Bumps carrierwave from 1.1.0 to 1.3.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md">carrierwave's changelog</a>.</em></p> <blockquote> <h2>1.3.2 - 2021-02-08</h2> <h3>Fixed</h3> <ul> <li>Fix Ruby 2.7 deprecations(<a href="https://github.com/aubinlrx"><code>@aubinlrx</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2462">#2462</a>)</li> </ul> <h3>Security</h3> <ul> <li>Fix Code Injection vulnerability in CarrierWave::RMagick (<a href="https://github.com/mshibuya"><code>@mshibuya</code></a> <a href="https://github.com/carrierwaveuploader/carrierwave/commit/eb9346df598a758a5f8c4a338852982fd7f8f6b8">eb9346df</a>, <a href="https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-cf3w-g86h-35x4">GHSA-cf3w-g86h-35x4</a>)</li> <li>Fix SSRF vulnerability in the remote file download feature (<a href="https://github.com/mshibuya"><code>@mshibuya</code></a> <a href="https://github.com/carrierwaveuploader/carrierwave/commit/91714adda998bc9e8decf5b1f5d260d808761304">91714add</a>, <a href="https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-fwcm-636p-68r5">GHSA-fwcm-636p-68r5</a>)</li> </ul> <h2>1.3.1 - 2018-12-29</h2> <h3>Fixed</h3> <ul> <li>Fix <code>#url_options_supported?</code> causing nil error(<a href="https://github.com/mshibuya"><code>@mshibuya</code></a> <a href="https://github.com/carrierwaveuploader/carrierwave/commit/0b9a64a1bb9f20d1de154dc3bf2e2dd988210220">0b9a64a1</a>, <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/issues/2361">#2361</a>)</li> </ul> <h2>1.3.0 - 2018-12-24</h2> <h3>Added</h3> <ul> <li>Query parameter support for fog-google(<a href="https://github.com/stanhu"><code>@stanhu</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2332">#2332</a>)</li> <li>Jets Turbine Support(<a href="https://github.com/tongueroo"><code>@tongueroo</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2355">#2355</a>)</li> <li>Add <code>allowed_types</code> to <code>content_type_whitelist_error</code>(<a href="https://github.com/mhluska"><code>@mhluska</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2270">#2270</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>S3 HTTPS url causes certificate issue when bucket name contains period(<a href="https://github.com/ransombriggs"><code>@ransombriggs</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2359">#2359</a>)</li> <li>Failed to get image dimensions when image is cached but not stored yet(<a href="https://github.com/artygus"><code>@artygus</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2349">#2349</a>)</li> <li>Only include <code>x-amz-acl</code> header for AWS(<a href="https://github.com/stanhu"><code>@stanhu</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2356">#2356</a>)</li> <li>Remove old caches when no space is left on disk(<a href="https://github.com/dosuken123"><code>@dosuken123</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2342">#2342</a>)</li> </ul> <h2>1.2.3 - 2018-06-30</h2> <h3>Fixed</h3> <ul> <li>Fix reading whole content of large files into memory on storing(<a href="https://github.com/dosuken123"><code>@dosuken123</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2314">#2314</a>)</li> </ul> <h2>1.2.2 - 2018-01-02</h2> <h3>Fixed</h3> <ul> <li>Reset Content-Type on converting file format(<a href="https://github.com/kyoshidajp"><code>@kyoshidajp</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2237">#2237</a>)</li> </ul> <h2>1.2.1 - 2017-10-04</h2> <h3>Fixed</h3> <ul> <li>Locale check breaks when a Symbol is given to available_locales(<a href="https://github.com/mshibuya"><code>@mshibuya</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/issues/2234">#2234</a>)</li> </ul> <h2>1.2.0 - 2017-09-30</h2> <h3>Added</h3> <ul> <li>Added Proc Support for Width and Height(<a href="https://github.com/tomprats"><code>@tomprats</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2169">#2169</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Decode unicode filenames from URL(<a href="https://github.com/fedorkk"><code>@fedorkk</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2131">#2131</a>)</li> <li>Change file size of error message to human size(<a href="https://github.com/aki77"><code>@aki77</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2199">#2199</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Bundled