Generated on May 24, 2024 via pnpm

Npm

Home

renovate 31.0.0

Automated dependency updates. Flexible so you don't need to be.

automated

bazel

bitbucket

Package summary

issues

licenses

Package created

11 Jan 2017

Version published

13 Dec 2021

Maintainers

Total deps

622

Direct deps

License

AGPL-3.0

Issues

3 critical severity issues

critical

simple-git@2.48.0

Remote code execution in simple-git

Recommendation: Upgrade to version 3.16.0 or later

via: simple-git@2.48.0

parse-url@6.0.5

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url

Recommendation: Upgrade to version 8.1.0 or later

via: git-url-parse@11.6.0

backslash@0.2.0

Package has no specified license

Recommendation: Check the package code and files for license information

via: json-dup-key-validator@1.0.3

Collapse

Expand

18 high severity issues

high

simple-git@2.48.0

Command injection in simple-git

Recommendation: Upgrade to version 3.3.0 or later

via: simple-git@2.48.0

parse-path@4.0.4

Authorization Bypass in parse-path

Recommendation: Upgrade to version 5.0.0 or later

via: git-url-parse@11.6.0

parse-link-header@1.0.1

Uncontrolled Resource Consumption in parse-link-header

Recommendation: Upgrade to version 2.0.0 or later

via: parse-link-header@1.0.1

simple-git@2.48.0

Command injection in simple-git

Recommendation: Upgrade to version 3.5.0 or later

via: simple-git@2.48.0

simple-git@2.48.0

simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol

Recommendation: Upgrade to version 3.15.0 or later

via: simple-git@2.48.0

luxon@2.1.1

Luxon Inefficient Regular Expression Complexity vulnerability

Recommendation: Upgrade to version 2.5.2 or later

via: luxon@2.1.1

minimatch@3.0.4

minimatch ReDoS vulnerability

Recommendation: Upgrade to version 3.0.5 or later

via: bunyan@1.8.15 & others

json5@2.2.0

Prototype Pollution in JSON5 via Parse Method

Recommendation: Upgrade to version 2.2.2 or later

via: json5@2.2.0

rc@1.2.8

Package uses a custom license expression: `(BSD-2-Clause OR MIT OR Apache-2.0)`

Recommendation: Validate that the license expression complies with your license policy

via: registry-auth-token@4.2.1

renovate@31.0.0

Package uses a problematic Network Protective license ("AGPL-3.0")

Recommendation: Validate that the package complies with your license policy

via: renovate@31.0.0

semver-utils@1.1.4

Package uses an invalid SPDX license ("APACHEv2")

Recommendation: Validate that the package complies with your license policy

via: semver-utils@1.1.4

spdx-exceptions@2.5.0

Package uses an atypical license ("CC-BY-3.0")

Recommendation: Read and validate the license terms

via: conventional-commits-detector@1.0.3

@npmcli/move-file@1.1.2

Deprecated package

via: cacache@15.3.0 & others

core-js-pure@3.37.1

Package uses postinstall script: "node -e "try{require('./postinstall')}catch(e){}""

via: @renovate/pep440@1.0.0

core-js@3.37.1

Package uses postinstall script: "node -e "try{require('./postinstall')}catch(e){}""

via: global-agent@2.2.0

debug@4.1.1

Deprecated package

via: marshal@0.5.2

dtrace-provider@0.8.8

Package uses install script: "node-gyp rebuild || node suppress-error.js"

via: bunyan@1.8.15

re2@1.17.1

Package uses install script: "install-from-cache --artifact build/Release/re2.node --host-var RE2_DOWNLOAD_MIRROR || npm run rebuild"

