Bump js-yaml, postcss-loader, webpack-serve and eslint - #77
Bump js-yaml, postcss-loader, webpack-serve and eslint#77dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 4.3.0 and updates ancestor dependencies [js-yaml](https://github.com/nodeca/js-yaml), [postcss-loader](https://github.com/webpack/postcss-loader), [webpack-serve](https://github.com/shellscape/webpack-serve) and [eslint](https://github.com/eslint/eslint). These dependencies need to be updated together. Updates `js-yaml` from 3.14.0 to 4.3.0 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.0...4.3.0) Updates `postcss-loader` from 3.0.0 to 8.2.1 - [Release notes](https://github.com/webpack/postcss-loader/releases) - [Changelog](https://github.com/webpack/postcss-loader/blob/main/CHANGELOG.md) - [Commits](webpack/postcss-loader@v3.0.0...v8.2.1) Updates `webpack-serve` from 0.3.2 to 4.0.0 - [Release notes](https://github.com/shellscape/webpack-serve/releases) - [Commits](shellscape/webpack-serve@v0.3.2...v4.0.0) Updates `eslint` from 4.19.1 to 10.6.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v4.19.1...v10.6.0) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.0 dependency-type: indirect - dependency-name: postcss-loader dependency-version: 8.2.1 dependency-type: direct:production - dependency-name: webpack-serve dependency-version: 4.0.0 dependency-type: direct:production - dependency-name: eslint dependency-version: 10.6.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrep-code-auth0-extensions-1[bot]](https://avatars.githubusercontent.com/in/1194156?s=60&v=4){kind=small}
| "version": "1.1.1", | ||
| "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz", | ||
| "integrity": "sha1-WQxhFWsK4vTwJVcyoViyZrxWsh0=" | ||
| }, | ||
| "ejs": { | ||
| "node_modules/ejs": { |
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 3605 lists a dependency (ejs) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of ejs are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') / Protection Mechanism Failure. ejs before 3.1.10 lacks prototype-pollution protection when handling template options, so a polluted Object.prototype can inject options such as client and escapeFunction into the template compiler and reach arbitrary-code paths. Any code that compiles or renders a template through render, renderFile, compile, or the Template constructor exercises the vulnerable options handling.
To resolve this comment:
Check if you are using ejs on the CLI.
- If you're affected, upgrade this dependency to at least version 3.1.10 at package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| "pako": "~1.0.5" | ||
| } | ||
| }, | ||
| "browserslist": { | ||
| "node_modules/browserslist": { |
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 2442 lists a dependency (browserslist) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of browserslist are vulnerable to Inefficient Regular Expression Complexity / Uncontrolled Resource Consumption. Calling the browserslist() query parser on a crafted query string triggers catastrophic regular-expression backtracking (ReDoS), allowing an attacker to consume excessive CPU and deny service.
To resolve this comment:
Check if you are using browserslist on the CLI.
- If you're affected, upgrade this dependency to at least version 4.16.5 at package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| "node": ">=6" | ||
| } | ||
| }, | ||
| "node_modules/webpack-dev-server": { |
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 11147 lists a dependency (webpack-dev-server) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of webpack-dev-server are vulnerable to Exposed Dangerous Method or Function. webpack-dev-server serves bundled assets without rejecting cross-origin classic script requests. Because such <script src> requests bypass the same-origin policy, a malicious website visited by a developer running the dev server can load the application bundle cross-origin and, via prototype pollution of the webpack runtime, extract the application source code.
To resolve this comment:
Check if you are using webpack dev server CLI setup.
- If you're affected, upgrade this dependency to at least version 5.2.1 at package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| "node": ">=6" | ||
| } | ||
| }, | ||
| "node_modules/webpack-dev-server": { |
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 11147 lists a dependency (webpack-dev-server) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of webpack-dev-server are vulnerable to Origin Validation Error. webpack-dev-server improperly validates the WebSocket connection Origin header, unconditionally accepting any IP-address-based Origin. A malicious website can perform a cross-site WebSocket hijack against a running dev server and exfiltrate the developer source code carried in Hot Module Reloading (HMR) messages. The insecure origin check is the package default and is reached on every WebSocket connection, so any project running an affected version is vulnerable.
To resolve this comment:
Check if you are using webpack dev server CLI setup and access untrusted web site with non-Chromium based browser.
- If you're affected, upgrade this dependency to at least version 5.2.1 at package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| } | ||
| }, | ||
| "terser": { | ||
| "node_modules/terser": { |
There was a problem hiding this comment.
High severity vulnerability introduced by a package you're using:
Line 10038 lists a dependency (terser) with a known High severity vulnerability. Fixing requires upgrading or replacing the dependency.
ℹ️ Why this matters
terser versions before 4.8.1, >= 5.0.0 before 5.14.2 are vulnerable to Inefficient Regular Expression Complexity.
To resolve this comment:
Upgrade this dependency to at least version 4.8.1 at package-lock.json.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| }, | ||
| "get-func-name": { | ||
| "node_modules/get-func-name": { |
There was a problem hiding this comment.
High severity vulnerability introduced by a package you're using:
Line 5180 lists a dependency (get-func-name) with a known High severity vulnerability. Fixing requires upgrading or replacing the dependency.
ℹ️ Why this matters
Affected version of get-func-name is vulnerable to Uncontrolled Resource Consumption / Inefficient Regular Expression Complexity. The current regex implementation for parsing values in the module is susceptible to excessive backtracking, leading to potential DoS attacks.
