://redirect.github.com/axios/axios/issues/6539">#6539</a>)</li> <li><a href="https://github.com/axios/axios/commit/c6cce43cd94489f655f4488c5a50ecaf781c94f2"><code>c6cce43</code></a> chore(release): v1.7.3 (<a href="https://redirect.github.com/axios/axios/issues/6521">#6521</a>)</li> <li><a href="https://github.com/axios/axios/commit/e3c76fc9bdd03aa4d98afaf211df943e2031453f"><code>e3c76fc</code></a> fix(adapter): fix progress event emitting; (<a href="https://redirect.github.com/axios/axios/issues/6518">#6518</a>)</li> <li><a href="https://github.com/axios/axios/commit/85d4d0ea0aae91082f04e303dec46510d1b4e787"><code>85d4d0e</code></a> fix(fetch): fix withCredentials request config (<a href="https://redirect.github.com/axios/axios/issues/6505">#6505</a>)</li> <li><a href="https://github.com/axios/axios/commit/92cd8ed94362f929d3d0ed85ca84296c0ac8fd6d"><code>92cd8ed</code></a> chore(github): update ISSUE_TEMPLATE.md (<a href="https://redirect.github.com/axios/axios/issues/6519">#6519</a>)</li> <li><a href="https://github.com/axios/axios/commit/8966ee7ea62ecbd6cfb39a905939bcdab5cf6388"><code>8966ee7</code></a> fix(xhr): return original config on errors from XHR adapter (<a href="https://redirect.github.com/axios/axios/issues/6515">#6515</a>)</li> <li><a href="https://github.com/axios/axios/commit/0e4f9fa29077ebee4499facea6be1492b42e8a26"><code>0e4f9fa</code></a> chore(release): v1.7.2 (<a href="https://redirect.github.com/axios/axios/issues/6414">#6414</a>)</li> <li><a href="https://github.com/axios/axios/commit/4f79aef81b7c4644328365bfc33acf0a9ef595bc"><code>4f79aef</code></a> fix(fetch): enhance fetch API detection; (<a href="https://redirect.github.com/axios/axios/issues/6413">#6413</a>)</li> <li>See full diff in <a href="https://github.com/axios/axios/compare/v1.7.1...v1.7.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/react/network/alerts). </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
9927ab238b |
Bump rollup from 4.13.2 to 4.22.4 in /compiler (#31039)
Bumps [rollup](https://github.com/rollup/rollup) from 4.13.2 to 4.22.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/releases">rollup's releases</a>.</em></p> <blockquote> <h2>v4.22.4</h2> <h2>4.22.4</h2> <p><em>2024-09-21</em></p> <h3>Bug Fixes</h3> <ul> <li>Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (<a href="https://redirect.github.com/rollup/rollup/issues/5671">#5671</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/5670">#5670</a>: refactor: Use object.prototype to check for reserved properties (<a href="https://github.com/YuHyeonWook"><code>@YuHyeonWook</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/5671">#5671</a>: Fix DOM Clobbering CVE (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>v4.22.3</h2> <h2>4.22.3</h2> <p><em>2024-09-21</em></p> <h3>Bug Fixes</h3> <ul> <li>Ensure that mutations in modules without side effects are observed while properly handling transitive dependencies (<a href="https://redirect.github.com/rollup/rollup/issues/5669">#5669</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/5669">#5669</a>: Ensure impure dependencies of pure modules are added (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>v4.22.2</h2> <h2>4.22.2</h2> <p><em>2024-09-20</em></p> <h3>Bug Fixes</h3> <ul> <li>Revert fix for side effect free modules until other issues are investigated (<a href="https://redirect.github.com/rollup/rollup/issues/5667">#5667</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/5667">#5667</a>: Partially revert <a href="https://redirect.github.com/rollup/rollup/issues/5658">#5658</a> and re-apply <a href="https://redirect.github.com/rollup/rollup/issues/5644">#5644</a> (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>v4.22.1</h2> <h2>4.22.1</h2> <p><em>2024-09-20</em></p> <h3>Bug Fixes</h3> <ul> <li>Revert <a href="https://redirect.github.com/rollup/rollup/issues/5644">#5644</a> "stable chunk hashes" while issues are being investigated</li> </ul> <h3>Pull Requests</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rollup/rollup/blob/master/CHANGELOG.md">rollup's changelog</a>.</em></p> <blockquote> <h2>4.22.4</h2> <p><em>2024-09-21</em></p> <h3>Bug Fixes</h3> <ul> <li>Fix a vulnerability in generated code that affects IIFE, UMD and CJS bundles when run in a browser context (<a href="https://redirect.github.com/rollup/rollup/issues/5671">#5671</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/5670">#5670</a>: refactor: Use object.prototype to check for reserved properties (<a href="https://github.com/YuHyeonWook"><code>@YuHyeonWook</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/5671">#5671</a>: Fix DOM Clobbering CVE (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>4.22.3</h2> <p><em>2024-09-21</em></p> <h3>Bug Fixes</h3> <ul> <li>Ensure that mutations in modules without side effects are observed while properly handling transitive dependencies (<a href="https://redirect.github.com/rollup/rollup/issues/5669">#5669</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/5669">#5669</a>: Ensure impure dependencies of pure modules are added (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>4.22.2</h2> <p><em>2024-09-20</em></p> <h3>Bug Fixes</h3> <ul> <li>Revert fix for side effect free modules until other issues are investigated (<a href="https://redirect.github.com/rollup/rollup/issues/5667">#5667</a>)</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/5667">#5667</a>: Partially revert <a href="https://redirect.github.com/rollup/rollup/issues/5658">#5658</a> and re-apply <a href="https://redirect.github.com/rollup/rollup/issues/5644">#5644</a> (<a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> </ul> <h2>4.22.1</h2> <p><em>2024-09-20</em></p> <h3>Bug Fixes</h3> <ul> <li>Revert <a href="https://redirect.github.com/rollup/rollup/issues/5644">#5644</a> "stable chunk hashes" while issues are being investigated</li> </ul> <h3>Pull Requests</h3> <ul> <li><a href="https://redirect.github.com/rollup/rollup/pull/5663">#5663</a>: chore(deps): update dependency inquirer to v11 (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot], <a href="https://github.com/lukastaegert"><code>@lukastaegert</code></a>)</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/5664">#5664</a>: chore(deps): lock file maintenance minor/patch updates (<a href="https://github.com/renovate"><code>@renovate</code></a>[bot])</li> <li><a href="https://redirect.github.com/rollup/rollup/pull/5665">#5665</a>: fix: type in CI file (<a href="https://github.com/YuHyeonWook"><code>@YuHyeonWook</code></a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rollup/rollup/commit/79c0aba353ca84c0e22c3cfe9eee433ba83f3670"><code>79c0aba</code></a> 4.22.4</li> <li><a href="https://github.com/rollup/rollup/commit/e2552c9e955e0a61f70f508200ee9f752f85a541"><code>e2552c9</code></a> Fix DOM Clobbering CVE (<a href="https://redirect.github.com/rollup/rollup/issues/5671">#5671</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/10ab90ea612f80de21c6c433c2d792eaf7b45f1c"><code>10ab90e</code></a> refactor: Use object.prototype to check for reserved properties (<a href="https://redirect.github.com/rollup/rollup/issues/5670">#5670</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/e1cba8e84a0c01dd16580ba7a2536a988dfb4e18"><code>e1cba8e</code></a> 4.22.3</li> <li><a href="https://github.com/rollup/rollup/commit/59cec3e86748369ce887f8fdb4ef7351335ab281"><code>59cec3e</code></a> Ensure impure dependencies of pure modules are added (<a href="https://redirect.github.com/rollup/rollup/issues/5669">#5669</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/b86ffd776cfa906573d36c3f019316d02445d9ef"><code>b86ffd7</code></a> 4.22.2</li> <li><a href="https://github.com/rollup/rollup/commit/d5ff63de9e317283f059bde06320bca11cf90488"><code>d5ff63d</code></a> Partially revert <a href="https://redirect.github.com/rollup/rollup/issues/5658">#5658</a> and re-apply <a href="https://redirect.github.com/rollup/rollup/issues/5644">#5644</a> (<a href="https://redirect.github.com/rollup/rollup/issues/5667">#5667</a>)</li> <li><a href="https://github.com/rollup/rollup/commit/0a821d931894f7f6f4ee33285b6f0925e10c8348"><code>0a821d9</code></a> Create SECURITY.md</li> <li><a href="https://github.com/rollup/rollup/commit/76e962daca5b7352bf199c28fa0a10ad4745c5e7"><code>76e962d</code></a> 4.22.1</li> <li><a href="https://github.com/rollup/rollup/commit/68c23da8824e05e84460a9a5bf18c4e91912a52a"><code>68c23da</code></a> Partially revert <a href="https://redirect.github.com/rollup/rollup/issues/5644">#5644</a></li> <li>Additional commits viewable in <a href="https://github.com/rollup/rollup/compare/v4.13.2...v4.22.4">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/react/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Lauren Tan
|
c9143b98d0 |
[compiler] Refactor release script
Updates the release script to publish tags as well as take a `--ci`
option
Test plan:
```
$ yarn npm:publish --debug --frfr
yarn run v1.22.22
$ node scripts/release/publish --debug --frfr
ℹ Preparing to publish (for real) [debug=true]
ℹ Building packages
✔ Successfully built babel-plugin-react-compiler
✔ Successfully built eslint-plugin-react-compiler
✔ Successfully built react-compiler-healthcheck
NPM 2-factor auth code: ******
✔ Wrote package.json for babel-plugin-react-compiler@0.0.0-experimental-10cf18a-20240806
========== babel-plugin-react-compiler ==========
⠧ Publishing babel-plugin-react-compiler@0.0.0-experimental-10cf18a-20240806 to npm
+ babel-plugin-react-compiler@0.0.0-experimental-10cf18a-20240806
✔ Successfully published babel-plugin-react-compiler to npm
ℹ dry-run: npm dist-tag add babel-plugin-react-compiler@0.0.0-experimental-10cf18a-20240806 experimental --otp=******
✔ Successfully pushed dist-tag experimental for babel-plugin-react-compiler to npm
✔ Wrote package.json for eslint-plugin-react-compiler@0.0.0-experimental-532f76b-20240806
========== eslint-plugin-react-compiler ==========
⠹ Publishing eslint-plugin-react-compiler@0.0.0-experimental-532f76b-20240806 to npm
+ eslint-plugin-react-compiler@0.0.0-experimental-532f76b-20240806
✔ Successfully published eslint-plugin-react-compiler to npm
ℹ dry-run: npm dist-tag add eslint-plugin-react-compiler@0.0.0-experimental-532f76b-20240806 experimental --otp=******
✔ Successfully pushed dist-tag experimental for eslint-plugin-react-compiler to npm
✔ Wrote package.json for react-compiler-healthcheck@0.0.0-experimental-48a8743-20240806
========== react-compiler-healthcheck ==========
⠙ Publishing react-compiler-healthcheck@0.0.0-experimental-48a8743-20240806 to npm
+ react-compiler-healthcheck@0.0.0-experimental-48a8743-20240806
✔ Successfully published react-compiler-healthcheck to npm
ℹ dry-run: npm dist-tag add react-compiler-healthcheck@0.0.0-experimental-48a8743-20240806 experimental --otp=******
✔ Successfully pushed dist-tag experimental for react-compiler-healthcheck to npm
✅ All done
✨ Done in 50.64s.
```
ghstack-source-id:
|
||
|
Lauren Tan
|
08b4ee83cc |
[compiler] Add babel-plugin-idx to snap
To surface any potential conflicts with this plugin, let's install it
into snap so we can surface any runtime errors after compilation
ghstack-source-id:
|
||
 Jan Kassens
|
70484844bf |
[BE] switch to hermes parser for prettier (#30421)
This will allow us to parse new flow syntax since the `flow` parser is no longer updated. I had to exclude some files and have them fall back to `flow` parser since they contain invalid graphql syntax that makes the plugin crash. |
||
 Mofei Zhang
|
735d3d2baa |
[compiler][ez] Upgrade babel generator version for playground
---
The current version of `@babel/generator` used by playground has some bugs (see https://github.com/babel/babel/issues/10966)
```js
// Try pasting this into playground
function useFoo(a, b) {
return (a ?? b) == c;
}
// Current playground output
function useFoo(a, b) {
return a ?? b == c;
}
```
We previously locked babel library versions to be compatible with the oldest Meta internal usages. Now that both compiler and eslint plugins are bundled with rollup, this shouldn't be necessary.
ghstack-source-id:
|
||
|
Mofei Zhang
|
6cca9c3184 |
[compiler][be] Fix lint violations in eslint-plugin
ghstack-source-id:
|
||
 Mike Vitousek
|
9a6e2d078c |
[compiler] Flow support for playground
Summary: The playground currently has limited support for Flow files--it tries to parse them if the // flow sigil is on the fist line, but this is often not the case for files one would like to inspect in practice. more importantly, component syntax isn't supported even then, because it depends on the Hermes parser.
