search

mishraomp / reactive-programming-docker

This repository contains sample code for reactive programming on dockerized containers
0 stars 0 forks source link

fix(deps): update dependency class-validator to ^0.14.0 [security] #73

Closed mishraomp closed 11 months ago

mishraomp commented 11 months ago

This PR contains the following updates:

Package Type Update Change
class-validator dependencies minor ^0.9.1 -> ^0.14.0

GitHub Vulnerability Alerts

CVE-2019-18413

In TypeStack class-validator, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input.

The default settings for forbidUnknownValues has been changed to true in 0.14.0.

NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.

Release Notes

typestack/class-validator (class-validator) ### [`v0.14.0`](https://togithub.com/typestack/class-validator/blob/HEAD/CHANGELOG.md#0140-2022-12-09) [Compare Source](https://togithub.com/typestack/class-validator/compare/v0.13.2...v0.14.0) ### [`v0.13.2`](https://togithub.com/typestack/class-validator/blob/HEAD/CHANGELOG.md#0132-2021-11-20) [Compare Source](https://togithub.com/typestack/class-validator/compare/v0.13.1...v0.13.2) > **NOTE:** This version fixes a security vulnerability allowing denial of service attacks with a specially crafted request payload. > Please update as soon as possible. ##### Fixed - switched to use `Array.isArray` in array checks from `instanceof` operator ##### Changed - `libphonenumber-js` package updated to `1.9.43` from `1.9.7` - `validator` package updated to `13.5.2` from `13.5.2` - various dev-dependencies updated ### [`v0.13.1`](https://togithub.com/typestack/class-validator/blob/HEAD/CHANGELOG.md#0131-2021-01-14) [Compare Source](https://togithub.com/typestack/class-validator/compare/v0.13.0...v0.13.1) ##### Added - optional mather function has been added to the `ArrayUnique` decorator ##### Fixed - a typo was fixed in the error message generated by the `IsUUID` decorator - calling `ValidationError.toString()` doesn't result in an error when `forbidNonWhitelisted` parameter was used - fixed typo in error message generated by `IsIn` decorator - the `@types/validator` package is correctly installed - `inlineSources` option is enabled in tsconfig preventing various sourcemap errors when consuming the package ##### Changed - various dev dependencies has been updated ### [`v0.13.0`](https://togithub.com/typestack/class-validator/blob/HEAD/CHANGELOG.md#0130-2021-01-11) [Compare Source](https://togithub.com/typestack/class-validator/compare/v0.12.2...v0.13.0) ##### Added - **project is restructured to allow three-shaking** - added option to fail on first validation error ([#​620](https://togithub.com/typestack/class-validator/issues/620)) - two new validator option is added: - `always` - allows setting global default for `always` option for decorators - `strictGroups` - ignore decorators with at least one group, when `ValidatorOptions.groups` is empty ### [`v0.12.2`](https://togithub.com/typestack/class-validator/blob/HEAD/CHANGELOG.md#0122-2020-04-23) [Compare Source](https://togithub.com/typestack/class-validator/compare/v0.12.1...v0.12.2) ##### Fixed - move `tslib` from `peerDependencies` to `dependencies` ([827eff1](https://togithub.com/typestack/class-validator/commit/827eff1)), closes [#​588](https://togithub.com/typestack/class-validator/issues/588) ### [`v0.12.1`](https://togithub.com/typestack/class-validator/blob/HEAD/CHANGELOG.md#0121-2020-04-18) [Compare Source](https://togithub.com/typestack/class-validator/compare/v0.12.0...v0.12.1) ##### Fixed - apply only nested validator for ValidateNested multi-dimensional array ([c463be5](https://togithub.com/typestack/class-validator/commit/c463be5)) ### [`v0.12.0`](https://togithub.com/typestack/class-validator/blob/HEAD/CHANGELOG.md#0120-2020-04-18) [Compare Source](https://togithub.com/typestack/class-validator/compare/v0.11.1...v0.12.0) ##### Fixed - accept negative timezone in isDateString ([#​564](https://togithub.com/typestack/class-validator/issues/564)) ([2012d72](https://togithub.com/typestack/class-validator/commit/2012d72)), closes [#​565](https://togithub.com/typestack/class-validator/issues/565) - apply all decorators type PropertyDecorator ([#​556](https://togithub.com/typestack/class-validator/issues/556)) ([5fb36e3](https://togithub.com/typestack/class-validator/commit/5fb36e3)), closes [#​555](https://togithub.com/typestack/class-validator/issues/555) - avoiding metadataStorage from DI ([#​335](https://togithub.com/typestack/class-validator/issues/335)) ([b57fef4](https://togithub.com/typestack/class-validator/commit/b57fef4)), closes [#​328](https://togithub.com/typestack/class-validator/issues/328) [#​261](https://togithub.com/typestack/class-validator/issues/261) [#​132](https://togithub.com/typestack/class-validator/issues/132) - correct registerDecorator options argument ([7909ec6](https://togithub.com/typestack/class-validator/commit/7909ec6)), closes [#​302](https://togithub.com/typestack/class-validator/issues/302) - IsNumberString accept isNumbericOptions as argument ([62b993f](https://togithub.com/typestack/class-validator/commit/62b993f)), closes [#​518](https://togithub.com/typestack/class-validator/issues/518) [#​463](https://togithub.com/typestack/class-validator/issues/463) - optional `constraints` property in ValidationError ([#​465](https://togithub.com/typestack/class-validator/issues/465)) ([84680ad](https://togithub.com/typestack/class-validator/commit/84680ad)), closes [#​309](https://togithub.com/typestack/class-validator/issues/309) - pass context to ValidationError for async validations ([#​533](https://togithub.com/typestack/class-validator/issues/533)) ([4eb1216](https://togithub.com/typestack/class-validator/commit/4eb1216)) - switch isLatitude & isLongitude validators ([#​513](https://togithub.com/typestack/class-validator/issues/513)) ([5497179](https://togithub.com/typestack/class-validator/commit/5497179)), closes [#​502](https://togithub.com/typestack/class-validator/issues/502) - switch isLatitude & isLongitude validators ([#​537](https://togithub.com/typestack/class-validator/issues/537)) ([c27500b](https://togithub.com/typestack/class-validator/commit/c27500b)) - ValidateNested support multi-dimensional arrays ([#​539](https://togithub.com/typestack/class-validator/issues/539)) ([62678e1](https://togithub.com/typestack/class-validator/commit/62678e1)) ##### Changed - update build process to enable tree shaking ([#​568](https://togithub.com/typestack/class-validator/issues/568)) ([11a7b8b](https://togithub.com/typestack/class-validator/commit/11a7b8b)), closes [#​258](https://togithub.com/typestack/class-validator/issues/258) [#​248](https://togithub.com/typestack/class-validator/issues/248) [#​247](https://togithub.com/typestack/class-validator/issues/247) [#​212](https://togithub.com/typestack/class-validator/issues/212) ##### Added - sync validatorjs version from v10.11.3 to v13.0.0 ([09120b7](https://togithub.com/typestack/class-validator/commit/09120b7)), closes [#​576](https://togithub.com/typestack/class-validator/issues/576) [#​425](https://togithub.com/typestack/class-validator/issues/425) ### [`v0.11.1`](https://togithub.com/typestack/class-validator/blob/HEAD/CHANGELOG.md#0111-2020-03-18) [Compare Source](https://togithub.com/typestack/class-validator/compare/v0.11.0...v0.11.1) ##### Fixed - IsNumber validator now works when maxDecimalPlaces=0 ([#​524](https://togithub.com/typestack/class-validator/issues/524)) ([b8aa922](https://togithub.com/typestack/class-validator/commit/b8aa922)) ##### Added - add all option in isuuid validator ([#​452](https://togithub.com/typestack/class-validator/issues/452)) ([98e9382](https://togithub.com/typestack/class-validator/commit/98e9382)) - add IsFirebasePushId validator ([#​548](https://togithub.com/typestack/class-validator/issues/548)) ([e7e2e53](https://togithub.com/typestack/class-validator/commit/e7e2e53)) - add options for isISO8601 validator ([#​460](https://togithub.com/typestack/class-validator/issues/460)) ([90a6638](https://togithub.com/typestack/class-validator/commit/90a6638)) ### [`v0.11.0`](https://togithub.com/typestack/class-validator/blob/HEAD/CHANGELOG.md#0110-2019-11-01) [Compare Source](https://togithub.com/typestack/class-validator/compare/v0.10.2...v0.11.0) ##### Fixed - create instance of ValidationError for whitelist errors ([#​434](https://togithub.com/typestack/class-validator/issues/434)) ([a98f5dd](https://togithub.com/typestack/class-validator/commit/a98f5dd)), closes [#​325](https://togithub.com/typestack/class-validator/issues/325) - pass context for isDefined and custom validators ([#​296](https://togithub.com/typestack/class-validator/issues/296)) ([0ef898e](https://togithub.com/typestack/class-validator/commit/0ef898e)), closes [#​292](https://togithub.com/typestack/class-validator/issues/292) ##### Added - add isHash validator ([#​445](https://togithub.com/typestack/class-validator/issues/445)) ([c454cf9](https://togithub.com/typestack/class-validator/commit/c454cf9)) - add isISSN validator ([#​450](https://togithub.com/typestack/class-validator/issues/450)) ([4bd586e](https://togithub.com/typestack/class-validator/commit/4bd586e)) - add isJWT validator ([#​444](https://togithub.com/typestack/class-validator/issues/444)) ([874861b](https://togithub.com/typestack/class-validator/commit/874861b)) - add isMACAddress validator ([#​449](https://togithub.com/typestack/class-validator/issues/449)) ([45b7df7](https://togithub.com/typestack/class-validator/commit/45b7df7)) - add support for maxDecimalPlaces on IsNumber ([#​381](https://togithub.com/typestack/class-validator/issues/381)) ([a4dc10e](https://togithub.com/typestack/class-validator/commit/a4dc10e)) ### [`v0.10.2`](https://togithub.com/typestack/class-validator/blob/HEAD/CHANGELOG.md#0102-2019-10-14) [Compare Source](https://togithub.com/typestack/class-validator/compare/v0.10.1...v0.10.2) ##### Fixed - apply custom constraint class validation to each item in the array ([#​295](https://togithub.com/typestack/class-validator/issues/295)) ([5bb704e](https://togithub.com/typestack/class-validator/commit/5bb704e)), closes [#​260](https://togithub.com/typestack/class-validator/issues/260) ##### Added - add isLatLong, isLatitude, isLongtitude validators ([#​427](https://togithub.com/typestack/class-validator/issues/427)) ([3fd15c4](https://togithub.com/typestack/class-validator/commit/3fd15c4)), closes [#​415](https://togithub.com/typestack/class-validator/issues/415) - add IsObject and IsNotEmptyObject new decorators ([#​334](https://togithub.com/typestack/class-validator/issues/334)) ([0a41aeb](https://togithub.com/typestack/class-validator/commit/0a41aeb)) - support ES6 Map and Set for regular validators with each option ([#​430](https://togithub.com/typestack/class-validator/issues/430)) ([a055bba](https://togithub.com/typestack/class-validator/commit/a055bba)), closes [#​428](https://togithub.com/typestack/class-validator/issues/428) ### [`v0.10.1`](https://togithub.com/typestack/class-validator/blob/HEAD/CHANGELOG.md#0101-2019-09-25) [Compare Source](https://togithub.com/typestack/class-validator/compare/v0.10.0...v0.10.1) ##### Fixed - add default message for isMilitaryTime validator ([#​411](https://togithub.com/typestack/class-validator/issues/411)) ([204b7df](https://togithub.com/typestack/class-validator/commit/204b7df)), closes [#​287](https://togithub.com/typestack/class-validator/issues/287) - add default message for isPort validator ([#​404](https://togithub.com/typestack/class-validator/issues/404)) ([74e568c](https://togithub.com/typestack/class-validator/commit/74e568c)) - add locale parameter for isAlpha and isAlphanumeric validat… ([#​406](https://togithub.com/typestack/class-validator/issues/406)) ([2f4bf4e](https://togithub.com/typestack/class-validator/commit/2f4bf4e)) ##### Added - add `skipUndefinedProperties`, `skipNullProperties` options ([#​414](https://togithub.com/typestack/class-validator/issues/414)) ([76c948a](https://togithub.com/typestack/class-validator/commit/76c948a)), closes [#​308](https://togithub.com/typestack/class-validator/issues/308) ### [`v0.10.0`](https://togithub.com/typestack/class-validator/blob/HEAD/CHANGELOG.md#0100-2019-08-10) [Compare Source](https://togithub.com/typestack/class-validator/compare/v0.9.1...v0.10.0) ##### Fixed - add correct signature for custom error message handler ([249c41d](https://togithub.com/typestack/class-validator/commit/249c41d)) ##### Added - add `IsISO31661Alpha3` and `IsISO31661Alpha2` validators ([#​273](https://togithub.com/typestack/class-validator/issues/273)) ([55c57b3](https://togithub.com/typestack/class-validator/commit/55c57b3)) - **IsDecimal:** implement `IsDecimal` from validatorjs ([#​359](https://togithub.com/typestack/class-validator/issues/359)) ([b4c8e21](https://togithub.com/typestack/class-validator/commit/b4c8e21)) - add `isPort` decorator ([#​282](https://togithub.com/typestack/class-validator/issues/282)) ([36684ec](https://togithub.com/typestack/class-validator/commit/36684ec)) - allow validate Map/Set ([#​365](https://togithub.com/typestack/class-validator/issues/365)) ([f6fcdc5](https://togithub.com/typestack/class-validator/commit/f6fcdc5)) - new `ValidatePromise` decorator - resolve promise before validate ([#​369](https://togithub.com/typestack/class-validator/issues/369)) ([35ec04d](https://togithub.com/typestack/class-validator/commit/35ec04d)) - replace instanceof Promise and support Promise/A+ ([#​310](https://togithub.com/typestack/class-validator/issues/310)) ([59eac09](https://togithub.com/typestack/class-validator/commit/59eac09)) - `isNumberString` now accept validator.js `IsNumericOptions` as second parameter ([#​262](https://togithub.com/typestack/class-validator/issues/262))

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Renovate Bot.