Skip to content

Bump jsonwebtoken, @twilio-labs/serverless-runtime-types, @twilio/runtime-handler, twilio and twilio-run in /serverless/segment #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Bump jsonwebtoken, @twilio-labs/serverless-runtime-types, @twilio/runtime-handler, twilio and twilio-run in /serverless/segment #7

dependabot wants to merge 1 commit into from

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Apr 12, 2024

Bumps jsonwebtoken to 9.0.2 and updates ancestor dependencies jsonwebtoken, @twilio-labs/serverless-runtime-types, @twilio/runtime-handler, twilio and twilio-run. These dependencies need to be updated together.

Updates jsonwebtoken from 8.5.1 to 9.0.2

Changelog

Sourced from jsonwebtoken's changelog.

9.0.2 - 2023-08-30

  • security: updating semver to 7.5.4 to resolve CVE-2022-25883, closes #921.
  • refactor: reduce library size by using lodash specific dependencies, closes #878.

9.0.1 - 2023-07-05

  • fix(stubs): allow decode method to be stubbed

9.0.0 - 2022-12-21

Breaking changes: See Migration from v8 to v9

Breaking changes

  • Removed support for Node versions 11 and below.
  • The verify() function no longer accepts unsigned tokens by default. ([834503079514b72264fd13023a3b8d648afd6a16]auth0/node-jsonwebtoken@8345030)
  • RSA key size must be 2048 bits or greater. ([ecdf6cc6073ea13a7e71df5fad043550f08d0fa6]auth0/node-jsonwebtoken@ecdf6cc)
  • Key types must be valid for the signing / verification algorithm

Security fixes

  • security: fixes Arbitrary File Write via verify function - CVE-2022-23529
  • security: fixes Insecure default algorithm in jwt.verify() could lead to signature validation bypass - CVE-2022-23540
  • security: fixes Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - CVE-2022-23541
  • security: fixes Unrestricted key type could lead to legacy keys usage - CVE-2022-23539
Commits
Maintainer changes

This version was pushed to npm by charlesrea, a new releaser for jsonwebtoken since your current version.


Updates @twilio-labs/serverless-runtime-types from 1.1.8 to 4.0.0

Release notes

Sourced from @​twilio-labs/serverless-runtime-types's releases.

@​twilio-labs/serverless-runtime-types@​4.0.0

Major Changes

@​twilio-labs/serverless-runtime-types@​3.0.0

Major Changes

All notable changes to this project will be documented in this file. See Conventional Commits for commit guidelines.

Commits
Maintainer changes

This version was pushed to npm by twilio-labs-ci, a new releaser for @​twilio-labs/serverless-runtime-types since your current version.


Updates @twilio/runtime-handler from 1.2.5 to 2.0.2

Release notes

Sourced from @​twilio/runtime-handler's releases.

@​twilio/runtime-handler@​2.0.2

Patch Changes

@​twilio/runtime-handler@​2.0.1

Patch Changes

@​twilio/runtime-handler@​2.0.0

Major Changes

Patch Changes

@​twilio/runtime-handler@​1.3.1

Patch Changes

All notable changes to this project will be documented in this file. See Conventional Commits for commit guidelines.

1.3.0 (2022-11-30)

Features

  • packages/twilio-run: regionalize toolkit config and api (#433) (30d5bdb)
Commits

Updates twilio from 3.83.0 to 5.0.3

Release notes

Sourced from twilio's releases.

5.0.3

Release Notes

Api

  • Correct conference filtering by date_created and date_updated documentation, clarifying that times are UTC.

Flex

  • Remove optional parameter from plugins and it to plugin_versions

Lookups

  • Add new pre_fill package to the lookup response

Messaging

  • Cleanup api.messaging.next-gen from Messaging Services endpoints
  • Readd Sending-Window after fixing test failure

Verify

  • Add whatsapp.msg_service_sid and whatsapp.from parameters to create, update, get and list of services endpoints

Voice

  • Correct conference filtering by date_created and date_updated documentation, clarifying that times are UTC.

Twiml

  • Add new token_type value payment-method for Pay verb

Docs

5.0.2

Release Notes

Library - Chore

Api

  • Add property queue_time to conference participant resource
  • Update RiskCheck documentation
  • Correct call filtering by start and end time documentation, clarifying that times are UTC.