This diff improves the state of flow support in the playground to make it more useful: when we see `flow` anywhere in the file, we'll assume it's a flow file, parse it with the Hermes parser, and disable typescript-specific features of Monaco editor.
ghstack-source-id:
|
||
|
dependabot[bot]
|
bbc8851c84 |
Bump ws from 8.13.0 to 8.17.1 in /compiler (#30043)
Bumps [ws](https://github.com/websockets/ws) from 8.13.0 to 8.17.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/websockets/ws/releases">ws's releases</a>.</em></p> <blockquote> <h2>8.17.1</h2> <h1>Bug fixes</h1> <ul> <li>Fixed a DoS vulnerability (<a href="https://redirect.github.com/websockets/ws/issues/2231">#2231</a>).</li> </ul> <p>A request with a number of headers exceeding the[<code>server.maxHeadersCount</code>][] threshold could be used to crash a ws server.</p> <pre lang="js"><code>const http = require('http'); const WebSocket = require('ws'); <p>const wss = new WebSocket.Server({ port: 0 }, function () { const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split(''); const headers = {}; let count = 0;</p> <p>for (let i = 0; i < chars.length; i++) { if (count === 2000) break;</p> <pre><code>for (let j = 0; j &lt; chars.length; j++) { const key = chars[i] + chars[j]; headers[key] = 'x'; if (++count === 2000) break; } </code></pre> <p>}</p> <p>headers.Connection = 'Upgrade'; headers.Upgrade = 'websocket'; headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ=='; headers['Sec-WebSocket-Version'] = '13';</p> <p>const request = http.request({ headers: headers, host: '127.0.0.1', port: wss.address().port });</p> <p>request.end(); }); </code></pre></p> <p>The vulnerability was reported by <a href="https://github.com/rrlapointe">Ryan LaPointe</a> in <a href="https://redirect.github.com/websockets/ws/issues/2230">websockets/ws#2230</a>.</p> <p>In vulnerable versions of ws, the issue can be mitigated in the following ways:</p> <ol> <li>Reduce the maximum allowed length of the request headers using the [<code>--max-http-header-size=size</code>][] and/or the [<code>maxHeaderSize</code>][] options so that no more headers than the <code>server.maxHeadersCount</code> limit can be sent.</li> </ol> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/websockets/ws/commit/3c56601092872f7d7566989f0e379271afd0e4a1"><code>3c56601</code></a> [dist] 8.17.1</li> <li><a href="https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c"><code>e55e510</code></a> [security] Fix crash when the Upgrade header cannot be read (<a href="https://redirect.github.com/websockets/ws/issues/2231">#2231</a>)</li> <li><a href="https://github.com/websockets/ws/commit/6a00029edd924499f892aed8003cef1fa724cfe5"><code>6a00029</code></a> [test] Increase code coverage</li> <li><a href="https://github.com/websockets/ws/commit/ddfe4a804d79e7788ab136290e609f91cf68423f"><code>ddfe4a8</code></a> [perf] Reduce the amount of <code>crypto.randomFillSync()</code> calls</li> <li><a href="https://github.com/websockets/ws/commit/b73b11828d166e9692a9bffe9c01a7e93bab04a8"><code>b73b118</code></a> [dist] 8.17.0</li> <li><a href="https://github.com/websockets/ws/commit/29694a5905fa703e86667928e6bacac397469471"><code>29694a5</code></a> [test] Use the <code>highWaterMark</code> variable</li> <li><a href="https://github.com/websockets/ws/commit/934c9d6b938b93c045cb13e5f7c19c27a8dd925a"><code>934c9d6</code></a> [ci] Test on node 22</li> <li><a href="https://github.com/websockets/ws/commit/1817bac06e1204bfb578b8b3f4bafd0fa09623d0"><code>1817bac</code></a> [ci] Do not test on node 21</li> <li><a href="https://github.com/websockets/ws/commit/96c9b3deddf56cacb2d756aaa918071e03cdbc42"><code>96c9b3d</code></a> [major] Flip the default value of <code>allowSynchronousEvents</code> (<a href="https://redirect.github.com/websockets/ws/issues/2221">#2221</a>)</li> <li><a href="https://github.com/websockets/ws/commit/e5f32c7e1e6d3d19cd4a1fdec84890e154db30c1"><code>e5f32c7</code></a> [fix] Emit at most one event per event loop iteration (<a href="https://redirect.github.com/websockets/ws/issues/2218">#2218</a>)</li> <li>Additional commits viewable in <a href="https://github.com/websockets/ws/compare/8.13.0...8.17.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/react/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Lauren Tan
|
61aa159086 |
[compiler] Fix up prettier
Our prettier setup is all messed up after the merge, so this PR should
fix things
ghstack-source-id:
|
||
|
Lauren Tan
|
0a0a5c02f1 |
[compiler:playground] Wait for build before running playground
Explicitly waits for the build to finish since the playground requires
them to run
ghstack-source-id:
|
||
|
dependabot[bot]
|
c325aec1ee |
Bump word-wrap from 1.2.3 to 1.2.5 in /compiler (#29064)
Bumps [word-wrap](https://github.com/jonschlinkert/word-wrap) from 1.2.3 to 1.2.5. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/jonschlinkert/word-wrap/releases">word-wrap's releases</a>.</em></p> <blockquote> <h2>1.2.5</h2> <p><strong>Changes</strong>:</p> <p>Reverts default value for <code>options.indent</code> to two spaces <code>' '</code>.</p> <p><strong>Full Changelog</strong>: <a href="https://github.com/jonschlinkert/word-wrap/compare/1.2.4...1.2.5">https://github.com/jonschlinkert/word-wrap/compare/1.2.4...1.2.5</a></p> <h2>1.2.4</h2> <h2>What's Changed</h2> <ul> <li>Remove default indent by <a href="https://github.com/mohd-akram"><code>@mohd-akram</code></a> in <a href="https://redirect.github.com/jonschlinkert/word-wrap/pull/24">jonschlinkert/word-wrap#24</a></li> <li>🔒fix: CVE 2023 26115 (2) by <a href="https://github.com/OlafConijn"><code>@OlafConijn</code></a> in <a href="https://redirect.github.com/jonschlinkert/word-wrap/pull/41">jonschlinkert/word-wrap#41</a></li> <li>🔒 fix: CVE-2023-26115 by <a href="https://github.com/aashutoshrathi"><code>@aashutoshrathi</code></a> in <a href="https://redirect.github.com/jonschlinkert/word-wrap/pull/33">jonschlinkert/word-wrap#33</a></li> <li>chore: publish workflow by <a href="https://github.com/OlafConijn"><code>@OlafConijn</code></a> in <a