data-transfer-project Bump the npm_and_yarn group across 1 directory with 16 updates

Bump the npm_and_yarn group across 1 directory with 16 updates

Open dependabot[bot] opened this issue 1 year ago • 1 comments

trafficstars

Bumps the npm_and_yarn group with 8 updates in the /client-rest directory:

Package	From	To
@angular/core	`11.2.14`	`12.0.0`
postcss	`7.0.39`	`8.4.38`
@angular-devkit/build-angular	`0.1102.13`	`18.1.4`
qs	`6.5.2`	`6.5.3`
follow-redirects	`1.14.8`	`1.15.6`
json-schema	`0.2.3`	`0.4.0`
jsprim	`1.4.1`	`1.4.2`
socket.io	`4.5.0`	`4.7.5`

Updates @angular/core from 11.2.14 to 12.0.0

Changelog

Sourced from @angular/core's changelog.

18.2.0-rc.0 (2024-08-07)

Breaking Changes

zone.js

fakeAsync will now flush pending timers at the end of the given function by default. To opt-out of this, you can use {flush: false} in options parameter of fakeAsync

compiler

Commit Type Description

d9d68e73d2 fix reduce chance of conflicts between generated factory and local variables (#57181)

compiler-cli

Commit Type Description

0b1dd39663 perf improve performance of interpolatedSignalNotInvoked extended diagnostic (#57291)

core

Commit Type Description

f7918f5272 feat Add 'flush' parameter option to fakeAsync to flush after the test (#57239)

7919982063 feat Add whenStable helper on ApplicationRef (#57190)

18.1.4 (2024-08-07)

compiler

Commit Type Description

6a99f83659 fix reduce chance of conflicts between generated factory and local variables (#57181)

compiler-cli

Commit Type Description

afb05ff1cb fix support JIT transforms before other transforms modifying classes (#57262)

bae54a1621 perf improve performance of interpolatedSignalNotInvoked extended diagnostic (#57291)

language-service

Commit Type Description

6ac209c24f fix avoid generating TS suggestion diagnostics for templates (#56241)

18.2.0-next.4 (2024-08-05)

compiler-cli

Commit Type Description

e2259c7b09 fix support JIT transforms before other transforms modifying classes (#57262)

core

Commit Type Description

Commit	Type	Description
d9d68e73d2	fix	reduce chance of conflicts between generated factory and local variables (#57181)

Commit	Type	Description
0b1dd39663	perf	improve performance of `interpolatedSignalNotInvoked` extended diagnostic (#57291)

Commit	Type	Description
f7918f5272	feat	Add 'flush' parameter option to fakeAsync to flush after the test (#57239)
7919982063	feat	Add whenStable helper on ApplicationRef (#57190)

Commit	Type	Description
6a99f83659	fix	reduce chance of conflicts between generated factory and local variables (#57181)

Commit	Type	Description
afb05ff1cb	fix	support JIT transforms before other transforms modifying classes (#57262)
bae54a1621	perf	improve performance of `interpolatedSignalNotInvoked` extended diagnostic (#57291)

Commit	Type	Description
6ac209c24f	fix	avoid generating TS suggestion diagnostics for templates (#56241)

Commit	Type	Description
e2259c7b09	fix	support JIT transforms before other transforms modifying classes (#57262)

... (truncated)

Commits

0a2191f Revert "refactor(core): optimize calls to split and slice while computing...
d555555 fix(platform-browser): prevent memory leak of style nodes if shadow DOM encap...
1449c5c fix(core): do not retain dynamically compiled components and modules (#42003)
effde9d refactor(core): remove unnecessary cast (#41960)
6bec2d4 refactor(core): optimize calls to split and slice while computing version...
e9ddc57 fix(core): invoke profiler around ngOnDestroy lifecycle hooks (#41969)
e218a8b refactor(common): change missing NgSwitch provider error message (#41704)
3361c19 docs: Remove references to protractor from documentation (#41731)
73c6c64 fix(core): handle multiple i18n attributes with expression bindings (#41882)
01cc995 fix(animations): ensure consistent transition namespace ordering (#19854)
Additional commits viewable in compare view

Updates postcss from 7.0.39 to 8.4.38

Release notes

Sourced from postcss's releases.