en translation was not loaded by default, causing translation missing(<a href="https://github.com/mshibuya"><code>@mshibuya</code></a> <a href="https://github.com/carrierwaveuploader/carrierwave/commit/95ce39d3ec98bee9b2846b32fdcf093c78fa44fb">95ce39d3</a>)</li> <li>Remove potentially redundant HEAD request on checking fog file existence(<a href="https://github.com/eritiro"><code>@eritiro</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2140">#2140</a>)</li> <li>Failing with uninitialized constant if uri is not loaded(<a href="https://github.com/jasdeepsingh"><code>@jasdeepsingh</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2223">#2223</a>)</li> <li>RMagick cloud not process remotely stored files(<a href="https://github.com/zog"><code>@zog</code></a> <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/pull/2185">#2185</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/56f39b23d16431a79faf8e361d4ee08238db2f66"><code>56f39b2</code></a> Version 1.3.2</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/eb9346df598a758a5f8c4a338852982fd7f8f6b8"><code>eb9346d</code></a> Fix Code Injection vulnerability in CarrierWave::RMagick</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/91714adda998bc9e8decf5b1f5d260d808761304"><code>91714ad</code></a> Fix SSRF vulnerability in the remote file download feature</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/8228e1b981f0a0513c2e61ad763ef63ffe96c195"><code>8228e1b</code></a> URI.open does not exist before Ruby 2.5</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/ac3d0068f65fe3e94a961027d14558baad5e775c"><code>ac3d006</code></a> URI.encode becomes escape, not unescape</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/0712435b22ef5e969b25dffe1f080b0935889557"><code>0712435</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/carrierwaveuploader/carrierwave/issues/2462">#2462</a> from aubinlrx/tweak/deprecation_warning_ruby_27</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/c3c652a4d2c877a20fff6a451cffc89321c02a3f"><code>c3c652a</code></a> Cloud not make JRuby build pass on Xenial, reverting back to Trusty</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/0cbea950da56127e5d9263de9bf0193da5490818"><code>0cbea95</code></a> Fix build issues with PostgreSQL and ImageMagick</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/60978361dcd872478f650068804c56f0ed193268"><code>6097836</code></a> use URI.open instead of Kernel.open for Ruby 2.7</li> <li><a href="https://github.com/carrierwaveuploader/carrierwave/commit/f10026b8e0eda7709a164b6f8304a6b71993d0f6"><code>f10026b</code></a> Use URI::DEFAULT_PARSER.unescape instead of URI.decode for Ruby 2.7</li> <li>Additional commits viewable in <a href="https://github.com/carrierwaveuploader/carrierwave/compare/v1.1.0...v1.3.2">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Bumps immer from 4.0.0 to 8.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/immerjs/immer/releases">immer's releases</a>.</em></p> <blockquote> <h2>v8.0.1</h2> <h2><a href="https://github.com/immerjs/immer/compare/v8.0.0...v8.0.1">8.0.1</a> (2021-01-20)</h2> <h3>Bug Fixes</h3> <ul> <li>Fixed security issue <a href="https://github-redirect.dependabot.com/immerjs/immer/issues/738">#738</a>: prototype pollution possible when applying patches CVE-2020-28477 (<a href="https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5">da2bd4f</a>)</li> </ul> <h2>v8.0.0</h2> <h1><a href="https://github.com/immerjs/immer/compare/v7.0.15...v8.0.0">8.0.0</a> (2020-11-17)</h1> <h3>feature</h3> <ul> <li>Always freeze by default (<a href="https://github-redirect.dependabot.com/immerjs/immer/issues/702">#702</a>) (<a href="https://github.com/immerjs/immer/commit/a406c8f1e524efabfe641f4eaf742b444e501cc0">a406c8f</a>)</li> </ul> <h3>BREAKING CHANGES</h3> <ul> <li>always freeze by default, even in production mode. Use <code>setAutoFreeze(process.env.NODE_ENV !