It seems that you have a maximum size around 64KB which sounds reasonable. But it might be a good idea to make the error nicer by saying that the file is too big or something similar?

DDDEU21 is online only

Summary

After update I've researched how to build my project in container using gitlab-ci. To build my project I have to build binary dependencies since [email protected] because gifsicle-bin have no prebuilt binaries. I've checked:

• node:12-buster
• node:12-buster-slim
• node:12-stretch
• node:12-stretch-slim
• node:12-alpine
• node:12-alpine3.9

My prepare script benchmark results:

1. node:12-buster-slim node:12-stretch-slim exec time: 3 minutes Prepare script:

   apt-get update
   apt-get install -y --no-install-recommends autoconf automake g++ libpng-dev make
   

2. node:12-buster node:12-stretch exec time: 3 minutes 30 seconds Prepare script: NO
3. node:12-alpine node:12-alpine3.9 exec time: 4 minutes 20 seconds Prepare script:

   apk add --no-cache autoconf automake file g++ libtool make nasm libpng-dev
   

Why alpine is slow

There's no prebuilt binary packages for musl.

Why buster(stretch) is slower than buster-slim(stretch-slim)

Full debian version is about 6x larger than slim version.

My request

Add prepare scripts to readme or create wiki page for that.

Additional info

imagemin/imagemin-gifsicle#32 imagemin/imagemin-gifsicle#40 imagemin/gifsicle-bin#79 imagemin/gifsicle-bin#113 imagemin/mozjpeg-bin#47 imagemin/optipng-bin#110

clised via: #266

See tcoopman/image-webpack-loader#262

Add instructions for container images:

• node:12-buster
• node:12-buster-slim
• node:12-alpine

Measure typical image pull and package installation times for container images above.

Add recommendation according to build time and image size.

Thanks!

Hello guys, good afternoon.

I use image-webpack-loader in my project. When install image-webpack-loader i get an error Error: pngquant failed to build, make sure that libpng-dev is installed. if it's really mandatory, would not it be the case to add this in the docs? and not only for a specific operating system, such as mac.

OS: Ubuntu 17.10.

This is an issue with imagemin-pngquant. See https://github.com/imagemin/imagemin-pngquant/issues/46

removing webp from the config or setting webp.enabled = false should work again.

I've got the following error when building package on serverless :

ERROR in ./app/assets/images/favicon.png
Module build failed (from ./node_modules/image-webpack-loader/index.js):
Error: spawn /builds/webapp/node_modules/cwebp-bin/vendor/cwebp ENOENT

It seems that, what any option i set or not set to webp config, webp is activated:

Maybe it comes from options init at https://github.com/tcoopman/image-webpack-loader/blob/83d8ea081e52e84cc4525dd4d5d0f12f8ccf3d65/index.js#L42

Then when initializing plugins, the condition is true, at https://github.com/tcoopman/image-webpack-loader/blob/83d8ea081e52e84cc4525dd4d5d0f12f8ccf3d65/index.js#L82 :

Any idea to resolve it ?

Ah yes, I see. That's an issue indeed

Have you tried setting config.webp to false?

This is probably not a bug, but I didn't expect a compilation error with 1.11 if it worked before in 1.10.

Environment

• Elixir & Erlang/OTP versions (elixir --version):

Erlang/OTP 23 [erts-11.0] [source] [64-bit] [smp:4:4] [ds:4:4:10] [async-threads:1] [hipe]

Elixir 1.11.0-rc.0 (48cee5a) (compiled with Erlang/OTP 23)

• Operating system: linux

Current behavior

This code:

    <%= if  @in_progress do%>
      <%= live_component @socket, BoardGamesWeb.GameLive.PlayingComponent, players: @players, me: @me, other_players: @other_players %>
    <% else %>
      <%= live_component @socket, BoardGamesWeb.GameLive.WaitingComponent, players: @players %>
    <% end %>

fails to compile:

== Compilation error in file lib/board_games_web/live/game_live.ex ==
** (SyntaxError) lib/board_games_web/live/game_live.html.leex:5:2: unexpected reserved word: end
    (eex 1.11.0-rc.0) lib/eex/compiler.ex:126: EEx.Compiler.generate_buffer/4
    (eex 1.11.0-rc.0) lib/eex/compiler.ex:65: EEx.Compiler.generate_buffer/4
    (phoenix_live_view 0.14.4) expanding macro: Phoenix.LiveView.Renderer.__before_compile__/1
    lib/board_games_web/live/game_live.ex:1: BoardGamesWeb.GameLive (module)
    (elixir 1.11.0-rc.0) lib/kernel/parallel_compiler.ex:314: anonymous fn/4 in Kernel.ParallelCompiler.spawn_workers/7

but with elixir 1.10 it compiles just fine.

Expected behavior

The do% is the issue on the first line. Changing this to do % fixes it. This is probably a good thing that this is now fixed.

I guess this has to do with [EEx] Make trimming behaviour via the :trim option more consistent in the changelog.

So this issue is more of some information if anyone else would run into it.

We don't have a wiki so far, so add it to the readme, we can refactor later if it would be too long

I follow the content of the documentation, but it does not work, I do not understand what went wrong.The file is packaged without error, but the picture is not compressed.

