[PR #1] [MERGED] Bump file-type and music-metadata #73

New issue

Closed

opened 2026-02-27 10:24:06 +03:00 by kerem · 0 comments

kerem commented

2026-02-27 10:24:06 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/mimamch/wa-gateway/pull/1
Author: @dependabot[bot]
Created: 2/22/2023
Status: ✅ Merged
Merged: 2/22/2023
Merged by: @mimamch

Base: master ← Head: dependabot/npm_and_yarn/file-type-and-music-metadata-16.5.4

📝 Commits (1)

adc811c Bump file-type and music-metadata

📊 Changes

1 file changed (+22 additions, -22 deletions)

View changed files

📝 package-lock.json (+22 -22)

📄 Description

Bumps file-type and music-metadata. These dependencies needed to be updated together.
Updates file-type from 16.5.3 to 16.5.4

Release notes

Sourced from file-type's releases.

v16.5.4

Fix: Malformed MKV could cause an infinite loop https://github.com/sindresorhus/file-type/commit/d86835680f4cccbee1a60628783c36700ec9e254

CVE-2022-36313

Also fixed in 17.1.3

Commits

b5fe3b9 16.5.4
d868356 Fix: Malformed MKV could cause an infinite loop
See full diff in compare view

Updates music-metadata from 7.12.3 to 7.13.3

Release notes

Sourced from music-metadata's releases.

v7.13.3

Changes

🚀 Enhancements

Ability to handle MP4 meta atom without 4 bytes padding @Borewit (#1484)

NPM release

NPM release: music-metadata@7.13.3

v7.13.2

Changes

🐛 Bug Fixes

Fix bitrate (format.bitrate) for WAV files @avwie (#1481)

NPM release

NPM release: music-metadata@7.13.2

v7.13.1

Changes

Added missing 'await' to docs for parseBuffer @motabass (#1439)

🐛 Bug Fixes

Handle Matroska file without duration @Borewit (#1472)

NPM release

NPM release: music-metadata@7.13.1

v7.13.0

Changes:

Add AIFF text-chunk support for CommonJS branch #1293

Simplify handling FourCC 6569cabdd77f1a5df0a57b75945d2704f83a57bc

NPM: music-metadata@7.13.0

v7.12.6

Changes:

Fix parsing uncompressed AIFF-C audio file #1212

NPM: music-metadata@7.12.6

v7.12.5

Changes:

Security upgrade file-type from 16.5.3 to 16.5.4 #1194, resolves CVE-2022-36313 in file-type dependency

NPM: music-metadata@7.12.5

... (truncated)

