Closed renovate[bot] closed 1 year ago
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
β» Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
Found file in cache: /tmp/renovate-cache/buildpack/7576b42decc67f70b61585f41c5074bea75c260886346e567578ea0e0dc2d571/node-v16.17.0-linux-x64.tar.xz
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@~2.3.2 (node_modules/tailwindcss/node_modules/chokidar/node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@2.3.2: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
npm WARN @pmmmwh/react-refresh-webpack-plugin@0.5.7 requires a peer of webpack@>=4.43.0 <6.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN source-map-loader@3.0.1 requires a peer of webpack@^5.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN css-minimizer-webpack-plugin@3.4.1 requires a peer of webpack@^5.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN eslint-webpack-plugin@3.2.0 requires a peer of eslint@^7.0.0 || ^8.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN eslint-webpack-plugin@3.2.0 requires a peer of webpack@^5.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN tailwindcss@3.1.8 requires a peer of postcss@^8.0.9 but none is installed. You must install peer dependencies yourself.
npm WARN update-browserslist-db@1.0.5 requires a peer of browserslist@>= 4.21.0 but none is installed. You must install peer dependencies yourself.
npm WARN cssnano-utils@3.1.0 requires a peer of postcss@^8.2.15 but none is installed. You must install peer dependencies yourself.
npm WARN postcss-import@14.1.0 requires a peer of postcss@^8.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN postcss-js@4.0.0 requires a peer of postcss@^8.3.3 but none is installed. You must install peer dependencies yourself.
npm WARN postcss-nested@5.0.6 requires a peer of postcss@^8.2.14 but none is installed. You must install peer dependencies yourself.
npm ERR! code EBADPLATFORM
npm ERR! notsup Unsupported platform for fsevents@2.3.2: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
npm ERR! notsup Valid OS: darwin
npm ERR! notsup Valid Arch: any
npm ERR! notsup Actual OS: linux
npm ERR! notsup Actual Arch: x64
npm ERR! A complete log of this run can be found in:
npm ERR! /tmp/renovate-cache/others/npm/_logs/2022-08-27T05_23_29_666Z-debug.log
This PR contains the following updates:
1.10.0
->9.0.6
GitHub Vulnerability Alerts
CVE-2020-28477
Overview
Affected versions of immer are vulnerable to Prototype Pollution.
Proof of exploit
Remediation
Version 8.0.1 contains a fix for this vulnerability, updating is recommended.
CVE-2021-23436
This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "proto" || p === "constructor") in applyPatches_ returns false if p is ['proto'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.
CVE-2021-3757
immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Configuration
π Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
π¦ Automerge: Disabled by config. Please merge this manually once you are satisfied.
β» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
π Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.