      {
        test: /\.(png|svg|jpg|jpeg|gif)$/,
        use: [{
            loader:'file-loader',
            options:{
                outputPath:"images/",
                publicPath:"./images",
            }
        },{
            loader: 'image-webpack-loader',
            options: {
              bypassOnDebug: true, // [email protected]
              disable: true, // [email protected] and newer
              mozjpeg: {
                progressive: true,
                quality: 65
              },
              optipng: {
                enabled: false,
              },
              pngquant: {
                quality: [0.65, 0.90],
                speed: 4
              },
              gifsicle: {
                interlaced: false,
              }
            },
       },]
      },

I would take a look at the repository of pngquant-bin and find out why it doesn’t work on windows. Maybe try to reinstall the package. I’m closing the issue because the original problem is solved.

Can you create a PR for this?

npm audit returns high severity errors:

if someone wants to create PR for this, that would be awesome.

you have disable: true, you should only set disable true for development not for a production build

should be fixed in the next release

Bumps imagemin-mozjpeg from 8.0.0 to 9.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/imagemin/imagemin-mozjpeg/releases">imagemin-mozjpeg's releases</a>.</em></p> <blockquote> <h2>v9.0.0</h2> <ul> <li>Require Node.js 10 (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-mozjpeg/issues/50">#50</a>) 96e9427</li> <li>Tidelift tasks 03f1abd</li> <li>Use Travis to test on Windows (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-mozjpeg/issues/38">#38</a>) 86fd015</li> </ul> <p><a href="https://github.com/imagemin/imagemin-mozjpeg/compare/v8.0.0...v9.0.0">https://github.com/imagemin/imagemin-mozjpeg/compare/v8.0.0...v9.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/imagemin/imagemin-mozjpeg/commit/6f609dac2e06cc04094a14427bbc507d3bc81333"><code>6f609da</code></a> 9.0.0</li> <li><a href="https://github.com/imagemin/imagemin-mozjpeg/commit/96e94271cea3ac69d8d67b69356994750e240a52"><code>96e9427</code></a> Require Node.js 10 (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-mozjpeg/issues/50">#50</a>)</li> <li><a href="https://github.com/imagemin/imagemin-mozjpeg/commit/03f1abd66938d7856c857eaf36ae2d19b9ddcfa4"><code>03f1abd</code></a> Tidelift tasks</li> <li><a href="https://github.com/imagemin/imagemin-mozjpeg/commit/86fd015269205015c757536ac65b1bedda8dec6a"><code>86fd015</code></a> Use Travis to test on Windows (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-mozjpeg/issues/38">#38</a>)</li> <li>See full diff in <a href="https://github.com/imagemin/imagemin-mozjpeg/compare/v8.0.0...v9.0.0">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

</details>

@dependabot rebase

⚠️ Dependabot is rebasing this PR ⚠️

If you make any changes to it yourself then they will take precedence over the rebase.

Bumps imagemin-pngquant from 8.0.0 to 9.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/imagemin/imagemin-pngquant/releases">imagemin-pngquant's releases</a>.</em></p> <blockquote> <h2>v9.0.1</h2> <ul> <li>Fix issue with <code>pngquant</code> and exit code 99 (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-pngquant/issues/71">#71</a>) c8e1546</li> </ul> <p><a href="https://github.com/imagemin/imagemin-pngquant/compare/v9.0.0...v9.0.1">https://github.com/imagemin/imagemin-pngquant/compare/v9.0.0...v9.0.1</a></p> <h2>v9.0.0</h2> <ul> <li>Require Node.js 10 (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-pngquant/issues/67">#67</a>) d285e92</li> </ul> <p><a href="https://github.com/imagemin/imagemin-pngquant/compare/v8.0.0...v9.0.0">https://github.com/imagemin/imagemin-pngquant/compare/v8.0.0...v9.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/imagemin/imagemin-pngquant/commit/ec83505c8dfa810a8761d8f286e56b7c24a680d7"><code>ec83505</code></a> 9.0.1</li> <li><a href="https://github.com/imagemin/imagemin-pngquant/commit/c8e1546ce23b7fa3761a2ad3c32f16c261009d46"><code>c8e1546</code></a> Fix issue with <code>pngquant</code> and exit code 99 (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-pngquant/issues/71">#71</a>)</li> <li><a href="https://github.com/imagemin/imagemin-pngquant/commit/07544022315bb1355e1e990fa53fffd986880d57"><code>0754402</code></a> 9.0.0</li> <li><a href="https://github.com/imagemin/imagemin-pngquant/commit/d285e92ba255aa072c8babec29dd9122cfb1a57a"><code>d285e92</code></a> Require Node.js 10 (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-pngquant/issues/67">#67</a>)</li> <li>See full diff in <a href="https://github.com/imagemin/imagemin-pngquant/compare/v8.0.0...v9.0.1">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

</details>

@dependabot rebase

Bumps imagemin-webp from 5.1.0 to 6.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/imagemin/imagemin-webp/releases">imagemin-webp's releases</a>.</em></p> <blockquote> <h2>v6.0.0</h2> <ul> <li>Require Node.js 10 (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-webp/issues/30">#30</a>) 707aeb3</li> <li>Meta tweaks 6bb71ff</li> </ul> <p><a href="https://github.com/imagemin/imagemin-webp/compare/v5.1.0...v6.0.0">https://github.com/imagemin/imagemin-webp/compare/v5.1.0...v6.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/imagemin/imagemin-webp/commit/2973893bd4c8b523670ed29ce7ad75c7fbaa6803"><code>2973893</code></a> 6.0.0</li> <li><a href="https://github.com/imagemin/imagemin-webp/commit/707aeb3ddf0268a57d617c7623956113f5f4df1e"><code>707aeb3</code></a> Require Node.js 10 (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-webp/issues/30">#30</a>)</li> <li><a href="https://github.com/imagemin/imagemin-webp/commit/6bb71fffbe09808a744eb62a38863160c4db5eb2"><code>6bb71ff</code></a> Meta tweaks</li> <li>See full diff in <a href="https://github.com/imagemin/imagemin-webp/compare/v5.1.0...v6.0.0">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

</details>

⚠️ Dependabot is rebasing this PR ⚠️

If you make any changes to it yourself then they will take precedence over the rebase.