To resolve this comment:
Upgrade this dependency to at least version 2.0.1 at package-lock.json.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.2.tgz", | ||
| "integrity": "sha512-S/TQAZJO+D3m9xeN1WTI8dLKBBiRgXBlTJvbWjCThHWZj9EvHK70Ff50/tYj2J/fvBY6JtFVwRuazHN2E7M9BA==" | ||
| }, | ||
| "node_modules/@babel/preset-env": { |
There was a problem hiding this comment.
Critical severity vulnerability may affect your project—review required:
Line 1081 lists a dependency (@babel/preset-env) with a known Critical severity vulnerability.
ℹ️ Why this matters
Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation.
To resolve this comment:
Check if you use Babel to compile untrusted JavaScript.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| } | ||
| }, | ||
| "@babel/plugin-transform-runtime": { | ||
| "node_modules/@babel/plugin-transform-runtime": { |
There was a problem hiding this comment.
Critical severity vulnerability may affect your project—review required:
Line 968 lists a dependency (@babel/plugin-transform-runtime) with a known Critical severity vulnerability.
ℹ️ Why this matters
Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation.
To resolve this comment:
Check if you use Babel to compile untrusted JavaScript.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| "@babel/code-frame": "^7.0.0", | ||
| "@babel/parser": "^7.4.0", | ||
| "@babel/types": "^7.4.0" | ||
| } | ||
| }, | ||
| "@babel/traverse": { | ||
| "node_modules/@babel/traverse": { |
There was a problem hiding this comment.
Critical severity vulnerability may affect your project—review required:
Line 1218 lists a dependency (@babel/traverse) with a known Critical severity vulnerability.
ℹ️ Why this matters
Affected versions of @babel/traverse and babel-traverse are vulnerable to Incomplete List of Disallowed Inputs / Incorrect Comparison. Compiling untrusted code with Babel using plugins that invoke the internal path.evaluate() or path.evaluateTruthy() methods (for example @babel/plugin-transform-runtime, @babel/preset-env with useBuiltIns, or any polyfill‐provider plugin) allows a maliciously crafted AST to execute arbitrary code on the build machine during compilation.
To resolve this comment:
Check if you use Babel to compile untrusted JavaScript.
- If you're affected, upgrade this dependency to at least version 7.23.2 at package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
|
Superseded by #81. |
Bumps js-yaml to 4.3.0 and updates ancestor dependencies js-yaml, postcss-loader, webpack-serve and eslint. These dependencies need to be updated together.
Updates
js-yamlfrom 3.14.0 to 4.3.0Changelog
Sourced from js-yaml's changelog.
... (truncated)
Commits
33d05b54.3.0 released663bfabDrop demo publish, to not override new v5 one.1cb8c7bAdd v4-legacy tag for publish02f27afRestore umd builds back to es58be84edFix es5 compatibility59423c6ReplacemaxMergeSeqLengthoption withmaxTotalMergeKeys(more robust). Ba...6842ef6doc polish590dbab4.2.0 releasedf944dc5Add package.json funding fieldf692719Changelog updateUpdates
postcss-loaderfrom 3.0.0 to 8.2.1Release notes
Sourced from postcss-loader's releases.
... (truncated)
Changelog
Sourced from postcss-loader's changelog.
... (truncated)
Commits
583677echore(release): 8.2.1a3ed7e2fix: update peer dependency for@rspack/corev2 (#717)c984ff4test: fix (#715)cc01d2bci: fixd4faa34docs: update contributingb1e4fa5chore: correct link (#713)d990168chore: migration to main org and branch (#712)522a07dchore(release): 8.2.09c74974feat: updatejitifrom v1 to v25a781e5chore: update github actions/checkout from v4 to v5 (#709)Maintainer changes
This version was pushed to npm by evilebottnawi, a new releaser for postcss-loader since your current version.
Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.Updates
webpack-servefrom 0.3.2 to 4.0.0Release notes
Sourced from webpack-serve's releases.
Commits
db1f0abchore(release): 4.0.0597dd31chore: update dependencies, test snapshots. credt:@jdavis-software#15287aac5chore(dev): npm audit fix26ea537chore(release): 3.2.0e29f861chore: update dependenciesfe46696chore: update funding.ymld0c47fdchore(release): 3.1.1b11a999chore: update dependencies, npm audit fixb60e028chore: adding funding.ymla8bec26chore(deps): audit fix (#8)Updates
eslintfrom 4.19.1 to 10.6.0Release notes
Sourced from eslint's releases.
... (truncated)
Commits
5d12a0410.6.0f7ca54bBuild: changelog update for 10.6.06a42034ci: run ecosystem tests on main branch (#20891)b1f9106feat: detect Symbol() and BigInt() in no-constant-binary-expression (#20981)3dbacdbci: bump actions/checkout from 6 to 7 (#21014)c3abfcachore: correct JSDoc param types in html formatter (#21018)a83683ddocs: Update READMEa832320ci: split ecosystem tests into separate jobs (#21001)6b05784fix: prefer-exponentiation-operator invalid autofix at statement start (#20997)bb9eb2afix: account for shadowedBooleaninno-extra-boolean-cast(#21013)Maintainer changes
This version was pushed to npm by eslintbot, a new releaser for eslint since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.