Update dependency semver to v7.5.2 [SECURITY] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
semver	7.3.2 -> 7.5.2

GitHub Vulnerability Alerts

CVE-2022-25883

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

---

Release Notes

npm/node-semver (semver)

v7.5.2

Compare Source

Bug Fixes

• 58c791f #​566 diff when detecting major change from prerelease (#​566) (@​lukekarrys)
• 5c8efbc #​565 preserve build in raw after inc (#​565) (@​lukekarrys)
• 717534e #​564 better handling of whitespace (#​564) (@​lukekarrys)

v7.5.1

Compare Source

Bug Fixes

• d30d25a #​559 show type on invalid semver error (#​559) (@​tjenkinson)

v7.5.0

Compare Source

Features

• 503a4e5 #​548 allow identifierBase to be false (#​548) (@​lsvalina)

Bug Fixes

• e219bb4 #​552 throw on bad version with correct error message (#​552) (@​wraithgar)
• fc2f3df #​546 incorrect results from diff sometimes with prerelease versions (#​546) (@​tjenkinson)
• 2781767 #​547 avoid re-instantiating SemVer during diff compare (#​547) (@​macno)

v7.4.0

Compare Source

Features

• 113f513 #​532 identifierBase parameter for .inc (#​532) (@​wraithgar, @​b-bly)
• 48d8f8f #​530 export new RELEASE_TYPES constant (@​hcharley)

Bug Fixes

• 940723d #​538 intersects with v0.0.0 and v0.0.0-0 (#​538) (@​wraithgar)
• aa516b5 #​535 faster parse options (#​535) (@​H4ad)
• 61e6ea1 #​536 faster cache key factory for range (#​536) (@​H4ad)
• f8b8b61 #​541 optimistic parse (#​541) (@​H4ad)
• 796cbe2 #​533 semver.diff prerelease to release recognition (#​533) (@​wraithgar, @​dominique-blockchain)
• 3f222b1 #​537 reuse comparators on subset (#​537) (@​H4ad)
• f66cc45 #​539 faster diff (#​539) (@​H4ad)

Documentation

• c5d29df #​530 Add "Constants" section to README (@​hcharley)

v7.3.8

Compare Source

Bug Fixes

• d8ef32c #​383 add support for node.js esm auto exports (#​383) (@​MylesBorins)

Documentation

• 7209b14 #​477 update range.js comments to clarify the caret ranges examples (#​477) (@​amitse)

7.3.7 (2022-04-11)

Bug Fixes

• allow node >=10 (85b269a)
• bin: get correct value from arg separated by equals (#​449) (4ceca76), closes #​431
• ensure SemVer instance passed to inc are not modified (#​427) (f070dde)
• inc prerelease with numeric preid (#​380) (802e161)

Dependencies

• revert to lru-cache@6 (22ae54d)

7.3.6 (2022-04-05)

Bug Fixes

• https://github.com/npm/node-semver/issues/329 (cb1ca1d)
• properly escape dots in GTE0 regexes (#​432) (11494f1)
• replace deprecated String.prototype.substr() (#​445) (e2d55e7)
• replace regex used to split ranges (#​434) (9ab7b71)

Documentation

• clarify * range behavior (cb1ca1d)

Dependencies

• [email protected] (#​442) (9a3064c)
• [email protected] (#​439) (60cbb3f)

v7.3.7

Compare Source

v7.3.6

Compare Source

v7.3.5

Compare Source

v7.3.4

Compare Source

v7.3.3

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.