fix(deps): update github vulnerability alerts [security] #227
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
Size Change: 0 B Total Size: 142 kB ℹ️ View Unchanged
|
QA Test EnvironmentVictorWinberg-OneList--renovate-all-minor-patch Environment has been created! deploy 2024-10-01 00:03 redeploy 2024-10-01 17:04 |
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
5 times, most recently
from
2e1c28d to
553e9a1
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
58d37f3 to
b1b2757
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
4 times, most recently
from
1fa35bf to
9c7dffa
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
3 times, most recently
from
7351ec6 to
acee056
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
aa76d5e to
d4317dc
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
1db38c3 to
c5f753a
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
6 times, most recently
from
0318352 to
3311e17
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
2 times, most recently
from
c9b0b5e to
4163ede
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
21 times, most recently
from
22ffbe6 to
4a4b60b
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
7 times, most recently
from
7680740 to
0c5a8bb
Compare
renovate
bot
force-pushed
the
renovate/all-minor-patch
branch
from
0c5a8bb to
84772ae
Compare
This PR contains the following updates:
1.20.2->1.20.31.4.6->1.4.716.4.5->16.4.72.29.1->2.31.06.9.0->6.10.27.34.3->7.37.34.19.2->4.20.02.0.6->2.0.78.12.0->8.13.11.5.4->1.5.5GitHub Vulnerability Alerts
CVE-2024-45590
Impact
body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.
Patches
this issue is patched in 1.20.3
References
CVE-2024-43796
Impact
In express <4.20.0, passing untrusted user input - even after sanitizing it - to
response.redirect()may execute untrusted codePatches
this issue is patched in express 4.20.0
Workarounds
users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist
Details
successful exploitation of this vector requires the following:
Release Notes
expressjs/body-parser (body-parser)
v1.20.3Compare Source
===================
depthoption to customize the depth level in the parserdepthlevel for parsing URL-encoded data is now32(previously wasInfinity)expressjs/cookie-parser (cookie-parser)
v1.4.7Compare Source
==========
hasOwnPropertyserializewithout options, useobj.hasOwnPropertywhen parsingmaintopackage.jsonfor rspackpartitionedoptionpriorityoptionexpiresoption to reject invalid datesmotdotla/dotenv (dotenv)
v16.4.7Compare Source
Changed
.tapfolder when publishing. (oops, sorry about that everyone. - @motdotla) #848v16.4.6Compare Source
Changed
import-js/eslint-plugin-import (eslint-plugin-import)
v2.31.0Compare Source
Added
order]: allow validating named imports ([#3043], thanks [@manuth])extensions]: add thecheckTypeImportsoption ([#2817], thanks [@phryneas])Fixed
ExportMap/ flat config: includelanguageOptionsin context ([#3052], thanks [@michaelfaith])no-named-as-default]: Allow using an identifier if the export is both a named and a default export ([#3032], thanks [@akwodkiewicz])export]: False positive for exported overloaded functions in TS ([#3065], thanks [@liuxingbaoyu])exportMap: export map cache is tainted by unreliable parse results ([#3062], thanks [@michaelfaith])exportMap: improve cacheKey when using flat config ([#3072], thanks [@michaelfaith])Changed
no-relative-packages]: fix typo ([#3066], thanks [@joshuaobrien])no-cycle]: dont scc for each linted file ([#3068], thanks [@soryy708])no-cycle]: adddisableSccto docs ([#3070], thanks [@soryy708])RuleTester([#3071], thanks [@G-Rath])no-restricted-paths]: fix grammar ([#3073], thanks [@unbeauvoyage])no-default-export], [no-named-export]: add test case (thanks [@G-Rath])v2.30.0Compare Source
