Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🤖 Dependency update #179

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

🤖 Dependency update #179

wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link

@renovate renovate bot commented Aug 21, 2023

Mend Renovate

This PR contains the following updates:

Package Type Update Change Age Adoption Passing Confidence
node major 12.18.3 -> 18.17.1 age adoption passing confidence
lockFileMaintenance All locks refreshed age adoption passing confidence
@types/node (source) devDependencies major 14.14.28 -> 20.5.1 age adoption passing confidence
@types/react (source) devDependencies major 17.0.2 -> 18.2.20 age adoption passing confidence
@types/react-copy-to-clipboard (source) devDependencies patch 5.0.0 -> 5.0.4 age adoption passing confidence
@types/styled-components (source) devDependencies patch 5.1.7 -> 5.1.26 age adoption passing confidence
axios (source) dependencies patch 0.21.1 -> 0.21.2 age adoption passing confidence
babel-plugin-styled-components (source) devDependencies major 1.12.0 -> 2.1.4 age adoption passing confidence
circleci/node docker major 12.18.3 -> 17.2.0 age adoption passing confidence
eslint (source) devDependencies major 7.20.0 -> 8.47.0 age adoption passing confidence
eslint-config-airbnb devDependencies major 18.2.1 -> 19.0.4 age adoption passing confidence
eslint-config-prettier devDependencies major 7.2.0 -> 9.0.0 age adoption passing confidence
eslint-plugin-import devDependencies minor 2.22.1 -> 2.28.1 age adoption passing confidence
eslint-plugin-jest devDependencies major 24.1.3 -> 27.2.3 age adoption passing confidence
eslint-plugin-jsx-a11y devDependencies minor 6.4.1 -> 6.7.1 age adoption passing confidence
eslint-plugin-prettier devDependencies major 3.3.1 -> 5.0.0 age adoption passing confidence
eslint-plugin-react devDependencies minor 7.22.0 -> 7.33.2 age adoption passing confidence
jest (source) devDependencies major 26.6.3 -> 29.6.2 age adoption passing confidence
next (source) dependencies major 10.0.6 -> 12.1.0 age adoption passing confidence
node engines major 12.20.1 -> 18.17.1 age adoption passing confidence
prettier (source) dependencies major 2.2.1 -> 3.0.2 age adoption passing confidence
prettier (source) devDependencies major 2.2.1 -> 3.0.2 age adoption passing confidence
prop-types (source) dependencies minor 15.7.2 -> 15.8.1 age adoption passing confidence
react (source) dependencies major 17.0.1 -> 18.2.0 age adoption passing confidence
react-copy-to-clipboard dependencies minor 5.0.3 -> 5.1.0 age adoption passing confidence
react-dom (source) dependencies major 17.0.1 -> 18.2.0 age adoption passing confidence
react-dropzone dependencies major 11.3.1 -> 14.2.3 age adoption passing confidence
svgo dependencies major 1.3.2 -> 3.0.2 age adoption passing confidence
styled-components (source) dependencies major 5.2.1 -> 6.0.7 age adoption passing confidence
typescript (source) devDependencies major 4.1.5 -> 5.1.6 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2021-3749

axios before v0.21.2 is vulnerable to Inefficient Regular Expression Complexity.

CVE-2021-39178

Impact

  • Affected: All of the following must be true to be affected
    • Next.js between version 10.0.0 and 11.1.0
    • The next.config.js file has images.domains array assigned
    • The image host assigned in images.domains allows user-provided SVG
  • Not affected: The next.config.js file has images.loader assigned to something other than default
  • Not affected: Deployments on Vercel are not affected

Patches

Next.js v11.1.1

CVE-2022-23646

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the next.config.js file must have an images.domains array assigned and the image host assigned in images.domains must allow user-provided SVG. If the next.config.js file has images.loader assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change next.config.js to use a different loader configuration other than the default.

Impact

  • Affected: All of the following must be true to be affected
    • Next.js between version 10.0.0 and 12.0.10
    • The next.config.js file has images.domains array assigned
    • The image host assigned in images.domains allows user-provided SVG
  • Not affected: The next.config.js file has images.loader assigned to something other than default

Patches

Next.js 12.1.0

Workarounds

Change next.config.js to use a different loader configuration other than the default, for example:

module.exports = {
  images: {
    loader: 'imgix',
    path: 'https://example.com/myaccount/',
  },
}

Or if you want to use the loader prop on the component, you can use custom:

module.exports = {
  images: {
    loader: 'custom',
  },
}

CVE-2021-43803

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. Note that prior version 0.9.9 package next hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

CVE-2021-37699

Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated, allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although it can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.

