This is a backport of the minor ReDos vulnerability in ansi-regex@<6.0.1, as requested in #38.
Fix ReDoS in certain cases (#37)
You are only really affected if you run the regex on untrusted user input in a server context, which it's very unlikely anyone is doing, since this regex is mainly used in command-line tools.
This is a backport of the minor ReDos vulnerability in ansi-regex@<6.0.1, as requested in #38.
Fix ReDoS in certain cases (#37)
You are only really affected if you run the regex on untrusted user input in a server context, which it's very unlikely anyone is doing, since this regex is mainly used in command-line tools.
This package now requires Node.js 12 or higher. For more, please read Sindre Sorhus’s FAQ.
v2.0.0
This release adopts ES2015 language features such as for-of and drops support for older browsers, including IE. If you need to support pre-ES2015 environments, you should stick with d3-color 1.x or use a transpiler.
BarChart: support percentage (of chart) for barSize. Helps set size of bar when there are few datapoints Fixes #3640 by @graup in recharts/recharts#4407
A recent release of @types/react broke some builds because they removed certain (unused) events from common event handler attributes. recharts was unknowingly enumerating keys of SVGProps in the Layer component with the old types and causing a type error on tsc with skipLibCheck: false
typescript - Layer: use SVGAttributes instead of SVGProps in forwardRef components by @ckifer in recharts/recharts#4413
typescript - Pie: fix Pie ref which was cast to HTMLElement when the ref is actually referring to SVGGElement. This gave false information to whoever is using ref on the Pie component
RFC 3447 and RFC 8017 allow for optional DigestAlgorithmNULL parameters
for sha* algorithms and require NULL paramters for md2 and md5
algorithms.
1.3.0 - 2022-03-17
Security
Three RSA PKCS#1 v1.5 signature verification issues were reported by Moosa
Yahyazadeh (moosa-yahyazadeh@uiowa.edu).
HIGH: Leniency in checking digestAlgorithm structure can lead to
signature forgery.
The code is lenient in checking the digest algorithm structure. This can
allow a crafted structure that steals padding bytes and uses unchecked
portion of the PKCS#1 encoded message to forge a signature when a low
public exponent is being used. For more information, please see
"Bleichenbacher's RSA signature forgery based on implementation
error"
by Hal Finney.
HIGH: Failing to check tailing garbage bytes can lead to signature
forgery.
The code does not check for tailing garbage bytes after decoding a
DigestInfo ASN.1 structure. This can allow padding bytes to be removed
and garbage data added to forge a signature when a low public exponent is
being used. For more information, please see "Bleichenbacher's RSA
signature forgery based on implementation
error"
by Hal Finney.
DigestInfo is not properly checked for proper ASN.1 structure. This can
lead to successful verification with signatures that contain invalid
structures but a valid digest.
[asn1] Add fallback to pretty print invalid UTF8 data.
[asn1] fromDer is now more strict and will default to ensuring all input
bytes are parsed or throw an error. A new option parseAllBytes can disable
this behavior.
NOTE: The previous behavior is being changed since it can lead to
security issues with crafted inputs. It is possible that code doing custom
DER parsing may need to adapt to this new behavior and optional flag.
[rsa] Add and use a validator to check for proper structure of parsed ASN.1
Bumps the npm_and_yarn group with 12 updates in the / directory:
5.0.05.0.14.1.05.0.14.2.14.2.31.4.13.1.03.3.04.0.22.0.03.1.02.0.03.0.11.8.62.12.74.18.24.19.21.15.21.15.60.10.01.3.13.11.35.0.41.0.61.0.7Updates
ansi-regexfrom 5.0.0 to 5.0.1Release notes
Sourced from ansi-regex's releases.
Commits
a9babce5.0.14657833fix incorrect formatc3c0b3fFix potential ReDoS (#37)178363bMove to GitHub Actions (#35)0755e66Add@Qix- to funding.ymlUpdates
ansi-regexfrom 4.1.0 to 5.0.1Release notes
Sourced from ansi-regex's releases.
Commits
a9babce5.0.14657833fix incorrect formatc3c0b3fFix potential ReDoS (#37)178363bMove to GitHub Actions (#35)0755e66Add@Qix- to funding.ymlUpdates
browserify-signfrom 4.2.1 to 4.2.3Changelog
Sourced from browserify-sign's changelog.
Commits
bf2c3ecv4.2.39247adf[patch] widen support to 0.12f427270[Deps] update `parse-asn187f3a35[Dev Deps] updateaud,npmignore,tapefb261ce[Deps] updateelliptic4d0ee49[patch] drop minimum node support to v19e2bf12[Deps] pinhash-baseto ~3.0, due to a breaking change168e16f[Deps] pinellipticdue to a breaking change37a4758[actions] remove redundant finisher4af5a90v4.2.2Maintainer changes
This version was pushed to npm by ljharb, a new releaser for browserify-sign since your current version.
Updates
d3-colorfrom 1.4.1 to 3.1.0Release notes
Sourced from d3-color's releases.
Commits
7a1573e3.1.075c19c4update LICENSEef94e01update dependencies5e9f757method shorthande4bc34eformatHex8 (#103)ac660c6{rgb,hsl}.clamp() (#102)70e3a04clamp HSL format (#101)994d8fdavoid backtracking (#100)7d61bbe3.0.193bc4ffrelated d3/d33; extract copyrights from LICENSEUpdates
d3-scalefrom 3.3.0 to 4.0.2Release notes
Sourced from d3-scale's releases.