8.4.38

Fixed endIndex: 0 in errors and warnings (by @romainmenke).

8.4.37

Fixed original.column are not numbers error in another case.

8.4.36

Fixed original.column are not numbers error on broken previous source map.

8.4.35

Avoid ! in node.parent.nodes type.

Allow to pass undefined to node adding method to simplify types.

8.4.34

Fixed AtRule#nodes type (by @tim-we).

Cleaned up code (by @DrKiraDmitry).

8.4.33

Fixed NoWorkResult behavior difference with normal mode (by @romainmenke).

Fixed NoWorkResult usage conditions (by @ahmdammarr).

8.4.32

Fixed postcss().process() types (by @ferreira-tb).

8.4.31

Fixed \r parsing to fix CVE-2023-44270.

8.4.30

Improved source map performance (by @romainmenke).

8.4.29

Fixed Node#source.offset (by @idoros).

Fixed docs (by @coliff).

8.4.28

Fixed Root.source.end for better source map (by @romainmenke).

Fixed Result.root types when process() has no parser.

8.4.27

Fixed Container clone methods types.

8.4.26

Fixed clone methods types.

8.4.25

Improve stringify performance (by @romainmenke).

Fixed docs (by @vikaskaliramna07).

8.4.24

Fixed Plugin types.

... (truncated)

Changelog

Sourced from postcss's changelog.

8.4.38

Fixed endIndex: 0 in errors and warnings (by @romainmenke).

8.4.37

Fixed original.column are not numbers error in another case.

8.4.36

Fixed original.column are not numbers error on broken previous source map.

8.4.35

Avoid ! in node.parent.nodes type.

Allow to pass undefined to node adding method to simplify types.

8.4.34

Fixed AtRule#nodes type (by Tim Weißenfels).

Cleaned up code (by Dmitry Kirillov).

8.4.33

Fixed NoWorkResult behavior difference with normal mode (by Romain Menke).

Fixed NoWorkResult usage conditions (by @ahmdammarr).

8.4.32

Fixed postcss().process() types (by Andrew Ferreira).

8.4.31

Fixed \r parsing to fix CVE-2023-44270.

8.4.30

Improved source map performance (by Romain Menke).

8.4.29

Fixed Node#source.offset (by Ido Rosenthal).

Fixed docs (by Christian Oliff).

8.4.28

Fixed Root.source.end for better source map (by Romain Menke).

Fixed Result.root types when process() has no parser.

8.4.27

Fixed Container clone methods types.

8.4.26

Fixed clone methods types.

8.4.25

Improve stringify performance (by Romain Menke).

Fixed docs (by @vikaskaliramna07).

8.4.24

Fixed Plugin types.

... (truncated)

Commits

a69d45e Release 8.4.38 version
64e35d9 Update dependencies
c1ad8fb Merge pull request #1932 from romainmenke/fix-warning-end-index--inventive-nu...
b45e7e9 fix endIndex
1bea246 failing test: for endIndex 0 in rangeBy
0fd1d86 Add changelog auto release on Github
49c906e Release 8.4.37 version
b5bd92c Fix another broken prev source map issue
2882039 Update dependencies
e5ad939 Release 8.4.36 version
Additional commits viewable in compare view

Updates @angular-devkit/build-angular from 0.1102.13 to 18.1.4

Release notes

Sourced from @angular-devkit/build-angular's releases.

v18.1.4

18.1.4 (2024-08-07)

@angular/build

Commit Description

allow explicitly disabling TypeScript incremental mode

lazy load Node.js inspector for dev server

v18.1.3

18.1.3 (2024-07-31)

@angular/build

Commit Description

add CSP nonce attribute to script tags when inline critical CSS is disabled

prevent build failures with remote CSS imports when Tailwind is configured

resolve error with extract-i18n builder for libraries

v18.1.2

18.1.2 (2024-07-24)

@angular/build

Commit Description

account for HTML base HREF for dev-server externals

correctly detect comma in Sass URL lexer

prevent redirection loop

serve HTML files directly

v18.1.1

18.1.1 (2024-07-17)

