search

microsoft / just

The task library that just works
https://microsoft.github.io/just
MIT License
1.95k stars 92 forks source link

Update dependency es5-ext to v0.10.63 [SECURITY] #741

Closed renovate[bot] closed 7 months ago

renovate[bot] commented 7 months ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
es5-ext 0.10.53 -> 0.10.63 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-27088

Impact

Passing functions with very long names or complex default argument names into function#copy orfunction#toStringTokens may put script to stall

Patches

Fixed with https://github.com/medikoo/es5-ext/commit/3551cdd7b2db08b1632841f819d008757d28e8e2 and https://github.com/medikoo/es5-ext/commit/a52e95736690ad1d465ebcd9791d54570e294602 Published with v0.10.63

Workarounds

No real workaround aside of refraining from using above utilities.

References

https://github.com/medikoo/es5-ext/issues/201

Release Notes

medikoo/es5-ext (es5-ext) ### [`v0.10.63`](https://togithub.com/medikoo/es5-ext/blob/HEAD/CHANGELOG.md#01063-2024-02-23) [Compare Source](https://togithub.com/medikoo/es5-ext/compare/v0.10.62...v0.10.63) ### [`v0.10.62`](https://togithub.com/medikoo/es5-ext/blob/HEAD/CHANGELOG.md#01062-2022-08-02) [Compare Source](https://togithub.com/medikoo/es5-ext/compare/v0.10.61...v0.10.62) ### [`v0.10.61`](https://togithub.com/medikoo/es5-ext/blob/HEAD/CHANGELOG.md#01061-2022-04-20) [Compare Source](https://togithub.com/medikoo/es5-ext/compare/v0.10.60...v0.10.61) ### [`v0.10.60`](https://togithub.com/medikoo/es5-ext/blob/HEAD/CHANGELOG.md#01060-2022-04-07) [Compare Source](https://togithub.com/medikoo/es5-ext/compare/v0.10.59...v0.10.60) ### [`v0.10.59`](https://togithub.com/medikoo/es5-ext/blob/HEAD/CHANGELOG.md#01059-2022-03-17) [Compare Source](https://togithub.com/medikoo/es5-ext/compare/v0.10.58...v0.10.59) ### [`v0.10.58`](https://togithub.com/medikoo/es5-ext/blob/HEAD/CHANGELOG.md#01058-2022-03-11) [Compare Source](https://togithub.com/medikoo/es5-ext/compare/v0.10.57...v0.10.58) ### [`v0.10.57`](https://togithub.com/medikoo/es5-ext/blob/HEAD/CHANGELOG.md#01057-2022-03-08) [Compare Source](https://togithub.com/medikoo/es5-ext/compare/v0.10.56...v0.10.57) ### [`v0.10.56`](https://togithub.com/medikoo/es5-ext/blob/HEAD/CHANGELOG.md#01056-2022-03-07) [Compare Source](https://togithub.com/medikoo/es5-ext/compare/v0.10.55...v0.10.56) ### [`v0.10.55`](https://togithub.com/medikoo/es5-ext/blob/HEAD/CHANGELOG.md#01055-2022-03-07) [Compare Source](https://togithub.com/medikoo/es5-ext/compare/v0.10.54...v0.10.55) ### [`v0.10.54`](https://togithub.com/medikoo/es5-ext/blob/HEAD/CHANGELOG.md#01054-2022-03-07) [Compare Source](https://togithub.com/medikoo/es5-ext/compare/v0.10.53...v0.10.54)

Configuration

📅 Schedule: Branch creation - "" in timezone America/Los_Angeles, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Mend Renovate. View repository job log here.

ecraig12345 commented 7 months ago

New version still prints a protest message, and the vulnerability isn't a big concern in this case.

renovate[bot] commented 7 months ago

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (0.10.63). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.