Bumps webpack from 4.42.0 to 4.44.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack/releases">webpack's releases</a>.</em></p> <blockquote> <h2>v4.44.1</h2> <h1>Bugfixes</h1> <ul> <li>fix bug in sideEffects optimization when using <code>export * from "non-esm"</code> and a default export.</li> <li>add missing optional peerDependencies for webpack-cli and webpack-command to support Yarn 2</li> </ul> <h2>v4.44.0</h2> <h1>Features</h1> <ul> <li>Improve <code>sideEffects</code> flag behavior when dynamic modules are part of the tree <ul> <li>Fixes a bug which causes empty modules (or type-only modules) to "break" Tree Shaking</li> </ul> </li> <li>add <code>splitChunks.enforceSizeThreshold</code> to allow enfore splitting larger chunks unrelated from other limiations <ul> <li>Not set by default to avoid breaking change</li> <li>It will be set by default to 50k in webpack 5</li> <li>It's recommended to set it in webpack 4 too</li> </ul> </li> <li>add support for <code>resolve.roots</code> and default <code>resolve.roots: [context]</code> <ul> <li>This allows to resolve server-relative urls (e.g. <code>/src/abc</code>) to the project root (or other locations when configured)</li> <li>This allows to use loaders that rely on that behavior</li> </ul> </li> </ul> <h1>Bugfixes</h1> <ul> <li>fix bug where splitChunks produced non-optimal results when <code>minSize</code> is set to <code>0</code> <ul> <li>This lead to <code>NaN</code>s in some places which breaks ordering</li> </ul> </li> <li>Fix bug which lead to HMR not working for splitChunks in entrypoints</li> <li>force update watchpack and chokidar for chokidar bugfix which causes files to stop being watched</li> </ul> <h2>v4.43.0</h2> <h1>Features</h1> <ul> <li>add <code>module.hot.invalidate()</code> to HMR API</li> </ul> <h1>Dependencies</h1> <ul> <li>push versions for forced security updates</li> </ul> <h2>v4.42.1</h2> <h1>Bugfixes</h1> <ul> <li>update webassemblyjs dependencies for instruction update</li> <li>update mkdirp dependency for security reasons</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpack/webpack/commit/cd4af164784f3938353102179adfcbcf8f53949d"><code>cd4af16</code></a> 4.44.1</li> <li><a href="https://github.com/webpack/webpack/commit/7895778cacbd1dd1d51659ac32971db279659aaf"><code>7895778</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/webpack/webpack/issues/11244">#11244</a> from webpack/bugfix/dynamic-reexport-default</li> <li><a href="https://github.com/webpack/webpack/commit/46304c888f2b066e358339df62ac7fd89606d433"><code>46304c8</code></a> ignore default export when reexporting a dynamic module</li> <li><a href="https://github.com/webpack/webpack/commit/91e81c8d19fa9e03768797a6fda34231b65963b1"><code>91e81c8</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/webpack/webpack/issues/11190">#11190</a> from merceyz/patch-2</li> <li><a href="https://github.com/webpack/webpack/commit/087af7c2e60c152ab7f7728c44b9f3bba2c0a7d0"><code>087af7c</code></a> Merge branch 'webpack-4' into patch-2</li> <li><a href="https://github.com/webpack/webpack/commit/d4603c6d7ef4acfbe956ef49d8476c7368526989"><code>d4603c6</code></a> 4.44.0</li> <li><a href="https://github.com/webpack/webpack/commit/ea06f033756fe21bc73698e8449a7cbf1fedeb13"><code>ea06f03</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/webpack/webpack/issues/11225">#11225</a> from webpack/deps/watchpack</li> <li><a href="https://github.com/webpack/webpack/commit/eae1ba05bb116d0b6db2968e078e6a8d67a2e5c6"><code>eae1ba0</code></a> update watchpack</li> <li><a href="https://github.com/webpack/webpack/commit/42dc03852b4dfddaf33aa3b000ee8c255ba4ffd1"><code>42dc038</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/webpack/webpack/issues/11210">#11210</a> from webpack/ci/timeout-4</li> <li><a href="https://github.com/webpack/webpack/commit/21e3c11a26e405395bb7777024a1fc7fb9a99484"><code>21e3c11</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/webpack/webpack/issues/11207">#11207</a> from webpack/backport/add-roots</li> <li>Additional commits viewable in <a href="https://github.com/webpack/webpack/compare/v4.42.0...v4.44.1">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

</details>

@dependabot rebase

⚠️ Dependabot is rebasing this PR ⚠️

If you make any changes to it yourself then they will take precedence over the rebase.

Bumps bl from 1.2.2 to 1.2.3. This update includes a security fix. <details> <summary>Vulnerabilities fixed</summary> <p><em>Sourced from <a href="https://github.com/advisories/GHSA-pp7h-53gx-mx7r">The GitHub Security Advisory Database</a>.</em></p> <blockquote> <p><strong>Remote Memory Exposure in bl</strong> A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1 and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.</p> <p>Affected versions: < 1.2.3</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rvagg/bl/commit/d69edfd66f2b1d8b50abc0ecfe42216437540178"><code>d69edfd</code></a> 1.2.3</li> <li><a href="https://github.com/rvagg/bl/commit/847473ab543e99a687a1ef871ba9a1c4d2e26ee7"><code>847473a</code></a> test all branches</li> <li><a href="https://github.com/rvagg/bl/commit/0bd87ec97be399b129fc62feff2943ffa21bcc00"><code>0bd87ec</code></a> Fix unintialized memory access</li> <li><a href="https://github.com/rvagg/bl/commit/dc097f3f33dffbe11ce4753cf0806ffca632260e"><code>dc097f3</code></a> test newer versions of Node</li> <li>See full diff in <a href="https://github.com/rvagg/bl/compare/v1.2.2...v1.2.3">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

</details>

Bumps decompress from 4.2.0 to 4.2.1. This update includes a security fix. <details> <summary>Vulnerabilities fixed</summary> <p><em>Sourced from <a href="https://github.com/advisories/GHSA-qgfr-5hqp-vrw9">The GitHub Security Advisory Database</a>.</em></p> <blockquote> <p><strong>Arbitrary File Write in decompress</strong> Versions of <code>decompress</code> prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing<code>../</code>.</p> <h2>Recommendation</h2> <p>Upgrade to version 4.2.1 or later.</p> <p>Affected versions: < 4.2.1</p> </blockquote> </details> <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/kevva/decompress/releases">decompress's releases</a>.</em></p> <blockquote> <h2>v4.2.1</h2> <ul> <li>Prevent directory traversal (<a href="https://github-redirect.dependabot.com/kevva/decompress/issues/73">#73</a>) 967146e</li> </ul> <p><a href="https://github.com/kevva/decompress/compare/v4.2.0...v4.2.1">https://github.com/kevva/decompress/compare/v4.2.0...v4.2.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/kevva/decompress/commit/84a8c1046946add1a6ae01c54dbebf312e4ffc85"><code>84a8c10</code></a> 4.2.1</li> <li><a href="https://github.com/kevva/decompress/commit/fafff47880cb5b47b022cd7be5542d576448603a"><code>fafff47</code></a> Meta tweaks</li> <li><a href="https://github.com/kevva/decompress/commit/967146e70f48be32ed1a69daa3941d681944d513"><code>967146e</code></a> Prevent directory traversal (<a href="https://github-redirect.dependabot.com/kevva/decompress/issues/73">#73</a>)</li> <li><a href="https://github.com/kevva/decompress/commit/74a462a139cc2561b6695e696266c8dc31562d3d"><code>74a462a</code></a> Meta tweaks</li> <li><a href="https://github.com/kevva/decompress/commit/7ddadd92139079e520cb822a03fe4260b7db7676"><code>7ddadd9</code></a> Add note about <code>filter</code> option</li> <li>See full diff in <a href="https://github.com/kevva/decompress/compare/v4.2.0...v4.2.1">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