Impact

  • Affected: Users of Next.js between 10.0.5 and 10.2.0
  • Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/_error.js without getInitialProps
  • Affected: Users of Next.js between 11.0.0 and 11.0.1 using pages/_error.js and next export
  • Not affected: Deployments on Vercel (vercel.com) are not affected
  • Not affected: Deployments with pages/404.js
  • Note that versions prior to 0.9.9 package next npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

We recommend upgrading to the latest version of Next.js to improve the overall security of your application.

Patches

https://github.com/vercel/next.js/releases/tag/v11.1.0

Release Notes

nodejs/node (node)

v18.17.1: 2023-08-09, Version 18.17.1 'Hydrogen' (LTS), @​RafaelGSS

Compare Source

This is a security release.

Notable Changes

The following CVEs are fixed in this release:

More detailed information on each of the vulnerabilities can be found in August 2023 Security Releases blog post.

Commits

v18.17.0: 2023-07-18, Version 18.17.0 'Hydrogen' (LTS), @​danielleadams

Compare Source

Notable Changes
Ada 2.0

Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements
to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url.

Ada 2.0 has been integrated into the Node.js codebase, ensuring that all parts of the application can benefit from the
improved performance. Additionally, Ada 2.0 features a significant performance boost over its predecessor, Ada 1.0.4,
while also eliminating the need for the ICU requirement for URL hostname parsing.

Contributed by Yagiz Nizipli and Daniel Lemire in #​47339

Web Crypto API

Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations.
This further improves interoperability with other implementations of Web Crypto API.

Contributed by Filip Skokan in #​46067

  • crypto:
    • update root certificates to NSS 3.89 (Node.js GitHub Bot) #​47659
  • dns:
    • (SEMVER-MINOR) expose getDefaultResultOrder (btea) #​46973
  • doc:
    • add ovflowd to collaborators (Claudio Wunder) #​47844
    • add KhafraDev to collaborators (Matthew Aitken) #​47510
  • events:
    • (SEMVER-MINOR) add getMaxListeners method (Matthew Aitken) #​47039
  • fs:
    • (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #​47084
    • (SEMVER-MINOR) add recursive option to readdir and opendir (Ethan Arrowood) #​41439
    • (SEMVER-MINOR) add support for mode flag to specify the copy behavior (Tetsuharu Ohzeki) #​47084
    • (SEMVER-MINOR) implement byob mode for readableWebStream() (Debadree Chatterjee) #​46933
  • http:
    • (SEMVER-MINOR) prevent writing to the body when not allowed by HTTP spec (Gerrard Lindsay) #​47732
    • (SEMVER-MINOR) remove internal error in assignSocket (Matteo Collina) #​47723
    • (SEMVER-MINOR) add highWaterMark opt in http.createServer (HinataKah0) #​47405
  • lib:
    • (SEMVER-MINOR) add webstreams to Duplex.from() (Debadree Chatterjee) #​46190
    • (SEMVER-MINOR) implement AbortSignal.any() (Chemi Atlow) #​47821
  • module:
    • change default resolver to not throw on unknown scheme (Gil Tayar) #​47824
  • node-api:
    • (SEMVER-MINOR) define version 9 (Chengzhong Wu) #​48151
    • (SEMVER-MINOR) deprecate napi_module_register (Vladimir Morozov) #​46319
  • stream:
    • (SEMVER-MINOR) preserve object mode in compose (Raz Luvaton) #​47413
    • (SEMVER-MINOR) add setter & getter for default highWaterMark (#​46929) (Robert Nagy) #​46929
  • test:
    • unflake test-vm-timeout-escape-nexttick (Santiago Gimeno) #​48078
  • test_runner:
    • (SEMVER-MINOR) add shorthands to test (Chemi Atlow) #​47909
    • (SEMVER-MINOR) support combining coverage reports (Colin Ihrig) #​47686
    • (SEMVER-MINOR) execute before hook on test (Chemi Atlow) #​47586
    • (SEMVER-MINOR) expose reporter for use in run api (Chemi Atlow) #​47238
  • tools:
    • update LICENSE and license-builder.sh (Santiago Gimeno) #​48078
  • url:
    • (SEMVER-MINOR) implement URL.canParse (Matthew Aitken) #​47179
  • wasi:
    • (SEMVER-MINOR) no longer require flag to enable wasi (Michael Dawson) #​47286
Commits

Configuration

📅 Schedule: Branch creation - "before 5am on monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@vercel
Copy link

vercel bot commented Aug 21, 2023

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Updated (UTC)
svg2jsx ❌ Failed (Inspect) Aug 21, 2023 1:57am

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
0 participants