search

gianpaj / walnut.tv

🔥 Discover trending videos from Reddit and curated YouTube channels – Soon using Next.js. See `dev` branch
https://walnut.tv
10 stars 6 forks source link

🚨 [security] Update stylelint 15.8.0 → 15.10.1 (minor) #211

Closed depfu[bot] closed 1 year ago

depfu[bot] commented 1 year ago

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ stylelint (15.8.0 → 15.10.1) · Repo · Changelog

Security Advisories 🚨

🚨 Stylelint has vulnerability in semver dependency

Summary

Our meow dependency (which we use for our CLI) depended on semver@5.7.1 . A vulnerability in this version of semver was recently identified and surfaced by npm audit:

Regular Expression Denial of Service - GHSA-c2qf-rxjj-qqgw

Details

Original post by the reporter:

"my npm audit show the report

semver <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - GHSA-c2qf-rxjj-qqgw
No fix available

And my dependencies tree for semver show your package

├─┬ stylelint@15.9.0
│ └─┬ meow@9.0.0
│ └─┬ read-pkg-up@7.0.1
│ └─┬ read-pkg@5.2.0
│ └─┬ normalize-package-data@2.5.0
│ └── semver@5.7.1 deduped

I found that meow@10.x.x contains normalize-package-data@5 and I can fix this vulnerability because it uses semver@7. But I can't update meow to the new major version because your package doesn't allow it."

Update your package to use the 'meow' version >=10"

PoC

N/A

Impact

We anticipate the impact to be low as Stylelint is a dev tool and meow is only used on the CLI pathway.

Release Notes

15.10.1

15.10.0

  • Added: media-query-no-invalid (#6963) (@romainmenke).
  • Added: support for JS objects with extends config option (#6998) (@fpetrakov).
  • Fixed: inconsistent errored properties in stylelint.lint() return value (#6983) (@ybiquitous).
  • Fixed: {selector,value}-no-vendor-prefix performance (#7016) (@jeddy3).
  • Fixed: custom-property-pattern performance (#7009) (@jeddy3).
  • Fixed: function-linear-gradient-no-nonstandard-direction false positives for <color-interpolation-method> (#6987) (@romainmenke).
  • Fixed: function-name-case performance (#7010) (@jeddy3).
  • Fixed: function-no-unknown performance (#7004) (@jeddy3).
  • Fixed: function-url-quotes performance (#7011) (@jeddy3).
  • Fixed: hue-degree-notation false negatives for oklch (#7015) (@romainmenke).
  • Fixed: hue-degree-notation performance (#7012) (@jeddy3).
  • Fixed: media-feature-name-no-unknown false positives for environment-blending, nav-controls, prefers-reduced-data, and video-color-gamut (#6978) (@romainmenke).
  • Fixed: media-feature-name-no-vendor-prefix positions for *-device-pixel-ratio (#6977) (@romainmenke).
  • Fixed: no-descending-specificity performance (#7026) (@romainmenke).
  • Fixed: no-duplicate-at-import-rules false negatives for imports with supports and layer conditions (#7001) (@romainmenke).
  • Fixed: selector-anb-no-unmatchable performance (#7042) (@romainmenke).
  • Fixed: selector-id-pattern performance (#7013) (@jeddy3).
  • Fixed: selector-pseudo-class-no-unknown false negatives for pseudo-elements with matching names (#6964) (@Mouvedia).
  • Fixed: selector-pseudo-element-no-unknown performance (#7007) (@jeddy3).
  • Fixed: selector-type-case performance (#7041) (@romainmenke).
  • Fixed: selector-type-no-unknown performance (#7027) (@romainmenke).
  • Fixed: unit-disallowed-list false negatives with percentages (#7018) (@romainmenke).

15.9.0

  • Added: insideFunctions: {"function": int} to number-max-precision (#6932) (@romainmenke).
  • Fixed: declaration-block-no-redundant-longhand-properties autofix for border-radius shorthand (#6958) (@mattxwang).
  • Fixed: declaration-block-no-redundant-longhand-properties autofix for border-width shorthand (#6956) (@mattxwang).
  • Fixed: declaration-block-no-redundant-longhand-properties autofix for grid-column and grid-row (#6957) (@mattxwang).

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
netlify[bot] commented 1 year ago

Deploy Preview for walnut ready!

Name Link
Latest commit 4212f243b7e714ecf3ea87f181f2b28022e00543
Latest deploy log https://app.netlify.com/sites/walnut/deploys/64a88c98855ff5000813e9bf
Deploy Preview https://deploy-preview-211--walnut.netlify.app
Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.