Skip to content

Update dependency y18n to 3.2.2 [SECURITY] - abandoned#120

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-y18n-vulnerability
Open

Update dependency y18n to 3.2.2 [SECURITY] - abandoned#120
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-y18n-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Mar 30, 2021

Copy link
Copy Markdown
Contributor

Mend Renovate

This PR contains the following updates:

Package Change
y18n 3.2.1 -> 3.2.2

GitHub Vulnerability Alerts

CVE-2020-7774

Overview

The npm package y18n before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution.

POC

const y18n = require('y18n')();

y18n.setLocale('__proto__');
y18n.updateLocale({polluted: true});

console.log(polluted); // true

Recommendation

Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.


Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Tokyo, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate Bot added the Renovate label Mar 30, 2021
@renovate renovate Bot changed the title Update dependency y18n to 3.2.2 [SECURITY] Update dependency y18n to 3.2.2 [SECURITY] - autoclosed May 14, 2021
@renovate renovate Bot closed this May 14, 2021
@renovate renovate Bot deleted the renovate/npm-y18n-vulnerability branch May 14, 2021 18:03
@renovate renovate Bot changed the title Update dependency y18n to 3.2.2 [SECURITY] - autoclosed Update dependency y18n to 3.2.2 [SECURITY] May 14, 2021
@renovate renovate Bot reopened this May 14, 2021
@renovate renovate Bot restored the renovate/npm-y18n-vulnerability branch May 14, 2021 18:39
@renovate renovate Bot force-pushed the renovate/npm-y18n-vulnerability branch from 1f82d80 to 0605fe5 Compare May 14, 2021 18:49
@codecov-commenter

codecov-commenter commented May 14, 2021

Copy link
Copy Markdown

Codecov Report

Merging #120 (0605fe5) into master (22e4247) will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master     #120   +/-   ##
=======================================
  Coverage   91.66%   91.66%           
=======================================
  Files           2        2           
  Lines          24       24           
  Branches        3        3           
=======================================
  Hits           22       22           
  Misses          2        2           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 22e4247...0605fe5. Read the comment docs.

@renovate renovate Bot force-pushed the renovate/npm-y18n-vulnerability branch from 0605fe5 to 2594ee7 Compare October 2, 2021 23:38
@renovate renovate Bot force-pushed the renovate/npm-y18n-vulnerability branch from 2594ee7 to 9fcf998 Compare October 3, 2021 01:22
@renovate renovate Bot changed the title Update dependency y18n to 3.2.2 [SECURITY] Update dependency y18n to 3.2.2 [SECURITY] - abandoned Mar 24, 2023
@renovate

renovate Bot commented Mar 24, 2023

Copy link
Copy Markdown
Contributor Author

Autoclosing Skipped

This PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants