npm ssri 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
Configuration
π Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
π¦ Automerge: Disabled by config. Please merge this manually once you are satisfied.
β» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
π» Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
[ ] If you want to rebase/retry this PR, check this box
This PR has been generated by Mend Renovate. View repository job log here.
:warning: We detected 3 security issues in this pull request:
Vulnerable Libraries (3)
Severity | Details
----- | --------
Medium | [boxen@1.3.0](https://github.com/koromerzhin/template-vuejs/blob/e80eb733b87e0ae6ecaf814c3a3fb7ba31e5bf54/apps/package-lock.json) (t) upgrade to: *>3.2.0*
Medium | [gitmoji-changelog@2.3.0](https://github.com/koromerzhin/template-vuejs/blob/e80eb733b87e0ae6ecaf814c3a3fb7ba31e5bf54/apps/package-lock.json) (t) upgrade to: *>=2.0.0-alpha.1*
Medium | [lock-verify@2.2.1](https://github.com/koromerzhin/template-vuejs/blob/e80eb733b87e0ae6ecaf814c3a3fb7ba31e5bf54/apps/package-lock.json) (t) upgrade to: *>1.1.0 || >=2.2.0*
More info on how to fix Vulnerable Libraries in [JavaScript](https://docs.guardrails.io/docs/en/vulnerabilities/javascript/using_vulnerable_libraries.html?utm_source=ghpr).
This PR contains the following updates:
7.1.0
->7.1.1
6.0.1
->6.0.2
GitHub Vulnerability Alerts
CVE-2021-27290
npm
ssri
5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.Configuration
π Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
π¦ Automerge: Disabled by config. Please merge this manually once you are satisfied.
β» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
π» Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Mend Renovate. View repository job log here.