== 'production')</code> for the old behavior. See <a href="https://github-redirect.dependabot.com/immerjs/immer/issues/687#issuecomment-728881754">immerjs/immer#687</a> for the rationale. Fixes <a href="https://github-redirect.dependabot.com/immerjs/immer/issues/649">#649</a>, <a href="https://github-redirect.dependabot.com/immerjs/immer/issues/681">#681</a>, <a href="https://github-redirect.dependabot.com/immerjs/immer/issues/687">#687</a></li> </ul> <h2>v7.0.15</h2> <h2><a href="https://github.com/immerjs/immer/compare/v7.0.14...v7.0.15">7.0.15</a> (2020-11-17)</h2> <h3>Bug Fixes</h3> <ul> <li>make plugin loading idempotent, fixes <a href="https://github-redirect.dependabot.com/immerjs/immer/issues/692">#692</a> (<a href="https://github.com/immerjs/immer/commit/754331bb0d0a24ca56399ac7a778f5e87be1c236">754331b</a>)</li> </ul> <h2>v7.0.14</h2> <h2><a href="https://github.com/immerjs/immer/compare/v7.0.13...v7.0.14">7.0.14</a> (2020-10-20)</h2> <h3>Bug Fixes</h3> <ul> <li>build issue. Fixes <a href="https://github-redirect.dependabot.com/immerjs/immer/issues/685">#685</a> (?) (<a href="https://github.com/immerjs/immer/commit/9007be0a68e8c521d23657729036d2eee9f5df83">9007be0</a>)</li> </ul> <h2>v7.0.13</h2> <h2><a href="https://github.com/immerjs/immer/compare/v7.0.12...v7.0.13">7.0.13</a> (2020-10-20)</h2> <h3>Bug Fixes</h3> <ul> <li>reconcile if the original value is assigned after creating a draft. Fixes <a href="https://github-redirect.dependabot.com/immerjs/immer/issues/659">#659</a> (<a href="https://github.com/immerjs/immer/commit/c0e6749e8df3e20d880d61b726b1395167ba2088">c0e6749</a>)</li> </ul> <h2>v7.0.12</h2> <h2><a href="https://github.com/immerjs/immer/compare/v7.0.11...v7.0.12">7.0.12</a> (2020-10-20)</h2> <h3>Bug Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5"><code>da2bd4f</code></a> fix: Fixed security issue <a href="https://github-redirect.dependabot.com/immerjs/immer/issues/738">#738</a>: prototype pollution possible when applying pa...</li> <li><a href="https://github.com/immerjs/immer/commit/d75de7031c3430fbcb76fa7b90cf681ba5042df9"><code>d75de70</code></a> chore: fix Buffer deprecation warning in test (<a href="https://github-redirect.dependabot.com/immerjs/immer/issues/706">#706</a>)</li> <li><a href="https://github.com/immerjs/immer/commit/8fbf93cddb27fe96891b7a7f3218742881dfaae1"><code>8fbf93c</code></a> docs: Add referential equality to pitfalls (<a href="https://github-redirect.dependabot.com/immerjs/immer/issues/731">#731</a>)</li> <li><a href="https://github.com/immerjs/immer/commit/c21a2ef6d78b683fa6d4bd62ba465cb3542e8c03"><code>c21a2ef</code></a> docs: Update current.md (<a href="https://github-redirect.dependabot.com/immerjs/immer/issues/728">#728</a>)</li> <li><a href="https://github.com/immerjs/immer/commit/211314c0b3b125bd4acf15f22dfb49eee9fb9729"><code>211314c</code></a> docs: add cool-store into built-with.md (<a href="https://github-redirect.dependabot.com/immerjs/immer/issues/724">#724</a>)</li> <li><a href="https://github.com/immerjs/immer/commit/e8fd805740f1b0ae788470b93615e51e9bc887a3"><code>e8fd805</code></a> chore(tests): use UTC date string in tests to be timezone independent (<a href="https://github-redirect.dependabot.com/immerjs/immer/issues/705">#705</a>)</li> <li><a href="https://github.com/immerjs/immer/commit/fe8f5891d4fdd35107ebb252df85332fd8c53543"><code>fe8f589</code></a> chore(comments): update comments (<a href="https://github-redirect.dependabot.com/immerjs/immer/issues/727">#727</a>)</li> <li><a href="https://github.com/immerjs/immer/commit/d8121d66a5546ab6939c64c23f5486e522c5ceb0"><code>d8121d6</code></a> chore(docs): Fix typo in pitfalls.md (<a href="https://github-redirect.dependabot.com/immerjs/immer/issues/729">#729</a>)</li> <li><a href="https://github.com/immerjs/immer/commit/5379cddef95a237fd25b450e629054b3e02f95ee"><code>5379cdd</code></a> chore(docs): Update example-reducer.md (<a href="https://github-redirect.dependabot.com/immerjs/immer/issues/734">#734</a>)</li> <li><a href="https://github.com/immerjs/immer/commit/d3908e12dfb118d44e54f8a2f44f8c6862fad940"><code>d3908e1</code></a> chore(deps): bump dot-prop from 4.2.0 to 4.2.1 in /website (<a href="https://github-redirect.dependabot.com/immerjs/immer/issues/735">#735</a>)</li> <li>Additional commits viewable in <a href="https://github.com/immerjs/immer/compare/v4.0.0...v8.0.1">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Bumps axios from 0.19.0 to 0.21.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/releases">axios's releases</a>.