Update dependency cached-path-relative to v1.1.0 [SECURITY] #953
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
from
85b88a9
to
73942c0
Compare
renovate
bot
changed the title
renovate
bot
deleted the
renovate/npm-cached-path-relative-vulnerability
branch
renovate
bot
changed the title
renovate
bot
restored the
renovate/npm-cached-path-relative-vulnerability
branch
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
from
73942c0
to
cad0943
Compare
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
3 times, most recently
from
d4aff29
to
87b8dc4
Compare
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
from
87b8dc4
to
68afbf5
Compare
|
|
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
from
68afbf5
to
d314e88
Compare
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
from
d314e88
to
548fe5f
Compare
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
4 times, most recently
from
a0c7f0a
to
296f7ac
Compare
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
from
296f7ac
to
d54d45e
Compare
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
from
d54d45e
to
52a5f4a
Compare
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
from
52a5f4a
to
70f0ad7
Compare
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
3 times, most recently
from
00e21ec
to
138cebe
Compare
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
from
138cebe
to
34412af
Compare
renovate
bot
force-pushed
the
renovate/npm-cached-path-relative-vulnerability
branch
from
34412af
to
5e924e3
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.0.2->1.1.0GitHub Vulnerability Alerts
CVE-2021-23518
The package cached-path-relative before 1.1.0 is vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as proto, the attribute of the object is accessed instead of a path. Note: This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573
Release Notes
ashaffer/cached-path-relative (cached-path-relative)
v1.1.0Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.