chore(deps): update dependency log4js to 6.4.0 [security] - abandoned

[renovate]

This PR contains the following updates:

Package	Change
log4js	6.2.1 -> 6.4.0
log4js	4.0.2 -> 6.4.0

GitHub Vulnerability Alerts

CVE-2022-21704

Impact

Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config.

Patches

Fixed by:

• https://github.com/log4js-node/log4js-node/pull/1141
• https://github.com/log4js-node/streamroller/pull/87

Released to NPM in log4js@6.4.0

Workarounds

Every version of log4js published allows passing the mode parameter to the configuration of file appenders, see the documentation for details.

References

Thanks to ranjit-git for raising the issue, and to @​lamweili for fixing the problem.

For more information

If you have any questions or comments about this advisory:

• Open an issue in logj4s-node
• Ask a question in the slack channel
• Email us at gareth.nomiddlename@gmail.com

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: packages/tokens/package-lock.json

lerna notice cli v4.0.0
npm notice 
npm notice New major version of npm available! 8.19.4 -> 9.6.2
npm notice Changelog: <https://github.com/npm/cli/releases/tag/v9.6.2>
npm notice Run `npm install -g npm@9.6.2` to update!
npm notice 
lerna notice cli v4.0.0
lerna info Bootstrapping 3 packages
lerna info Installing external dependencies
lerna ERR! npm install --ignore-scripts --ignore-scripts --no-audit --package-lock-only exited 1 in '@multei/storybook'
lerna ERR! npm install --ignore-scripts --ignore-scripts --no-audit --package-lock-only stderr:
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: react-dom@16.14.0
npm ERR! Found: react@17.0.2
npm ERR! node_modules/react
npm ERR!   dev react@"17.0.2" from the root project
npm ERR!   peer react@">=16.3.0" from @emotion/core@10.1.1
npm ERR!   node_modules/@emotion/core
npm ERR!     peer @emotion/core@"^10.0.27" from @emotion/styled@10.0.27
npm ERR!     node_modules/@emotion/styled
npm ERR!       @emotion/styled@"^10.0.27" from @storybook/theming@6.3.8
npm ERR!       node_modules/@storybook/theming
npm ERR!         @storybook/theming@"6.3.8" from @storybook/addon-actions@6.3.8
npm ERR!         node_modules/@storybook/addon-actions
npm ERR!         6 more (@storybook/addons, @storybook/api, ...)
npm ERR!     peer @emotion/core@"^10.0.28" from @emotion/styled-base@10.0.31
npm ERR!     node_modules/@emotion/styled-base
npm ERR!       @emotion/styled-base@"^10.0.27" from @emotion/styled@10.0.27
npm ERR!       node_modules/@emotion/styled
npm ERR!         @emotion/styled@"^10.0.27" from @storybook/theming@6.3.8
npm ERR!         node_modules/@storybook/theming
npm ERR!     3 more (@storybook/theming, @storybook/ui, emotion-theming)
npm ERR!   32 more (@emotion/styled, @emotion/styled-base, ...)
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer react@"^16.14.0" from react-dom@16.14.0
npm ERR! node_modules/react-dom
npm ERR!   peerOptional react-dom@"^16.8.0 || ^17.0.0" from @storybook/addon-actions@6.3.8
npm ERR!   node_modules/@storybook/addon-actions
npm ERR!     dev @storybook/addon-actions@"6.3.8" from the root project
npm ERR!   peerOptional react-dom@"^16.8.0 || ^17.0.0" from @storybook/addon-links@6.3.8
npm ERR!   node_modules/@storybook/addon-links
npm ERR!     dev @storybook/addon-links@"6.3.8" from the root project
npm ERR!   20 more (@storybook/addons, @storybook/api, @reach/router, ...)
npm ERR! 
npm ERR! Conflicting peer dependency: react@16.14.0
npm ERR! node_modules/react
npm ERR!   peer react@"^16.14.0" from react-dom@16.14.0
npm ERR!   node_modules/react-dom
npm ERR!     peerOptional react-dom@"^16.8.0 || ^17.0.0" from @storybook/addon-actions@6.3.8
npm ERR!     node_modules/@storybook/addon-actions
npm ERR!       dev @storybook/addon-actions@"6.3.8" from the root project
npm ERR!     peerOptional react-dom@"^16.8.0 || ^17.0.0" from @storybook/addon-links@6.3.8
npm ERR!     node_modules/@storybook/addon-links
npm ERR!       dev @storybook/addon-links@"6.3.8" from the root project
npm ERR!     20 more (@storybook/addons, @storybook/api, @reach/router, ...)
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /tmp/renovate-cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate-cache/others/npm/_logs/2023-03-16T13_47_19_975Z-debug-0.log
lerna ERR! npm install --ignore-scripts --ignore-scripts --no-audit --package-lock-only exited 1 in '@multei/storybook'
lerna WARN complete Waiting for 1 child process to exit. CTRL-C to exit immediately.

[renovate]

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.