</em></p> <blockquote> <h2>v0.21.1</h2> <h3>0.21.1 (December 21, 2020)</h3> <p>Fixes and Functionality:</p> <ul> <li>Hotfix: Prevent SSRF (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3410">#3410</a>)</li> <li>Protocol not parsed when setting proxy config from env vars (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3070">#3070</a>)</li> <li>Updating axios in types to be lower case (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2797">#2797</a>)</li> <li>Adding a type guard for <code>AxiosError</code> (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2949">#2949</a>)</li> </ul> <p>Internal and Tests:</p> <ul> <li>Remove the skipping of the <code>socket</code> http test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3364">#3364</a>)</li> <li>Use different socket for Win32 test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3375">#3375</a>)</li> </ul> <p>Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:</p> <ul> <li>Daniel Lopretto <a href="mailto:[email protected]">[email protected]</a></li> <li>Jason Kwok <a href="mailto:[email protected]">[email protected]</a></li> <li>Jay <a href="mailto:[email protected]">[email protected]</a></li> <li>Jonathan Foster <a href="mailto:[email protected]">[email protected]</a></li> <li>Remco Haszing <a href="mailto:[email protected]">[email protected]</a></li> <li>Xianming Zhong <a href="mailto:[email protected]">[email protected]</a></li> </ul> <h2>v0.21.0</h2> <h3>0.21.0 (October 23, 2020)</h3> <p>Fixes and Functionality:</p> <ul> <li>Fixing requestHeaders.Authorization (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3287">#3287</a>)</li> <li>Fixing node types (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3237">#3237</a>)</li> <li>Fixing axios.delete ignores config.data (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3282">#3282</a>)</li> <li>Revert "Fixing overwrite Blob/File type as Content-Type in browser. (<a href="https://github-redirect.dependabot.com/axios/axios/issues/1773">#1773</a>)" (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3289">#3289</a>)</li> <li>Fixing an issue that type 'null' and 'undefined' is not assignable to validateStatus when typescript strict option is enabled (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3200">#3200</a>)</li> </ul> <p>Internal and Tests:</p> <ul> <li>Lock travis to not use node v15 (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3361">#3361</a>)</li> </ul> <p>Documentation:</p> <ul> <li>Fixing simple typo, existant -> existent (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3252">#3252</a>)</li> <li>Fixing typos (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3309">#3309</a>)</li> </ul> <p>Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:</p> <ul> <li>Allan Cruz <a href="mailto:[email protected]">[email protected]</a></li> <li>George Cheng <a href="mailto:[email protected]">[email protected]</a></li> <li>Jay <a href="mailto:[email protected]">[email protected]</a></li> <li>Kevin Kirsche <a href="mailto:[email protected]">[email protected]</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/axios/axios/blob/v0.21.1/CHANGELOG.md">axios's changelog</a>.</em></p> <blockquote> <h3>0.21.1 (December 21, 2020)</h3> <p>Fixes and Functionality:</p> <ul> <li>Hotfix: Prevent SSRF (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3410">#3410</a>)</li> <li>Protocol not parsed when setting proxy config from env vars (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3070">#3070</a>)</li> <li>Updating axios in types to be lower case (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2797">#2797</a>)</li> <li>Adding a type guard for <code>AxiosError</code> (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2949">#2949</a>)</li> </ul> <p>Internal and Tests:</p> <ul> <li>Remove the skipping of the <code>socket</code> http test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3364">#3364</a>)</li> <li>Use different socket for Win32 test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3375">#3375</a>)</li> </ul> <p>Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:</p> <ul> <li>Daniel Lopretto <a href="mailto:[email protected]">[email protected]</a></li> <li>Jason Kwok <a href="mailto:[email protected]">[email protected]</a></li> <li>Jay <a href="mailto:[email protected]">[email protected]</a></li> <li>Jonathan Foster <a href="mailto:[email protected]">[email protected]</a></li> <li>Remco Haszing <a