Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

⬆️ Updates qs to v6.9.7 [SECURITY] #559

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Jun 1, 2023

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
qs 6.9.6 -> 6.9.7 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2022-24999

qs before 6.10.3 allows attackers to cause a Node process hang because an __ proto__ key can be used. In many typical web framework use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[__proto__]=b&a[__proto__]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4.


Release Notes

ljharb/qs (qs)

v6.9.7

Compare Source

  • [Fix] parse: ignore __proto__ keys (#​428)
  • [Fix] stringify: avoid encoding arrayformat comma when encodeValuesOnly = true (#​424)
  • [Robustness] stringify: avoid relying on a global undefined (#​427)
  • [readme] remove travis badge; add github actions/codecov badges; update URLs
  • [Docs] add note and links for coercing primitive values (#​408)
  • [Tests] clean up stringify tests slightly
  • [meta] fix README.md (#​399)
  • Revert "[meta] ignore eclint transitive audit warning"
  • [actions] backport actions from main
  • [Dev Deps] backport updates from main

Configuration

📅 Schedule: Branch creation - "" in timezone Europe/Moscow, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate
Copy link
Contributor Author

renovate bot commented Jun 1, 2023

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.


  • Branch has one or more failed status checks

@auto-assign auto-assign bot requested a review from AlexRogalskiy June 1, 2023 03:59
@changelogg
Copy link

changelogg bot commented Jun 1, 2023

Hey! Changelogs info seems to be missing or might be in incorrect format.
Please use the below template in PR description to ensure Changelogg can detect your changes:
- (tag) changelog_text
or
- tag: changelog_text
OR
You can add tag in PR header or while doing a commit too
(tag) PR header
or
tag: PR header
Valid tags: added / feat, changed, deprecated, fixed / fix, removed, security, build, ci, chore, docs, perf, refactor, revert, style, test
Thanks!
For more info, check out changelogg docs

@viezly
Copy link

viezly bot commented Jun 1, 2023

Pull request by bot. No need to analyze

@github-actions
Copy link

github-actions bot commented Jun 1, 2023

Thanks for the PR!

This section of the codebase is owner by https://github.com/AlexRogalskiy/ - if they write a comment saying "LGTM" then it will be merged.

@github-actions
Copy link

github-actions bot commented Jun 1, 2023

🏷️ [bumpr] Next version:v1.16.1 Changes:v1.16.0...AlexRogalskiy:renovate/npm-qs-vulnerability

@socket-security
Copy link

socket-security bot commented Jun 1, 2023

👍 Dependency issues cleared. Learn more about Socket for GitHub ↗︎

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report↗︎

@renovate renovate bot force-pushed the renovate/npm-qs-vulnerability branch from 5182377 to 469ab9a Compare January 5, 2024 05:09
Copy link

socket-security bot commented Jan 5, 2024

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/qs@6.9.7 None 0 170 kB ljharb

🚮 Removed packages: npm/qs@6.9.6

View full report↗︎

@renovate renovate bot changed the title ⬆️ Updates qs to v6.9.7 [SECURITY] ⬆️ Updates qs to v6.9.7 [SECURITY] - autoclosed Apr 24, 2024
@renovate renovate bot closed this Apr 24, 2024
@renovate renovate bot deleted the renovate/npm-qs-vulnerability branch April 24, 2024 13:39
@renovate renovate bot changed the title ⬆️ Updates qs to v6.9.7 [SECURITY] - autoclosed ⬆️ Updates qs to v6.9.7 [SECURITY] Apr 24, 2024
@renovate renovate bot reopened this Apr 24, 2024
@renovate renovate bot restored the renovate/npm-qs-vulnerability branch April 24, 2024 17:46
@renovate renovate bot force-pushed the renovate/npm-qs-vulnerability branch from 469ab9a to f1a4aa4 Compare April 24, 2024 17:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

0 participants