</details>

Bumps schema-utils from 2.6.5 to 2.7.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpack/schema-utils/releases">schema-utils's releases</a>.</em></p> <blockquote> <h2>v2.7.1</h2> <h3><a href="https://github.com/webpack/schema-utils/compare/v2.7.0...v2.7.1">2.7.1</a> (2020-08-31)</h3> <h3>Bug Fixes</h3> <ul> <li>remove esModuleInterop from tsconfig (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/110">#110</a>) (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/111">#111</a>) (<a href="https://github.com/webpack/schema-utils/commit/2f40154b91e45b393258ae9dd8f10cc3b8590b7d">2f40154</a>)</li> </ul> <h2>v2.7.0</h2> <h2><a href="https://github.com/webpack/schema-utils/compare/v2.6.6...v2.7.0">2.7.0</a> (2020-05-29)</h2> <h3>Features</h3> <ul> <li>improve hints (<a href="https://github.com/webpack/schema-utils/commit/a36e535faca1b01e27c3bfa3c8bee9227c3f836c">a36e535</a>)</li> <li>smart not case (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/101">#101</a>) (<a href="https://github.com/webpack/schema-utils/commit/698d8b05462d86aadb217e25a45c7b953a79a52e">698d8b0</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>move @types/json-schema from devDependencies to dependencies (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/97">#97</a>) (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/98">#98</a>) (<a href="https://github.com/webpack/schema-utils/commit/945e67db5e19baf7ec7df72813b0739dd56f950d">945e67d</a>)</li> </ul> <h2>v2.6.6</h2> <h3><a href="https://github.com/webpack/schema-utils/compare/v2.6.5...v2.6.6">2.6.6</a> (2020-04-17)</h3> <h3>Bug Fixes</h3> <ul> <li>improve perf</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/webpack/schema-utils/blob/master/CHANGELOG.md">schema-utils's changelog</a>.</em></p> <blockquote> <h3><a href="https://github.com/webpack/schema-utils/compare/v2.7.0...v2.7.1">2.7.1</a> (2020-08-31)</h3> <h3>Bug Fixes</h3> <ul> <li>remove esModuleInterop from tsconfig (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/110">#110</a>) (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/111">#111</a>) (<a href="https://github.com/webpack/schema-utils/commit/2f40154b91e45b393258ae9dd8f10cc3b8590b7d">2f40154</a>)</li> </ul> <h2><a href="https://github.com/webpack/schema-utils/compare/v2.6.6...v2.7.0">2.7.0</a> (2020-05-29)</h2> <h3>Features</h3> <ul> <li>improve hints (<a href="https://github.com/webpack/schema-utils/commit/a36e535faca1b01e27c3bfa3c8bee9227c3f836c">a36e535</a>)</li> <li>smart not case (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/101">#101</a>) (<a href="https://github.com/webpack/schema-utils/commit/698d8b05462d86aadb217e25a45c7b953a79a52e">698d8b0</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li>move @types/json-schema from devDependencies to dependencies (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/97">#97</a>) (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/98">#98</a>) (<a href="https://github.com/webpack/schema-utils/commit/945e67db5e19baf7ec7df72813b0739dd56f950d">945e67d</a>)</li> </ul> <h3><a href="https://github.com/webpack/schema-utils/compare/v2.6.5...v2.6.6">2.6.6</a> (2020-04-17)</h3> <h3>Bug Fixes</h3> <ul> <li>improve perf</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpack/schema-utils/commit/102d170506640346b8269d7e38a042b6b5b3a444"><code>102d170</code></a> chore(release): 2.7.1</li> <li><a href="https://github.com/webpack/schema-utils/commit/b083c75808ccc5871904399690618fc6c584bb60"><code>b083c75</code></a> chore(deps): update typescript (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/112">#112</a>)</li> <li><a href="https://github.com/webpack/schema-utils/commit/2f40154b91e45b393258ae9dd8f10cc3b8590b7d"><code>2f40154</code></a> fix: remove esModuleInterop from tsconfig (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/110">#110</a>) (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/111">#111</a>)</li> <li><a href="https://github.com/webpack/schema-utils/commit/6a5d216ec633c0ec94c524b4e655a6a2cc9f1bb5"><code>6a5d216</code></a> docs: avoid confusing (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/108">#108</a>)</li> <li><a href="https://github.com/webpack/schema-utils/commit/a92e2f9d6536ac7493a700b2c8421de97cbe92c2"><code>a92e2f9</code></a> chore(badge): update to packagephobia.com (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/107">#107</a>)</li> <li><a href="https://github.com/webpack/schema-utils/commit/132fee2af33a2087568bd7482687576fbd121905"><code>132fee2</code></a> chore(release): 2.7.0</li> <li><a href="https://github.com/webpack/schema-utils/commit/f7a48bc98fcb1e9f466be705cb0f69c5a8a9d636"><code>f7a48bc</code></a> chore(deps): update (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/102">#102</a>)</li> <li><a href="https://github.com/webpack/schema-utils/commit/945e67db5e19baf7ec7df72813b0739dd56f950d"><code>945e67d</code></a> fix: move @types/json-schema from devDependencies to dependencies (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/97">#97</a>) (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/98">#98</a>)</li> <li><a href="https://github.com/webpack/schema-utils/commit/698d8b05462d86aadb217e25a45c7b953a79a52e"><code>698d8b0</code></a> feat: smart not case (<a href="https://github-redirect.dependabot.com/webpack/schema-utils/issues/101">#101</a>)</li> <li><a href="https://github.com/webpack/schema-utils/commit/a36e535faca1b01e27c3bfa3c8bee9227c3f836c"><code>a36e535</code></a> feat: improve hints</li> <li>Additional commits viewable in <a href="https://github.com/webpack/schema-utils/compare/v2.6.5...v2.7.1">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

</details>

Bumps elliptic from 6.5.2 to 6.5.3. This update includes a security fix. <details> <summary>Vulnerabilities fixed</summary> <p><em>Sourced from <a href="https://github.com/advisories/GHSA-vh7m-p724-62c2">The GitHub Security Advisory Database</a>.</em></p> <blockquote> <p><strong>Signature Malleabillity in elliptic</strong> The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.</p> <p>Affected versions: < 6.5.3</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/indutny/elliptic/commit/8647803dc3d90506aa03021737f7b061ba959ae1"><code>8647803</code></a> 6.5.3</li> <li><a href="https://github.com/indutny/elliptic/commit/856fe4d99fe7b6200556e6400b3bf585b1721bec"><code>856fe4d</code></a> signature: prevent malleability and overflows</li> <li>See full diff in <a href="https://github.com/indutny/elliptic/compare/v6.5.2...v6.5.3">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

</details>

Bumps webpack-cli from 3.3.11 to 3.3.12. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/webpack/webpack-cli/blob/v3.3.12/CHANGELOG.md">webpack-cli's changelog</a>.</em></p> <blockquote> <h1>3.3.12 (2020-06-03)</h1> <p><a href="https://github.com/webpack/webpack-cli/compare/v3.3.11...v3.3.12">Full Changelog</a></p> <h2>Chore</h2> <ul> <li>update dependencies</li> </ul> <p><a name="3.3.11"></a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpack/webpack-cli/commit/33574ec82e1f6d8b71e872db086bbfaaf77707ba"><code>33574ec</code></a> chore(release): 3.3.12</li> <li><a href="https://github.com/webpack/webpack-cli/commit/4f1a2f3268480d268c73719986791321d38ac5b3"><code>4f1a2f3</code></a> chore: bump dependencies for v3 (<a href="https://github-redirect.dependabot.com/webpack/webpack-cli/issues/1595">#1595</a>)</li> <li><a href="https://github.com/webpack/webpack-cli/commit/ab910dfe16df71757c6a7de5033333e5a8d93c38"><code>ab910df</code></a> docs(templates): Branding guide violation fix (<a href="https://github-redirect.dependabot.com/webpack/webpack-cli/issues/1226">#1226</a>)</li> <li>See full diff in <a href="https://github.com/webpack/webpack-cli/compare/v3.3.11...v3.3.12">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~evilebottnawi">evilebottnawi</a>, a new releaser for webpack-cli since your current version.</p> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