Flex

  • Adding optional parameter to plugins

Media

  • Remove API: MediaProcessor

Messaging

  • Remove Sending-Window due to test failure
  • Add Sending-Window as a response property to Messaging Services, gated by a beta feature flag

Numbers

... (truncated)

Changelog

Sourced from twilio's changelog.

[2024-04-04] Version 5.0.3

Api

  • Correct conference filtering by date_created and date_updated documentation, clarifying that times are UTC.

Flex

  • Remove optional parameter from plugins and it to plugin_versions

Lookups

  • Add new pre_fill package to the lookup response

Messaging

  • Cleanup api.messaging.next-gen from Messaging Services endpoints
  • Readd Sending-Window after fixing test failure

Verify

  • Add whatsapp.msg_service_sid and whatsapp.from parameters to create, update, get and list of services endpoints

Voice

  • Correct conference filtering by date_created and date_updated documentation, clarifying that times are UTC.

Twiml

  • Add new token_type value payment-method for Pay verb

[2024-04-01] Version 5.0.2

Library - Chore

Api

  • Add property queue_time to conference participant resource
  • Update RiskCheck documentation
  • Correct call filtering by start and end time documentation, clarifying that times are UTC.

Flex

  • Adding optional parameter to plugins

Media

  • Remove API: MediaProcessor

Messaging

  • Remove Sending-Window due to test failure
  • Add Sending-Window as a response property to Messaging Services, gated by a beta feature flag

Numbers

  • Correct valid_until_date field to be visible in Bundles resource
  • Adding port_in_status field to the Port In resource and phone_number_status and sid fields to the Port In Phone Number resource

Oauth

... (truncated)

Upgrade guide

Sourced from twilio's upgrade guide.

Upgrade Guide

All MAJOR version bumps will have upgrade notes posted here.

[2024-03-07] 4.x.x to 5.x.x

Overview

Twilio Node Helper Library’s major version 5.0.0 is now available. We ensured that you can upgrade to Node helper Library 5.0.0 version without any breaking changes of existing apis

Behind the scenes Node Helper is now auto-generated via OpenAPI with this release. This enables us to rapidly add new features and enhance consistency across versions and languages. We're pleased to inform you that version 5.0.0 adds support for the application/json content type in the request body.

[2023-01-25] 3.x.x to 4.x.x

  • Supported Node.js versions updated
    • Upgrade to Node.js >= 14
    • Dropped support for Node.js < 14 (#791)
    • Added support for Node.js 18 (#794)
  • Lazy loading enabled by default (#752)
    • Required Twilio modules now lazy load by default
    • See the README for how to disable lazy loading
  • Type changes from object to Record (#873)
    • Certain response properties now use the Record type with string keys
    • Including the subresourceUris property for v2010 APIs and the links properties for non-v2010 APIs
  • Access Tokens
    • Creating an AccessToken requires an identity in the options (#875)
    • ConversationsGrant has been deprecated in favor of VoiceGrant (#783)
    • IpMessagingGrant has been removed (#784)
  • TwiML function deprecations (#788)
    • <Refer>
      • Refer.referSip() replaced by Refer.sip()
    • <Say>

      • Say.ssmlBreak() and Say.break_() replaced by Say.break()

      • Say.ssmlEmphasis() replaced by Say.emphasis()

      • Say.ssmlLang() replaced by Say.lang()

      • Say.ssmlP() replaced by Say.p()

      • Say.ssmlPhoneme() replaced by Say.phoneme()

      • Say.ssmlProsody() replaced by Say.prosody()

      • Say.ssmlS() replaced by Say.s()

      • Say.ssmlSayAs() replaced by Say.sayAs()

      • Say.ssmlSub() replaced by Say.sub()

      • Say.ssmlW() replaced by Say.w()

        Old:

        

        • 

      

      • 

    

    • 






... (truncated)





Commits

    

  • dd1b16c Release 5.0.3
    • 

  • e2bac2a [Librarian] Regenerated @ b894abe9525247ea4345d78891244817d397f6de f80058eb41...
    • 

  • 4cfbe26 Release 5.0.2
    • 

  • 015e56c [Librarian] Regenerated @ 7e2caf2ef38bb07afedbc8ba24e3a235c57337ad 2deb312512...
    • 

  • cc0c0e8 chore: remove media reference (#1014)
    • 

  • 9931e4e Release 5.0.1
    • 

  • f5f0458 [Librarian] Regenerated @ 84df4a97cab4aa96362a9d21aaf3909bbd2dbf5a
    • 

