[Snyk] Upgrade sirv-cli from 1.0.11 to 1.0.14

[nejidevelops]

Snyk has created this PR to upgrade sirv-cli from 1.0.11 to 1.0.14.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 3 versions ahead of your current version.

• The recommended version was released 4 years ago.

Release notes

Package name: sirv-cli

• 1.0.14 - 2021-08-14
  

  Chores

  • (sirv): Bump @ polka/url to take advantage of this fix
• 1.0.13 - 2021-08-13
  

  Patches

  • (sirv) Only use req.path if has req._decoded flag exists (#82):

    The req._decoded check was added & should have always been in there, since this was sirv's way of preventing duplicate decodeURIComponent calls. However, this was only true when it received a request from a polka@next app, since Polka was previously writing the decoded value to req.path – this changed with polka@v1.0.0-next.16

    Now that the latest polka@next (and Express) doesn't decode automatically anymore, req.path isn't trustworthy on its own. It needs req._decoded to be there too in order to trust it.

    This combo-check is backwards compatible for polka@next users who don't upgrade and will unblock Express users for the first time, who have always had a "raw" req.path value set.

• 1.0.12 - 2021-05-24
  

  Patches

  • (sirv-cli): Ensure boolean options are parsed as booleans (#97): 8ebca7c
  • (sirv): Bump @ polka/url dependency version: 7c5162a

  Chores

  • Adjust GitHub Action env setup (#109): f2ae0f5
  • Update Github Action image(s) and Node versions: 9334dfc, cf2de81, c7e0a20
  • Add test for filename with space (#102): ede9189
    Thank you @ samccone!
• 1.0.11 - 2021-01-30
  

  Patches

  • (sirv) Add Vary header when gzip or brotli is in use (#95): 86e6733
    Thank you @ istarkov~!

from sirv-cli GitHub release notes

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[gemini-code-assist]

Summary of Changes

Hello @nejidevelops, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request automates the upgrade of the sirv-cli dependency to its latest version, 1.0.14. This update is crucial for maintaining the project's security posture and stability by integrating recent bug fixes and dependency updates from the sirv-cli ecosystem. It ensures that the project benefits from improved URL handling, correct parsing of boolean options, and updated internal libraries, contributing to a more robust and secure application environment.

Highlights

• Dependency Upgrade: The sirv-cli package has been upgraded from version 1.0.11 to 1.0.14 to incorporate the latest fixes and improvements.
• Polka URL Handling Fix: Version 1.0.13 of sirv-cli (via its sirv dependency) includes a critical fix for handling req.path when polka no longer decodes URLs automatically, ensuring compatibility with polka@next and Express applications.
• Boolean Option Parsing: Version 1.0.12 of sirv-cli addresses an issue where boolean options were not correctly parsed, improving the reliability of command-line arguments.
• Internal Dependency Updates: The upgrade also includes updates to internal dependencies such as @polka/url (from 1.0.0-next.11 to 1.0.0-next.29) and replaces mime with mrmime for improved MIME type handling within the sirv package.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• svelte-app/package-lock.json
  • Updated sirv-cli from 1.0.11 to 1.0.14.
  • Updated sirv (a dependency of sirv-cli) from 1.0.11 to 1.0.19.
  • Updated @polka/url (a dependency of sirv) from 1.0.0-next.11 to 1.0.0-next.29.
  • Removed mime dependency and introduced mrmime version 1.0.1.
  • Added name: "svelte-app" entry to the root package definition.
• svelte-app/package.json
  • Updated sirv-cli dependency from ^1.0.11 to ^1.0.14.

Activity

• This pull request was automatically generated by Snyk to upgrade the sirv-cli dependency.
• The PR description includes detailed release notes for sirv-cli versions 1.0.12, 1.0.13, and 1.0.14, outlining the changes and fixes introduced in each version.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request, automatically generated by Snyk, upgrades sirv-cli from 1.0.11 to 1.0.14. This is a patch update that includes several bug fixes, including one for parsing boolean CLI options which is relevant to your start script.

While the change is correct, I've suggested a further upgrade to the latest major version of sirv-cli (2.0.2) for better performance and more recent updates. Please see the specific comment for details on the required changes if you choose to proceed with that.

[gemini-code-assist]

While this upgrade to 1.0.14 is good, this version is from August 2021. I recommend upgrading to the latest major version, 2.0.2, which was released in February 2022. This will give you a smaller, faster sirv-cli with the latest fixes.

sirv-cli@2.x has some breaking changes. Notably, the --dev flag is removed and is now the default behavior. If you upgrade, you'll need to remove this flag from your serve function in rollup.config.js.

Here's what you'd need to do:

1. Accept the code suggestion below.
2. Run npm install to update package-lock.json.
3. In svelte-app/rollup.config.js, modify the serve function to remove the --dev argument:

// svelte-app/rollup.config.js:80
server = require('child_process').spawn('npm', ['run', 'start', '--'], {
  stdio: ['ignore', 'inherit', 'inherit'],
  shell: true
});

Suggested change

	"sirv-cli": "^1.0.14",
	"sirv-cli": "^2.0.2",