href="https://redirect.github.com/jonschlinkert/word-wrap/pull/42">jonschlinkert/word-wrap#42</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mohd-akram"><code>@mohd-akram</code></a> made their first contribution in <a href="https://redirect.github.com/jonschlinkert/word-wrap/pull/24">jonschlinkert/word-wrap#24</a></li> <li><a href="https://github.com/OlafConijn"><code>@OlafConijn</code></a> made their first contribution in <a href="https://redirect.github.com/jonschlinkert/word-wrap/pull/41">jonschlinkert/word-wrap#41</a></li> <li><a href="https://github.com/aashutoshrathi"><code>@aashutoshrathi</code></a> made their first contribution in <a href="https://redirect.github.com/jonschlinkert/word-wrap/pull/33">jonschlinkert/word-wrap#33</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/jonschlinkert/word-wrap/compare/1.2.3...1.2.4">https://github.com/jonschlinkert/word-wrap/compare/1.2.3...1.2.4</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/jonschlinkert/word-wrap/commit/207044ebda1dd3809d15b6000a48409266536771"><code>207044e</code></a> 1.2.5</li> <li><a href="https://github.com/jonschlinkert/word-wrap/commit/98943154855b0dd79b707462b9202614990c7f61"><code>9894315</code></a> revert default indent</li> <li><a href="https://github.com/jonschlinkert/word-wrap/commit/f64b188c7261d26b99e1e2075d6b12f21798e83a"><code>f64b188</code></a> run verb to generate README</li> <li><a href="https://github.com/jonschlinkert/word-wrap/commit/03ea08256ba0c8e8b02b1b304f0f5bd2b1863207"><code>03ea082</code></a> Merge pull request <a href="https://redirect.github.com/jonschlinkert/word-wrap/issues/42">#42</a> from jonschlinkert/chore/publish-workflow</li> <li><a href="https://github.com/jonschlinkert/word-wrap/commit/420dce9a2412b21881202b73a3c34f0edc53cb2e"><code>420dce9</code></a> Merge pull request <a href="https://redirect.github.com/jonschlinkert/word-wrap/issues/41">#41</a> from jonschlinkert/fix/CVE-2023-26115-2</li> <li><a href="https://github.com/jonschlinkert/word-wrap/commit/bfa694edf55bb84ff84512f13da6d68bf7593f06"><code>bfa694e</code></a> Update .github/workflows/publish.yml</li> <li><a href="https://github.com/jonschlinkert/word-wrap/commit/ace0b3c78f81aaf43040bab3bc91d3c5546d3fd2"><code>ace0b3c</code></a> chore: bump version to 1.2.4</li> <li><a href="https://github.com/jonschlinkert/word-wrap/commit/6fd727594676f3e1b196b08a320908bec2f4ca02"><code>6fd7275</code></a> chore: add publish workflow</li> <li><a href="https://github.com/jonschlinkert/word-wrap/commit/30d6daf60fce429f5f559252fa86ee78200652c4"><code>30d6daf</code></a> chore: fix test</li> <li><a href="https://github.com/jonschlinkert/word-wrap/commit/655929cabea6299dddf3b4a21fc3713fca701b48"><code>655929c</code></a> chore: remove package-lock</li> <li>Additional commits viewable in <a href="https://github.com/jonschlinkert/word-wrap/compare/1.2.3...1.2.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/react/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ba51ebe03a |
Bump tough-cookie from 4.1.2 to 4.1.4 in /compiler (#29065)
Bumps [tough-cookie](https://github.com/salesforce/tough-cookie) from 4.1.2 to 4.1.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/salesforce/tough-cookie/releases">tough-cookie's releases</a>.</em></p> <blockquote> <h2>v4.1.4</h2> <p><a href="https://www.npmjs.com/package/tough-cookie/v/4.1.4">https://www.npmjs.com/package/tough-cookie/v/4.1.4</a></p> <h2>What's Changed</h2> <ul> <li>Add local alias for <code>toString</code> by <a href="https://github.com/corvidism"><code>@corvidism</code></a> in <a href="https://redirect.github.com/salesforce/tough-cookie/pull/409">salesforce/tough-cookie#409</a></li> <li>Fix incorrect string validation for URL by <a href="https://github.com/coditva"><code>@coditva</code></a> in <a href="https://redirect.github.com/salesforce/tough-cookie/pull/261">salesforce/tough-cookie#261</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/corvidism"><code>@corvidism</code></a> made their first contribution in <a href="https://redirect.github.com/salesforce/tough-cookie/pull/409">salesforce/tough-cookie#409</a></li> <li><a href="https://github.com/coditva"><code>@coditva</code></a> made their first contribution in <a href="https://redirect.github.com/salesforce/tough-cookie/pull/261">salesforce/tough-cookie#261</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/salesforce/tough-cookie/compare/v4.1.3...v4.1.4">https://github.com/salesforce/tough-cookie/compare/v4.1.3...v4.1.4</a></p> <h2>4.1.3</h2> <p>Security fix for Prototype Pollution discovery in <a href="https://redirect.github.com/salesforce/tough-cookie/issues/282">#282</a>. This is a minor release, although output from the <code>inspect</code> utility is affected by this change, we felt this change was important enough to be pushed into the next patch.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/salesforce/tough-cookie/commit/cacbc37936bd4824693d885e1e65dca626ed3c8c"><code>cacbc37</code></a> Bump version to 4.1.4</li> <li><a href="https://github.com/salesforce/tough-cookie/commit/a48fb3a6ba2bbce41595a20e1db56543d974057b"><code>a48fb3a</code></a> Add tests for url validation</li> <li><a href="https://github.com/salesforce/tough-cookie/commit/50e69bf9372c13a1e573b77c179a879198a240e3"><code>50e69bf</code></a> Merge pull request <a href="https://redirect.github.com/salesforce/tough-cookie/issues/261">#261</a> from postmanlabs/fix/url-string-validation</li> <li><a href="https://github.com/salesforce/tough-cookie/commit/1253d58825378c2327e3a71e2228b65812d1cf7c"><code>1253d58</code></a> Merge pull request <a href="https://redirect.github.com/salesforce/tough-cookie/issues/409">#409</a> from corvidism/validators-to-string</li> <li><a href="https://github.com/salesforce/tough-cookie/commit/238367e2f1d8a2c72cc25cc80a6eeecb612983d6"><code>238367e</code></a> Add local alias for <code>toString</code></li> <li><a href="https://github.com/salesforce/tough-cookie/commit/4ff4d29f6cefd279a412b8d62a21142ebd410b36"><code>4ff4d29</code></a> 4.1.3 release preparation, update the package and lib/version to 4.1.3. (<a href="https://redirect.github.com/salesforce/tough-cookie/issues/284">#284</a>)</li> <li><a href="https://github.com/salesforce/tough-cookie/commit/12d474791bb856004e858fdb1c47b7608d09cf6e"><code>12d4747</code></a> Prevent prototype pollution in cookie memstore (<a href="https://redirect.github.com/salesforce/tough-cookie/issues/283">#283</a>)</li> <li><a href="https://github.com/salesforce/tough-cookie/commit/f06b72d1d447f33dfa6222c0a3c0c5e063558248"><code>f06b72d</code></a> Fix documentation for store.findCookies, missing allowSpecialUseDomain proper...