fix(deps): update dependency jszip to v3.8.0 [security]#110
fix(deps): update dependency jszip to v3.8.0 [security]#110renovate[bot] wants to merge 1 commit intomasterfrom
Conversation
renovate
bot
added
dependencies
|
Kudos, SonarCloud Quality Gate passed!
|
renovate
bot
force-pushed
the
renovate/npm-jszip-vulnerability/VF-000
branch
from
94a501b to
c8e5877
Compare
|
Kudos, SonarCloud Quality Gate passed!
|
renovate
bot
force-pushed
the
renovate/npm-jszip-vulnerability/VF-000
branch
from
c8e5877 to
a62925c
Compare
|
Kudos, SonarCloud Quality Gate passed!
|
renovate
bot
force-pushed
the
renovate/npm-jszip-vulnerability/VF-000
branch
from
a62925c to
b8dbc16
Compare
|
Kudos, SonarCloud Quality Gate passed!
|
renovate
bot
force-pushed
the
renovate/npm-jszip-vulnerability/VF-000
branch
2 times, most recently
from
b08fdaa to
5ba91f5
Compare
|
renovate
bot
force-pushed
the
renovate/npm-jszip-vulnerability/VF-000
branch
from
5ba91f5 to
98f9706
Compare
renovate
bot
changed the title
|
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/npm-jszip-vulnerability/VF-000
branch
from
98f9706 to
08110a8
Compare
This PR contains the following updates:
3.7.1→3.8.0GitHub Vulnerability Alerts
CVE-2022-48285
loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
Release Notes
Stuk/jszip (jszip)
v3.8.0Compare Source
loadAsync, to avoid "zip slip" attacks. The original filename is available on each zip entry asunsafeOriginalName. See the documentation. Many thanks to McCaulay Hudson for reporting.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.