Bump lodash, bower, gulp, gulp-jshint, gulp-less, gulp-wrap, karma and karma-phantomjs-launcher

[dependabot]

Bumps lodash to 4.17.21 and updates ancestor dependencies lodash, bower, gulp, gulp-jshint, gulp-less, gulp-wrap, karma and karma-phantomjs-launcher. These dependencies need to be updated together.

Updates lodash from 4.17.11 to 4.17.21

Commits

• f299b52 Bump to v4.17.21
• c4847eb Improve performance of toNumber, trim and trimEnd on large input strings
• 3469357 Prevent command injection through _.template's variable option
• ded9bc6 Bump to v4.17.20.
• 63150ef Documentation fixes.
• 00f0f62 test.js: Remove trailing comma.
• 846e434 Temporarily use a custom fork of lodash-cli.
• 5d046f3 Re-enable Travis tests on 4.17 branch.
• aa816b3 Remove /npm-package.
• d7fbc52 Bump to v4.17.19
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by bnjmnt4n, a new releaser for lodash since your current version.

Updates bower from 1.4.2 to 1.8.14

Release notes

Sourced from bower's releases.

v1.8.12

• Properly bundle all dependencies of Bower within package

v1.8.10

• Security fixes for tar-fs dependency bower/bower#2576
• Security fixes for handlebars dependency bower/bower#2586
• Security fixes for ini dependency bower/bower#2589

v1.8.8

Fix security issue connected to extracting .tar.gz archives

This bug allows to write arbitrary file on filesystem when Bower extracts malicious package

Needlessly to say, please upgrade

v1.8.7

Fixes side effect of fix from v1.8.6 that caused improper permissions for extracted folders

bower/bower#2532

v1.8.6

Fix Zip Slip Vulnerability of decompress-zip package: https://snyk.io/research/zip-slip-vulnerability

Note: v1.8.5 has been unpublished because of missing files

v1.8.4

• Fixes release 1.8.3 by publishing with npm@3 instead of npm@5 (to include lib/node_modules)

v1.8.3

• 451c60e Do not store resolutions if --save is not used, fixes #2344 (#2508)
• 50ee729 Allow to disable shorthand resolver (#2507)
• bb17839 Allow shallow cloning when source is a ssh protocol (#2506)
• 5a6ae54 Add support for Arrays in Environment Variable replacement (#2411)
• 74af42c Only replace last @ after (if any) last / with # (#2395)
• 💯Make tests work on Windows / Linux / OSX on node versions 0.10 / 0.12 / 4 / 6 / 8 / 9
• 💅Format source code with prettier

v1.8.2

Migrate registry url from http://bower.herokuapp.com to https://registry.bower.io

It is so we leverage CDN and offload Heroku instance reducing costs.

v1.8.0

• Download tar archives from GitHub when possible (#2263)
  • Change default shorthand resolver for github from git:// to https://
• Fix ssl handling by not setting GIT_SSL_NO_VERIFY=false (#2361)
• Allow for removing components with url instead of name (#2368)
• Show in warning message location of malformed bower.json (#2357)
• Improve handling of non-semver versions in git resolver (#2316)
• Fix handling of cached releases pluginResolverFactory (#2356)

... (truncated)

Changelog

Sourced from bower's changelog.

Changelog

Newer releases

Please see: https://github.com/bower/bower/releases

1.8.0 - 2016-11-07

• Download tar archives from GitHub when possible (#2263)
  • Change default shorthand resolver for github from git:// to https://
• Fix ssl handling by not setting GIT_SSL_NO_VERIFY=false (#2361)
• Allow for removing components with url instead of name (#2368)
• Show in warning message location of malformed bower.json (#2357)
• Improve handling of non-semver versions in git resolver (#2316)
• Fix handling of cached releases pluginResolverFactory (#2356)
• Allow to type the entire version when conflict occured (#2243)
• Allow owner/reponame shorthand for registering components (#2248)
• Allow single-char repo names and package names (#2249)
• Make bower version no longer honor version in bower.json (#2232)
• Add postinstall hook (#2252)
• Allow for @ instead of # for install and info commands (#2322)
• Upgrade all bundled modules

1.7.9 - 2016-04-05

• Show warnings for invalid bower.json fields
• Update bower-json
  • Less strict validation on package name (allow spaces, slashes, and "@")