via: re2@1.17.1

Collapse

Expand

12 moderate severity issues

moderate

got@11.8.3

Got allows a redirect to a UNIX socket

Recommendation: Upgrade to version 11.8.5 or later

via: @yarnpkg/core@2.4.0 & others

nanoid@3.1.30

Exposure of Sensitive Information to an Unauthorized Actor in nanoid

Recommendation: Upgrade to version 3.1.31 or later

via: nanoid@3.1.30

parse-url@6.0.5

parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing

Recommendation: Upgrade to version 8.1.0 or later

via: git-url-parse@11.6.0

markdown-it@12.2.0

Uncontrolled Resource Consumption in markdown-it

Recommendation: Upgrade to version 12.3.2 or later

via: markdown-it@12.2.0

openpgp@5.0.1

Cleartext Signed Message Signature Spoofing in openpgp

Recommendation: Upgrade to version 5.10.1 or later

via: openpgp@5.0.1

fast-xml-parser@3.19.0

fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

Recommendation: Upgrade to version 4.1.2 or later

via: @aws-sdk/client-ec2@3.35.0 & others

semver@7.3.5

semver vulnerable to Regular Expression Denial of Service

Recommendation: Upgrade to version 7.5.2 or later

via: @yarnpkg/core@2.4.0 & others

openpgp@5.0.1

Package uses a problematic Weakly Protective license ("LGPL-3.0+")

Recommendation: Validate that the package complies with your license policy

via: openpgp@5.0.1

@arcanis/slice-ansi@1.1.1

Package has no specified source code repository

via: @yarnpkg/core@2.4.0

@npmcli/fs@1.1.1

Package has no specified source code repository

via: cacache@15.3.0 & others

minipass-collect@1.0.2

Package has no specified source code repository

via: cacache@15.3.0 & others

minipass-pipeline@1.2.4

Package has no specified source code repository

via: cacache@15.3.0 & others

Collapse

Expand

7 low severity issues

low

debug@4.1.1

Regular Expression Denial of Service in debug

Recommendation: Upgrade to version 4.3.1 or later

via: marshal@0.5.2

auth-header@1.0.0

Package uses a license that is not OSI approved ("CC0-1.0")

Recommendation: Read and validate the license terms

via: auth-header@1.0.0

spdx-license-ids@3.0.18

Package uses a license that is not OSI approved ("CC0-1.0")

Recommendation: Read and validate the license terms

via: conventional-commits-detector@1.0.3

openpgp@5.0.1

Package uses a deprecated license ("LGPL-3.0+")

via: openpgp@5.0.1

renovate@31.0.0

Package uses a deprecated license ("AGPL-3.0")

via: renovate@31.0.0

semver-utils@1.1.4

Package uses a license that is not OSI approved ("APACHEv2")

Recommendation: Read and validate the license terms

via: semver-utils@1.1.4

spdx-exceptions@2.5.0

Package uses a license that is not OSI approved ("CC-BY-3.0")

