New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency grunt to v1 [SECURITY] #15

Open

renovate wants to merge 1 commit into master from renovate/npm-grunt-vulnerability

renovate bot commented May 9, 2021 •

edited

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
grunt (source)	`~0.4.1` -> `~1.5.3`

GitHub Vulnerability Alerts

CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

CVE-2022-0436

Grunt prior to version 1.5.2 is vulnerable to path traversal.

CVE-2022-1537

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.

Release Notes

gruntjs/grunt (grunt)

`v1.5.3`

Merge pull request #1745 from gruntjs/fix-copy-op 572d79b
Patch up race condition in symlink copying. 58016ff
Merge pull request #1746 from JamieSlome/patch-1 0749e1d
Create SECURITY.md 69b7c50

`v1.5.2`

Update Changelog 7f15fd5
Merge pull request #1743 from gruntjs/cleanup-link b0ec6e1
Clean up link handling 433f91b

`v1.5.1`

Merge pull request #1742 from gruntjs/update-symlink-test ad22608
Fix symlink test 0652305

`v1.5.0`

Updated changelog b2b2c2b
Merge pull request #1740 from gruntjs/update-deps-22-10 3eda6ae
Update testing matrix 47d32de
More updates 2e9161c
Remove console log 04b960e
Update dependencies, tests... aad3d45
Merge pull request #1736 from justlep/main fdc7056
support .cjs extension e35fe54

`v1.4.1`

Update Changelog e7625e5
Merge pull request #1731 from gruntjs/update-options 5d67e34
Fix ci install d13bf88
Switch to Actions 08896ae
Update grunt-known-options eee0673
Add note about a breaking change 1b6e288

`v1.4.0`

Merge pull request #1728 from gruntjs/update-deps-changelog 63b2e89
Update changelog and util dep 106ed17
Merge pull request #1727 from gruntjs/update-deps-apr 49de70b
Update CLI and nodeunit 47cf8b6
Merge pull request #1722 from gruntjs/update-through e86db1c
Update deps 4952368

`v1.3.0`

Merge pull request #1720 from gruntjs/update-changelog-deps faab6be
Update Changelog and legacy-util dependency 520fedb
Merge pull request #1719 from gruntjs/yaml-refactor 7e669ac
Switch to use safeLoad for loading YML files via file.readYAML. e350cea
Merge pull request #1718 from gruntjs/legacy-log-bumo 7125f49
Bump legacy-log 00d5907

`v1.2.1`

Changelog update ae11839
Merge pull request #1715 from sibiraj-s/remove-path-is-absolute 9d23cb6
Remove path-is-absolute dependency e789b1f

`v1.2.0`

Allow usage of grunt plugins that are located in any location that
is visible to Node.js and NPM, instead of node_modules directly
inside package that have a dev dependency to these pluginhttps://github.com/gruntjs/grunt/pull/1677nt/pull/1677)
Removed coffeescript from dependencies. To ease transition, if
coffeescript is still around, Grunt will attempt to load it.
If it is not, and the user loads a CoffeeScript file,
Grunt will print a useful error indicating that the
coffeescript package should be installed as a dev dependency.
This is considerably more user-friendly than dropping the require entirely,
but doing so is feasible with the latest grunt-cli as users
may simply use grunt --require https://github.com/gruntjs/grunt/pull/1675thub.com/Remove coffeescript from dependencies. gruntjs/grunt#1675)
Exposes Grunt Option keys for ease of use.
(https://github.com/gruntjs/grunt/pull/15701570)
Avoiding infinite loop on very long command names.
(https://github.com/gruntjs/grunt/pull/16971697)

`v1.1.0`

Update to mkdirp ~1.0.3
Only support versions of Node >= 8

`v1.0.4`

`v1.0.3`

`v1.0.2`

`v1.0.1`

`v1.0.0`

`v0.4.5`

`v0.4.4`

`v0.4.3`

`v0.4.2`

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from 5f07afd to 2097a28 Compare

April 24, 2022 18:28

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from 2097a28 to dccd390 Compare

March 16, 2023 06:57

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from dccd390 to c2f5601 Compare

March 25, 2023 00:47

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 2 times, most recently from aedc453 to fba392d Compare

April 3, 2023 11:40

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 2 times, most recently from 8c2c231 to ef1fba4 Compare

April 17, 2023 14:33

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 2 times, most recently from 5e84f96 to d585e87 Compare

May 28, 2023 15:32

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 2 times, most recently from d5402a4 to bb3df45 Compare

June 4, 2023 17:26

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 6 times, most recently from 48f8b6c to 0561220 Compare

June 19, 2023 11:36

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 5 times, most recently from 51a1c86 to aed00a1 Compare

July 6, 2023 11:05

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 3 times, most recently from e1584ef to a303974 Compare

July 9, 2023 13:36

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 4 times, most recently from 7778101 to 62f80a9 Compare

July 19, 2023 15:13

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from 62f80a9 to c0de28a Compare

July 27, 2023 17:38

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from 0dc4d00 to a07d2b6 Compare

December 3, 2023 16:11

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 4 times, most recently from 3c42971 to 4e23419 Compare

January 9, 2024 09:51

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 2 times, most recently from 897a9d3 to 5bd1e48 Compare

January 16, 2024 17:20

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 3 times, most recently from ad01907 to 0a4fff2 Compare

February 4, 2024 09:46

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from 0a4fff2 to 103cb04 Compare

February 4, 2024 13:31

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 4 times, most recently from d1a4425 to d54d653 Compare

February 29, 2024 14:34

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 2 times, most recently from 66a1c96 to 3e59034 Compare

March 12, 2024 15:36

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 4 times, most recently from 190eb16 to e42150e Compare

March 24, 2024 15:23

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 3 times, most recently from 0e874ea to 57c70f7 Compare

April 21, 2024 11:31

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch 3 times, most recently from 84df344 to bf98fc1 Compare

April 25, 2024 16:40

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from bf98fc1 to 0838d57 Compare

May 1, 2024 09:50


          Update dependency grunt to v1 [SECURITY]

7c6ea90

renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from 0838d57 to 7c6ea90 Compare

May 1, 2024 13:13

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment