Update dependency passport to v0.6.0 [SECURITY] - autoclosed

renovate[bot] commented 2 years ago

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
passport (source)	`0.4.0` -> `0.6.0`

GitHub Vulnerability Alerts

CVE-2022-25896

This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.

Release Notes

jaredhanson/passport

### [`v0.6.0`](https://togithub.com/jaredhanson/passport/blob/HEAD/CHANGELOG.md#060---2022-05-20) [Compare Source](https://togithub.com/jaredhanson/passport/compare/v0.5.3...v0.6.0) ##### Added - `authenticate()`, `req#login`, and `req#logout` accept a `keepSessionInfo: true` option to keep session information after regenerating the session. ##### Changed - `req#login()` and `req#logout()` regenerate the the session and clear session information by default. - `req#logout()` is now an asynchronous function and requires a callback function as the last argument. ##### Security - Improved robustness against session fixation attacks in cases where there is physical access to the same system or the application is susceptible to cross-site scripting (XSS). ### [`v0.5.3`](https://togithub.com/jaredhanson/passport/blob/HEAD/CHANGELOG.md#053---2022-05-16) [Compare Source](https://togithub.com/jaredhanson/passport/compare/v0.5.2...v0.5.3) ##### Fixed - `initialize()` middleware extends request with `login()`, `logIn()`, `logout()`, `logOut()`, `isAuthenticated()`, and `isUnauthenticated()` functions again, reverting change from 0.5.1. ### [`v0.5.2`](https://togithub.com/jaredhanson/passport/blob/HEAD/CHANGELOG.md#052---2021-12-16) [Compare Source](https://togithub.com/jaredhanson/passport/compare/v0.5.1...v0.5.2) ##### Fixed - Introduced a compatibility layer for strategies that depend directly on `passport@0.4.x` or earlier (such as `passport-azure-ad`), which were broken by the removal of private variables in `passport@0.5.1`. ### [`v0.5.1`](https://togithub.com/jaredhanson/passport/blob/HEAD/CHANGELOG.md#051---2021-12-15) [Compare Source](https://togithub.com/jaredhanson/passport/compare/v0.5.0...v0.5.1) ##### Added - Informative error message in session strategy if session support is not available. ##### Changed - `authenticate()` middleware, rather than `initialize()` middleware, extends request with `login()`, `logIn()`, `logout()`, `logOut()`, `isAuthenticated()`, and `isUnauthenticated()` functions. ### [`v0.5.0`](https://togithub.com/jaredhanson/passport/blob/HEAD/CHANGELOG.md#050---2021-09-23) [Compare Source](https://togithub.com/jaredhanson/passport/compare/v0.4.1...v0.5.0) ##### Changed - `initialize()` middleware extends request with `login()`, `logIn()`, `logout()`, `logOut()`, `isAuthenticated()`, and `isUnauthenticated()` functions. ##### Removed - `login()`, `logIn()`, `logout()`, `logOut()`, `isAuthenticated()`, and `isUnauthenticated()` functions no longer added to `http.IncomingMessage.prototype`. ##### Fixed - `userProperty` option to `initialize()` middleware only affects the current request, rather than all requests processed via singleton Passport instance, eliminating a race condition in situations where `initialize()` middleware is used multiple times in an application with `userProperty` set to different values. [Unreleased]: https://togithub.com/jaredhanson/passport/compare/v0.6.0...HEAD [0.6.0]: https://togithub.com/jaredhanson/passport/compare/v0.5.3...v0.6.0 [0.5.3]: https://togithub.com/jaredhanson/passport/compare/v0.5.2...v0.5.3 [0.5.2]: https://togithub.com/jaredhanson/passport/compare/v0.5.1...v0.5.2 [0.5.1]: https://togithub.com/jaredhanson/passport/compare/v0.5.0...v0.5.1 ### [`v0.4.1`](https://togithub.com/jaredhanson/passport/compare/v0.4.0...v0.4.1) [Compare Source](https://togithub.com/jaredhanson/passport/compare/v0.4.0...v0.4.1)

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

renovate[bot] commented 2 years ago

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: eslint-config-airbnb@15.1.0
npm ERR! Found: eslint-plugin-jsx-a11y@6.0.2
npm ERR! node_modules/eslint-plugin-jsx-a11y
npm ERR!   dev eslint-plugin-jsx-a11y@"6.0.2" from the root project
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer eslint-plugin-jsx-a11y@"^5.1.1" from eslint-config-airbnb@15.1.0
npm ERR! node_modules/eslint-config-airbnb
npm ERR!   dev eslint-config-airbnb@"15.1.0" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: eslint-plugin-jsx-a11y@5.1.1
npm ERR! node_modules/eslint-plugin-jsx-a11y
npm ERR!   peer eslint-plugin-jsx-a11y@"^5.1.1" from eslint-config-airbnb@15.1.0
npm ERR!   node_modules/eslint-config-airbnb
npm ERR!     dev eslint-config-airbnb@"15.1.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! 
npm ERR! For a full report see:
npm ERR! /tmp/renovate-cache/others/npm/_logs/2022-11-20T20_35_15_354Z-eresolve-report.txt

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate-cache/others/npm/_logs/2022-11-20T20_35_15_354Z-debug-0.log

secure-code-warrior-for-github[bot] commented 2 years ago

Micro-Learning Topic: Cross-site scripting (Detected by phrase)

Matched on "cross-site scripting"

What is this? (2min video)

Cross-site scripting vulnerabilities occur when unescaped input is rendered into a page displayed to the user. When HTML or script is included in the input, it will be processed by a user's browser as HTML or script and can alter the appearance of the page or execute malicious scripts in their user context.

Try a challenge in Secure Code Warrior

Helpful references

Prevent Cross-Site Scripting (XSS) in ASP.NET Core - A detailed Microsoft article on how to prevent cross-site scripting in ASP.NET Core.
OWASP Cross Site Scripting (XSS) Software Attack - OWASP community page with comprehensive information about cross site scripting, and links to various OWASP resources to help detect or prevent it.
OWASP Cross Site Scripting Prevention Cheat Sheet - This article provides a simple positive model for preventing XSS using output encoding properly.

Micro-Learning Topic: Race condition (Detected by phrase)

Matched on "race condition"

What is this? (2min video)

A race condition is a flaw that produces an unexpected result when the timing of actions impact other actions.

yurikrupnik / node-playground