secure-code-warrior-for-github[bot]
commented
2 months ago Micro-Learning Topic: Prototype pollution (Detected by phrase)
Matched on "Prototype pollution"
By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf).
This PR contains the following updates:
3.2.3->5.0.0GitHub Vulnerability Alerts
CVE-2022-37611
Prototype pollution vulnerability in tschaub gh-pages via the partial variable in util.js.
Release Notes
tschaub/gh-pages (gh-pages)
### [`v5.0.0`](https://togithub.com/tschaub/gh-pages/blob/HEAD/changelog.md#v500) [Compare Source](https://togithub.com/tschaub/gh-pages/compare/v4.0.0...v5.0.0) Potentially breaking change: the `publish` method now always returns a promise. Previously, it did not return a promise in some error cases. This should not impact most users. Updates to the development dependencies required a minimum Node version of 14 for the tests. The library should still work on Node 12, but tests are no longer run in CI for version 12. A future major version of the library may drop support for version 12 altogether. - [#438](https://togithub.com/tschaub/gh-pages/pull/438) - Remove quotation marks ([@Vicropht](https://togithub.com/Vicropht)) - [#459](https://togithub.com/tschaub/gh-pages/pull/459) - Bump async from 2.6.4 to 3.2.4 ([@tschaub](https://togithub.com/tschaub)) - [#454](https://togithub.com/tschaub/gh-pages/pull/454) - Bump email-addresses from 3.0.1 to 5.0.0 ([@tschaub](https://togithub.com/tschaub)) - [#455](https://togithub.com/tschaub/gh-pages/pull/455) - Bump actions/setup-node from 1 to 3 ([@tschaub](https://togithub.com/tschaub)) - [#453](https://togithub.com/tschaub/gh-pages/pull/453) - Bump actions/checkout from 2 to 3 ([@tschaub](https://togithub.com/tschaub)) - [#445](https://togithub.com/tschaub/gh-pages/pull/445) - Update README to clarify project site configuration requirements with tools like CRA, webpack, Vite, etc. ([@Nezteb](https://togithub.com/Nezteb)) - [#452](https://togithub.com/tschaub/gh-pages/pull/452) - Assorted updates ([@tschaub](https://togithub.com/tschaub)) ### [`v4.0.0`](https://togithub.com/tschaub/gh-pages/blob/HEAD/changelog.md#v400) [Compare Source](https://togithub.com/tschaub/gh-pages/compare/v3.2.3...v4.0.0) This release doesn't include any breaking changes, but due to updated development dependencies, tests are no longer run on Node 10. - [#432](https://togithub.com/tschaub/gh-pages/pull/432) - Updated dev dependencies and formatting ([@tschaub](https://togithub.com/tschaub)) - [#430](https://togithub.com/tschaub/gh-pages/pull/430) - Bump ansi-regex from 3.0.0 to 3.0.1 ([@tschaub](https://togithub.com/tschaub)) - [#431](https://togithub.com/tschaub/gh-pages/pull/431) - Bump path-parse from 1.0.6 to 1.0.7 ([@tschaub](https://togithub.com/tschaub)) - [#427](https://togithub.com/tschaub/gh-pages/pull/427) - Bump async from 2.6.1 to 2.6.4 ([@tschaub](https://togithub.com/tschaub)) - [#423](https://togithub.com/tschaub/gh-pages/pull/423) - Bump minimist from 1.2.5 to 1.2.6 ([@tschaub](https://togithub.com/tschaub))Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.