</details>

⚠️ Dependabot is rebasing this PR ⚠️

If you make any changes to it yourself then they will take precedence over the rebase.

Bumps imagemin-svgo from 7.1.0 to 8.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/imagemin/imagemin-svgo/releases">imagemin-svgo's releases</a>.</em></p> <blockquote> <h2>v8.0.0</h2> <ul> <li>Require Node.js 10 (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-svgo/issues/40">#40</a>) fa899fc</li> </ul> <p><a href="https://github.com/imagemin/imagemin-svgo/compare/v7.1.0...v8.0.0">https://github.com/imagemin/imagemin-svgo/compare/v7.1.0...v8.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/imagemin/imagemin-svgo/commit/bc04dc0c8aff45766f18cb0158eb6e9ddb57ef04"><code>bc04dc0</code></a> 8.0.0</li> <li><a href="https://github.com/imagemin/imagemin-svgo/commit/fa899fcbccf3541a04e9d4f9be44cdc50a86eed6"><code>fa899fc</code></a> Require Node.js 10 (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-svgo/issues/40">#40</a>)</li> <li>See full diff in <a href="https://github.com/imagemin/imagemin-svgo/compare/v7.1.0...v8.0.0">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~1000ch">1000ch</a>, a new releaser for imagemin-svgo since your current version.</p> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

</details>

Bumps imagemin-gifsicle from 6.0.1 to 7.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/imagemin/imagemin-gifsicle/releases">imagemin-gifsicle's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h3>Breaking</h3> <ul> <li>Require Node.js 10 a5feafd</li> </ul> <h3>Enhancements</h3> <ul> <li>Update <code>gifsicle</code> dependency 68b9a4d</li> <li>Optimize images in memory ac13852</li> </ul> <p><a href="https://github.com/imagemin/imagemin-gifsicle/compare/v6.0.1...v7.0.0">https://github.com/imagemin/imagemin-gifsicle/compare/v6.0.1...v7.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/imagemin/imagemin-gifsicle/commit/c91e5b2c1c8e7f0d2221ea779d19d3e6d1ab41be"><code>c91e5b2</code></a> 7.0.0</li> <li><a href="https://github.com/imagemin/imagemin-gifsicle/commit/a5feafd222707066853db6d6679004244374a708"><code>a5feafd</code></a> Require Node.js 10</li> <li><a href="https://github.com/imagemin/imagemin-gifsicle/commit/68b9a4dd8f638e97c51dd32d61a58423971565da"><code>68b9a4d</code></a> Update <code>gifsicle</code> dependency</li> <li><a href="https://github.com/imagemin/imagemin-gifsicle/commit/7d29c8f59410ffe6f9046c8519b88a326bce3361"><code>7d29c8f</code></a> Tidelift tasks</li> <li><a href="https://github.com/imagemin/imagemin-gifsicle/commit/ac13852216beb62ea466de1d0a4517fadc162d88"><code>ac13852</code></a> Optimize images in memory</li> <li><a href="https://github.com/imagemin/imagemin-gifsicle/commit/c5c090d3fd39ec4574a067c5c1363ff10ad33a31"><code>c5c090d</code></a> Meta tweaks</li> <li><a href="https://github.com/imagemin/imagemin-gifsicle/commit/ea61ad9adec44c6db12f528c7312424f2da9f1c9"><code>ea61ad9</code></a> Use Travis to test on Windows (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-gifsicle/issues/31">#31</a>)</li> <li>See full diff in <a href="https://github.com/imagemin/imagemin-gifsicle/compare/v6.0.1...v7.0.0">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

</details>

⚠️ Dependabot is rebasing this PR ⚠️

If you make any changes to it yourself then they will take precedence over the rebase.