@angular-devkit/build-angular

Commit Description

skip undefined files when generating budget stats

@angular/build

Commit Description

remove Vite "/@id/" prefix for explicit external dependencies

resolve only ".wasm" files

v18.1.0

18.1.0 (2024-07-10)

@schematics/angular

Commit Description

generate new projects with ECMAScript standard class field behavior

Commit	Description
	allow explicitly disabling TypeScript incremental mode
	lazy load Node.js inspector for dev server

Commit	Description
	add CSP `nonce` attribute to script tags when inline critical CSS is disabled
	prevent build failures with remote CSS imports when Tailwind is configured
	resolve error with `extract-i18n` builder for libraries

Commit	Description
	account for HTML base HREF for dev-server externals
	correctly detect comma in Sass URL lexer
	prevent redirection loop
	serve HTML files directly

Commit	Description
	skip undefined files when generating budget stats

Commit	Description
	remove Vite "/@id/" prefix for explicit external dependencies
	resolve only ".wasm" files

Commit	Description
	generate new projects with ECMAScript standard class field behavior

... (truncated)

Changelog

Sourced from @angular-devkit/build-angular's changelog.

18.1.4 (2024-08-07)

@angular/build

Commit Type Description

f8b092711 fix allow explicitly disabling TypeScript incremental mode

f3a5970fc fix lazy load Node.js inspector for dev server

18.2.0-next.3 (2024-07-31)

@angular/build

Commit Type Description

636cb6932 fix add CSP nonce attribute to script tags when inline critical CSS is disabled

7d52941a2 fix prevent build failures with remote CSS imports when Tailwind is configured

0466fb74a fix resolve error with extract-i18n builder for libraries

18.1.3 (2024-07-31)

@angular/build

Commit Type Description

a28615d7d fix add CSP nonce attribute to script tags when inline critical CSS is disabled

747a1447c fix prevent build failures with remote CSS imports when Tailwind is configured

c0933f2c0 fix resolve error with extract-i18n builder for libraries

18.2.0-next.2 (2024-07-24)

@angular/build

Commit Type Description

37a2138cb fix account for HTML base HREF for dev-server externals

8ff687d03 fix correctly detect comma in Sass URL lexer

6d6937587 fix prevent redirection loop

Commit	Type	Description
f8b092711	fix	allow explicitly disabling TypeScript incremental mode
f3a5970fc	fix	lazy load Node.js inspector for dev server

Commit	Type	Description
636cb6932	fix	add CSP `nonce` attribute to script tags when inline critical CSS is disabled
7d52941a2	fix	prevent build failures with remote CSS imports when Tailwind is configured
0466fb74a	fix	resolve error with `extract-i18n` builder for libraries

Commit	Type	Description
a28615d7d	fix	add CSP `nonce` attribute to script tags when inline critical CSS is disabled
747a1447c	fix	prevent build failures with remote CSS imports when Tailwind is configured
c0933f2c0	fix	resolve error with `extract-i18n` builder for libraries

Commit	Type	Description
37a2138cb	fix	account for HTML base HREF for dev-server externals
8ff687d03	fix	correctly detect comma in Sass URL lexer
6d6937587	fix	prevent redirection loop

... (truncated)

Commits

See full diff in compare view

Updates json5 from 1.0.1 to 2.2.3

Release notes

Sourced from json5's releases.

v2.2.3

Fix: [email protected] is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1

Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0

New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

v2.1.3 [code, diff]

Fix: An out of memory bug when parsing numbers has been fixed. (#228, #229)

v2.1.2

Fix: Bump minimist to v1.2.5. (#222)

v2.1.1

New: package.json and package.json5 include a module property so bundlers like webpack, rollup and parcel can take advantage of the ES Module build. (#208)

Fix: stringify outputs \0 as \\x00 when followed by a digit. (#210)

Fix: Spelling mistakes have been fixed. (#196)

v2.1.0

New: The index.mjs and index.min.mjs browser builds in the dist directory support ES6 modules. (#187)

v2.0.1

Fix: The browser builds in the dist directory support ES5. (#182)

v2.0.0

Major: JSON5 officially supports Node.js v6 and later. Support for Node.js v4 has been dropped. Since Node.js v6 supports ES5 features, the code has been rewritten in native ES5, and the dependence on Babel has been eliminated.

New: Support for Unicode 10 has been added.