1.7.8 - 2016-04-04

• Don't ask for git credentials in non-interactive session, fixes #956 #1009
• Prevent swallowing exceptions with programmatic api, fixes #2187
• Update graceful-fs to 4.x in all dependences, fixes nodejs/node#5213
• Resolve pluggable resolvers using cwd and fallback to global modules, fixes #1919
• Upgrade handlebars to 4.0.5, closes #2195
• Replace all % chatacters in defined scripts, instead of only first one, fixes #2174
• Update opn package to fix issues with "bower open" command on Windows
• Update bower-config
  • Do not interpolate environment variables in script hooks, fixes bower/config#47
• Update bower-json
  • Validate package name more strictly and allow only latin letters, dots, dashes and underscores
• Add support for "save" and "save-exact" in .bowerrc, #2161

1.7.7 - 2016-01-27

Revert locations of all files while still packaging node_modules.

It's because people are depending on internals of bower, like bower/lib/renderers/StandardRenderer. We want to preserve this

... (truncated)

Commits

• d765b2b Bump to 1.8.14
• ca23b46 Run CI only on node 6+
• 7f26c5b Fix bug unauthenticated git protocol in GitHubResolver (#2612)
• 4b5722f Update README.md
• 557c1cd Fix mode for bin/bower
• 74560b7 Fix child process execution
• 2905791 Fix running bower on non-windows
• dfdda3f Merge remote-tracking branch 'origin/master'
• fa36814 Bump to 1.8.13
• f19bc34 Make sure correct git/svn binary is always used
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by sheerun, a new releaser for bower since your current version.

Updates gulp from 3.9.1 to 4.0.2

Release notes

Sourced from gulp's releases.

v4.0.2

Fix

• Bind src/dest/symlink to the gulp instance to support esm exports (5667666) - Ref standard-things/esm#797

Docs

• Add notes about esm support (4091bd3) - Closes #2278
• Fix the Negative Globs section & examples (3c66d95) - Closes #2297
• Remove next tag from recipes (1693a11) - Closes #2277
• Add default task wrappers to Watching Files examples to make runnable (d916276) - Closes #2322
• Fix syntax error in lastRun API docs (ea52a92) - Closes #2315
• Fix typo in Explaining Globs (5d81f42) - Closes #2326

Build

• Add node 12 to Travis & Azure (b4b5a68)

v4.0.1

Fix

• Temporary workaround for facebook/Docusaurus#257 (9f4a2e9) - Closes facebook/Docusaurus#257

Docs

• Fix error in ES2015 usage example (a4e8d48) - Closes #2099 #2100
• Add temporary notice for 4.0.0 vs 3.9.1 documentation (126423a) - Closes #2121
• Improve recipe for empty glob array (45830cf) - Closes #2122
• Reword standard to default (b065a13)
• Fix recipe typo (86acdea) - Closes #2156
• Add front-matter to each file (d693e49) - Closes #2109
• Rename "Getting Started" to "Quick Start" & update it (6a0fa00)
• Add "Creating Tasks" documentation (21b6962)
• Add "JavaScript and Gulpfiles" documentation (31adf07)
• Add "Working with Files" documentation (50fafc6)
• Add "Async Completion" documentation (ad8b568)
• Add "Explaining Globs" documentation (f8cafa0)
• Add "Using Plugins" documentation (233c3f9)
• Add "Watching Files" documentation (f3f2d9f)
• Add Table of Contents to "Getting Started" directory (a43caf2)
• Improve & fix parts of Getting Started (84b0234)
• Create and link-to a "docs missing" page for LINK_NEEDED references (2bd75d0)
• Redirect users to new Getting Started guides (53e9727)
• Temporarily reference gulp@next in Quick Start (2cecf1e)
• Fixed a capitalization typo in a heading (3d051d8) - Closes #2242
• Use h2 headers within Quick Start documentation (921312c) - Closes #2241
• Fix for nested directories references (4c2b9a7)
• Add some more cleanup for Docusaurus (6a8fd8f)
• Temporarily point LINK_NEEDED references to documentation-missing.md (df7cdcb)
• API documentation improvements based on feedback (0a68710)

... (truncated)

Changelog

Sourced from gulp's changelog.

gulp changelog

4.0.0

Task system changes

• replaced 3.x task system (orchestrator) with new task system (bach)
  • removed gulp.reset
  • removed 3 argument syntax for gulp.task
  • gulp.task should only be used when you will call the task with the CLI
  • added gulp.series and gulp.parallel methods for composing tasks. Everything must use these now.
  • added single argument syntax for gulp.task which allows a named function to be used as the name of the task and task function.
  • added gulp.tree method for retrieving the task tree. Pass { deep: true } for an archy compatible node list.
  • added gulp.registry for setting custom registries.

