Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update dependency of chrono-node to v2.2.4 or higher due to CVE-2021-23371 #1

Open
gecko655 opened this issue May 7, 2021 · 4 comments
Labels
good first issue Good for newcomers help wanted Extra attention is needed Status: PR Welcome Welcome to Pull Request

Comments

@gecko655
Copy link

gecko655 commented May 7, 2021

chrono-node CVE-2021-23371: https://snyk.io/vuln/SNYK-JS-CHRONONODE-1083228

I would like to update chrono-node to v2.2.4 or higher, due to a vulnerability about a DoS attack issue.

Chrono-node v2 has breaking changes, which is critical for this textlint rule.

For Users

  • Chrono’s default now handles only international English. While in the previous version, it tried to parse with all known languages.
  • The current fully supported languages are en, ja, and fr (de and pt are partially supported). Other languages from v1 (nl and zh) are under development.
    https://github.com/wanasit/chrono#whats-changed-in-the-v2

So, following things have to be done to update chrono-node to v2.x:

  • Change the code to use the chrono-node v2.x correctly with locale support.
  • Drop the support for es (Spanish) that is not supported by chrono-node v2.x.
  • (Possibly) Drop the support for auto language detection and user will have to choose a language in textlintrc file.

(If you find it's not necessary, it's fine to just close this issue.)
(一旦Issueを立てましたが、必要ないようであればそのまま閉じていただいて構いません。)

@azu azu added the help wanted Extra attention is needed label May 7, 2021
@azu
Copy link
Member

azu commented May 7, 2021

Thanks for the report!
We need to update the module

@azu azu added the good first issue Good for newcomers label May 7, 2021
@tyler36

This comment was marked as off-topic.

@azu azu added the Status: PR Welcome Welcome to Pull Request label Nov 7, 2023
@tyler36
Copy link

tyler36 commented Nov 28, 2023

Started PR #13 but I am stuck.

@azu
Copy link
Member

azu commented Nov 28, 2023

Thanks. I'll look it in weekend.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
good first issue Good for newcomers help wanted Extra attention is needed Status: PR Welcome Welcome to Pull Request
Projects
None yet
Development

No branches or pull requests

3 participants