Open renovate[bot] opened 2 years ago
Merging #1546 (0f256c3) into main (ebc5600) will not change coverage. The diff coverage is
n/a
.
@@ Coverage Diff @@
## main #1546 +/- ##
=========================================
Coverage 78.37% 78.37%
Complexity 2266 2266
=========================================
Files 1287 1287
Lines 17918 17918
Branches 1650 1650
=========================================
Hits 14044 14044
Misses 3387 3387
Partials 487 487
Flag | Coverage Δ | |
---|---|---|
butler | 89.11% <ø> (ø) |
Flags with carried forward coverage won't be shown. Click here to find out more.
Continue to review full report at Codecov.
Legend - Click here to learn more
Δ = absolute <relative> (impact)
,ø = not affected
,? = missing data
Powered by Codecov. Last update 3d610a9...0f256c3. Read the comment docs.
This PR contains the following updates:
4.17.20
->4.17.21
GitHub Vulnerability Alerts
CVE-2020-28500
All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. Steps to reproduce (provided by reporter Liyuan Chen): var lo = require('lodash'); function build_blank (n) { var ret = "1" for (var i = 0; i < n; i++) { ret += " " } return ret + "1"; } var s = build_blank(50000) var time0 = Date.now(); lo.trim(s) var time_cost0 = Date.now() - time0; console.log("time_cost0: " + time_cost0) var time1 = Date.now(); lo.toNumber(s) var time_cost1 = Date.now() - time1; console.log("time_cost1: " + time_cost1) var time2 = Date.now(); lo.trimEnd(s) var time_cost2 = Date.now() - time2; console.log("time_cost2: " + time_cost2)
CVE-2021-23337
lodash
versions prior to 4.17.21 are vulnerable to Command Injection via the template function.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.