Recommendation: Read and validate the license terms

via: conventional-commits-detector@1.0.3

Collapse

Expand

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

376 Packages, Including:

@arcanis/slice-ansi@1.1.1

@babel/code-frame@7.24.2

@babel/helper-validator-identifier@7.24.5

@babel/highlight@7.24.5

@babel/runtime-corejs3@7.24.5

@breejs/later@4.1.0

@gar/promisify@1.1.3

@kwsites/file-exists@1.1.1

@kwsites/promise-deferred@1.1.1

@nodelib/fs.scandir@2.1.5

@nodelib/fs.stat@2.0.5

@nodelib/fs.walk@1.2.8

@npmcli/move-file@1.1.2

@renovatebot/parser-utils@1.0.0

@renovatebot/ruby-semver@1.0.0

@sindresorhus/is@4.2.0

@szmarczak/http-timer@4.0.6

@tootallnate/once@1.1.2

@types/cacheable-request@6.0.3

@types/emscripten@1.39.12

@types/http-cache-semantics@4.0.4

@types/keyv@3.1.4

@types/mdast@3.0.15

@types/minimist@1.2.5

@types/moo@0.5.5

@types/node@13.13.52

@types/node@20.12.12

@types/normalize-package-data@2.4.4

@types/redis@2.8.32

@types/responselike@1.0.3

@types/semver@7.5.8

@types/treeify@1.0.3

@types/unist@2.0.10

@types/yauzl@2.10.3

agent-base@6.0.2

agentkeepalive@4.5.0

aggregate-error@3.1.0

ansi-regex@5.0.1

ansi-styles@3.2.1

ansi-styles@4.3.0

any-promise@1.3.0

argparse@1.0.10

array-union@2.1.0

arrify@1.0.1

asap@2.0.6

asn1.js@5.4.1

azure-devops-node-api@11.1.0

bail@1.0.5

balanced-match@1.0.2

base64-js@1.5.1

Apache License 2.0

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

use-patent-claims

place-warranty

Cannot

hold-liable

use-trademark

Must

include-copyright

include-license

state-changes

include-notice

122 Packages, Including:

@aws-crypto/ie11-detection@1.0.0

@aws-crypto/sha256-browser@1.2.2

@aws-crypto/sha256-js@1.2.2

@aws-crypto/supports-web-crypto@1.0.0

@aws-crypto/util@1.2.2

@aws-sdk/abort-controller@3.35.0

@aws-sdk/abort-controller@3.38.0

@aws-sdk/client-ec2@3.35.0

@aws-sdk/client-ecr@3.38.0

@aws-sdk/client-sso@3.35.0

@aws-sdk/client-sso@3.38.0

@aws-sdk/client-sts@3.35.0

@aws-sdk/client-sts@3.38.0

@aws-sdk/config-resolver@3.35.0

@aws-sdk/config-resolver@3.38.0

@aws-sdk/credential-provider-env@3.35.0

@aws-sdk/credential-provider-env@3.38.0

@aws-sdk/credential-provider-imds@3.35.0

@aws-sdk/credential-provider-imds@3.38.0

@aws-sdk/credential-provider-ini@3.35.0

@aws-sdk/credential-provider-ini@3.38.0

@aws-sdk/credential-provider-node@3.35.0

@aws-sdk/credential-provider-node@3.38.0

@aws-sdk/credential-provider-process@3.35.0

@aws-sdk/credential-provider-process@3.38.0

@aws-sdk/credential-provider-sso@3.35.0

@aws-sdk/credential-provider-sso@3.38.0

@aws-sdk/credential-provider-web-identity@3.35.0

@aws-sdk/credential-provider-web-identity@3.38.0

@aws-sdk/fetch-http-handler@3.35.0

@aws-sdk/fetch-http-handler@3.38.0

@aws-sdk/hash-node@3.35.0

@aws-sdk/hash-node@3.38.0

@aws-sdk/invalid-dependency@3.35.0

@aws-sdk/invalid-dependency@3.38.0

@aws-sdk/is-array-buffer@3.35.0

@aws-sdk/is-array-buffer@3.37.0

@aws-sdk/middleware-content-length@3.35.0

@aws-sdk/middleware-content-length@3.38.0

@aws-sdk/middleware-host-header@3.35.0

@aws-sdk/middleware-host-header@3.38.0

@aws-sdk/middleware-logger@3.35.0

@aws-sdk/middleware-logger@3.38.0

@aws-sdk/middleware-retry@3.35.0

@aws-sdk/middleware-retry@3.38.0

@aws-sdk/middleware-sdk-ec2@3.35.0

@aws-sdk/middleware-sdk-sts@3.35.0

