🚨 [security] Update async: 3.2.0 → 3.2.3 (patch)

[depfu[bot]]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ async (3.2.0 → 3.2.3) · Repo · Changelog

Security Advisories 🚨

🚨 Prototype Pollution in async

A vulnerability exists in Async through 3.2.1 (fixed in 3.2.2) , which could let a malicious user obtain privileges via the mapValues() method.

Release Notes

3.2.3 (from changelog)

• Fix bugs in comment parsing in autoInject. (#1767, #1780)

3.2.2 (from changelog)

• Fix potential prototype pollution exploit

3.2.1 (from changelog)

• Use queueMicrotask if available to the environment (#1761)
• Minor perf improvement in priorityQueue (#1727)
• More examples in documentation (#1726)
• Various doc fixes (#1708, #1712, #1717, #1740, #1739, #1749, #1756)
• Improved test coverage (#1754)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 38 commits:

• Version 3.2.3
• Update built files
• Update changelog for v3.2.3
• fix: address edge case in comment stripping (#1780)
• chore: remove unused Travis CI config (#1781)
• ci: setup GitHub Actions (#1782)
• Core: const, let, arrow-fn and unused variables (#1776)
• Housekeeping (#1772)
• Fix an inefficient regex in autoInject (#1767)
• be explicit (#1769)
• update docs
• Version 3.2.2
• Update built files
• update changelog for 3.2.2
• Fix prototype pollution vulnerability
• Fix(docs): use plural `callbacks` word in `lib/map.js` (#1765)
• regen docs
• update changelog
• Version 3.2.1
• Update built files
• Enhance examples for Collections methods. (#1726)
• use queueMicrotask instead of setTimeout in browsers in order to avoid browser throttling (#1761)
• fixing the grammar in documentation (#1756)
• Added modern-async to the list of other libraries (#1739)
• Improving tests case coverage (#1754)
• chore: Fix typo in detect.js (#1749)
• Fix typo: `unshift` instead `unshirt` (#1740)
• update issue template
• disable broken osx pipeline
• update azure vm images
• update pipelines steps
• priorityQueue: Prevent same tick setImmediate (#1727)
• V3 Docs :: Fix "unshirtAsync" typo (#1712)
• docs: Fix simple typo, whoses -> whose (#1717)
• fix typo (#1707)
• Fix code until code example (#1708)
• update test matrixes
• regen docs

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)