Commits

7d6bfff 7.13.3
a59e19a Ability to handle MP4 meta atom without 4 bytes padding
a1c4478 Map badge icons to commonjs branch
59b8811 Fix code style
0608b91 Fix CJS style imports
b023b8a 7.13.2
6aa9b84 Bitrate fix for WAV files
e7c661b 7.13.1
327a8c4 Handle Matroska file without duration
58e8cc0 Add action to assign label "dev-dependencies" to Dependabot PR's
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/mimamch/wa-gateway/pull/1 **Author:** [@dependabot[bot]](https://github.com/apps/dependabot) **Created:** 2/22/2023 **Status:** ✅ Merged **Merged:** 2/22/2023 **Merged by:** [@mimamch](https://github.com/mimamch) **Base:** `master` ← **Head:** `dependabot/npm_and_yarn/file-type-and-music-metadata-16.5.4` --- ### 📝 Commits (1) - [`adc811c`](https://github.com/mimamch/wa-gateway/commit/adc811cb3b94c85c6dd08be1e6691a93a41327f5) Bump file-type and music-metadata ### 📊 Changes **1 file changed** (+22 additions, -22 deletions) <details> <summary>View changed files</summary> 📝 `package-lock.json` (+22 -22) </details> ### 📄 Description Bumps [file-type](https://github.com/sindresorhus/file-type) and [music-metadata](https://github.com/borewit/music-metadata). These dependencies needed to be updated together. Updates `file-type` from 16.5.3 to 16.5.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sindresorhus/file-type/releases">file-type's releases</a>.</em></p> <blockquote> <h2>v16.5.4</h2> <ul> <li>Fix: Malformed MKV could cause an infinite loop <a href="https://github.com/sindresorhus/file-type/commit/d86835680f4cccbee1a60628783c36700ec9e254">https://github.com/sindresorhus/file-type/commit/d86835680f4cccbee1a60628783c36700ec9e254</a> <ul> <li><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36313">CVE-2022-36313</a></li> <li>Also fixed in <a href="https://github.com/sindresorhus/file-type/releases/tag/v17.1.3">17.1.3</a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sindresorhus/file-type/commit/b5fe3b9596711a42c0141d97a11e4f0fa5fcc7a0"><code>b5fe3b9</code></a> 16.5.4</li> <li><a href="https://github.com/sindresorhus/file-type/commit/d86835680f4cccbee1a60628783c36700ec9e254"><code>d868356</code></a> Fix: Malformed MKV could cause an infinite loop</li> <li>See full diff in <a href="https://github.com/sindresorhus/file-type/compare/v16.5.3...v16.5.4">compare view</a></li> </ul> </details> <br /> Updates `music-metadata` from 7.12.3 to 7.13.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/borewit/music-metadata/releases">music-metadata's releases</a>.</em></p> <blockquote> <h2>v7.13.3</h2> <h2>Changes</h2> <h2>:rocket: Enhancements</h2> <ul> <li>Ability to handle MP4 <code>meta</code> atom without 4 bytes padding <a href="https://github.com/Borewit"><code>@Borewit</code></a> (<a href="https://github-redirect.dependabot.com/borewit/music-metadata/issues/1484">#1484</a>)</li> </ul> <h2>NPM release</h2> <p>NPM release: <a href="https://www.npmjs.com/package/music-metadata/v/7.13.3">music-metadata@7.13.3</a></p> <h2>v7.13.2</h2> <h2>Changes</h2> <h2>:bug: Bug Fixes</h2> <ul> <li>Fix bitrate (<code>format.bitrate</code>) for WAV files <a href="https://github.com/avwie"><code>@avwie</code></a> (<a href="https://github-redirect.dependabot.com/borewit/music-metadata/issues/1481">#1481</a>)</li> </ul> <h2>NPM release</h2> <p>NPM release: <a href="https://www.npmjs.com/package/music-metadata/v/7.13.2">music-metadata@7.13.2</a></p> <h2>v7.13.1</h2> <h2>Changes</h2> <ul> <li>Added missing 'await' to docs for parseBuffer <a href="https://github.com/motabass"><code>@motabass</code></a> (<a href="https://github-redirect.dependabot.com/borewit/music-metadata/issues/1439">#1439</a>)</li> </ul> <h2>:bug: Bug Fixes</h2> <ul> <li>Handle Matroska file without duration <a href="https://github.com/Borewit"><code>@Borewit</code></a> (<a href="https://github-redirect.dependabot.com/borewit/music-metadata/issues/1472">#1472</a>)</li> </ul> <h2>NPM release</h2> <p>NPM release: <a href="https://www.npmjs.com/package/music-metadata/v/7.13.1">music-metadata@7.13.1</a></p> <h2>v7.13.0</h2> <p>Changes:</p> <ul> <li>Add AIFF text-chunk support for CommonJS branch <a href="https://github-redirect.dependabot.com/borewit/music-metadata/issues/1293">#1293</a></li> <li>Simplify handling FourCC 6569cabdd77f1a5df0a57b75945d2704f83a57bc</li> </ul> <p>NPM: <a href="https://www.npmjs.com/package/music-metadata/v/7.13.0">music-metadata@7.13.0</a></p> <h2>v7.12.6</h2> <p>Changes:</p> <ul> <li>Fix parsing uncompressed AIFF-C audio file <a href="https://github-redirect.dependabot.com/borewit/music-metadata/issues/1212">#1212</a></li> </ul> <p>NPM: <a href="https://www.npmjs.com/package/music-metadata/v/7.12.6">music-metadata@7.12.6</a></p> <h2>v7.12.5</h2> <p>Changes:</p> <ul> <li>Security upgrade file-type from 16.5.3 to 16.5.4 <a href="https://github-redirect.dependabot.com/borewit/music-metadata/issues/1194">#1194</a>, resolves <a href="https://www.cve.org/CVERecord?id=CVE-2022-36313">CVE-2022-36313</a> in file-type dependency</li> </ul> <p>NPM: <a href="https://www.npmjs.com/package/music-metadata/v/7.12.5">music-metadata@7.12.5</a></p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Borewit/music-metadata/commit/7d6bfffa796d31d51de95cf0da85e14f82d9f769"><code>7d6bfff</code></a> 7.13.3</li> <li><a href="https://github.com/Borewit/music-metadata/commit/a59e19aaa3f266da7c9650d4a4c0038fb35d5cbf"><code>a59e19a</code></a> Ability to handle MP4 <code>meta</code> atom without 4 bytes padding</li> <li><a href="https://github.com/Borewit/music-metadata/commit/a1c447859e2c8ac26224a7d891d3d820577cfe7b"><code>a1c4478</code></a> Map badge icons to commonjs branch</li> <li><a href="https://github.com/Borewit/music-metadata/commit/59b8811ce206d45c565d669e720c082520ddd870"><code>59b8811</code></a> Fix code style</li> <li><a href="https://github.com/Borewit/music-metadata/commit/0608b919eb6f2b515d9e35a497c124026df0de94"><code>0608b91</code></a> Fix CJS style imports</li> <li><a href="https://github.com/Borewit/music-metadata/commit/b023b8a5dcb3bff7912fd8b936e7d5bb954c2c42"><code>b023b8a</code></a> 7.13.2</li> <li><a href="https://github.com/Borewit/music-metadata/commit/6aa9b849c816cea45bc329ee067d1c0c159f7b84"><code>6aa9b84</code></a> Bitrate fix for WAV files</li> <li><a href="https://github.com/Borewit/music-metadata/commit/e7c661b3b0b778cc28c55972523543302ba4670e"><code>e7c661b</code></a> 7.13.1</li> <li><a href="https://github.com/Borewit/music-metadata/commit/327a8c4df6696b762538607c6e8c44f990127511"><code>327a8c4</code></a> Handle Matroska file without duration</li> <li><a href="https://github.com/Borewit/music-metadata/commit/58e8cc04de39ce3701572a10f17652b608a806f8"><code>58e8cc0</code></a> Add action to assign label "dev-dependencies" to Dependabot PR's</li> <li>Additional commits viewable in <a href="https://github.com/borewit/music-metadata/compare/v7.12.3...v7.13.3">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/mimamch/wa-gateway/network/alerts). </details> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>