href="mailto:[email protected]">[email protected]</a></li> <li>Xianming Zhong <a href="mailto:[email protected]">[email protected]</a></li> </ul> <h3>0.21.0 (October 23, 2020)</h3> <p>Fixes and Functionality:</p> <ul> <li>Fixing requestHeaders.Authorization (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3287">#3287</a>)</li> <li>Fixing node types (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3237">#3237</a>)</li> <li>Fixing axios.delete ignores config.data (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3282">#3282</a>)</li> <li>Revert "Fixing overwrite Blob/File type as Content-Type in browser. (<a href="https://github-redirect.dependabot.com/axios/axios/issues/1773">#1773</a>)" (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3289">#3289</a>)</li> <li>Fixing an issue that type 'null' and 'undefined' is not assignable to validateStatus when typescript strict option is enabled (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3200">#3200</a>)</li> </ul> <p>Internal and Tests:</p> <ul> <li>Lock travis to not use node v15 (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3361">#3361</a>)</li> </ul> <p>Documentation:</p> <ul> <li>Fixing simple typo, existant -> existent (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3252">#3252</a>)</li> <li>Fixing typos (<a href="https://github-redirect.dependabot.com/axios/axios/pull/3309">#3309</a>)</li> </ul> <p>Huge thanks to everyone who contributed to this release via code (authors listed below) or via reviews and triaging on GitHub:</p> <ul> <li>Allan Cruz <a href="mailto:[email protected]">[email protected]</a></li> <li>George Cheng <a href="mailto:[email protected]">[email protected]</a></li> <li>Jay <a href="mailto:[email protected]">[email protected]</a></li> <li>Kevin Kirsche <a href="mailto:[email protected]">[email protected]</a></li> <li>Remco Haszing <a href="mailto:[email protected]">[email protected]</a></li> <li>Taemin Shin <a href="mailto:[email protected]">[email protected]</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/axios/axios/commit/a64050a6cfbcc708a55a7dc8030d85b1c78cdf38"><code>a64050a</code></a> Releasing 0.21.1</li> <li><a href="https://github.com/axios/axios/commit/d57cd976f3cc0f1c5bb1f0681660e50004781db5"><code>d57cd97</code></a> Updating changelog for 0.21.1 release</li> <li><a href="https://github.com/axios/axios/commit/8b0f373df0574b7cb3c6b531b4092cd670dac6e3"><code>8b0f373</code></a> Use different socket for Win32 test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3375">#3375</a>)</li> <li><a href="https://github.com/axios/axios/commit/e426910be7c417bdbcde9c18cb184ead826fc0e1"><code>e426910</code></a> Protocol not parsed when setting proxy config from env vars (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3070">#3070</a>)</li> <li><a href="https://github.com/axios/axios/commit/c7329fefc890050edd51e40e469a154d0117fc55"><code>c7329fe</code></a> Hotfix: Prevent SSRF (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3410">#3410</a>)</li> <li><a href="https://github.com/axios/axios/commit/f472e5da5fe76c72db703d6a0f5190e4ad31e642"><code>f472e5d</code></a> Adding a type guard for <code>AxiosError</code> (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2949">#2949</a>)</li> <li><a href="https://github.com/axios/axios/commit/768825589fd0d36b64a66717ca6df2efd8fb7844"><code>7688255</code></a> Remove the skipping of the <code>socket</code> http test (<a href="https://github-redirect.dependabot.com/axios/axios/issues/3364">#3364</a>)</li> <li><a href="https://github.com/axios/axios/commit/820fe6e41a96f05fb4781673ce07486f1b37515d"><code>820fe6e</code></a> Updating axios in types to be lower case (<a href="https://github-redirect.dependabot.com/axios/axios/issues/2797">#2797</a>)</li> <li><a href="https://github.com/axios/axios/commit/94ca24b5b23f343769a15f325693246e07c177d2"><code>94ca24b</code></a> Releasing 0.21.0</li> <li><a href="https://github.com/axios/axios/commit/2130a0c8acc588c72b53dfef31a11442043ffb06"><code>2130a0c</code></a> Updating changelog for 0.21.0 release</li> <li>Additional commits viewable in <a href="https://github.com/axios/axios/compare/v0.19.0...v0.21.1">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Bumps nokogiri from 1.8.1 to 1.10.8. <details> <summary>Release notes</summary>