</li> <li><a href="https://github.com/salesforce/tough-cookie/commit/cf6debd15f16df43030f36719251fcce0ed27dfc"><code>cf6debd</code></a> Fix incorrect string validation for URL</li> <li>See full diff in <a href="https://github.com/salesforce/tough-cookie/compare/v4.1.2...v4.1.4">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~ccasey">ccasey</a>, a new releaser for tough-cookie since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/react/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
8287cb9290 |
Bump postcss from 8.4.24 to 8.4.31 in /compiler (#29063)
Bumps [postcss](https://github.com/postcss/postcss) from 8.4.24 to 8.4.31. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/releases">postcss's releases</a>.</em></p> <blockquote> <h2>8.4.31</h2> <ul> <li>Fixed <code>\r</code> parsing to fix CVE-2023-44270.</li> </ul> <h2>8.4.30</h2> <ul> <li>Improved source map performance (by <a href="https://github.com/romainmenke"><code>@romainmenke</code></a>).</li> </ul> <h2>8.4.29</h2> <ul> <li>Fixed <code>Node#source.offset</code> (by <a href="https://github.com/idoros"><code>@idoros</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/coliff"><code>@coliff</code></a>).</li> </ul> <h2>8.4.28</h2> <ul> <li>Fixed <code>Root.source.end</code> for better source map (by <a href="https://github.com/romainmenke"><code>@romainmenke</code></a>).</li> <li>Fixed <code>Result.root</code> types when <code>process()</code> has no parser.</li> </ul> <h2>8.4.27</h2> <ul> <li>Fixed <code>Container</code> clone methods types.</li> </ul> <h2>8.4.26</h2> <ul> <li>Fixed clone methods types.</li> </ul> <h2>8.4.25</h2> <ul> <li>Improve stringify performance (by <a href="https://github.com/romainmenke"><code>@romainmenke</code></a>).</li> <li>Fixed docs (by <a href="https://github.com/vikaskaliramna07"><code>@vikaskaliramna07</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's changelog</a>.</em></p> <blockquote> <h2>8.4.31</h2> <ul> <li>Fixed <code>\r</code> parsing to fix CVE-2023-44270.</li> </ul> <h2>8.4.30</h2> <ul> <li>Improved source map performance (by Romain Menke).</li> </ul> <h2>8.4.29</h2> <ul> <li>Fixed <code>Node#source.offset</code> (by Ido Rosenthal).</li> <li>Fixed docs (by Christian Oliff).</li> </ul> <h2>8.4.28</h2> <ul> <li>Fixed <code>Root.source.end</code> for better source map (by Romain Menke).</li> <li>Fixed <code>Result.root</code> types when <code>process()</code> has no parser.</li> </ul> <h2>8.4.27</h2> <ul> <li>Fixed <code>Container</code> clone methods types.</li> </ul> <h2>8.4.26</h2> <ul> <li>Fixed clone methods types.</li> </ul> <h2>8.4.25</h2> <ul> <li>Improve stringify performance (by Romain Menke).</li> <li>Fixed docs (by <a href="https://github.com/vikaskaliramna07"><code>@vikaskaliramna07</code></a>).</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/postcss/postcss/commit/90208de8805dd762596c0028b8637ffbed23e371"><code>90208de</code></a> Release 8.4.31 version</li> <li><a href="https://github.com/postcss/postcss/commit/58cc860b4c1707510c9cd1bc1fa30b423a9ad6c5"><code>58cc860</code></a> Fix carrier return parsing</li> <li><a href="https://github.com/postcss/postcss/commit/4fff8e4cdc237619df1d73a444c0a8329701c1e2"><code>4fff8e4</code></a> Improve pnpm test output</li> <li><a href="https://github.com/postcss/postcss/commit/cd43ed123274a92ebc13a1e8cccf1d65b8198f84"><code>cd43ed1</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/caa916bdcbf66c51321574e2dde112ab13e8b306"><code>caa916b</code></a> Update dependencies</li> <li><a href="https://github.com/postcss/postcss/commit/8972f76923e921a3c9655822382039b31b1c8e1a"><code>8972f76</code></a> Typo</li> <li><a href="https://github.com/postcss/postcss/commit/11a5286f781d2a637f2c545c5e9cd661055acaab"><code>11a5286</code></a> Typo</li> <li><a href="https://github.com/postcss/postcss/commit/45c55017776fc61f7815d1ea8e92d5291ca5d6c8"><code>45c5501</code></a> Release 8.4.30 version</li> <li><a href="https://github.com/postcss/postcss/commit/bc3c341f589f9c15f1b56838a33d908374e537e0"><code>bc3c341</code></a> Update linter</li> <li><a href="https://github.com/postcss/postcss/commit/b2be58a2eb788d12474ee1335f8ecdb9fa6225aa"><code>b2be58a</code></a> Merge pull request <a href="https://redirect.github.com/postcss/postcss/issues/1881">#1881</a> from romainmenke/improve-sourcemap-performance--phil...</li> <li>Additional commits viewable in <a href="https://github.com/postcss/postcss/compare/8.4.24...8.4.31">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/facebook/react/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Lauren Tan
|
b195a947de |
[compiler:publish] Prompt for OTP
Makes running the script a little more ergonomic by prompting for OTP
upfront.
ghstack-source-id:
|
||
 Abishek Ilango
|
541e3c516d |
[compiler:playground] Resizable tabs (#29133)
## Summary Every tab wraps the text around but there is no way to resize it. It was also hard to use the source map tab. It doesn't occupy the full height nor is the tab resizable. So I made all the tabs resizable. > Also, > * make the source map tab occupy full height > * make it a teeny tiny bit easier to work with the compiler playground (especially source map) ## How did you test this change? https://github.com/facebook/react/assets/91976421/cdec30e8-cadb-4958-8786-31c54ea83bd6 Signed-off-by: abizek <abishekilango@protonmail.com> |
||
|
Lauren Tan
|
3f1436cca1 |
[compiler:playground] Fix broken builds
Now that the compiler is public, the `*` version was grabbing the latest
version of the compiler off of npm and was resolving to my very first
push to npm (an empty package containing only a single package.json).
