Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): [security] bump y18n from 4.0.0 to 4.0.3 #108

Merged
merged 2 commits into from
Jul 14, 2022
Merged

fix(deps): [security] bump y18n from 4.0.0 to 4.0.3 #108

merged 2 commits into from
Jul 14, 2022

Conversation

dependabot-preview[bot]
Copy link
Contributor

Bumps y18n from 4.0.0 to 4.0.3. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Prototype Pollution

Overview

The npm package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution.

POC

const y18n = require('y18n')();

y18n.setLocale('proto');
y18n.updateLocale({polluted: true});


console.log(polluted); // true

Recommendation

Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.

Affected versions: = 4.0.0

Changelog

Sourced from y18n's changelog.

4.0.3 (2021-04-07)

Bug Fixes

  • release: 4.x.x should not enforce Node 10 (#126) (1e21a53)

4.0.1 (2020-11-30)

Bug Fixes

Commits
Maintainer changes

This version was pushed to npm by oss-bot, a new releaser for y18n since your current version.


Dependabot compatibility score

You can trigger a rebase of this PR by commenting @dependabot rebase.

If all status checks pass Dependabot will automatically merge this pull request during working hours.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in the .dependabot/config.yml file in this repo:

  • Update frequency
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

@dependabot-preview
fix(deps): [security] bump y18n from 4.0.0 to 4.0.3
651efde 
Bumps [y18n](https://github.com/yargs/y18n) from 4.0.0 to 4.0.3. **This update includes a security fix.**
- [Release notes](https://github.com/yargs/y18n/releases)
- [Changelog](https://github.com/yargs/y18n/blob/y18n-v4.0.3/CHANGELOG.md)
- [Commits](yargs/y18n@v4.0.0...y18n-v4.0.3)

Signed-off-by: dependabot-preview[bot] <[email protected]>
@dependabot-preview dependabot-preview bot added dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability labels Apr 8, 2021
@dependabot-preview dependabot-preview bot mentioned this pull request Apr 8, 2021
Closed
@dependabot-preview
Copy link
Contributor Author

One of your CI runs failed on this pull request, so Dependabot won't merge it.

Dependabot will still automatically merge this pull request if you amend it and your tests pass.

@dependabot-preview
Copy link
Contributor Author

This pull request will no longer be automatically closed when a new version is found as this pull request was created by Dependabot Preview and this repo is using a version: 2 config file. You can close this pull request and let Dependabot re-create it the next time it checks for updates.

@decyjphr decyjphr merged commit 6ca16c6 into main-enterprise Jul 14, 2022
@decyjphr decyjphr deleted the dependabot-npm_and_yarn-y18n-4.0.3 branch July 14, 2022 04:06
torgst added a commit to helse-sorost/safe-settings that referenced this pull request Sep 14, 2024
@torgst
fix environments updating global array
2bf5f87 
The environments plugin was changing `MergeDeep.NAME_FIELDS`, which is a global object. The reason was to avoid environments being filtered out from the change list if they only have a name field.
However, the environments plugin has it's own overriden sync method, and thus we can simply drop the whole filtering from that method.

Fixes github#108
torgst added a commit to helse-sorost/safe-settings that referenced this pull request Sep 14, 2024
@torgst
fix environments updating global array
b3077ed 
The environments plugin was changing `MergeDeep.NAME_FIELDS`, which is a global object. The reason was to avoid environments being filtered out from the change list if they only have a name field.
However, the environments plugin has it's own overriden sync method, and thus we can simply drop the whole filtering from that method.

Fixes github#108
torgst added a commit to helse-sorost/safe-settings that referenced this pull request Sep 14, 2024
@torgst
fix environments updating global array
9ba0165 
The environments plugin was changing `MergeDeep.NAME_FIELDS`, which is a global object. The reason was to avoid environments being filtered out from the change list if they only have a name field.
However, the environments plugin has it's own overriden sync method, and thus we can simply drop the whole filtering from that method.

Fixes github#108
decyjphr added a commit that referenced this pull request Sep 16, 2024
@decyjphr @torgst
Decyjphr/pr 682 (#685)
610094d 
* update comments from #249

I found the logic behind some of what happened here hard to follow and updated the comments to try to make it easier to follow.

* fix environments updating global array

The environments plugin was changing `MergeDeep.NAME_FIELDS`, which is a global object. The reason was to avoid environments being filtered out from the change list if they only have a name field.
However, the environments plugin has it's own overriden sync method, and thus we can simply drop the whole filtering from that method.

Fixes #108

* remove repeating line

This has to be a "typo" from 9a74e05 calling the same assignment twice. Removing to clean up.

---------

Co-authored-by: Torgeir S. hos Sykehuspartner <[email protected]>
decyjphr pushed a commit that referenced this pull request Sep 16, 2024
@torgst
Fix: array comparison breaks if using the environments plugin (#682)
85aae4f 
* update comments from #249

I found the logic behind some of what happened here hard to follow and updated the comments to try to make it easier to follow.

* fix environments updating global array

The environments plugin was changing `MergeDeep.NAME_FIELDS`, which is a global object. The reason was to avoid environments being filtered out from the change list if they only have a name field.
However, the environments plugin has it's own overriden sync method, and thus we can simply drop the whole filtering from that method.

Fixes #108

* remove repeating line

This has to be a "typo" from 9a74e05 calling the same assignment twice. Removing to clean up.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@decyjphr