Sourced from nokogiri's releases.

1.10.8 / 2020-02-10

Security

[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

1.10.7 / 2019-12-03

Bug

• [MRI] Ensure the patch applied in v1.10.6 works with GNU patch. #1954

1.10.6 / 2019-12-03

Bug

• [MRI] Fix FreeBSD installation of vendored libxml2. [#1941, #1953] (Thanks, @​nurse!)

1.10.5 / 2019-10-31

Dependencies

• [MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10
• [MRI] vendored libxslt is updated from 1.1.33 to 1.1.34

1.10.4 / 2019-08-11

Security

Address CVE-2019-5477 (#1915)

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.

This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.

This CVE's public notice is sparklemotion/nokogiri#1915

1.10.3 / 2019-04-22

Security Notes

</tr></table> ... (truncated) </details> <details> <summary>Changelog</summary>

Sourced from nokogiri's changelog.

1.10.8 / 2020-02-10

Security

[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.

1.10.7 / 2019-12-03

Fixed

• [MRI] Ensure the patch applied in v1.10.6 works with GNU patch. [#1954]

1.10.6 / 2019-12-03

Fixed

• [MRI] Fix FreeBSD installation of vendored libxml2. [#1941, #1953] (Thanks, @​nurse!)

1.10.5 / 2019-10-31

Security

[MRI] Vendored libxslt upgraded to v1.1.34 which addresses three CVEs for libxslt:

• CVE-2019-13117
• CVE-2019-13118
• CVE-2019-18197
• CVE-2019-19956

More details are available at #1943.

Dependencies

• [MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10
• [MRI] vendored libxslt is updated from 1.1.33 to 1.1.34

1.10.4 / 2019-08-11

Security

Address CVE-2019-5477 (#1915).

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess by Ruby's Kernel.open method. Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file is being passed untrusted user input.

