Closed renovate[bot] closed 1 month ago
Name | Link |
---|---|
Latest commit | a6730766667d673dc7b90bc04506587086919816 |
Latest deploy log | https://app.netlify.com/sites/quirrel-docs/deploys/662b2ff9ebc161000841bd23 |
Name | Link |
---|---|
Latest commit | a6730766667d673dc7b90bc04506587086919816 |
Latest deploy log | https://app.netlify.com/sites/quirrel-development-ui/deploys/662b2ff9faad3a000806664a |
Deploy Preview | https://deploy-preview-1170--quirrel-development-ui.netlify.app |
Preview on mobile | Toggle QR Code...Use your smartphone camera to open QR code link. |
To edit notification comments on pull requests, go to your Netlify site configuration.
This PR contains the following updates:
9.0.5
->9.0.6
GitHub Vulnerability Alerts
CVE-2021-3757
immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
CVE-2021-23436
This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition
(p === "__proto__" || p === "constructor")
inapplyPatches_
returns false ifp
is['__proto__']
(or['constructor']
). The===
operator (strict equality operator) returns false if the operands have different type.Release Notes
immerjs/immer (immer)
### [`v9.0.6`](https://togithub.com/immerjs/immer/releases/tag/v9.0.6) [Compare Source](https://togithub.com/immerjs/immer/compare/v9.0.5...v9.0.6) ##### Bug Fixes - **security:** Follow up on CVE-2020-28477 where `path: [["__proto__"], "x"]` could still pollute the prototype ([fa671e5](https://togithub.com/immerjs/immer/commit/fa671e55ee9bd42ae08cc239102b665a23958237))Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.