Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(deps): update dependency class-validator to v0.14.0 [security] #117

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Mar 18, 2023

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
class-validator 0.13.1 -> 0.14.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2019-18413

In TypeStack class-validator, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input.

The default settings for forbidUnknownValues has been changed to true in 0.14.0.

NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.


Release Notes

typestack/class-validator (class-validator)

v0.14.0

Compare Source

v0.13.2

Compare Source

NOTE: This version fixes a security vulnerability allowing denial of service attacks with a specially crafted request payload.
Please update as soon as possible.

Fixed
  • switched to use Array.isArray in array checks from instanceof operator
Changed
  • libphonenumber-js package updated to 1.9.43 from 1.9.7
  • validator package updated to 13.5.2 from 13.5.2
  • various dev-dependencies updated

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Mar 18, 2023
@renovate renovate bot force-pushed the renovate/npm-class-validator-vulnerability branch from 9f115a9 to 225ba56 Compare March 19, 2023 09:46
@renovate renovate bot changed the title chore(deps): update dependency class-validator to 0.14.0 [security] chore(deps): update dependency class-validator to v0.14.0 [security] Mar 23, 2023
@renovate renovate bot changed the title chore(deps): update dependency class-validator to v0.14.0 [security] chore(deps): update dependency class-validator to v0.14.0 [security] - autoclosed Apr 27, 2023
@renovate renovate bot closed this Apr 27, 2023
@renovate renovate bot deleted the renovate/npm-class-validator-vulnerability branch April 27, 2023 03:04
@renovate renovate bot changed the title chore(deps): update dependency class-validator to v0.14.0 [security] - autoclosed chore(deps): update dependency class-validator to v0.14.0 [security] Apr 27, 2023
@renovate renovate bot reopened this Apr 27, 2023
@renovate renovate bot restored the renovate/npm-class-validator-vulnerability branch April 27, 2023 07:32
@renovate renovate bot changed the title chore(deps): update dependency class-validator to v0.14.0 [security] chore(deps): update dependency class-validator to 0.14.0 [security] Apr 27, 2023
@renovate renovate bot force-pushed the renovate/npm-class-validator-vulnerability branch from 225ba56 to 2cc1eb7 Compare April 27, 2023 07:33
@renovate renovate bot changed the title chore(deps): update dependency class-validator to 0.14.0 [security] chore(deps): update dependency class-validator to v0.14.0 [security] May 28, 2023
@renovate renovate bot changed the title chore(deps): update dependency class-validator to v0.14.0 [security] chore(deps): update dependency class-validator to v0.14.0 [security] - autoclosed Dec 8, 2024
@renovate renovate bot closed this Dec 8, 2024
@renovate renovate bot deleted the renovate/npm-class-validator-vulnerability branch December 8, 2024 18:42
@renovate renovate bot changed the title chore(deps): update dependency class-validator to v0.14.0 [security] - autoclosed chore(deps): update dependency class-validator to v0.14.0 [security] Dec 8, 2024
@renovate renovate bot reopened this Dec 8, 2024
@renovate renovate bot force-pushed the renovate/npm-class-validator-vulnerability branch from a41cadc to 2cc1eb7 Compare December 8, 2024 22:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants