search

antongolub / yarn-audit-fix

The missing `yarn audit fix`
MIT License
181 stars 9 forks source link

chore(deps): update dependency terser to v5.14.2 [security] #258

Closed renovate[bot] closed 2 years ago

renovate[bot] commented 2 years ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
terser (source) 5.14.1 -> 5.14.2 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-25858

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

Release Notes

terser/terser ### [`v5.14.2`](https://togithub.com/terser/terser/blob/HEAD/CHANGELOG.md#v5142) [Compare Source](https://togithub.com/terser/terser/compare/v5.14.1...0136e8a05ef864666a6e95b0de8b679b0bc93338) - Security fix for RegExps that should not be evaluated (regexp DDOS) - Source maps improvements ([#​1211](https://togithub.com/terser/terser/issues/1211)) - Performance improvements in long property access evaluation ([#​1213](https://togithub.com/terser/terser/issues/1213))

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

â™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.

sonarcloud[bot] commented 2 years ago

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

antongolub commented 2 years ago

:tada: This PR is included in version 9.3.3 :tada:

The release is available on:

Your semantic-release bot :package::rocket: