🚨 [security] Update grunt: 1.0.3 → 1.5.3 (minor)

[depfu]

---

Welcome to Depfu 👋

This is one of the first three pull requests with dependency updates we've sent your way. We tried to start with a few easy patch-level updates. Hopefully your tests will pass and you can merge this pull request without too much risk. This should give you an idea how Depfu works in general.

After you merge your first pull request, we'll send you a few more. We'll never open more than seven PRs at the same time so you're not getting overwhelmed with updates.

Let us know if you have any questions. Thanks so much for giving Depfu a try!

---

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ grunt (1.0.3 → 1.5.3) · Repo · Changelog

Security Advisories 🚨

🚨 Race Condition in Grunt

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.

🚨 Path Traversal in Grunt

Grunt prior to version 1.5.2 is vulnerable to path traversal.

🚨 Arbitrary Code Execution in grunt

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

Release Notes

1.5.3

• Merge pull request #1745 from gruntjs/fix-copy-op 572d79b
• Patch up race condition in symlink copying. 58016ff
• Merge pull request #1746 from JamieSlome/patch-1 0749e1d
• Create SECURITY.md 69b7c50

v1.5.2...v1.5.3

1.5.2

• Update Changelog 7f15fd5
• Merge pull request #1743 from gruntjs/cleanup-link b0ec6e1
• Clean up link handling 433f91b

v1.5.1...v1.5.2

1.5.1

• Merge pull request #1742 from gruntjs/update-symlink-test ad22608
• Fix symlink test 0652305

v1.5.0...v1.5.1

1.5.0

• Updated changelog b2b2c2b
• Merge pull request #1740 from gruntjs/update-deps-22-10 3eda6ae
• Update testing matrix 47d32de
• More updates 2e9161c
• Remove console log 04b960e
• Update dependencies, tests... aad3d45
• Merge pull request #1736 from justlep/main fdc7056
• support .cjs extension e35fe54

v1.4.1...v1.5.0

1.4.1

• Update Changelog e7625e5
• Merge pull request #1731 from gruntjs/update-options 5d67e34
• Fix ci install d13bf88
• Switch to Actions 08896ae
• Update grunt-known-options eee0673
• Add note about a breaking change 1b6e288

v1.4.0...v1.4.1

1.4.0

• Merge pull request #1728 from gruntjs/update-deps-changelog 63b2e89
• Update changelog and util dep 106ed17
• Merge pull request #1727 from gruntjs/update-deps-apr 49de70b
• Update CLI and nodeunit 47cf8b6
• Merge pull request #1722 from gruntjs/update-through e86db1c
• Update deps 4952368

v1.3.0...v1.4.0

1.3.0

• Merge pull request #1720 from gruntjs/update-changelog-deps faab6be
• Update Changelog and legacy-util dependency 520fedb
• Merge pull request #1719 from gruntjs/yaml-refactor 7e669ac
• Switch to use safeLoad for loading YML files via file.readYAML. e350cea
• Merge pull request #1718 from gruntjs/legacy-log-bumo 7125f49
• Bump legacy-log 00d5907

v1.2.1...v1.3.0

1.2.1

• Changelog update ae11839
• Merge pull request #1715 from sibiraj-s/remove-path-is-absolute 9d23cb6
• Remove path-is-absolute dependency e789b1f

v1.2.0...v1.2.1

1.2.0

• Allow usage of grunt plugins that are located in any location that
  is visible to Node.js and NPM, instead of node_modules directly
  inside package that have a dev dependency to these plugins.
  (PR: #1677)
• Removed coffeescript from dependencies. To ease transition, if
  coffeescript is still around, Grunt will attempt to load it.
  If it is not, and the user loads a CoffeeScript file,
  Grunt will print a useful error indicating that the
  coffeescript package should be installed as a dev dependency.
  This is considerably more user-friendly than dropping the require entirely,
  but doing so is feasible with the latest grunt-cli as users
  may simply use grunt --require coffeescript/register.
  (PR: #1675)
• Exposes Grunt Option keys for ease of use.
  (PR: #1570)
• Avoiding infinite loop on very long command names.
  (PR: #1697)

1.1.0

• Update to mkdirp ~1.0.3
• Only support versions of Node >= 8

1.0.4 (from changelog)

  date: 2019-04-22
  changes:
    - Update js-yaml to address https://npmjs.com/advisories/788
    - Use SOURCE_DATE_EPOCH to render dates in template.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[depfu]

Closed in favor of #93.