Update dependency gh-pages to v6 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
gh-pages	^3.2.0 → ^6.0.0

---

tschaub gh-pages vulnerable to prototype pollution

CVE-2022-37611 / GHSA-8mmm-9v2q-x3f9

More information

Details

Prototype pollution vulnerability in tschaub gh-pages via the partial variable in util.js.

Severity

• CVSS Score: 9.8 / 10 (Critical)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-37611
• https://github.com/tschaub/gh-pages/issues/446
• https://github.com/tschaub/gh-pages/blob/e363b144defe8e555f5a54251a6f7f1297c0e3f6/lib/util.js#L11
• https://github.com/tschaub/gh-pages/blob/e363b144defe8e555f5a54251a6f7f1297c0e3f6/lib/util.js#L16
• https://github.com/tschaub/gh-pages/pull/452
• https://github.com/advisories/GHSA-8mmm-9v2q-x3f9

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

tschaub/gh-pages (gh-pages)

v6.3.0

Compare Source

This relesae includes a fix for filenames starting with - and a number of dependency updates. See below for details.

• #​593 - Handle filenames starting with a dash (@​sherlockdoyle)
• #​591 - Bump commander from 11.1.0 to 13.0.0 (@​tschaub)
• #​587 - Bump eslint-config-tschaub from 14.1.2 to 15.1.0 (@​tschaub)
• #​590 - Bump mocha from 10.8.2 to 11.0.1 (@​tschaub)
• #​583 - Bump mocha from 10.7.3 to 10.8.2 (@​tschaub)
• #​584 - Bump chai from 4.3.10 to 4.5.0 (@​tschaub)

v6.2.0

Compare Source

Assorted dependency updates and a documentation change.

• #​581 - Update globby (@​tschaub)
• #​578 - Bump sinon from 18.0.0 to 19.0.2 (@​tschaub)
• #​579 - Bump eslint from 8.57.0 to 8.57.1 (@​tschaub)
• #​576 - Bump async from 3.2.5 to 3.2.6 (@​tschaub)
• #​573 - Bump mocha from 10.7.0 to 10.7.3 (@​tschaub)
• #​571 - Bump mocha from 10.6.0 to 10.7.0 (@​tschaub)
• #​569 - Bump mocha from 10.4.0 to 10.6.0 (@​tschaub)
• #​563 - Bump braces from 3.0.2 to 3.0.3 (@​tschaub)
• #​561 - Bump sinon from 17.0.2 to 18.0.0 (@​tschaub)
• #​557 - Bump sinon from 17.0.1 to 17.0.2 (@​tschaub)
• #​555 - Bump dir-compare from 4.2.0 to 5.0.0 (@​tschaub)
• #​550 - Bump mocha from 10.3.0 to 10.4.0 (@​tschaub)
• #​549 - Bump tmp from 0.2.1 to 0.2.3 (@​tschaub)
• #​548 - Bump eslint from 8.56.0 to 8.57.0 (@​tschaub)
• #​545 - Bump mocha from 10.2.0 to 10.3.0 (@​tschaub)
• #​541 - fix: update instruction for next.js (@​multivoltage)

v6.1.1

Compare Source

This release fixes an issue with the --cname option.

• #​535 - fix: Add missing cname option not passed to the config (@​WillBAnders)
• #​539 - Bump eslint from 8.55.0 to 8.56.0 (@​tschaub)

v6.1.0

Compare Source

This release adds support for --nojekyll and --cname options.

• #​531 - Bump sinon from 15.2.0 to 17.0.1 (@​tschaub)
• #​529 - Bump async from 3.2.4 to 3.2.5 (@​tschaub)
• #​524 - Bump commander from 11.0.0 to 11.1.0 (@​tschaub)
• #​530 - Bump eslint from 8.49.0 to 8.53.0 (@​tschaub)
• #​520 - Bump chai from 4.3.8 to 4.3.10 (@​tschaub)
• #​527 - Bump actions/setup-node from 3 to 4 (@​tschaub)
• #​533 - Add --nojekyll and --cname options (@​tschaub)
• #​512 - Bump dir-compare from 4.0.0 to 4.2.0 (@​tschaub)
• #​513 - Bump chai from 4.3.7 to 4.3.8 (@​tschaub)
• #​515 - Bump actions/checkout from 3 to 4 (@​tschaub)
• #​516 - Bump eslint from 8.46.0 to 8.49.0 (@​tschaub)

v6.0.0

Compare Source

This release drops support for Node 14. Otherwise, there are no special upgrade considerations.

• #​507 - Dependency updates and drop Node 14 (@​tschaub)
• #​495 - Bump sinon from 15.0.3 to 15.2.0 (@​tschaub)
• #​500 - Bump semver from 6.3.0 to 6.3.1 (@​tschaub)
• #​506 - Bump eslint from 8.38.0 to 8.46.0 (@​tschaub)
• #​505 - Bump word-wrap from 1.2.3 to 1.2.5 (@​tschaub)
• #​504 - Add error message when --dist is not specified. (@​domsleee)
• #​473 - Bump fs-extra from 8.1.0 to 11.1.1 (@​tschaub)
• #​477 - Bump eslint from 8.32.0 to 8.38.0 (@​tschaub)
• #​474 - Bump sinon from 15.0.1 to 15.0.3 (@​tschaub)
• #​440 - Update readme.md (@​harveer07)

v5.0.0

Compare Source

Potentially breaking change: the publish method now always returns a promise. Previously, it did not return a promise in some error cases. This should not impact most users.

Updates to the development dependencies required a minimum Node version of 14 for the tests. The library should still work on Node 12, but tests are no longer run in CI for version 12. A future major version of the library may drop support for version 12 altogether.

• #​438 - Remove quotation marks (@​Vicropht)
• #​459 - Bump async from 2.6.4 to 3.2.4 (@​tschaub)
• #​454 - Bump email-addresses from 3.0.1 to 5.0.0 (@​tschaub)
• #​455 - Bump actions/setup-node from 1 to 3 (@​tschaub)
• #​453 - Bump actions/checkout from 2 to 3 (@​tschaub)
• #​445 - Update README to clarify project site configuration requirements with tools like CRA, webpack, Vite, etc. (@​Nezteb)
• #​452 - Assorted updates (@​tschaub)

v4.0.0

Compare Source

This release doesn't include any breaking changes, but due to updated development dependencies, tests are no longer run on Node 10.

• #​432 - Updated dev dependencies and formatting (@​tschaub)
• #​430 - Bump ansi-regex from 3.0.0 to 3.0.1 (@​tschaub)
• #​431 - Bump path-parse from 1.0.6 to 1.0.7 (@​tschaub)
• #​427 - Bump async from 2.6.1 to 2.6.4 (@​tschaub)
• #​423 - Bump minimist from 1.2.5 to 1.2.6 (@​tschaub)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.