This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4. </tr></table> ... (truncated) </details> <details> <summary>Commits</summary>

• 6ce10d1 version bump to v1.10.8
• 2320f5b update CHANGELOG for v1.10.8
• 4a77fdb remove patches from the hoe Manifest
• 570b6cb update to use rake-compiler ~1.1.0
• 2cdb68e backport libxml2 patch for CVE-2020-7595
• e6b3229 version bump to v1.10.7
• 4f9d443 update CHANGELOG
• 80e67ef Fix the patch from #1953 to work with both git and patch
• 7cf1b85 Fix typo in generated metadata
• d76180d add gem metadata
• Additional commits viewable in compare view </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Superseded by #13.

Bumps nokogiri from 1.8.1 to 1.10.10. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sparklemotion/nokogiri/releases">nokogiri's releases</a>.</em></p> <blockquote> <h2>1.10.10 / 2020-07-06</h2> <h3>Features</h3> <ul> <li>[MRI] Cross-built Windows gems now support Ruby 2.7 [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2029">#2029</a>]. Note that prior to this release, the v1.11.x prereleases provided this support.</li> </ul> <h2>1.10.9 / 2020-03-01</h2> <h3>Fixed</h3> <ul> <li>[MRI] Raise an exception when Nokogiri detects a specific libxml2 edge case involving blank Schema nodes wrapped by Ruby objects that would cause a segfault. Currently no fix is available upstream, so we're preventing a dangerous operation and informing users to code around it if possible. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1985">#1985</a>, <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2001">#2001</a>]</li> <li>[JRuby] Change <code>NodeSet#to_a</code> to return a RubyArray instead of Object, for compilation under JRuby 9.2.9 and later. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1968">#1968</a>, <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1969">#1969</a>] (Thanks, <a href="https://github.com/headius">@headius</a>!)</li> </ul> <h2>1.10.8 / 2020-02-10</h2> <h3>Security</h3> <p>[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1992">#1992</a>. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.</p> <h2>1.10.7 / 2019-12-03</h2> <h3>Bug</h3> <ul> <li>[MRI] Ensure the patch applied in v1.10.6 works with GNU <code>patch</code>. <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1954">#1954</a></li> </ul> <h2>1.10.6 / 2019-12-03</h2> <h3>Bug</h3> <ul> <li>[MRI] Fix FreeBSD installation of vendored libxml2. [#1941, <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1953">#1953</a>] (Thanks, <a href="https://github.com/nurse">@nurse</a>!)</li> </ul> <h2>1.10.5 / 2019-10-31</h2> <h3>Dependencies</h3> <ul> <li>[MRI] vendored libxml2 is updated from 2.9.9 to 2.9.10</li> <li>[MRI] vendored libxslt is updated from 1.1.33 to 1.1.34</li> </ul> <h2>1.10.4 / 2019-08-11</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.md">nokogiri's changelog</a>.</em></p> <blockquote> <h2>1.10.10 / 2020-07-06</h2> <h3>Features</h3> <ul> <li>[MRI] Cross-built Windows gems now support Ruby 2.7 [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2029">#2029</a>]. Note that prior to this release, the v1.11.x prereleases provided this support.</li> </ul> <h2>1.10.9 / 2020-03-01</h2> <h3>Fixed</h3> <ul> <li>[MRI] Raise an exception when Nokogiri detects a specific libxml2 edge case involving blank Schema nodes wrapped by Ruby objects that would cause a segfault. Currently no fix is available upstream, so we're preventing a dangerous operation and informing users to code around it if possible. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1985">#1985</a>, <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/2001">#2001</a>]</li> <li>[JRuby] Change <code>NodeSet#to_a</code> to return a RubyArray instead of Object, for compilation under JRuby 9.2.9 and later. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1968">#1968</a>, <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1969">#1969</a>] (Thanks, <a href="https://github.com/headius">@headius</a>!)</li> </ul> <h2>1.10.8 / 2020-02-10</h2> <h3>Security</h3> <p>[MRI] Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1992">#1992</a>. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.</p> <h2>1.10.7 / 2019-12-03</h2> <h3>Fixed</h3> <ul> <li>[MRI] Ensure the patch applied in v1.10.6 works with GNU <code>patch</code>. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1954">#1954</a>]</li> </ul> <h2>1.10.6 / 2019-12-03</h2> <h3>Fixed</h3> <ul> <li>[MRI] Fix FreeBSD installation of vendored libxml2. [<a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1941">#1941</a>, <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1953">#1953</a>] (Thanks, <a href="https://github.com/nurse">@nurse</a>!)</li> </ul> <h2>1.10.5 / 2019-10-31</h2> <h3>Security</h3> <p>[MRI] Vendored libxslt upgraded to v1.1.34 which addresses three CVEs for libxslt:</p> <ul> <li>CVE-2019-13117</li> <li>CVE-2019-13118</li> <li>CVE-2019-18197</li> <li>CVE-2019-19956</li> </ul> <p>More details are available at <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1943">#1943</a>.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sparklemotion/nokogiri/commit/a9a3717154bdb99ed6d0d785736eb471c9d6a954"><code>a9a3717</code></a> version bump to v1.10.10</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/d2d3c18a6c2db5b448381573c1248fe480198003"><code>d2d3c18</code></a> update CHANGELOG for v1.10.10</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/f0c324c1d93a2880a32dc46cf8766ff132409806"><code>f0c324c</code></a> Merge branch '2029-windows-support-for-ruby-27-on-v110x' into v1.10.x</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/c39e1b082e73557207db1468e4b567727a384579"><code>c39e1b0</code></a> Support fat binary gems for ruby-2.7</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/90916022e38fd48c3a9e3763b0f47f834261d399"><code>9091602</code></a> ci: only manage the v1.10.x pipeline on this branch</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/e2e191de387f854619bc8a3f9b39ca687fe0bf31"><code>e2e191d</code></a> version bump to v1.10.9</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/50f8fdeae4afb8582ff6347d7aa17822a1e11242"><code>50f8fde</code></a> update CHANGELOG</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/9b5deef76aeb5e3868cafb0b0956cca3708136f3"><code>9b5deef</code></a> Change return type to RubyArray</li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/ae054f750283dccb1454d71dc00d0343dc2b1c60"><code>ae054f7</code></a> update CHANGELOG for <a href="https://github-redirect.dependabot.com/sparklemotion/nokogiri/issues/1985">#1985</a></li> <li><a href="https://github.com/sparklemotion/nokogiri/commit/71bcaf0bb1351c09e48f41f10314cb35bb4a4db4"><code>71bcaf0</code></a> Work around a bug in libxml2</li> <li>Additional commits viewable in <a href="https://github.com/sparklemotion/nokogiri/compare/v1.8.1...v1.10.10">compare view</a></li> </ul> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>