Bumps imagemin-optipng from 7.1.0 to 8.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/imagemin/imagemin-optipng/releases">imagemin-optipng's releases</a>.</em></p> <blockquote> <h2>v8.0.0</h2> <ul> <li>Require Node.js 10 (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-optipng/issues/26">#26</a>) fd32870</li> <li>Fix missing backquote in the readme (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-optipng/issues/24">#24</a>) 552a3ab</li> <li>Tidelift tasks d9b69ac</li> <li>Set interlacing to <code>0</code> by default, add tests and improve docs d439590</li> <li>Add <code>interlaced</code> option (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-optipng/issues/23">#23</a>) ef42c2d</li> </ul> <p><a href="https://github.com/imagemin/imagemin-optipng/compare/v7.1.0...v8.0.0">https://github.com/imagemin/imagemin-optipng/compare/v7.1.0...v8.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/imagemin/imagemin-optipng/commit/abae52303e06e2b5697d32c529578e17f680fef7"><code>abae523</code></a> 8.0.0</li> <li><a href="https://github.com/imagemin/imagemin-optipng/commit/fd32870f257597e9f919b4e894f6765269fafab1"><code>fd32870</code></a> Require Node.js 10 (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-optipng/issues/26">#26</a>)</li> <li><a href="https://github.com/imagemin/imagemin-optipng/commit/552a3abfe048f7d5b8ef1610a019b89a2ea2be21"><code>552a3ab</code></a> Fix missing backquote in the readme (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-optipng/issues/24">#24</a>)</li> <li><a href="https://github.com/imagemin/imagemin-optipng/commit/d9b69acddf38ceadfd5cd6e200c7d5e3dbb0dcf6"><code>d9b69ac</code></a> Tidelift tasks</li> <li><a href="https://github.com/imagemin/imagemin-optipng/commit/d439590aadb1ba5e7101f36cc2a8dcf34b0568bb"><code>d439590</code></a> Set interlacing to <code>0</code> by default, add tests and improve docs</li> <li><a href="https://github.com/imagemin/imagemin-optipng/commit/ef42c2dd774939ad6e878754158d1805088b5b27"><code>ef42c2d</code></a> Add <code>interlaced</code> option (<a href="https://github-redirect.dependabot.com/imagemin/imagemin-optipng/issues/23">#23</a>)</li> <li>See full diff in <a href="https://github.com/imagemin/imagemin-optipng/compare/v7.1.0...v8.0.0">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

</details>

TODO

• [ ] show the status of the game
• [ ] show how many players have joined the game
• [ ] show how many players are spectating
• [ ] allow to sort the games by date and name
• [ ] allow to filter games by status, players

Ok, reading https://hexdocs.pm/phoenix_live_view/Phoenix.LiveView.html#module-colocating-templates it's clear why it's an infinite loop.

Sorry for the noise

Environment

• Elixir version (elixir -v): Elixir 1.10.4 (compiled with Erlang/OTP 23)
• Phoenix version (mix deps): 1.5.4
• Phoenix LiveView version (mix deps): 0.13.3
• Operating system: linux

Actual behavior

Create a new project with:

mix phx.new foo --live --no-ecto --app foo

run mix phx.server and go to http://localhost:4000

now open a editor and edit: lib/foo_web/live/page_live.html.leex and add to the top of the file: <%= render "bla.html" %>.

You get the error no case clause matching: "bla.html"in Phoenix.LiveView.Engine.fetch_assign!/2 (I'm not sure if this the expected behavior, but this is not the bug)

When you now change the page_live.html.leex and remove everything but <%= render "bla.html" %>. So this is the page_live.html.leex file:

`<%= render "bla.html" %>`

When you surf to the page, the page will not load, the beam will use a huge amount off cpu and ram and on my OS gets killed after a short while: “mix phx.server” terminated by signal SIGKILL (Forced quit)

Expected behavior

I would expect this not to hang, but show a meaningful error.

Other remarks

Using <%= render "bla.html" %> in lib/foo_web/templates/layout/root.html.leex results in a more sensible error:

Could not render "bla.html" for FooWeb.LayoutView, please define a matching clause for render/2 or define a template at "lib/foo_web/templates/layout/*". The following templates were compiled:
...

and it's not possible to trigger the bug in these templates.

If you define a Commanded Application then you can use the Commanded.EventStore module to interact with the configured event store. This can simplify testing where you configure the app to use the in-memory event store for testing and a "real" event store elsewhere without changing any code (other than the env-specific configuration).

I thought so, but had some issues, need to find out what they were exactly.

I'm not sure I follow exactly what you are proposing here. Do you mean the ability to query the state field managed by an event handler from another process? If so that should be a straightforward change as event handlers are registered with the configured Commanded registry and can be looked up via the Commanded application and their name.

Yes, that's what I'm proposing. That would mean you don't need a separate process to handle the state. Would you be able to find the event handler with https://hexdocs.pm/commanded/Commanded.Registration.Adapter.html#c:whereis_name/2? Or is that via some other api?

You could have a supervisor which starts the agent and handler and uses a :one_for_all restart strategy so that both the handler and Agent process get restarted whenever either one crashes:

Yes that's what I'm probably will go for.

Any remarks on the previous design?

A problem in the previous example is that I'm using EventStore directly, making it harder to use in tests, but I guess I should be able to use the adapter as well?

I'd think that using Agent or a custom GenServer in combination with Commanded.Event.Handler could work well. The only issue I see for transient models like mine is that you want to link the Agentwith the Event.Handler so that if any of them crashes, they both are restarted. This is a bit of extra complexity that has to be dealt with.

So I'm seeing 3 possible solutions to handle what I want right now (transient read models):

1. Expose the state of an Commanded.Event.Handler so that you can access it from the outside (this seems to be the most obvious way of making a transient read model.
2. Implement my own event handler like the example above.
3. use an Agent in combination with an event handler and either:
   • link them together
   • or don't use a transient event handler and when the agent restart, delete the subscription first.

Are you open for (1)? If so, I can create a PR for it as well.