CLI changes

• split CLI out into a module if you want to save bandwidth/disk space. you can install the gulp CLI using either npm install gulp -g or npm install gulp-cli -g, where gulp-cli is the smaller one (no module code included)
• add --tasks-json flag to CLI to dump the whole tree out for other tools to consume
• added --verify flag to check the dependencies in package.json against the plugin blacklist.

vinyl/vinyl-fs changes

• added gulp.symlink which functions exactly like gulp.dest, but symlinks instead.
• added dirMode param to gulp.dest and gulp.symlink which allows better control over the mode of the destination folder that is created.
• globs passed to gulp.src will be evaluated in order, which means this is possible gulp.src(['*.js', '!b*.js', 'bad.js']) (exclude every JS file that starts with a b except bad.js)
• performance for gulp.src has improved massively
  • gulp.src(['**/*', '!b.js']) will no longer eat CPU since negations happen during walking now
• added since option to gulp.src which lets you only match files that have been modified since a certain date (for incremental builds)
• fixed gulp.src not following symlinks
• added overwrite option to gulp.dest which allows you to enable or disable overwriting of existing files

Commits

• 069350a Release: 4.0.2
• b4b5a68 Build: Add node 12 to Travis & Azure
• 5667666 Fix: Bind src/dest/symlink to the gulp instance to support esm exports (ref s...
• 4091bd3 Docs: Add notes about esm support (closes #2278)
• 3c66d95 Docs: Fix the Negative Globs section & examples (closes #2297)
• 1693a11 Docs: Remove next tag from recipes (closes #2277)
• d916276 Docs: Add default task wrappers to Watching Files examples to make runnable (...
• ea52a92 Docs: Fix syntax error in lastRun API docs (closes #2315)
• 5d81f42 Docs: Fix typo in Explaining Globs (#2326)
• ea3bba4 Release: 4.0.1
• Additional commits viewable in compare view

Updates gulp-jshint from 1.11.2 to 2.1.0

Changelog

Sourced from gulp-jshint's changelog.

2.0

• jshint is now a peerDependency, meaning you must install it seperately

  npm install jshint gulp-jshint --save-dev

Commits

• 32a25b0 2.1.0
• 2c57c9f Merge pull request #157 from spalger/remove-gulp-util
• 5f621f8 vinyl is only used in testing
• 5eaabdd add yarn.lock file for dev
• 154180d [gulp-util/PluginError] use plugin-error directly
• 357ab98 [gulp-util/File] use Vinyl directly
• 807bead 2.0.4
• aca8740 Add test to verify that default files are not broken
• c277434 2.0.3
• 711f3f0 test fix
• Additional commits viewable in compare view

Updates gulp-less from 3.0.5 to 3.5.0

Release notes

Sourced from gulp-less's releases.

v3.5.0

• update dependency accord d706f87f10f6b3fe4277d0fb37b4baa979a7e1be @​zkochan

v3.4.0

• remove gulp-util f58e0f789a2905317e1067ea1a9a546c4cee9a96

v3.3.2

• update dependencies - dfefda34004ef462515ee52377b8a75e2bed0898

v3.3.0

• update accord dependency to remove any GPL code from the tree cf6d8a6f2b5c11043a595baaf2cfddbf66721bf3

v3.2.0

• skip less 2.7.0 6fa258b275223e7c5363a07f77ab583a4698d1cd
• update deps c5a391daab3b86657e926f60cc39482b02483a89
• fix less version c48064c08a603232ec5d3bf118772377a33e5019

v3.1.0

No release notes provided.

Commits

• 453625a 3.5.0
• d706f87 fix(deps): update accord to version 0.28 (#281)
• 9f9e643 3.4.0
• f58e0f7 Remove gulp-util
• dd37ea2 3.3.2
• dfefda3 update deps, clean files
• 18d0880 3.3.0
• cf6d8a6 Update package.json (#253)
• 3db484e Docs: Update Changelog through 3.2.0 (#258)
• 052aea7 3.2.0
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by stevelacy, a new releaser for gulp-less since your current version.

Updates gulp-wrap from 0.11.0 to 0.15.0

Changelog

Sourced from gulp-wrap's changelog.

0.14.0

Removed dependency on gulp-util, fixes (#40).

Commits

• See full diff in compare view

Updates karma from 0.13.22 to 6.4.1

Release notes

Sourced from karma's releases.

v6.4.1

6.4.1 (2022-09-19)

Bug Fixes

• pass integrity value (63d86be)

v6.4.0

6.4.0 (2022-06-14)

Features

• support SRI verification of link tags (dc51a2e)
• support SRI verification of script tags (6a54b1c)

v6.3.20

6.3.20 (2022-05-13)

Bug Fixes

• prefer IPv4 addresses when resolving domains (e17698f), closes #3730

v6.3.19

6.3.19 (2022-04-19)

Bug Fixes

• client: error out when opening a new tab fails (099b85e)

v6.3.18

6.3.18 (2022-04-13)

Bug Fixes

• deps: upgrade socket.io to v4.4.1 (52a30bb)

v6.3.17

6.3.17 (2022-02-28)

Bug Fixes

• deps: update colors to maintained version (#3763) (fca1884)

v6.3.16

... (truncated)

Changelog

Sourced from karma's changelog.

6.4.1 (2022-09-19)

Bug Fixes

• pass integrity value (63d86be)

6.4.0 (2022-06-14)

Features

• support SRI verification of link tags (dc51a2e)
• support SRI verification of script tags (6a54b1c)

6.3.20 (2022-05-13)

Bug Fixes

• prefer IPv4 addresses when resolving domains (e17698f), closes #3730

6.3.19 (2022-04-19)

Bug Fixes

• client: error out when opening a new tab fails (099b85e)

6.3.18 (2022-04-13)

Bug Fixes

• deps: upgrade socket.io to v4.4.1 (52a30bb)

6.3.17 (2022-02-28)

Bug Fixes

• deps: update colors to maintained version (#3763) (fca1884)

6.3.16 (2022-02-10)

Bug Fixes

• security: mitigate the "Open Redirect Vulnerability" (ff7edbb)

... (truncated)

Commits

• 0013121 chore(release): 6.4.1 [skip ci]
• 63d86be fix: pass integrity value
• 84f7cc3 chore(release): 6.4.0 [skip ci]
• f2d0663 docs: add integrity parameter
• dc51a2e feat: support SRI verification of link tags
• 6a54b1c feat: support SRI verification of script tags
• 5e71cf5 chore(release): 6.3.20 [skip ci]
• e17698f fix: prefer IPv4 addresses when resolving domains
• 60f4f79 build: add Node 16 and 18 to the CI matrix
• 6ff5aaf chore(release): 6.3.19 [skip ci]
• Additional commits viewable in compare view

Updates karma-phantomjs-launcher from 0.2.3 to 1.0.4

Changelog

Sourced from karma-phantomjs-launcher's changelog.

1.0.4 (2017-03-10)

Bug Fixes

• windows pathing (895fb860, closes #167)

1.0.3 (2017-03-10)

Bug Fixes

• path issue with phantomjs and phantomjs-prebuilt (482eba50)

1.0.2 (2016-08-31)

Bug Fixes

• incorrect phantomjs path calculation (faa7474e)

1.0.1 (2016-06-23)

Bug Fixes

• version-reset: set version back to 1.0 (9b0f5e34)

1.0.0 (2016-01-28)

Bug Fixes

• replace deprecated nvm version identifier with the proper one (9f9e0e2d)
• test on Node v4 instead of ancient v0.4 (ad1aad5f)
• use phantomjs-prebuilt instead of deprecated phantomjs (5844941a)

Commits

• eb0ca03 chore: release v1.0.4
• 895fb86 fix: windows pathing
• 00c3321 chore: release v1.0.3
• c342607 chore: update contributors
• db7ebc3 chore: add yarn.lock
• fe013cd Merge pull request #131 from leightarasenko/master
• 482eba5 fix: path issue with phantomjs and phantomjs-prebuilt
• 9c56c0f chore: release v1.0.2
• 5938221 chore: update contributors
• fb11f35 Merge pull request #127 from enterit/binary-path-fix
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.