@aws-sdk/middleware-sdk-sts@3.38.0

@aws-sdk/middleware-serde@3.35.0

@aws-sdk/middleware-serde@3.38.0

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

72 Packages, Including:

@iarna/toml@2.2.5

@npmcli/fs@1.1.1

abbrev@1.1.1

aproba@2.0.0

are-we-there-yet@3.0.1

boolbase@1.0.0

cacache@15.3.0

changelog-filename-regex@2.0.1

chownr@2.0.0

color-support@1.1.3

console-control-strings@1.1.0

deep-freeze-es6@1.4.1

fastq@1.17.1

fs-minipass@2.1.0

fs.realpath@1.0.0

gauge@4.0.4

glob-parent@5.1.2

glob@6.0.4

glob@7.2.3

graceful-fs@4.2.11

handy-redis@2.3.1

has-unicode@2.0.1

hosted-git-info@2.8.9

hosted-git-info@4.1.0

infer-owner@1.0.4

inflight@1.0.6

inherits@2.0.4

ini@1.3.8

ini@2.0.0

isexe@2.0.0

json-stringify-safe@5.0.1

lru-cache@4.1.5

lru-cache@6.0.0

make-fetch-happen@9.1.0

minimalistic-assert@1.0.1

minimatch@3.0.4

minimatch@3.1.2

minipass-collect@1.0.2

minipass-flush@1.0.5

minipass-pipeline@1.2.4

minipass-sized@1.0.3

minipass@3.3.6

minipass@5.0.0

nopt@5.0.0

npmlog@6.0.2

once@1.3.3

once@1.4.0

picocolors@1.0.1

promise-inflight@1.0.1

pseudomap@1.0.2

BSD 2-Clause "Simplified" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

hold-liable

Must

include-copyright

include-license

22 Packages, Including:

@yarnpkg/core@2.4.0

@yarnpkg/fslib@2.10.4

@yarnpkg/json-proxy@2.1.1

@yarnpkg/libzip@2.3.0

@yarnpkg/parsers@2.4.1

@yarnpkg/pnp@2.3.2

@yarnpkg/shell@2.4.1

css-select@4.3.0

css-what@6.1.0

domelementtype@2.3.0

domhandler@4.3.1

domutils@2.8.0

dtrace-provider@0.8.8

entities@2.1.0

entities@2.2.0

esprima@4.0.1

extract-zip@2.0.1

http-cache-semantics@4.1.1

normalize-package-data@2.5.0

normalize-package-data@3.0.3

nth-check@2.1.1

uglify-js@3.17.4

BSD 3-Clause "New" or "Revised" License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

11 Packages, Including:

diff@4.0.2

global-agent@2.2.0

ieee754@1.2.1

install-artifact-from-github@1.3.5

moo@0.5.1

qs@6.12.1

re2@1.17.1

roarr@2.15.4

source-map@0.6.1

sprintf-js@1.0.3

sprintf-js@1.1.3

BSD Zero Clause License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

include-copyright

include-license

include-original

Cannot

hold-liable

Must

4 Packages, Including:

tslib@1.14.1

tslib@2.1.0

tslib@2.3.1

tslib@2.6.2

(MIT OR CC0-1.0)

Public Domain

4 Packages, Including:

type-fest@0.13.1

type-fest@0.18.1

type-fest@0.6.0

type-fest@0.8.1

Creative Commons Zero v1.0 Universal

Public Domain

Not OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

Cannot

Must

2 Packages, Including:

auth-header@1.0.0

spdx-license-ids@3.0.18

Python License 2.0

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

use-trademark

hold-liable

Must

include-copyright

include-license

state-changes

1 Packages, Including:

argparse@2.0.1

N/A

1 Packages, Including:

backslash@0.2.0

(MIT OR GPL-2.0)

Permissive

1 Packages, Including:

node.extend@2.0.3

GNU Lesser General Public License v3.0 or later

Weakly Protective

OSI Approved

Deprecated

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

use-patent-claims

Cannot

sublicense

hold-liable

Must

include-original

state-changes

disclose-source

include-license

include-copyright

include-install-instructions

1 Packages, Including:

openpgp@5.0.1

(BSD-2-Clause OR MIT OR Apache-2.0)

