Update dependency class-validator to v0.14.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
class-validator	0.13.2 -> 0.14.0

GitHub Vulnerability Alerts

CVE-2019-18413

In TypeStack class-validator, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input.

The default settings for forbidUnknownValues has been changed to true in 0.14.0.

NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.

---

Release Notes

typestack/class-validator (class-validator)

v0.14.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pnpm-lock.yaml

Scope: all 23 workspace projects
Progress: resolved 0, reused 1, downloaded 0, added 0
Progress: resolved 70, reused 69, downloaded 0, added 0
Progress: resolved 70, reused 70, downloaded 0, added 0
demo/api                                 |  WARN  deprecated [email protected]
demo/api                                 |  WARN  deprecated [email protected]
demo/api                                 |  WARN  deprecated [email protected]
demo/site                                |  WARN  deprecated @googlemaps/[email protected]
packages/admin/admin-rte                 |  WARN  deprecated @types/[email protected]
Progress: resolved 270, reused 269, downloaded 0, added 0
storybook                                |  WARN  deprecated @storybook/[email protected]
Progress: resolved 369, reused 368, downloaded 0, added 0
Progress: resolved 463, reused 437, downloaded 0, added 0
Progress: resolved 712, reused 642, downloaded 0, added 0
Progress: resolved 973, reused 900, downloaded 0, added 0
Progress: resolved 1325, reused 1252, downloaded 0, added 0
Progress: resolved 1502, reused 1428, downloaded 0, added 0
Progress: resolved 1732, reused 1671, downloaded 1, added 0
Progress: resolved 2031, reused 1974, downloaded 1, added 0
Progress: resolved 2285, reused 2229, downloaded 1, added 0
Progress: resolved 2649, reused 2591, downloaded 2, added 0
Progress: resolved 3188, reused 3130, downloaded 2, added 0
Progress: resolved 3507, reused 3450, downloaded 2, added 0
 WARN  38 deprecated subdependencies found: @babel/[email protected], @npmcli/[email protected], @types/[email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Progress: resolved 3561, reused 3504, downloaded 2, added 0
Progress: resolved 3561, reused 3504, downloaded 2, added 0, done
 ERR_PNPM_PEER_DEP_ISSUES  Unmet peer dependencies

demo/admin
├─┬ @mui/x-data-grid 5.17.20
│ ├── ✕ unmet peer @mui/material@^5.4.1: found 6.1.2
│ └── ✕ unmet peer @mui/system@^5.4.1: found 6.1.2
└─┬ @mui/x-data-grid-pro 5.17.20
  ├── ✕ unmet peer @mui/material@^5.4.1: found 6.1.2
  └── ✕ unmet peer @mui/system@^5.4.1: found 6.1.2

demo/api
└─┬ @nestjs/graphql 10.1.7
  └─┬ @nestjs/mapped-types 1.2.0
    └── ✕ unmet peer class-validator@"^0.11.1 || ^0.12.0 || ^0.13.0": found 0.14.0

docs
└─┬ @mui/x-data-grid 5.17.20
  ├── ✕ unmet peer @mui/material@^5.4.1: found 6.1.2
  └── ✕ unmet peer @mui/system@^5.4.1: found 6.1.2

packages/admin/admin
└─┬ @mui/x-data-grid 5.17.20
  ├── ✕ unmet peer @mui/material@^5.4.1: found 6.1.2
  └── ✕ unmet peer @mui/system@^5.4.1: found 6.1.2

packages/admin/admin-theme
└─┬ @mui/x-data-grid 5.17.20
  ├── ✕ unmet peer @mui/material@^5.4.1: found 6.1.2
  └── ✕ unmet peer @mui/system@^5.4.1: found 6.1.2

packages/admin/cms-admin
└─┬ @mui/x-data-grid 5.17.20
  ├── ✕ unmet peer @mui/material@^5.4.1: found 6.1.2
  └── ✕ unmet peer @mui/system@^5.4.1: found 6.1.2

packages/api/cms-api
└─┬ @nestjs/graphql 10.1.7
  └─┬ @nestjs/mapped-types 1.2.0
    └── ✕ unmet peer class-validator@"^0.11.1 || ^0.12.0 || ^0.13.0": found 0.14.0

storybook
├─┬ @mui/x-data-grid 5.17.20
│ ├── ✕ unmet peer @mui/material@^5.4.1: found 6.1.2
│ └── ✕ unmet peer @mui/system@^5.4.1: found 6.1.2
└─┬ @mui/x-data-grid-pro 5.17.20
  ├── ✕ unmet peer @mui/material@^5.4.1: found 6.1.2
  └── ✕ unmet peer @mui/system@^5.4.1: found 6.1.2

hint: If you don't want pnpm to fail on peer dependency issues, add "strict-peer-dependencies=false" to an .npmrc file at the root of your project.