I've now done something like this. Except for that it's not yet very robust at this point, are there any downsides to an approach like this?

defmodule BoardGames.ReadModel.AllGames do
  use GenServer

  alias BoardGames.TempelDesSchreckens.Event
  alias __MODULE__

  def start_link(default) do
    GenServer.start_link(__MODULE__, default)
  end

  @impl true
  def init(_config) do
    {:ok, %{}, {:continue, :subscribe}}
  end

  @impl true
  def handle_info({:events, events}, state) do
    state =
      Enum.reduce(events, state, fn
        %EventStore.RecordedEvent{data: %Event.GameCreated{game_id: game_id}}, state ->
          %{state | waiting_for_players: MapSet.put(state.waiting_for_players, game_id)}

        %EventStore.RecordedEvent{data: _}, state ->
          state
      end)

    :ok = BoardGames.EventStore.ack(state.subscription, events)

    {:noreply, state}
  end

  @impl true
  def handle_info({:subscribed, _subscription}, state) do
    {:noreply, state}
  end

  @impl true
  def handle_continue(:subscribe, state) do
    {:ok, subscription} =
      BoardGames.EventStore.subscribe_to_all_streams(__MODULE__, self(),
        start_from: :origin,
        transient: true
      )

    state = %{state | subscription: subscription}
    {:noreply, state}
  end
end

Commanded v1.2.0 has support for stateful event handlers (#400). You can pass initial state when starting the handler or from the init/1 callback function. The state is accessed from the metadata passed to the handle function, via the :state key. To update state return {:ok, new_state} from a handle function.

Yes, but how do you access that state from outside the event handler? To my example of a boardgame. The event handler would track the state of the game as a readmodel projection. Now I want to ask questions to that readmodel to know the state of the game.

So with the PR I got this working, now I can add subscription_opts: [transient: true] to a handler and it works.

My next problem though is how do I access the state of the handler? I'm starting to wonder if it wouldn't be better to not use the handler provided by commanded and just implement my own GenServer that subscribes to the EventStore for this?

Any thoughts?

@slashdotdash I think the functionality is complete, so ready for review.

I'm not sure why this PR also includes e9e9492. I thought I started from master correctly.

This branch is WIP but I wanted to push it already to see if I'm on the right track, so all feedback is already welcome. Please let me know if I'm on the right track, if the style is correct and what other tests you want.

This feature is needed to fix: https://github.com/commanded/commanded/issues/401

TODO

• [ ] check what needs to happen for to subscribe from a disconnected state
• [ ] checkpoint_last_seen or notify_subscribers probably needs to be changed as well
• [ ] add more tests
• [ ] add to documentation

You mean for transient subscribers only I expect. If you can point me in the direction of where this change would need to happen I might find some time for it.

Ah no, found it. It is because the init is used in the child_spec (https://github.com/commanded/commanded/blob/master/lib/commanded/event/handler.ex#L465) and it's the child_spec that is called before the supervisor starts the children, because the supervisor actually starts a list of child_specs.

So the documentation of https://hexdocs.pm/commanded/Commanded.Event.Handler.html#c:init/0 are not completely correct:

Optional initialization callback function called when the handler starts.

it's not really called when the handler starts, but just before that.

I've just dived a bit in the code and it seems that the supervisors indeed first calls all the inits to get all the configuration before starting the children. (see here: https://github.com/elixir-lang/elixir/blob/1145dc01680aab7094f8a6dbd38b65185e14adb4/lib/elixir/lib/supervisor.ex#L556)

I didn't know that was the case - unexpected behavior for me

A problem I have with your example is that when my children look like:

children: [
  ExampleApp,
  TransientEventHandler
]

opts = ...
Supervisor.start_link(children, opts)

that the ExampleApp is not yet started when init for the TransientEventHandler is called.

I guess the Commanded.Application doesn't start immediately, because I thought the children are started in order and the supervisor waits for each child to start before continuing to the next one?

A use case that I'm thinking about now is event handlers that don't have to live long (very short - couple of minutes - to a couple of hours, max days) where it doesn't make sense to store their internal state in a db. But of course it's still possible that they can crash or that the system restarts (continuous deployment).

An example is playing a board game like chess or whatever, and I want an event handler to store the state of the game while the game is being played. The state can be stored in the GenServer with state, but if the GenServer restarts I don't receive the events from the start again. The event handler only makes sense while the game is being played, so you start and stop them dynamically as well for a specific stream.

An other example (other use case as well) is during the development of your event handlers, where you don't want to bother yet with storing the state to a db, so you first handle it in memory.

Your example of deleting the subscription before start is something that would work indeed. Thanks for that, I'm going to start with this. It would be nice though to have something like #356 although I agree that the name projection is not the best. maybe subscription_type :: :transient | :durable or just subscription

First of all, I'm not sure if this should be an issue here or on eventstore.

I'm looking for a way of implementing transient event handlers with some guarantees of delivery.

Basically this is what I would like to have:

1. have transient event handlers
2. with guaranteed delivery
3. and options to provide start_from

I've been looking at: https://github.com/commanded/eventstore/blob/develop/guides/Subscriptions.md#transient-subscriptions but it seems that this doesn't give 2 and 3.

I've also saw #356 that was closed a few days ago, so I'm wondering on how to go forward. Is this something other people could use as well?

So I'm wondering how to implement this. Would the way forward be to use persistent subscriptions and reset the subscription at the start? Or is there a better way to handle this?

Sorry to comment on a closed PR, but I was wondering why it was closed without further comments? I was just looking for a feature like this where you could have "transient" event handlers that receive the events from the start every time they restart.

Is there an other way to achieve this?

added image-webpack-loader,i spend more 40s build. is it a wrong in somewhere?

depending on how many images you have, it might take quite some time to compress all the images. So this can take long. You probably only want to enable this loader in a production build.