Commits
83555bd4.0.2cfc7d51update dependencies13491eedefault base 10 log ticks to ~s (#255)0561e754.0.1925dd3aupgrade dependenciesf0180a8simpler exact ticks9f745d0exact log ticks (#253)8fd6d25implicit trim for log ticks (#254)3281b77Update README.md (#252)07e8aacupdate READMEUpdates
d3-scale-chromaticfrom 2.0.0 to 3.1.0Release notes
Sourced from d3-scale-chromatic's releases.
Commits
2c52792update LICENSE0496bc43.1.081d50e2upgrade dependencies14c9b25Add schemeObservable10 (#51)109cfa3restructure README (#49)2aa3ad23.0.08fc14d0Adopt type=module (#37)Updates
d3-transitionfrom 2.0.0 to 3.0.1Release notes
Sourced from d3-transition's releases.
Commits
c4c94c43.0.1c7a42c6update dependenciescb1fc2dpush on prepublishOnly5caa287fix d3-selection peerDependency98e84f03.0.0aa44264Update README692f025fix #121; add transition.selectChild[ren]1ac7984Precise sideEffects. (#115)d1a518cAdopt type=module (#123)abe6511Merge pull request #122 from inokawa/patch-1Updates
rechartsfrom 1.8.6 to 2.12.7Release notes
Sourced from recharts's releases.
... (truncated)
Changelog
Sourced from recharts's changelog.
... (truncated)
Commits
2074e2e2.12.71e9e032fix: guard against accidental undefined access in Brush239b3aefix(area-dot): regressionon in parameters passed to custom area dot22064ed2.12.6504518dAdded js suffix to main module and jsnext:main paths in package json (#4431)a705024fix: The box size of the Tooltip is 0 at the first rendering of TooltipBoundi...bdad6ec2.12.5ed95633fix(layer-types): use SVGAttributes instead of SVGProps in forwardRef compone...3d2e8b9feat(BarChart): support percentage for barSize. Fixes #3640 (#4407)981eb8f2.12.4Updates
expressfrom 4.18.2 to 4.19.2Release notes
Sourced from express's releases.
... (truncated)
Changelog
Sourced from express's changelog.
Commits
04bc6274.19.2da4d763Improved fix for open redirect allow list bypass4f0f6cc4.19.1a003cfaAllow passing non-strings to res.location with new encoding handling checks f...a1fa90ffixed un-edited version in history.md for 4.19.011f2b1dbuild: fix build due to inconsistent supertest behavior in older versions084e3654.19.00867302Prevent open redirect allow list bypass due to encodeurl567c9c6Add note on how to update docs for new release (#5541)69a4cf2deps: cookie@0.6.0Maintainer changes
This version was pushed to npm by wesleytodd, a new releaser for express since your current version.
Updates
follow-redirectsfrom 1.15.2 to 1.15.6Commits
35a517cRelease version 1.15.6 of the npm package.c4f847fDrop Proxy-Authorization across hosts.8526b4aUse GitHub for disclosure.b1677ceRelease version 1.15.5 of the npm package.d8914f7Preserve fragment in responseUrl.6585820Release version 1.15.4 of the npm package.7a6567eDisallow bracketed hostnames.05629afPrefer native URL instead of deprecated url.parse.1cba8e8Prefer native URL instead of legacy url.resolve.72bc2a4Simplify _processResponse error handling.Updates
node-forgefrom 0.10.0 to 1.3.1Changelog
Sourced from node-forge's changelog.
... (truncated)
Commits
a0a4a42Release 1.3.1.a33830fUpdate changelog.740954dAllow optional DigestAlgorithm parameters.56f4316Allow DigestInfo.DigestAlgorith.parameters to be optionalcbf0bd5Start 1.3.1-0.6c5b901Release 1.3.0.0f3972aUpdate changelog.dc77b39Fix error checking.bb822c0Add advisory links.d4395feUpdate changelog.Updates
webpack-dev-serverfrom 3.11.3 to 5.0.4Release notes
Sourced from webpack-dev-server's releases.
... (truncated)
Changelog
Sourced from webpack-dev-server's changelog.
... (truncated)
Commits
64a1860chore(release): 5.0.4aab576afix(security): bump webpack-dev-middleware (#5112)fb6f22achore(deps-dev): bump@commitlint/config-conventional(#5104)ba9dfb6chore(deps-dev): bump@commitlint/clifrom 19.0.3 to 19.1.0 (#5103)08cab58chore(release): 5.0.337f4760chore(deps-dev): bump@types/nodefrom 20.11.25 to 20.11.26 (#5102)6e1aed3fix(types): proxy (#5101)8ea7cb8chore(deps): bump open from 10.0.4 to 10.1.0 (#5100)c6a3586chore(deps-dev): bump puppeteer from 22.4.0 to 22.4.1 (#5099)2201442chore(deps): update (#5096)Updates
path-parsefrom 1.0.6 to 1.0.7Commits
Updates
webpack-dev-middlewarefrom 3.7.3 to 7.2.1Release notes
Sourced from webpack-dev-middleware's releases.
... (truncated)
Changelog
Sourced from webpack-dev-middleware's changelog.