Added
dynamic-import-chunkname]: addallowEmptyoption to allow empty leading comments ([#2942], thanks [@JiangWeixian])dynamic-import-chunkname]: Allow empty chunk name when webpackMode: 'eager' is set; add suggestions to remove name in eager mode ([#3004], thanks [@amsardesai])no-unused-modules]: AddignoreUnusedTypeExportsoption ([#3011], thanks [@silverwind])Fixed
no-extraneous-dependencies]: allow wrong path ([#3012], thanks [@chabb])no-cycle]: use scc algorithm to optimize ([#2998], thanks [@soryy708])no-duplicates]: Removing duplicates breaks in TypeScript ([#3033], thanks [@yesl-kim])newline-after-import]: fix considerComments option when require ([#2952], thanks [@developer-bandi])order]: do not compare first path segment for relative paths ([#2682]) ([#2885], thanks [@mihkeleidast])Changed
no-extraneous-dependencies: Make glob pattern description more explicit ([#2944], thanks [@mulztob])no-unused-modules]: add console message to help debug [#2866]ExportMap: make procedures static instead of monkeypatching exportmap ([#2982], thanks [@soryy708])ExportMap: separate ExportMap instance from its builder logic ([#2985], thanks [@soryy708])order: Add a quick note on how unbound imports and --fix ([#2640], thanks [@minervabot])exportMapBuilder: avoid hoisting ([#2989], thanks [@soryy708])ExportMap: extract "builder" logic to separate files ([#2991], thanks [@soryy708])order]: update the description of thepathGroupsExcludedImportTypesoption ([#3036], thanks [@liby])jsx-eslint/eslint-plugin-jsx-a11y (eslint-plugin-jsx-a11y)
v6.10.2Compare Source
Fixed
no-redundandant-roles: allow<img src="*.svg" role="img" />#936Commits
0d01a1aes-iterator-helpersaa075bdd15d3ab@babel/cli,@babel/core,@babel/eslint-parser,@babel/plugin-transform-flow-strip-types,@babel/register5dad7c4aria-role: Add valid test for<svg role="img" />daba189label-has-associated-control: add line breaks for readability0bc6378label-has-associated-control: add additional test cases30d2318d92446cv6.10.1Compare Source
Commits
4925ba8cb6788c@babel/cli,@babel/core,@babel/eslint-parser,@babel/plugin-transform-flow-strip-types,@babel/register,auto-changelog,eslint-plugin-import,tape518a77ees-iterator-helpers,string.prototype.includeseed03a32ee940ca262131aria-querye517937v6.10.0Compare Source
Fixed
label-has-associated-control: add additional error message#1005label-has-associated-control: ignore undetermined label text#966Commits
a284cbfdeac4fdattributessettinga1ee7f86cd1a7074d5dec@babel/cli,@babel/core,@babel/eslint-parser,@babel/plugin-transform-flow-strip-types6eca2350be7ea9npm auditinstead ofaud05a5e49axobject-query912e98caxobject-query75147aaaxe-core27ff7cbce846e0cca288bjsx-eslint/eslint-plugin-react (eslint-plugin-react)
v7.37.3Compare Source
Fixed
no-danger][no-danger]: avoid a crash on a nested component name ([#3833][] @ljharb)no-unknown-property][no-unknown-property]: supportprecedenceprop in react 19 ([#3829][] @acusti)prop-types][prop-types]: props missing in validation when using generic types from a namespace import ([#3859][] @rbondoc96)Changed
jsx-no-script-url][jsx-no-script-url]: Improve tests ([#3849][] @radu2147)default-props-match-prop-types][default-props-match-prop-types], [jsx-boolean-value][jsx-boolean-value], [jsx-curly-brace-presence][jsx-curly-brace-presence], [jsx-no-bind][jsx-no-bind], [no-array-index-key][no-array-index-key], [no-is-mounted][no-is-mounted], [no-render-return-value][no-render-return-value], [require-default-props][require-default-props] ([#3841][] @bastiendmt)Configuration
📅 Schedule: Branch creation - "every 3 months on the first day of the month" in timezone Europe/Stockholm, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.