search

jpmorganchase / salt-ds

React UI components built with a focus on accessibility, customization and ease-of-use
https://www.saltdesignsystem.com
Apache License 2.0
132 stars 90 forks source link

Update dependency ag-grid-community to v31.3.4 [SECURITY] #4051

Closed renovate[bot] closed 2 months ago

renovate[bot] commented 2 months ago

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
ag-grid-community (source) 31.3.2 -> 31.3.4 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-39001

ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

CVE-2024-38996

ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties. Prior versions were also found to be affected.

Release Notes

ag-grid/ag-grid (ag-grid-community) ### [`v31.3.4`](https://redirect.github.com/ag-grid/ag-grid/releases/tag/v31.3.4) [Compare Source](https://redirect.github.com/ag-grid/ag-grid/compare/v31.3.2...v31.3.4) https://www.ag-grid.com/changelog/?fixVersion=31.3.4

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR was generated by Mend Renovate. View the repository job log.

vercel[bot] commented 2 months ago

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
saltdesignsystem ❌ Failed (Inspect) Sep 5, 2024 1:57pm
changeset-bot[bot] commented 2 months ago

⚠️ No Changeset found

Latest commit: 3d3341e8e203ce195d38595f100dc447b441de36

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

renovate[bot] commented 2 months ago

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (^31.3.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.