New: The test framework has been migrated from Mocha to Tap.

New: The browser build at dist/index.js is no longer minified by default. A minified version is available at dist/index.min.js. (#181)

Fix: The warning has been made clearer when line and paragraph separators are

... (truncated)

Changelog

Sourced from json5's changelog.

v2.2.3 [code, diff]

Fix: [email protected] is now the 'latest' release according to npm instead of v1.0.2. (#299)

v2.2.2 [code, diff]

Fix: Properties with the name __proto__ are added to objects and arrays. (#199) This also fixes a prototype pollution vulnerability reported by Jonathan Gregson! (#295).

v2.2.1 [code, diff]

Fix: Removed dependence on minimist to patch CVE-2021-44906. (#266)

v2.2.0 [code, diff]

New: Accurate and documented TypeScript declarations are now included. There is no need to install @types/json5. (#236, #244)

v2.1.3 [code, diff]

Fix: An out of memory bug when parsing numbers has been fixed. (#228, #229)

v2.1.2 [code, diff]

Fix: Bump minimist to v1.2.5. (#222)

v2.1.1 [code, [diff][d2.1.1]]

... (truncated)

Commits

c3a7524 2.2.3
94fd06d docs: update CHANGELOG for v2.2.3
3b8cebf docs(security): use GitHub security advisories
f0fd9e1 docs: publish a security policy
6a91a05 docs(template): bug -> bug report
14f8cb1 2.2.2
10cc7ca docs: update CHANGELOG for v2.2.2
7774c10 fix: add proto to objects and arrays
edde30a Readme: slight tweak to intro
97286f8 Improve example in readme
Additional commits viewable in compare view

Updates loader-utils from 1.4.2 to 2.0.4

Release notes

Sourced from loader-utils's releases.

v2.0.4

2.0.4 (2022-11-11)

Bug Fixes

ReDoS problem (#225) (ac09944)

v2.0.3

2.0.3 (2022-10-20)

Bug Fixes

security: prototype pollution exploit (#217) (a93cf6f)

v2.0.2

2.0.2 (2021-11-04)

Bug Fixes

base64 generation and unicode characters (#197) (8c2d24e)

v2.0.1

2.0.1 (2021-10-29)

Bug Fixes

md4 support on Node.js v17 (#193) (1069f61)

v2.0.0

2.0.0 (2020-03-17)

⚠ BREAKING CHANGES

minimum required Node.js version is 8.9.0 (#166) (c937e8c)

the getOptions method returns empty object on empty query (#167) (b595cfb)

Use md4 by default

Changelog

Sourced from loader-utils's changelog.

2.0.4 (2022-11-11)

Bug Fixes

ReDoS problem (#225) (ac09944)

2.0.3 (2022-10-20)

Bug Fixes

security: prototype pollution exploit (#217) (a93cf6f)

2.0.2 (2021-11-04)

Bug Fixes

base64 generation and unicode characters (#197) (8c2d24e)

2.0.1 (2021-10-29)

Bug Fixes

md4 support on Node.js v17 (#193) (1069f61)

2.0.0 (2020-03-17)

⚠ BREAKING CHANGES

minimum required Node.js version is 8.9.0 (#166) (c937e8c)

the getOptions method returns empty object on empty query (#167) (b595cfb)

Use md4 by default

1.4.0 (2020-02-19)

Features

the resourceQuery is passed to the interpolateName method (#163) (cd0e428)

1.3.0 (2020-02-19)

... (truncated)

Commits

6688b50 chore(release): 2.0.4
ac09944 fix: ReDoS problem (#225)
7162619 chore(release): 2.0.3
a93cf6f fix(security): prototype polution exploit (#217)
90c7c4b chore(release): 2.0.2
8c2d24e fix: base64 generation and unicode characters (#197)
5fb5562 chore(release): 2.0.1
1069f61 fix: md4 support on Node.js v17 (#193)
d9f4e23 chore(release): 2.0.0
865dc03 refactor: switch to md4 by default (#168)
Additional commits viewable in compare view

Updates qs from 6.5.2 to 6.5.3

Changelog

Sourced from qs's changelog.