Expression

1 Packages, Including:

rc@1.2.8

GNU Affero General Public License v3.0

Network Protective

OSI Approved

Deprecated

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

place-warranty

Cannot

sublicense

hold-liable

Must

include-copyright

include-license

state-changes

disclose-source

include-install-instructions

1 Packages, Including:

renovate@31.0.0

APACHEv2

Invalid

Not OSI Approved

1 Packages, Including:

semver-utils@1.1.4

Creative Commons Attribution 3.0 Unported

Uncategorized

Not OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

Cannot

Must

1 Packages, Including:

spdx-exceptions@2.5.0

The Unlicense

Public Domain

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

private-use

modify

Cannot

include-copyright

hold-liable

Must

1 Packages, Including:

stream-buffers@3.0.2

Direct Dependencies

All Dependencies CSV

ⓘ This is a list of renovate 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
@aws-sdk/client-ec2	3.35.0	2.36 MB	Apache-2.0	prod	1
@aws-sdk/client-ecr	3.38.0	103.11 kB	Apache-2.0	prod	1
@breejs/later	4.1.0	82.6 kB	MIT	prod
@iarna/toml	2.2.5	22.86 kB	ISC	prod
@renovate/pep440	1.0.0	9.47 kB	Apache-2.0	prod	1
@renovatebot/parser-utils	1.0.0	68.53 kB	MIT	prod
@renovatebot/ruby-semver	1.0.0	9.93 kB	MIT	prod
@sindresorhus/is	4.2.0	13.37 kB	MIT	prod
@yarnpkg/core	2.4.0	99.88 kB	BSD-2-Clause	prod	3
@yarnpkg/parsers	2.4.1	24.11 kB	BSD-2-Clause	prod
auth-header	1.0.0	6.76 kB	CC0-1.0	prod	1
azure-devops-node-api	11.1.0	487.16 kB	MIT	prod
bunyan	1.8.15	58.89 kB	MIT	prod	2
cacache	15.3.0	21.46 kB	ISC	prod optional	1 4
chalk	4.1.2	11.31 kB	MIT	prod
changelog-filename-regex	2.0.1	1.81 kB	ISC	prod
clean-git-ref	2.0.1	1.11 kB	Apache-2.0	prod
commander	8.3.0	38.44 kB	MIT	prod
conventional-commits-detector	1.0.3	4.73 kB	MIT	prod	1 1 2
crypto-random-string	3.3.1	4.23 kB	MIT	prod
deepmerge	4.2.2	7.91 kB	MIT	prod
delay	5.0.0	3.96 kB	MIT	prod
dequal	2.0.2	4.22 kB	MIT	prod
detect-indent	6.1.0	3.92 kB	MIT	prod
editorconfig	0.15.3	18.28 kB	MIT	prod
email-addresses	5.0.0	23.69 kB	MIT	prod
emoji-regex	9.2.2	10.86 kB	MIT	prod
emojibase-regex	5.1.3	10.2 kB	MIT	prod
emojibase	5.2.0	22.86 kB	MIT	prod
extract-zip	2.0.1	4.26 kB	BSD-2-Clause	prod
fast-safe-stringify	2.1.1	7.71 kB	MIT	prod
find-up	5.0.0	3.72 kB	MIT	prod
fs-extra	10.0.0	32.9 kB	MIT	prod
git-url-parse	11.6.0	8.81 kB	MIT	prod	1 1 1
github-url-from-git	1.5.0	2.71 kB	MIT	prod
global-agent	2.2.0	29.83 kB	BSD-3-Clause	prod	1 1
got	11.8.3	66.03 kB	MIT	prod	1
handlebars	4.7.7	617.76 kB	MIT	prod
handy-redis	2.3.1	60.48 kB	ISC	prod
hasha	5.2.2	4.81 kB	MIT	prod
ignore	5.1.9	13.16 kB	MIT	prod
ini	2.0.0	3.99 kB	ISC	prod
js-yaml	4.1.0	99.96 kB	MIT	prod
json-dup-key-validator	1.0.3	5.66 kB	MIT	prod	1
json-stringify-pretty-compact	3.0.0	3.89 kB	MIT	prod
json5	2.2.0	53.98 kB	MIT	prod	1
luxon	2.1.1	822.69 kB	MIT	prod	1
markdown-it	12.2.0	153.19 kB	MIT	prod	1
markdown-table	2.0.0	4.76 kB	MIT	prod
marshal	0.5.2	8.92 kB	MIT	prod	1 1
minimatch	3.0.4	11.16 kB	ISC	prod optional	1
moo	0.5.1	10.59 kB	BSD-3-Clause	prod
nanoid	3.1.30	5.28 kB	MIT	prod	1
node-html-parser	3.3.6	37.08 kB	MIT	prod
openpgp	5.0.1	5.1 MB	LGPL-3.0+	prod	2 1
p-all	3.0.0	2.57 kB	MIT	prod
p-map	4.0.0	3.36 kB	MIT	prod
p-queue	6.6.2	8.17 kB	MIT	prod
parse-diff	0.8.1	7.96 kB	MIT	prod
parse-link-header	1.0.1	3.24 kB	MIT	prod	1
re2	1.17.1	315.83 kB	BSD-3-Clause	prod optional	2 4
redis	3.1.2	45.79 kB	MIT	prod
registry-auth-token	4.2.1	4.33 kB	MIT	prod	1
remark-github	10.1.0	6.41 kB	MIT	prod
remark	13.0.0	3.08 kB	MIT	prod
semver-stable	3.0.0	2.36 kB	MIT	prod
semver-utils	1.1.4	4.09 kB	APACHEv2	prod	1 1
semver	7.3.5	25.68 kB	ISC	prod optional	1
shlex	2.1.0	6.72 kB	MIT	prod
simple-git	2.48.0	103.38 kB	MIT	prod	1 3
slugify	1.6.3	6.68 kB	MIT	prod
traverse	0.6.6	10.94 kB	MIT	prod
tslib	2.3.1	7.85 kB	0BSD	prod
upath	2.0.1	8.13 kB	MIT	prod
url-join	4.0.1	5.64 kB	MIT	prod
validate-npm-package-name	3.0.0	5.25 kB	ISC	prod
xmldoc	1.1.2	10.94 kB	MIT	prod

