Make updates for dependency security - Githubissues

SuffolkLITLab / ALKiln

Integrated automated end-to-end testing with docassemble, puppeteer, and cucumber.

https://assemblyline.suffolklitlab.org/docs/alkiln/intro

MIT License

14 stars 4 forks source link

Make updates for dependency security #727

Closed BryceStevenWilley closed 1 year ago

BryceStevenWilley commented 1 year ago

cucumber 8.6.0 -> 9.3.0
- NOTABLE: cucumber has dropped support for Node 12 and 17 from v8 to v9.
mocha 9.2.0 -> 9.2.2
qs 6.10.2 -> 6.10.3
puppeteer 20.7.2 -> 20.8.2
minimatch 3.0.4 -> 3.0.5 (was 3.0.4 in many dependencies, patch shouldn't break them)

Should address the following, fairly serious, security issues:

Sandbox escape vuln: https://github.com/advisories/GHSA-g644-9gfx-q4q4
Prototype pollution: https://github.com/advisories/GHSA-hrpp-h998-j3pp
Regex DoS (less critical IMO): https://github.com/advisories/GHSA-j8xg-fqg3-53r7
Another Regex DoS: https://github.com/advisories/GHSA-f8q6-p94x-37v3

If this passes, I'll merge. Some of those issues are bad, so I've made a patch for v4, pushing now.