  • 1ec67a5 Release 5.0.0
    • 

  • e3f6d44 [Librarian] Regenerated @ 2264f28906b87ae1f1aedbf72f8dc0e4b57a545a
    • 

  • dfb418d feat!: Merge branch '5.0.0-rc' into main (#1011)
    • 

  • Additional commits viewable in compare view
    • 







Updates twilio-run from 3.4.5 to 4.0.2



Release notes

Sourced from twilio-run's releases.




twilio-run@4.0.2


Patch Changes



twilio-run@4.0.1


Patch Changes



twilio-run@4.0.0


Major Changes



Patch Changes



twilio-run@3.5.4


Patch Changes








Commits






Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.





Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:


    

  • @dependabot rebase will rebase this PR
    • 

  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • 

  • @dependabot merge will merge this PR after your CI passes on it
    • 

  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
    • 

  • @dependabot cancel merge will cancel a previously requested merge and block automerging
    • 

  • @dependabot reopen will reopen this PR if it is closed
    • 

  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
    • 

  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • 

  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
    • 

  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
    • 

  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    
You can disable automated security fix PRs for this repo from the Security Alerts page.
    • 




    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



          

        
      




  




      

       
            



      

  
        

  

      

  
  

  
          

  

    

      


  

      
        @dependabot
  




      

        
          Bump jsonwebtoken, @twilio-labs/serverless-runtime-types, @twilio/run…
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          0829f21
        
      

    

  

    

      
…time-handler, twilio and twilio-run

Bumps [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken) to 9.0.2 and updates ancestor dependencies [jsonwebtoken](https://github.com/auth0/node-jsonwebtoken), [@twilio-labs/serverless-runtime-types](https://github.com/twilio-labs/serverless-toolkit), [@twilio/runtime-handler](https://github.com/twilio-labs/serverless-toolkit), [twilio](https://github.com/twilio/twilio-node) and [twilio-run](https://github.com/twilio-labs/serverless-toolkit). These dependencies need to be updated together.


Updates `jsonwebtoken` from 8.5.1 to 9.0.2
- [Changelog](https://github.com/auth0/node-jsonwebtoken/blob/master/CHANGELOG.md)
- [Commits](auth0/node-jsonwebtoken@v8.5.1...v9.0.2)

Updates `@twilio-labs/serverless-runtime-types` from 1.1.8 to 4.0.0
- [Release notes](https://github.com/twilio-labs/serverless-toolkit/releases)
- [Commits](https://github.com/twilio-labs/serverless-toolkit/commits/@twilio-labs/serverless-runtime-types@4.0.0)

Updates `@twilio/runtime-handler` from 1.2.5 to 2.0.2
- [Release notes](https://github.com/twilio-labs/serverless-toolkit/releases)
- [Commits](https://github.com/twilio-labs/serverless-toolkit/compare/@twilio/runtime-handler@1.2.5...@twilio/runtime-handler@2.0.2)

Updates `twilio` from 3.83.0 to 5.0.3
- [Release notes](https://github.com/twilio/twilio-node/releases)
- [Changelog](https://github.com/twilio/twilio-node/blob/main/CHANGES.md)
- [Upgrade guide](https://github.com/twilio/twilio-node/blob/main/UPGRADE.md)
- [Commits](twilio/twilio-node@3.83.0...5.0.3)

Updates `twilio-run` from 3.4.5 to 4.0.2
- [Release notes](https://github.com/twilio-labs/serverless-toolkit/releases)
- [Commits](https://github.com/twilio-labs/serverless-toolkit/compare/twilio-run@3.4.5...twilio-run@4.0.2)

---
updated-dependencies:
- dependency-name: jsonwebtoken
  dependency-type: indirect
- dependency-name: "@twilio-labs/serverless-runtime-types"
  dependency-type: direct:production
- dependency-name: "@twilio/runtime-handler"
  dependency-type: direct:production
- dependency-name: twilio
  dependency-type: direct:production
- dependency-name: twilio-run
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
bot



          added
  the 

  dependencies

  Pull requests that update a dependency file
 label


      Apr 12, 2024

    

  












  
  

    

      

  




      


    


    

      

        
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  



      

    

  




  
          



      

  

    
    

    

  

    Reviewers
  


    

    No reviews






    
    

    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
      

  

    

      1 participant