chore(deps): update dependency class-validator to v0.14.0 [security] #1968
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
Code Climate has analyzed commit 9b96e9e and detected 0 issues on this pull request. View more on Code Climate. |
✅ Deploy Preview for jellyfishsdk ready!
To edit notification comments on pull requests, go to your Netlify site settings. |
Codecov ReportBase: 93.66% // Head: 93.86% // Increases project coverage by
Additional details and impacted files@@ Coverage Diff @@
## main #1968 +/- ##
==========================================
+ Coverage 93.66% 93.86% +0.20%
==========================================
Files 366 366
Lines 10979 10985 +6
Branches 1431 1432 +1
==========================================
+ Hits 10283 10311 +28
+ Misses 668 645 -23
- Partials 28 29 +1
Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. ☔ View full report at Codecov. |
renovate
bot
force-pushed
the
renovate/npm-class-validator-vulnerability
branch
from
d080441 to
6bf4916
Compare
renovate
bot
force-pushed
the
renovate/npm-class-validator-vulnerability
branch
from
6bf4916 to
d26da3c
Compare
fuxingloh
requested review from
canonbrother,
ivan-zynesis,
eli-lim,
thedoublejay,
kyleleow and
pierregee
as code owners
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. ⚠ Warning: custom changes will be lost. |
|
Docker build preview for jellyfish/apps is ready! Built with commit 5803ddf
You can also get an immutable image with the commit hash
|
This PR contains the following updates:
0.13.2->0.14.00.13.2->0.14.0GitHub Vulnerability Alerts
CVE-2019-18413
In TypeStack class-validator,
validate()input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optionalforbidUnknownValuesparameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input.The default settings for
forbidUnknownValueshas been changed totruein 0.14.0.NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.
Release Notes
typestack/class-validator
v0.14.0Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Mend Renovate. View repository job log here.