search

coda / packs-sdk

SDK for Coda Packs
https://coda.io/why-build-packs
MIT License
90 stars 26 forks source link

Update dependency jsonpath-plus to v10 [SECURITY] #3088

Closed krypton-build-user closed 1 week ago

krypton-build-user commented 1 month ago

This PR contains the following updates:

Package Type Update Change
jsonpath-plus dependencies major 9.0.0 -> 10.0.7

GitHub Vulnerability Alerts

CVE-2024-21534

Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.

Note:

There was an attempt to fix it in version 10.0.0 but it could still be exploited using different payloads.

Release Notes

s3u/JSONPath (jsonpath-plus) ### [`v10.0.7`](https://togithub.com/s3u/JSONPath/blob/HEAD/CHANGES.md#1007) [Compare Source](https://togithub.com/s3u/JSONPath/compare/v10.0.6...v10.0.7) - fix(security): prevent `constructor` access - docs: add security policy file ### [`v10.0.6`](https://togithub.com/s3u/JSONPath/blob/HEAD/CHANGES.md#1006) [Compare Source](https://togithub.com/s3u/JSONPath/compare/v10.0.5...v10.0.6) - fix(security): prevent `call`/`apply` invocation of `Function` ### [`v10.0.5`](https://togithub.com/s3u/JSONPath/blob/HEAD/CHANGES.md#1005) [Compare Source](https://togithub.com/s3u/JSONPath/compare/v10.0.4...v10.0.5) - fix: remove overly aggressive disabling of native functions but disallow `__proto__` ### [`v10.0.4`](https://togithub.com/s3u/JSONPath/blob/HEAD/CHANGES.md#1004) [Compare Source](https://togithub.com/s3u/JSONPath/compare/v10.0.3...v10.0.4) - fix(security): further prevent binding of Function calls which may evade detection ### [`v10.0.3`](https://togithub.com/s3u/JSONPath/blob/HEAD/CHANGES.md#1003) [Compare Source](https://togithub.com/s3u/JSONPath/compare/v10.0.2...v10.0.3) - fix(security): prevent binding of Function calls which may evade detection ### [`v10.0.2`](https://togithub.com/s3u/JSONPath/blob/HEAD/CHANGES.md#1002) [Compare Source](https://togithub.com/s3u/JSONPath/compare/v10.0.1...v10.0.2) - fix(security): prevent Function calls outside of member expressions ### [`v10.0.1`](https://togithub.com/s3u/JSONPath/blob/HEAD/CHANGES.md#1001) - fix(security): prohibit `Function` in "safe" vm ### [`v10.0.0`](https://togithub.com/s3u/JSONPath/blob/HEAD/CHANGES.md#1000) BREAKING CHANGES: - Require Node 18+ - fix(security): use safe vm by default in Node - chore: bump jsep, devDeps. and lint

Configuration

šŸ“… Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

šŸš¦ Automerge: Disabled by config. Please merge this manually once you are satisfied.

ā™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

šŸ”• Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Self-Hosted Renovate Bot. Find all logs here.