6.5.3

[Fix] parse: ignore __proto__ keys (#428)

[Fix] utils.merge: avoid a crash with a null target and a truthy non-array source

[Fix] correctly parse nested arrays

[Fix] stringify: fix a crash with strictNullHandling and a custom filter/serializeDate (#279)

[Fix] utils: merge: fix crash when source is a truthy primitive & no options are provided

[Fix] when parseArrays is false, properly handle keys ending in []

[Fix] fix for an impossible situation: when the formatter is called with a non-string value

[Fix] utils.merge: avoid a crash with a null target and an array source

[Refactor] utils: reduce observable [[Get]]s

[Refactor] use cached Array.isArray

[Refactor] stringify: Avoid arr = arr.concat(...), push to the existing instance (#269)

[Refactor] parse: only need to reassign the var once

[Robustness] stringify: avoid relying on a global undefined (#427)

[readme] remove travis badge; add github actions/codecov badges; update URLs

[Docs] Clean up license text so it’s properly detected as BSD-3-Clause

[Docs] Clarify the need for "arrayLimit" option

[meta] fix README.md (#399)

[meta] add FUNDING.yml

[actions] backport actions from main

[Tests] always use String(x) over x.toString()

[Tests] remove nonexistent tape option

[Dev Deps] backport from main

Commits

298bfa5 v6.5.3
ed0f5dc [Fix] parse: ignore __proto__ keys (#428)
691e739 [Robustness] stringify: avoid relying on a global undefined (#427)
1072d57 [readme] remove travis badge; add github actions/codecov badges; update URLs
12ac1c4 [meta] fix README.md (#399)
0338716 [actions] backport actions from main
5639c20 Clean up license text so it’s properly detected as BSD-3-Clause
51b8a0b add FUNDING.yml
45f6759 [Fix] fix for an impossible situation: when the formatter is called with a no...
f814a7f [Dev Deps] backport from main
Additional commits viewable in compare view

Updates braces from 2.3.2 to 3.0.3

Changelog

Sourced from braces's changelog.

Release history

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog and this project adheres to Semantic Versioning.

Changelogs are for humans, not machines.

There should be an entry for every single version.

The same types of changes should be grouped.

Versions and sections should be linkable.

The latest version comes first.

The release date of each versions is displayed.

Mention whether you follow Semantic Versioning.

Changelog entries are classified using the following labels (from keep-a-changelog):

Added for new features.

Changed for changes in existing functionality.

Deprecated for soon-to-be removed features.

Removed for now removed features.

Fixed for any bug fixes.

Security in case of vulnerabilities.

[3.0.0] - 2018-04-08

v3.0 is a complete refactor, resulting in a faster, smaller codebase, with fewer deps, and a more accurate parser and compiler.

Breaking Changes

The undocumented .makeRe method was removed

Non-breaking changes

Caching was removed

Commits

See full diff in compare view

Updates express from 4.18.1 to 4.19.2

Release notes

Sourced from express's releases.

4.19.2

What's Changed

Improved fix for open redirect allow list bypass

Full Changelog: https://github.com/expressjs/express/compare/4.19.1...4.19.2

4.19.1

What's Changed

Fix ci after location patch by @wesleytodd in expressjs/express#5552

fixed un-edited version in history.md for 4.19.0 by @wesleytodd in expressjs/express#5556

Full Changelog: https://github.com/expressjs/express/compare/4.19.0...4.19.1

4.19.0

What's Changed

fix typo in release date by @UlisesGascon in expressjs/express#5527

docs: nominating @wesleytodd to be project captian by @wesleytodd in expressjs/express#5511

docs: loosen TC activity rules by @wesleytodd in expressjs/express#5510

Add note on how to update docs for new release by @crandmck in expressjs/express#5541

Prevent open redirect allow list bypass due to encodeurl

Release 4.19.0 by @wesleytodd in expressjs/express#5551

New Contributors

@crandmck made their first contribution in expressjs/express#5541

Full Changelog: https://github.com/expressjs/express/compare/4.18.3...4.19.0

4.18.3

Main Changes

Fix routing requests without method

deps: [email protected]

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: [email protected]