Bumps ini from 1.3.5 to 1.3.7. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/npm/ini/commit/c74c8af35f32b801a7e82a8309eab792a95932f6"><code>c74c8af</code></a> 1.3.7</li> <li><a href="https://github.com/npm/ini/commit/024b8b55ac1c980c6225607b007714c54eb501ba"><code>024b8b5</code></a> update deps, add linting</li> <li><a href="https://github.com/npm/ini/commit/032fbaf5f0b98fce70c8cc380e0d05177a9c9073"><code>032fbaf</code></a> Use Object.create(null) to avoid default object property hazards</li> <li><a href="https://github.com/npm/ini/commit/2da90391ef70db41d10f013e3a87f9a8c5d01a72"><code>2da9039</code></a> 1.3.6</li> <li><a href="https://github.com/npm/ini/commit/cfea636f534b5ca7550d2c28b7d1a95d936d56c6"><code>cfea636</code></a> better git push script, before publish instead of after</li> <li><a href="https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1"><code>56d2805</code></a> do not allow invalid hazardous string as section name</li> <li>See full diff in <a href="https://github.com/isaacs/ini/compare/v1.3.5...v1.3.7">compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~isaacs">isaacs</a>, a new releaser for ini since your current version.</p> </details> <br />

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

<details> <summary>Dependabot commands and options</summary> <br />

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

</details>