search

algolia / places

:globe_with_meridians: Turn any <input> into an address autocomplete
https://community.algolia.com/places/
MIT License
5.35k stars 234 forks source link

chore(deps): update dependency algoliasearch-helper to v3 [security] #1155

Closed renovate[bot] closed 1 year ago

renovate[bot] commented 2 years ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
algoliasearch-helper (source) 2.28.1 -> 3.6.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2021-23433

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters._parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the implementation allows users to define arbitrary search patterns.

Release Notes

algolia/algoliasearch-helper-js ### [`v3.6.2`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.6.1...3.6.2) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.6.1...3.6.2) ### [`v3.6.1`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.6.0...3.6.1) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.6.0...3.6.1) ### [`v3.6.0`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.5.5...3.6.0) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.5.5...3.6.0) ### [`v3.5.5`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.5.4...3.5.5) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.5.4...3.5.5) ### [`v3.5.4`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.5.3...3.5.4) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.5.3...3.5.4) ### [`v3.5.3`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.5.2...3.5.3) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.5.2...3.5.3) ### [`v3.5.2`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.5.1...3.5.2) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.5.1...3.5.2) ### [`v3.5.1`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.5.0...3.5.1) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.5.0...3.5.1) ### [`v3.5.0`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.4.5...3.5.0) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.4.5...3.5.0) ### [`v3.4.5`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.4.4...3.4.5) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.4.4...3.4.5) ### [`v3.4.4`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.4.3...3.4.4) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.4.3...3.4.4) ### [`v3.4.3`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.4.2...3.4.3) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.4.2...3.4.3) ### [`v3.4.2`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.4.1...3.4.2) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.4.1...3.4.2) ### [`v3.4.1`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.3.4...3.4.1) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.3.4...3.4.1) ### [`v3.3.4`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.3.3...3.3.4) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.3.3...3.3.4) ### [`v3.3.3`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.3.2...3.3.3) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.3.2...3.3.3) ### [`v3.3.2`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.3.1...3.3.2) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.3.1...3.3.2) ### [`v3.3.1`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.3.0...3.3.1) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.3.0...3.3.1) ### [`v3.3.0`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.2.2...3.3.0) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.2.2...3.3.0) ### [`v3.2.2`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.2.1...3.2.2) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.2.1...3.2.2) ### [`v3.2.1`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.2.0...3.2.1) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.2.0...3.2.1) ### [`v3.2.0`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.1.2...3.2.0) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.1.2...3.2.0) ### [`v3.1.2`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.1.1...3.1.2) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.1.1...3.1.2) ### [`v3.1.1`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.1.0...3.1.1) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.1.0...3.1.1) ### [`v3.1.0`](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.0.0...3.1.0) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/3.0.0...3.1.0) ### [`v3.0.0`](https://togithub.com/algolia/algoliasearch-helper-js/compare/2.28.1...3.0.0) [Compare Source](https://togithub.com/algolia/algoliasearch-helper-js/compare/2.28.1...3.0.0)

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.

Haroenv commented 2 years ago

the "vulnerable" code isn't exposed in places, as well as places being deprecated soon, it might not be worth migrating to this major

renovate[bot] commented 1 year ago

Renovate Ignore Notification

As this PR has been closed unmerged, Renovate will ignore this upgrade and you will not receive PRs for any future 3.x releases. However, if you upgrade to 3.x manually then Renovate will reenable minor and patch updates automatically.

If this PR was closed by mistake or you changed your mind, you can simply rename this PR and you will soon get a fresh replacement PR opened.