chore(deps): update dependency ua-parser-js to v0.7.33 [security] #25561
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/npm-ua-parser-js-vulnerability
branch
from
84e67a2
to
c747eb2
Compare
…/npm-ua-parser-js-vulnerability
…cypress-io/cypress into renovate/npm-ua-parser-js-vulnerability
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. ⚠ Warning: custom changes will be lost. |
AtofStryker
approved these changes
Jan 25, 2023
flotwig
approved these changes
Jan 25, 2023
tgriesser
added a commit
that referenced
this pull request
Jan 26, 2023
* develop: (27 commits) refactor: remove unused cloud routes (#25584) chore: fix issue template formatting issue (#25587) fix: fixed issue with CT + electron + run mode not exiting properly (#25585) chore(deps): update dependency ua-parser-js to v0.7.33 [security] (#25561) fix: add alternative binary names for edge-beta (#25456) chore: add batch execution to CloudDataSource (#22457) chore: End a/b campaigns for aci smart banners (#25504) chore: release @cypress/schematic-v2.5.0 fix(cypress-schematic): do not disable e2e support file (#25400) chore: adding memory issue template (#25559) feat: Add Angular CT Schematic (#24374) chore: enforce changelog entries on PR reviews (#25459) chore: bump package.json to 12.4.0 [run ci] (#25556) feat: Add 'type' option to `.as` to store aliases by value (#25251) chore: release @cypress/webpack-dev-server-v3.2.3 feat: Display line break in cy.log (#25467) chore: update types (#25538) fix: Revert "fix: adding emergency garbage collection for chromium-based browsers" (#25546) fix: percy - wait to take snapshot until previous tooltips are gone (#25522) feat: support data-qa selector in selector playground (#25475) ...
|
Released in This comment thread has been locked. If you are still experiencing this issue after upgrading to |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.7.24->0.7.33GitHub Vulnerability Alerts
CVE-2022-25927
Description:
A regular expression denial of service (ReDoS) vulnerability has been discovered in
ua-parser-js.Impact:
This vulnerability bypass the library's
MAX_LENGTHinput limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.Affected Versions:
All versions of the library prior to version
0.7.33/1.0.33.Patches:
A patch has been released to remove the vulnerable regular expression, update to version
0.7.33/1.0.33or later.References:
Regular expression Denial of Service - ReDoS
Credits:
Thanks to @Snyk who first reported the issue.
Release Notes
faisalman/ua-parser-js
v0.7.33Compare Source
v0.7.32Compare Source
v0.7.31Compare Source
v0.7.30Compare Source
v0.7.28Compare Source
v0.7.27Compare Source
v0.7.26Compare Source
v0.7.25Compare Source
Configuration
📅 Schedule: Branch creation - "" in timezone America/New_York, Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.