Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🚨 [security] Update winston 3.2.1 → 3.13.0 (minor) #137

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

🚨 [security] Update winston 3.2.1 → 3.13.0 (minor) #137

wants to merge 1 commit into from

Conversation

depfu[bot]
Copy link
Contributor

@depfu depfu bot commented Mar 25, 2024

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ winston (3.2.1 → 3.13.0) · Repo · Changelog

Release Notes

Too many releases to show here. View the full release notes.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ color (indirect, 3.0.0 → 3.2.1) · Repo

Release Notes

3.2.1

Patch Release 3.2.1

  • Revert color-convert back down to <2 since v2 introduced ES6 syntax.

If you need color-convert@>=2 then you'll need to have ES6 support. It's 2021, embrace it. 🙂

3.2.0

Minor Release 3.2.0

NOTE: This is the final release of color that uses ES5 syntax. For those following along, 4.0.0 was just released that switches to ES6 (const/let) syntax, which will (at some point) be followed by another major release that further switches to ES Modules entirely. This will be a sweeping change across the color package suite (color, color-string, color-convert). Keep a look out if these issues have been bothering you.

  • Bumps color convert to latest (fixes some issues with HCG)
  • Bumps mocha to latest

3.1.3

  • Fixes fixed alpha precision when parsing RGBA hex strings in constructor (#174)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 22 commits:

↗️ color-string (indirect, 1.5.3 → 1.9.1) · Repo · Changelog

Security Advisories 🚨

🚨 Regular Expression Denial of Service (ReDOS)

In the npm package color-string, there is a ReDos (Regular Expression Denial of Service) vulnerability regarding an exponential time complexity for
linearly increasing input lengths for hwb() color strings.

Strings reaching more than 5000 characters would see several
milliseconds of processing time; strings reaching more than
50,000 characters began seeing 1500ms (1.5s) of processing time.

The cause was due to a the regular expression that parses
hwb() strings - specifically, the hue value - where
the integer portion of the hue value used a 0-or-more quantifier
shortly thereafter followed by a 1-or-more quantifier.

This caused excessive backtracking and a cartesian scan,
resulting in exponential time complexity given a linear
increase in input length.

Release Notes

1.9.0

Minor Release 1.9.0

  • Add parsing of exponential alpha values for HWB and HSL (#66)

Thanks to @babycannotsay for their contribution!

1.8.2

Patch release 1.8.2

  • Fix incorrect handling of optional comma in rgb() regex (#65)

Thanks to @gerdasi and @mastertheblaster for reporting and confirming the bug!

1.8.1

Patch release 1.8.1

  • Fix rgb alpha percentage parsing from int to float (#61)

Thanks to @clytras for their contribution!

1.7.4

Patch Release 1.7.4

  • Fix bug in .to.hex() output if the inputs aren't rounded numbers (#25)

1.7.1

Patch release 1.7.1

  • Reduce acceptable characters in keyword matching regex (#42)

Thanks to @benmccann for their contributions!

1.7.0

Minor Release 1.7.0

  • Add support for space-separated RGB (#58)
  • Removed Travis CI in favor of Github Actions
  • Small repository cleanup.

Thanks to @JJC1138 and @clytras for their contributions!

1.6.0

Minor release 1.6.0

  • #55 - Add support for space-separated HSL

Thanks @htunnicliff for the contribution :)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ fecha (indirect, 2.3.3 → 4.2.3) · Repo · Changelog

Release Notes

4.2.3 (from changelog)

  • Fixed bug with UTC date on daylights savings time #94

4.2.1 (from changelog)

  • Fixed missing source map
  • Fixed security y18n

Does any of this look wrong? Please let us know.

