fix(deps): update dependency jszip to v3.8.0 [security] #110
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
added
dependencies
|
Kudos, SonarCloud Quality Gate passed!
|
renovate
bot
force-pushed
the
renovate/npm-jszip-vulnerability/VF-000
branch
from
94a501b
to
c8e5877
Compare
|
Kudos, SonarCloud Quality Gate passed!
|
renovate
bot
force-pushed
the
renovate/npm-jszip-vulnerability/VF-000
branch
from
c8e5877
to
a62925c
Compare
|
Kudos, SonarCloud Quality Gate passed!
|
renovate
bot
force-pushed
the
renovate/npm-jszip-vulnerability/VF-000
branch
from
a62925c
to
b8dbc16
Compare
|
Kudos, SonarCloud Quality Gate passed!
|
renovate
bot
force-pushed
the
renovate/npm-jszip-vulnerability/VF-000
branch
from
b8dbc16
to
b08fdaa
Compare
renovate
bot
force-pushed
the
renovate/npm-jszip-vulnerability/VF-000
branch
from
b08fdaa
to
5ba91f5
Compare
|
This PR contains the following updates:
3.7.1->3.8.0GitHub Vulnerability Alerts
CVE-2022-48285
loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
Release Notes
Stuk/jszip (jszip)
v3.8.0Compare Source
loadAsync, to avoid "zip slip" attacks. The original filename is available on each zip entry asunsafeOriginalName. See the documentation. Many thanks to McCaulay Hudson for reporting.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.