Tree

Treemap

renovate 31.0.0

Issues

3 critical severity issues

18 high severity issues

12 moderate severity issues

7 low severity issues

Licenses

MIT License

Apache License 2.0

ISC License

BSD 2-Clause "Simplified" License

BSD 3-Clause "New" or "Revised" License

BSD Zero Clause License

(MIT OR CC0-1.0)

Creative Commons Zero v1.0 Universal

Python License 2.0

N/A

(MIT OR GPL-2.0)

GNU Lesser General Public License v3.0 or later

(BSD-2-Clause OR MIT OR Apache-2.0)

GNU Affero General Public License v3.0

APACHEv2

Creative Commons Attribution 3.0 Unported

The Unlicense

Direct Dependencies

Visualizations

Recent Versions

Scan your app for security vulnerabilities and license issues

Log into your account

Create your account

renovate 31.0.0

Issues

3 critical severity issues

18 high severity issues

12 moderate severity issues

7 low severity issues

Licenses

MIT License

Apache License 2.0

ISC License

BSD 2-Clause "Simplified" License

BSD 3-Clause "New" or "Revised" License

BSD Zero Clause License

(MIT OR CC0-1.0)

Creative Commons Zero v1.0 Universal

Python License 2.0

N/A

(MIT OR GPL-2.0)

GNU Lesser General Public License v3.0 or later

(BSD-2-Clause OR MIT OR Apache-2.0)

GNU Affero General Public License v3.0

APACHEv2

Creative Commons Attribution 3.0 Unported

The Unlicense

Direct Dependencies

Visualizations

Recent Versions

Scan your app for security vulnerabilities and license issues