↗️ logform (indirect, 2.1.2 → 2.6.0) · Repo · Changelog

Release Notes

2.6.0

  • Add engines.node field to package.json, matching winston dc72f30
  • Bump @babel/preset-env from 7.20.2 to 7.23.2 (#282) 3fa46ff
  • Bump @babel/cli from 7.21.5 to 7.23.0 (#279) 5bbd37c
  • Bump @babel/core from 7.21.8 to 7.23.2 (#283) 7829c80
  • Bump rimraf from 3.0.2 to 5.0.5 (#276) 60f2a57
  • Bump @colors/colors from 1.5.0 to 1.6.0 (#278) 4122c75
  • Bump actions/checkout from 3 to 4 (#281) 696fca6
  • Update Node versions used in CI tests to match winston 2456702
  • Bump safe-stable-stringify from 2.4.2 to 2.4.3 (#260) e138505
  • Bump @babel/cli from 7.19.3 to 7.21.5 (#268) 2f6b096
  • Bump eslint from 8.33.0 to 8.40.0 (#270) 9f75e6c
  • Bump @babel/core from 7.20.12 to 7.21.8 (#271) ac5a90d
  • Update version number in bug report template 3e3a0b6
  • Add TS version to issue template a93698c
  • Note TS<4.4 incompatibility per #244 f79c612

v2.5.1...v2.6.0

2.5.1

2.5.1

2023/02/07

Bugfix

The triple-beam types package has been promoted to a full dependency, by first-time contributor @carboneater (Thanks!)
in #243 to fix #242.

2.5.0

2.5.0

2023/02/06

Improvements

All the improvements in this release are from first-time contributors - thanks for your contributions!

Dependency updates by @dependabot

2.4.2

2.4.2

Bugfixes

This patch-level release includes a fix for a crash on attempt to uncolorize Symbol.
Thanks to @Alexsey for that first contribution in #188.

Maintainability updates:

Line break styles were changed to be LF (instead of CRLF) more consistently so that linter warnings aren't drowned out by notes about that.

Dependency updates by @dependabot

  • @babel/cli from 7.17.10 to 7.18.6 in #187
  • @babel/core from 7.18.5 to 7.18.6 in #185
  • @babel/preset-env from 7.18.2 to 7.18.6 in #184
  • eslint from 8.18.0 to 8.19.0 in #186

2.4.1

What's Changed

Dependabot bumps:

New Contributors

Full Changelog: v2.4.0...v2.4.1

2.4.0

v2.3.2...v2.4.0

2.3.2

This update, which also used up version number 2.3.1, pinned the version of the colors dependency due to vandalism by a developer of that package, as noted here.

As discussed in the winston package, all users should update to this (or a later version, should one exist) ASAP.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ triple-beam (indirect, 1.3.0 → 1.4.1) · Repo · Changelog

Release Notes

1.4.1

  • Relax node engines requirement to geq 14.0.0 in package.json a537d09

v1.4.0...v1.4.1

1.4.0

1.3.0...v1.4.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 15 commits:

↗️ winston-transport (indirect, 4.3.0 → 4.7.0) · Repo · Changelog

Release Notes

4.7.0

v4.6.0...v4.7.0

4.6.0

v4.5.0...v4.6.0

4.5.0

  • Update .npmignore 8cbcdf3
  • Merge branch 'master' of github.com:winstonjs/winston-transport 22b195e
  • Changelog for 4.5.0 b47cfcd
  • Memory leak fix: do not wait process.nextTick (#81) 6566518
  • Update linting dependencies (#87) 46e5822
  • Replace Travis CI with GitHub Actions (#82) 0b7ad4f
  • fix(logform): removed duplicate dependency (#67) ed56cf2
  • Relative ref to bin file not needed; npm looks there by default (#80) 35baf39

4.4.2...v4.5.0

4.4.1

Updates to dependencies and Typescript support for last feature release.

4.4.0

  • Prepare for v4.4.0: update changelog, update dependencies, update Travis Node version eabd2ac
  • Expose LegacyTransportStream on index (#42) 46db8f3
  • Add handleRejections option support (#41) c7ac369

4.3.0...v4.4.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 50 commits:

🆕 @​colors/colors (added, 1.6.0)

🆕 @​dabh/diagnostics (added, 2.0.3)

🆕 @​types/triple-beam (added, 1.3.5)

🆕 fn.name (added, 1.1.0)

🆕 safe-stable-stringify (added, 2.4.3)

🗑️ colornames (removed)

🗑️ colors (removed)

🗑️ diagnostics (removed)

🗑️ env-variable (removed)

🗑️ fast-safe-stringify (removed)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Mar 25, 2024
@depfu depfu bot mentioned this pull request Mar 25, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
depfu
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
0 participants