This was breaking the playground as it would attempt to load the
compiler but then crash the babel pipeline due to the node module not
being found.
ghstack-source-id:
|
||
 Joseph Savona
|
3adca7a477 |
compiler: fix jsx text attributes with double quotes (#29079)
Fixes #29069 by detecting the presence of double-quotes in JSX attribute strings and falling back to using an expression container. |
||
|
Lauren Tan
|
6948639df6 |
[publish] Add script to publish packages
Adds a script to publish babel-plugin-react-compiler, eslint-plugin-react-compiler, and react-compiler-healthcheck to npm. Instructions are in a comment in scripts/publish.js, please read carefully before using this script! Test plan: ``` $ yarn npm:publish yarn run v1.22.10 $ node scripts/publish ℹ Preparing to publish (dry run) [debug=false] ℹ Building packages ✔ Successfully built babel-plugin-react-compiler ✔ Successfully built eslint-plugin-react-compiler ✔ Successfully built react-compiler-healthcheck ℹ Dry run: Report tarball contents ========== babel-plugin-react-compiler ========== ⠴ Running npm pack --dry-run npm WARN config init.author.name Use `--init-author-name` instead. npm WARN config init.author.email Use `--init-author-email` instead. ⠦ Running npm pack --dry-run npm notice npm notice 📦 babel-plugin-react-compiler@0.0.1 npm notice === Tarball Contents === npm notice 11B dist/__tests__/DisjointSet-test.d.ts npm notice 11B dist/__tests__/envConfig-test.d.ts npm notice 11B dist/__tests__/Logger-test.d.ts npm notice 11B dist/__tests__/parseConfigPragma-test.d.ts npm notice 11B dist/__tests__/Result-test.d.ts npm notice 145B dist/__tests__/test-utils/validateNoUseBeforeDefine.d.ts npm notice 144B dist/Babel/BabelPlugin.d.ts npm notice 350B dist/Babel/RunReactCompilerBabelPlugin.d.ts npm notice 2.4kB dist/CompilerError.d.ts npm notice 455B dist/Entrypoint/Gating.d.ts npm notice 376B dist/Entrypoint/Imports.d.ts npm notice 166B dist/Entrypoint/index.d.ts npm notice 1.8kB dist/Entrypoint/Options.d.ts npm notice 1.3kB dist/Entrypoint/Pipeline.d.ts npm notice 819B dist/Entrypoint/Program.d.ts npm notice 295B dist/Entrypoint/Reanimated.d.ts npm notice 753B dist/Entrypoint/Suppression.d.ts npm notice 113B dist/HIR/AssertConsistentIdentifiers.d.ts npm notice 115B dist/HIR/AssertTerminalSuccessorsExist.d.ts npm notice 529B dist/HIR/AssertValidBlockNesting.d.ts npm notice 110B dist/HIR/AssertValidMutableRanges.d.ts npm notice 585B dist/HIR/BuildHIR.d.ts npm notice 116B dist/HIR/BuildReactiveScopeTerminalsHIR.d.ts npm notice 125B dist/HIR/ComputeUnconditionalBlocks.d.ts npm notice 602B dist/HIR/Dominator.d.ts npm notice 12.7kB dist/HIR/Environment.d.ts npm notice 184B dist/HIR/FindContextIdentifiers.d.ts npm notice 401B dist/HIR/Globals.d.ts npm notice 22.2kB dist/HIR/HIR.d.ts npm notice 2.8kB dist/HIR/HIRBuilder.d.ts npm notice 1.1kB dist/HIR/index.d.ts npm notice 108B dist/HIR/MergeConsecutiveBlocks.d.ts npm notice 115B dist/HIR/MergeOverlappingReactiveScopesHIR.d.ts npm notice 2.2kB dist/HIR/ObjectShape.d.ts npm notice 1.4kB dist/HIR/PrintHIR.d.ts npm notice 106B dist/HIR/PruneUnusedLabelsHIR.d.ts npm notice 1.1kB dist/HIR/Types.d.ts npm notice 1.9kB dist/HIR/visitors.d.ts npm notice 776B dist/index.d.ts npm notice 5.4MB dist/index.js npm notice 429B dist/Inference/AnalyseFunctions.d.ts npm notice 324B dist/Inference/DropManualMemoization.d.ts npm notice 436B dist/Inference/index.d.ts npm notice 224B dist/Inference/InferAlias.d.ts npm notice 204B dist/Inference/InferAliasForPhis.d.ts npm notice 206B dist/Inference/InferAliasForStores.d.ts npm notice 115B dist/Inference/InferMutableContextVariables.d.ts npm notice 151B dist/Inference/InferMutableLifetimes.d.ts npm notice 109B dist/Inference/InferMutableRanges.d.ts npm notice 212B dist/Inference/InferMutableRangesForAlias.d.ts npm notice 106B dist/Inference/InferReactivePlaces.d.ts npm notice 368B dist/Inference/InferReferenceEffects.d.ts npm notice 201B dist/Inference/InferTryCatchAliases.d.ts npm notice 130B dist/Inference/InlineImmediatelyInvokedFunctionExpressions.d.ts npm notice 106B dist/Optimization/ConstantPropagation.d.ts npm notice 258B dist/Optimization/DeadCodeElimination.d.ts npm notice 177B dist/Optimization/index.d.ts npm notice 103B dist/Optimization/PruneMaybeThrows.d.ts npm notice 108B dist/ReactiveScopes/AlignMethodCallScopes.d.ts npm notice 110B dist/ReactiveScopes/AlignObjectMethodScopes.d.ts npm notice 133B dist/ReactiveScopes/AlignReactiveScopesToBlockScopes.d.ts npm notice 126B dist/ReactiveScopes/AlignReactiveScopesToBlockScopesHIR.d.ts npm notice 132B dist/ReactiveScopes/AssertScopeInstructionsWithinScope.d.ts npm notice 125B dist/ReactiveScopes/AssertWellFormedBreakTargets.d.ts npm notice 363B dist/ReactiveScopes/BuildReactiveBlocks.d.ts npm notice 142B dist/ReactiveScopes/BuildReactiveFunction.d.ts npm notice 759B dist/ReactiveScopes/CodegenReactiveFunction.d.ts npm notice 154B dist/ReactiveScopes/CollectReactiveIdentifiers.d.ts npm notice 128B dist/ReactiveScopes/CollectReferencedGlobals.d.ts npm notice 698B dist/ReactiveScopes/DeriveMinimalDependencies.d.ts npm notice 138B dist/ReactiveScopes/ExtractScopeDeclarationsFromDestructuring.d.ts npm notice 121B dist/ReactiveScopes/FlattenReactiveLoops.d.ts npm notice 124B dist/ReactiveScopes/FlattenScopesWithHooksOrUse.d.ts npm notice 2.1kB dist/ReactiveScopes/index.d.ts npm notice 370B dist/ReactiveScopes/InferReactiveScopeVariables.d.ts npm notice 217B dist/ReactiveScopes/MemoizeFbtOperandsInSameScope.d.ts npm notice 127B dist/ReactiveScopes/MergeOverlappingReactiveScopes.d.ts npm notice 138B dist/ReactiveScopes/MergeReactiveScopesThatInvalidateTogether.d.ts npm notice 1.0kB dist/ReactiveScopes/PrintReactiveFunction.d.ts npm notice 123B dist/ReactiveScopes/PromoteUsedTemporaries.d.ts npm notice 118B dist/ReactiveScopes/PropagateEarlyReturns.d.ts npm notice 127B dist/ReactiveScopes/PropagateScopeDependencies.d.ts