Closed renovate[bot] closed 1 year ago
Merging #968 (0e54a31) into master (dbe0f6d) will not change coverage. The diff coverage is
n/a
.
@@ Coverage Diff @@
## master #968 +/- ##
=========================================
Coverage 89.15% 89.15%
Complexity 2212 2212
=========================================
Files 354 354
Lines 9987 9987
Branches 1438 1438
=========================================
Hits 8904 8904
Misses 787 787
Partials 296 296
Flag | Coverage Δ | |
---|---|---|
integration | 51.78% <ø> (ø) |
|
jest | 86.68% <ø> (ø) |
|
karma | 95.53% <ø> (ø) |
|
unittests | 87.43% <ø> (ø) |
Flags with carried forward coverage won't be shown. Click here to find out more.
:mega: We’re building smart automated test selection to slash your CI/CD build times. Learn more
This PR contains the following updates:
4.0.4
->4.0.5
⚠ Dependency Lookup Warnings ⚠
Warnings were logged while processing this repo. Please check the logs for more information.
GitHub Vulnerability Alerts
CVE-2022-2421
Due to improper type validation in the
socket.io-parser
library (which is used by thesocket.io
andsocket.io-client
packages to encode and decode Socket.IO packets), it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.Example:
This bubbles up in the
socket.io
package:At first sight, the potential impact seems rather limited, but please upgrade to a safe version as soon as possible.
This should be fixed by:
socket.io-parser@4.2.1
socket.io-parser@4.0.5
Dependency analysis for the
socket.io
packagesocket.io
versionsocket.io-parser
version4.5.2...latest
~4.2.0
(ref)4.1.3...4.5.1
~4.0.4
(ref)3.0.5...4.1.2
~4.0.3
(ref)3.0.0...3.0.4
~4.0.1
(ref)Dependency analysis for the
socket.io-client
packagesocket.io-client
versionsocket.io-parser
version4.5.0...latest
~4.2.0
(ref)4.3.0...4.4.1
~4.1.1
(ref)3.1.0...4.2.0
~4.0.4
(ref)3.0.5
~4.0.3
(ref)3.0.0...3.0.4
~4.0.1
(ref)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.