search

onokatio / blog.katio.net

my blog script
1 stars 1 forks source link

Update dependency y18n to 4.0.1 [SECURITY] - autoclosed #126

Closed renovate[bot] closed 2 years ago

renovate[bot] commented 2 years ago

WhiteSource Renovate

This PR contains the following updates:

Package Change
y18n 4.0.0 -> 4.0.1

GitHub Vulnerability Alerts

CVE-2020-7774

Overview

The npm package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution.

POC

const y18n = require('y18n')();

y18n.setLocale('__proto__');
y18n.updateLocale({polluted: true});

console.log(polluted); // true

Recommendation

Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.

Configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by WhiteSource Renovate. View repository job log here.

cloudflare-workers-and-pages[bot] commented 2 years ago

Deploying with  Cloudflare Pages  Cloudflare Pages

Latest commit: 8e76d40
Status: ✅  Deploy successful!
Preview URL: https://154709c6.blog-katio-net.pages.dev

View logs

netlify[bot] commented 2 years ago

Deploy Preview for blog-katio-net processing.

Name Link
Latest commit 8e76d4098c33076f10166e8fd9e1606cef43f60c
Latest deploy log https://app.netlify.com/sites/blog-katio-net/deploys/628b7aaee3fffc000873ef35