npm notice 123B dist/ReactiveScopes/PruneAllReactiveScopes.d.ts npm notice 126B dist/ReactiveScopes/PruneAlwaysInvalidatingScopes.d.ts npm notice 117B dist/ReactiveScopes/PruneHoistedContexts.d.ts npm notice 227B dist/ReactiveScopes/PruneNonEscapingScopes.d.ts npm notice 125B dist/ReactiveScopes/PruneNonReactiveDependencies.d.ts npm notice 122B dist/ReactiveScopes/PruneTemporaryLValues.d.ts npm notice 118B dist/ReactiveScopes/PruneUnusedLabels.d.ts npm notice 118B dist/ReactiveScopes/PruneUnusedScopes.d.ts npm notice 123B dist/ReactiveScopes/RenameVariables.d.ts npm notice 114B dist/ReactiveScopes/StabilizeBlockIds.d.ts npm notice 3.1kB dist/ReactiveScopes/visitors.d.ts npm notice 170B dist/SSA/EliminateRedundantPhi.d.ts npm notice 101B dist/SSA/EnterSSA.d.ts npm notice 154B dist/SSA/index.d.ts npm notice 99B dist/SSA/LeaveSSA.d.ts npm notice 63.5kB dist/tsconfig.tsbuildinfo npm notice 43B dist/TypeInference/index.d.ts npm notice 103B dist/TypeInference/InferTypes.d.ts npm notice 352B dist/Utils/ComponentDeclaration.d.ts npm notice 256B dist/Utils/DisjointSet.d.ts npm notice 322B dist/Utils/HookDeclaration.d.ts npm notice 613B dist/Utils/logger.d.ts npm notice 2.3kB dist/Utils/Result.d.ts npm notice 119B dist/Utils/RuntimeDiagnosticConstants.d.ts npm notice 1.1kB dist/Utils/Stack.d.ts npm notice 149B dist/Utils/todo.d.ts npm notice 782B dist/Utils/utils.d.ts npm notice 603B dist/Validation/index.d.ts npm notice 117B dist/Validation/ValidateContextVariableLValues.d.ts npm notice 109B dist/Validation/ValidateHooksUsage.d.ts npm notice 214B dist/Validation/ValidateMemoizedEffectDependencies.d.ts npm notice 113B dist/Validation/ValidateNoCapitalizedCalls.d.ts npm notice 114B dist/Validation/ValidateNoRefAccesInRender.d.ts npm notice 113B dist/Validation/ValidateNoSetStateInRender.d.ts npm notice 131B dist/Validation/ValidatePreservedManualMemoization.d.ts npm notice 102B dist/Validation/ValidateUseMemo.d.ts npm notice 2.3kB package.json npm notice === Tarball Details === npm notice name: babel-plugin-react-compiler npm notice version: 0.0.1 npm notice filename: babel-plugin-react-compiler-0.0.1.tgz npm notice package size: 1.1 MB npm notice unpacked size: 5.5 MB npm notice shasum: 9a0fb71bdc904d6ab92432a506b0e037f10dd7ce npm notice integrity: sha512-hXtObyIEP4MbO[...]jstRbpztyLf4g== npm notice total files: 119 npm notice ========== eslint-plugin-react-compiler ========== ⠴ Running npm pack --dry-run npm WARN config init.author.name Use `--init-author-name` instead. npm WARN config init.author.email Use `--init-author-email` instead. ⠋ Running npm pack --dry-run npm notice npm notice 📦 eslint-plugin-react-compiler@0.0.0 npm notice === Tarball Contents === npm notice 827B README.md npm notice 2.1MB dist/index.js npm notice 968B package.json npm notice === Tarball Details === npm notice name: eslint-plugin-react-compiler npm notice version: 0.0.0 npm notice filename: eslint-plugin-react-compiler-0.0.0.tgz npm notice package size: 300.5 kB npm notice unpacked size: 2.1 MB npm notice shasum: f24dab544b03d36d9bb676a16256f114bd5e0ed6 npm notice integrity: sha512-8PcKZXZ+RVBDP[...]D7jFmkvHJoBeA== npm notice total files: 3 npm notice ========== react-compiler-healthcheck ========== ⠼ Running npm pack --dry-run npm WARN config init.author.name Use `--init-author-name` instead. npm WARN config init.author.email Use `--init-author-email` instead. ⠏ Running npm pack --dry-run npm notice npm notice 📦 react-compiler-healthcheck@0.0.0 npm notice === Tarball Contents === npm notice 2.1MB dist/index.js npm notice 677B package.json npm notice 1.8kB rollup.config.js npm notice 1.1kB src/checks/libraryCompat.ts npm notice 3.2kB src/checks/reactCompiler.ts npm notice 759B src/checks/strictMode.ts npm notice 67B src/config.ts npm notice 1.5kB src/index.ts npm notice 602B tsconfig.json npm notice === Tarball Details === npm notice name: react-compiler-healthcheck npm notice version: 0.0.0 npm notice filename: react-compiler-healthcheck-0.0.0.tgz npm notice package size: 290.4 kB npm notice unpacked size: 2.1 MB npm notice shasum: 55c0eb57aebc7305270a29e78ebf6c056044bae0 npm notice integrity: sha512-nPVhGyh8i9PoO[...]v52c3U0tKGpzA== npm notice total files: 9 npm notice ✔ Please confirm contents of packages before publishing. You can run this command again with --for-real to publish to npm ✨ Done in 61.19s. ``` ``` $ yarn npm:publish --debug --for-real yarn run v1.22.10 $ node scripts/publish --debug --for-real ℹ Preparing to publish (for real) [debug=true] ℹ Building packages ✔ Successfully built babel-plugin-react-compiler ✔ Successfully built eslint-plugin-react-compiler ✔ Successfully built react-compiler-healthcheck ✔ Bumped babel-plugin-react-compiler to 0.0.0-experimental-2769f7a-20240513 ✔ Bumped eslint-plugin-react-compiler to 0.0.0-experimental-e04a001-20240513 ✔ Bumped react-compiler-healthcheck to 0.0.0-experimental-410375f-20240513 ========== babel-plugin-react-compiler ========== ⠋ Publishing babel-plugin-react-compiler to npm Command that would have run: npm publish --dry-run /Users/lauren/code/react-forget/compiler/scripts/publish.js:188 throw new Error( ^ Error: This error is intentional, please double check scripts/publish.js and remove this error prior to publishing at main (/Users/lauren/code/react-forget/compiler/scripts/publish.js:188:13) Node.js v20.11.0 error Command failed with exit code 1. info Visit https://yarnpkg.com/en/docs/cli/run for documentation about this command. ``` On the day of launch, remove the hardcoded error, then run `yarn npm:publish --debug --for-real` first as a sanity check. Confirm the contents are correct. Then when you are certain, run `yarn npm:publish --for-real`, and push the commited version bumps to GitHub so the hashes that the packages originate from are public. ghstack-source-id: 403bc22d4b340056fd112fcfc38580f28ed6c986 Pull Request resolved: https://github.com/facebook/react-forget/pull/2966 |
