New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency grunt to v1 [SECURITY] #3

Open

renovate wants to merge 1 commit into master from renovate/npm-grunt-vulnerability

renovate bot commented Feb 28, 2024 •

edited

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
grunt (source)	`~0.4.0` -> `~1.5.3`

GitHub Vulnerability Alerts

CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

CVE-2022-0436

Grunt prior to version 1.5.2 is vulnerable to path traversal.

CVE-2022-1537

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.

Release Notes

gruntjs/grunt (grunt)

`v1.5.3`

Merge pull request #1745 from gruntjs/fix-copy-op 572d79b
Patch up race condition in symlink copying. 58016ff
Merge pull request #1746 from JamieSlome/patch-1 0749e1d
Create SECURITY.md 69b7c50

`v1.5.2`

Update Changelog 7f15fd5
Merge pull request #1743 from gruntjs/cleanup-link b0ec6e1
Clean up link handling 433f91b

`v1.5.1`

Merge pull request #1742 from gruntjs/update-symlink-test ad22608
Fix symlink test 0652305

`v1.5.0`

Updated changelog b2b2c2b
Merge pull request #1740 from gruntjs/update-deps-22-10 3eda6ae
Update testing matrix 47d32de
More updates 2e9161c
Remove console log 04b960e
Update dependencies, tests... aad3d45
Merge pull request #1736 from justlep/main fdc7056
support .cjs extension e35fe54

`v1.4.1`

Update Changelog e7625e5
Merge pull request #1731 from gruntjs/update-options 5d67e34
Fix ci install d13bf88
Switch to Actions 08896ae
Update grunt-known-options eee0673
Add note about a breaking change 1b6e288

`v1.4.0`

Merge pull request #1728 from gruntjs/update-deps-changelog 63b2e89
Update changelog and util dep 106ed17
Merge pull request #1727 from gruntjs/update-deps-apr 49de70b
Update CLI and nodeunit 47cf8b6
Merge pull request #1722 from gruntjs/update-through e86db1c
Update deps 4952368

`v1.3.0`

Merge pull request #1720 from gruntjs/update-changelog-deps faab6be
Update Changelog and legacy-util dependency 520fedb
Merge pull request #1719 from gruntjs/yaml-refactor 7e669ac
Switch to use safeLoad for loading YML files via file.readYAML. e350cea
Merge pull request #1718 from gruntjs/legacy-log-bumo 7125f49
Bump legacy-log 00d5907

`v1.2.1`

Changelog update ae11839
Merge pull request #1715 from sibiraj-s/remove-path-is-absolute 9d23cb6
Remove path-is-absolute dependency e789b1f

`v1.2.0`

Allow usage of grunt plugins that are located in any location that
is visible to Node.js and NPM, instead of node_modules directly
inside package that have a dev dependency to these pluginhttps://github.com/gruntjs/grunt/pull/1677nt/pull/1677)
Removed coffeescript from dependencies. To ease transition, if
coffeescript is still around, Grunt will attempt to load it.
If it is not, and the user loads a CoffeeScript file,
Grunt will print a useful error indicating that the
coffeescript package should be installed as a dev dependency.
This is considerably more user-friendly than dropping the require entirely,
but doing so is feasible with the latest grunt-cli as users
may simply use grunt --require https://github.com/gruntjs/grunt/pull/1675thub.com/Remove coffeescript from dependencies. gruntjs/grunt#1675)
Exposes Grunt Option keys for ease of use.
(https://github.com/gruntjs/grunt/pull/15701570)
Avoiding infinite loop on very long command names.
(https://github.com/gruntjs/grunt/pull/16971697)

`v1.1.0`

Update to mkdirp ~1.0.3
Only support versions of Node >= 8

`v1.0.4`

`v1.0.3`

`v1.0.2`

`v1.0.1`

`v1.0.0`

`v0.4.5`

`v0.4.4`

`v0.4.3`

`v0.4.2`

`v0.4.1`

Configuration

📅 Schedule: Branch creation - "" in timezone America/Vancouver, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 4 times, most recently from d2e50ee to 95cee04 Compare

March 1, 2024 08:47

renovate bot changed the title ~~Pin dependency grunt to 0.4.5 [SECURITY]~~ Update dependency grunt to v1 [SECURITY]

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from 95cee04 to 4da68df Compare

March 13, 2024 02:56

renovate bot changed the title ~~Update dependency grunt to v1 [SECURITY]~~ Pin dependency grunt to 0.4.5 [SECURITY]

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from 4da68df to b5a4afb Compare

March 16, 2024 05:35

renovate bot changed the title ~~Pin dependency grunt to 0.4.5 [SECURITY]~~ Update dependency grunt to v1 [SECURITY]

renovate bot changed the title ~~Update dependency grunt to v1 [SECURITY]~~ Pin dependency grunt to 0.4.5 [SECURITY]

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 2 times, most recently from 30cb81d to a909e19 Compare

March 23, 2024 08:52

renovate bot changed the title ~~Pin dependency grunt to 0.4.5 [SECURITY]~~ Update dependency grunt to v1 [SECURITY]

renovate bot changed the title ~~Update dependency grunt to v1 [SECURITY]~~ Pin dependency grunt to 0.4.5 [SECURITY]

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 2 times, most recently from efc46fc to 12c7329 Compare

March 27, 2024 23:49

renovate bot changed the title ~~Pin dependency grunt to 0.4.5 [SECURITY]~~ Update dependency grunt to v1 [SECURITY]

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from 12c7329 to 1c9ced5 Compare

April 14, 2024 23:44

renovate bot changed the title ~~Update dependency grunt to v1 [SECURITY]~~ Pin dependency grunt to 0.4.5 [SECURITY]

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from 1c9ced5 to 072dae3 Compare

April 16, 2024 23:52

renovate bot changed the title ~~Pin dependency grunt to 0.4.5 [SECURITY]~~ Update dependency grunt to v1 [SECURITY]

renovate bot changed the title ~~Update dependency grunt to v1 [SECURITY]~~ Pin dependency grunt to 0.4.5 [SECURITY]

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 2 times, most recently from 7ed9244 to c339159 Compare

April 24, 2024 23:23

renovate bot changed the title ~~Pin dependency grunt to 0.4.5 [SECURITY]~~ Update dependency grunt to v1 [SECURITY]

renovate bot changed the title ~~Update dependency grunt to v1 [SECURITY]~~ Pin dependency grunt to 0.4.5 [SECURITY]

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 2 times, most recently from a06a3c9 to 3c6004d Compare

April 28, 2024 11:57

renovate bot changed the title ~~Pin dependency grunt to 0.4.5 [SECURITY]~~ Update dependency grunt to v1 [SECURITY]

renovate bot changed the title ~~Update dependency grunt to v1 [SECURITY]~~ Pin dependency grunt to 0.4.5 [SECURITY]

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from 3c6004d to aeb53b8 Compare

May 1, 2024 11:14


          Update dependency grunt to v1 [SECURITY]

2c9274c

renovate bot changed the title ~~Pin dependency grunt to 0.4.5 [SECURITY]~~ Update dependency grunt to v1 [SECURITY]

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from aeb53b8 to 2c9274c Compare

May 2, 2024 17:46

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment