Upgrade @vue/server-renderer to 3.5.42 · Pull request #6 · john-peterson-g17/todo-app

g1tbotopened this pull request15h ago

Upgrades @vue/server-renderer (npm) from 3.3.4 to 3.5.42, which fixes these known vulnerabilities:

Advisory	Severity	Affected	Fixed in	Summary
GHSA-g2v6-rqmx-r4w6	high	3.3.4	3.5.42	@vue/server-renderer: XSS via missing CR in attribute-name blacklist

Lockfiles changed: src/package-lock.json.

Only the version changes. This pull request lands through this branch's required checks like any other. If they fail because code has to change, g1t closes it and puts g1t on an issue to make the change.

Opened by g1t's security updates. Turn them off for this project on its Security page.

g1tbotadded the dependencies and javascript labels· 15h ago

g1tbotcommented15h ago

Dependency review

Passed. 23 dependency changes, none vulnerable.

src/package-lock.json

Change	Package	Version	Relationship	License	Vulnerabilities
Added	`@babel/helper-string-parser`	7.29.7	transitive	MIT	none known
Added	`@babel/helper-validator-identifier`	7.29.7	transitive	MIT	none known
Added	`@babel/parser`	7.29.9	transitive	MIT	none known
Added	`@babel/types`	7.29.8	transitive	MIT	none known
Added	`@vue/compiler-core`	3.5.42	transitive	MIT	none known
Added	`@vue/compiler-dom`	3.5.42	transitive	MIT	none known
Added	`@vue/compiler-ssr`	3.5.42	transitive	MIT	none known
Added	`@vue/reactivity`	3.5.42	transitive	MIT	none known
Added	`@vue/runtime-core`	3.5.42	transitive	MIT	none known
Added	`@vue/runtime-dom`	3.5.42	transitive	MIT	none known
Added	`@vue/server-renderer`	3.5.42	transitive	MIT	none known
Added	`@vue/shared`	3.5.42	transitive	MIT	none known
Added	`csstype`	3.2.3	transitive	MIT	none known
Added	`entities`	7.0.1	transitive	BSD-2-Clause	none known
Added	`source-map-js`	1.2.2	transitive	BSD-3-Clause	none known
Removed	`@babel/helper-string-parser`	7.22.5	transitive	unknown
Removed	`@babel/helper-validator-identifier`	7.22.5	transitive	unknown
Removed	`@babel/parser`	7.22.7	transitive	unknown
Removed	`@babel/types`	7.22.5	transitive	unknown
Removed	`@vue/server-renderer`	3.3.4	transitive	unknown
Removed	`csstype`	3.1.2	transitive	unknown
Removed	`source-map-js`	1.0.2	transitive	unknown
Removed	`to-fast-properties`	2.0.0	transitive	unknown

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

All checks have passed

2 passed · none are required, so none hold the merge

Workflows

Dependency review — 23 dependency changes, none vulnerableDetails

g1t / deploy — Preview is live

All checks have passed

2 passed · none are required, so none hold the merge

Workflows

Dependency review — 23 dependency changes, none vulnerableDetails

g1t / deploy — Preview is live

No reviews yet

Up to date with master