search

yarnpkg / yarn

The 1.x line is frozen - features and bugfixes now happen on https://github.com/yarnpkg/berry
https://classic.yarnpkg.com
Other
41.4k stars 2.73k forks source link

Update dependency semver to v5.7.2 [SECURITY] - autoclosed #8961

Closed renovate[bot] closed 1 month ago

renovate[bot] commented 1 year ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
semver 5.5.0 -> 5.7.2 age adoption passing confidence

[!WARNING] Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2022-25883

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Release Notes

npm/node-semver (semver) ### [`v5.7.2`](https://togithub.com/npm/node-semver/releases/tag/v5.7.2) [Compare Source](https://togithub.com/npm/node-semver/compare/v5.7.1...v5.7.2) ##### Bug Fixes - [`2f8fd41`](https://togithub.com/npm/node-semver/commit/2f8fd41487acf380194579ecb6f8b1bbfe116be0) [#​585](https://togithub.com/npm/node-semver/pull/585) better handling of whitespace ([#​585](https://togithub.com/npm/node-semver/issues/585)) ([@​joaomoreno](https://togithub.com/joaomoreno), [@​lukekarrys](https://togithub.com/lukekarrys)) ### [`v5.7.1`](https://togithub.com/npm/node-semver/compare/v5.7.0...v5.7.1) [Compare Source](https://togithub.com/npm/node-semver/compare/v5.7.0...v5.7.1) ### [`v5.7.0`](https://togithub.com/npm/node-semver/compare/v5.6.0...v5.7.0) [Compare Source](https://togithub.com/npm/node-semver/compare/v5.6.0...v5.7.0) ### [`v5.6.0`](https://togithub.com/npm/node-semver/compare/v5.5.1...v5.6.0) [Compare Source](https://togithub.com/npm/node-semver/compare/v5.5.1...v5.6.0) ### [`v5.5.1`](https://togithub.com/npm/node-semver/compare/v5.5.0...v5.5.1) [Compare Source](https://togithub.com/npm/node-semver/compare/v5.5.0...v5.5.1)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR was generated by Mend Renovate. View the repository job log.