||
|
Jan Kassens
|
e63d3d1491 |
Upgrade to React 19 beta (#2938)
- Updated all directly defined dependencies to the latest React 19 Beta - `package.json`: used `resolutions` to force React 19 for `react-is` transitive dependency - `package.json`: postinstall script to patch fbt for the React 19 element Symbol - Match on the message in Snap to exclude a React 19 warning that `act` should be imported from `react` instead (from inside `@testing-library/react`) - Some updated snapshots, I think due to now recovering behavior of `useMemoCache`, please review. In a next step, we can do the following. I excluded it since it from here as it made the PR unreviewable on GitHub. - Snapshots now use `react/compiler-runtime` as in prod, so the different default in Snap is no longer needed. |
||
 Sathya Gunsasekaran
|
c88d356603 |
[healthcheck] Add status message
Show compiling status message and not just block UI. ghstack-source-id: 67761c5d32216e105c4aa6404dfa07d76ae22583 Pull Request resolved: https://github.com/facebook/react-forget/pull/2921 |
||
|
Sathya Gunsasekaran
|
9e15ade177 |
[healthcheck] Read files from globbed path
ghstack-source-id: a79336c2b1c85ae4d5b941ffbeffb3df10816448 Pull Request resolved: https://github.com/facebook/react-forget/pull/2887 |
||
|
Sathya Gunsasekaran
|
a6cc5bc874 |
[healthcheck] Read glob of src path
Use yargs to parse input of glob expression matching the path of src files to compile. ghstack-source-id: 6a35e958428cd08ef5c96e0014e072d3faf04064 Pull Request resolved: https://github.com/facebook/react-forget/pull/2886 |
||
|
Lauren Tan
|
2f66d37cfd |
Use lz-string for playground state uri param
This compresses more efficiently than the base64 encoding we were previously using, which makes sharing URLs a little less unwieldy and takes up less space in local storage. Using some real code as an example, lz-string compresses to 8040 bytes, whereas the original base64 encoding we were using compresses to 16504 bytes ghstack-source-id: b8f1089889b94b07d6f419606b798ffddb8863ba Pull Request resolved: https://github.com/facebook/react-forget/pull/2834 |
||
|
Jan Kassens
|
76bb13cd26 |
First attempt at making the linter work with advanced TypeScript syntax
First attempt at making the linter work with advanced TypeScript syntax Falls back to the babel parser for some advanced syntax like string template syntax. This is pretty hacky as it doesn't take in any parsing options that are configured for the outer ESLint parser, not sure how that could be handled. |
||
|
Lauren Tan
|
07a3404c5f | Add basic playwright e2e test to playground | ||
|
Lauren Tan
|
5485ed0855 | Standardize on banner2 plugin | ||
|
Lauren Tan
|
f01f74d9e1 |
Also build react-forget-runtime with rollup
This adds rollup to the runtime and adds a new plugin to add the license banner + inject the `"use no memo"` directive. We need to inject it there as rollup currently strips out unknown directives during bundling. |
||
|
Lauren Tan
|
b4eeae6f5d | Share rollup packages across workspace | ||
|
Lauren Tan
|
91826d4924 |
Configure rollup to strip comments and whitespace
For now this configures rollup to strip out comments in DEV builds and whitespace. Unfortunately there's no easy way to do this in just terser alone or other minifiers/manglers, so I had to add prettier as well to re-format the minified code. This does make the build a little bit slower: ``` before: yarn build 118.96s user 12.38s system 185% cpu 1:10.81 total after: yarn build 121.55s user 12.90s system 183% cpu 1:13.17 total ``` Eventually I would like to have a similar setup to React's rollup config where we can have DEV and prod builds. After the repo merge we could probably share or reuse bits of React's rollup config. |
||
|
Lauren Tan
|
4e6aa42773 |
Upgrade to typescript 5.4.3
This PR makes all packages share the same typescript version and updates us to latest versions of typescript, ts-node, typescript-eslint/eslint-plugin and typescript-eslint/parser. I also noticed that the tsconfig we were extending (node18-strictest) was deprecated, so I switched us over to one that's more up to date. Also had to make a couple of small changes to the playground so that continues to build correctly. |
||
|
Lauren Tan
|
e6ce5e4922 | [eslint] Update devDep to match types | ||
|
Lauren Tan
|
15abd38911 |
Cleanup unused eslint-browser and js-fuzzer packages
These were never used, so let's clean them up |
||
|
Sathya Gunasekaran
|
70302048a0 | Update yarn.lock | ||
|
Lauren Tan
|
1f45b13fda | Update yarn.lock | ||
|
Mofei Zhang
|
e09c631aff | [be][snap] Make testfilter file recognize glob patterns, remove @skip | ||
|
Mofei Zhang
|
9d25ced018 | [instrument] Optional globalGating means no global gating | ||
|
Mofei Zhang
|
915a0b8389 |
[be] Consolidate sprout -> snap
--- No changes to snap or sprout's functionality. Tweaks to consolidate sprout into snap while keeping its simple interface and most developer patterns. - to keep `filter` mode fast, we do not run sprout in filter mode - sprout is run in non-filter mode for both test and update ~~Small qol improvement: `--watch` will start you in `filter` mode~~ ### Cost of this change `performance.now()` is quite noisy due to background processes and ThreadPool logic (especially with asymmetric task distribution), so I used `process.cpuUsage` which reports time spent in user-space. This was much less noisy (1-4% standard dev / mean) Running all tests becomes slower by ~50%. Initial runs are slower because they load in Forget's `require` chains. - 23.9s previous initial run - 34.6s current initial run - 11.5s previous subsequent runs - 15.4s current subsequent runs Running filtered tests remains very fast (~100ms on the average case) --- Additional modes or commands could be added as needed (e.g. run tests in filter mode, with sprout output) |