Other Changes

Use https: protocol instead of deprecated git: protocol by @vcsjones in expressjs/express#5032

build: [email protected] and [email protected] by @abenhamdine in expressjs/express#5034

ci: update actions/checkout to v3 by @armujahid in expressjs/express#5027

test: remove unused function arguments in params by @raksbisht in expressjs/express#5124

Remove unused originalIndex from acceptParams by @raksbisht in expressjs/express#5119

Fixed typos by @raksbisht in expressjs/express#5117

examples: remove unused params by @raksbisht in expressjs/express#5113

fix: parameter str is not described in JSDoc by @raksbisht in expressjs/express#5130

fix: typos in History.md by @raksbisht in expressjs/express#5131

build : add [email protected] by @abenhamdine in expressjs/express#5028

test: remove unused function arguments in params by @raksbisht in expressjs/express#5137

... (truncated)

Changelog

Sourced from express's changelog.

4.19.2 / 2024-03-25

Improved fix for open redirect allow list bypass

4.19.1 / 2024-03-20

Allow passing non-strings to res.location with new encoding handling checks

4.19.0 / 2024-03-20

Prevent open redirect allow list bypass due to encodeurl

deps: [email protected]

4.18.3 / 2024-02-29

Fix routing requests without method

deps: [email protected]

Fix strict json error message on Node.js 19+

deps: content-type@~1.0.5

deps: [email protected]

deps: [email protected]

Add partitioned option

4.18.2 / 2022-10-08

Fix regression routing a large stack in a single route

deps: [email protected]

deps: [email protected]

perf: remove unnecessary object clone

deps: [email protected]

Commits

04bc627 4.19.2
da4d763 Improved fix for open redirect allow list bypass
4f0f6cc 4.19.1
a003cfa Allow passing non-strings to res.location with new encoding handling checks f...
a1fa90f fixed un-edited version in history.md for 4.19.0
11f2b1d build: fix build due to inconsistent supertest behavior in older versions
084e365 4.19.0
0867302 Prevent open redirect allow list bypass due to encodeurl
567c9c6 Add note on how to update docs for new release (#5541)
69a4cf2 deps: [email protected]
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by wesleytodd, a new releaser for express since your current version.

Updates follow-redirects from 1.14.8 to 1.15.6

Commits

35a517c Release version 1.15.6 of the npm package.
c4f847f Drop Proxy-Authorization across hosts.
8526b4a Use GitHub for disclosure.
b1677ce Release version 1.15.5 of the npm package.
d8914f7 Preserve fragment in responseUrl.
6585820 Release version 1.15.4 of the npm package.
7a6567e Disallow bracketed hostnames.
05629af Prefer native URL instead of deprecated url.parse.
1cba8e8 Prefer native URL instead of legacy url.resolve.
72bc2a4 Simplify _processResponse error handling.
Additional commits viewable in compare view

Updates json-schema from 0.2.3 to 0.4.0

Commits

f6f6a3b Use a little more robust method of checking instances
ef60987 Update version
b62f1da Protect against constructor modification, #84
fb427cd Link to json-schema-org repository in addition to site, fixes #54
22f1461 Don't allow proto property to be used for schema default/coerce, fixes #84
c52a27c Get basic test to pass
b3f42b3 Add security policy
3b0cec3 Update version
c28470f Update readme to acknowledge the state of the package
7dff9cd Merge pull request #81 from hodovani/patch-1
Additional commits viewable in compare view

Updates jsprim from 1.4.1 to 1.4.2

Changelog

Sourced from jsprim's changelog.

v1.4.2 (2021-11-29)

#35 Backport json-schema 0.4.0 to version 1.4.x

Commits

5c8475f joyent/node-jsprim#35 Backport json-schema 0.4.0 to version 1.4.x
See full diff in compare view

Maintainer changes

This version was pushed to npm by bahamat, a new releaser for jsprim since your current version.

Updates node-forge from 0.10.0 to 1.3.1

Changelog

Sourced from node-forge's changelog.

1.3.1 - 2022-03-29

Fixes

RFC 3447 and RFC 8017 allow for optional DigestAlgorithm NULL parameters for sha* algorithms and require NULL paramters for md2 and md5 algorithms.

1.3.0 - 2022-03-17

Security

Three RSA PKCS#1 v1.5 signature verification issues were reported by Moosa Yahyazadeh ([email protected]).

HIGH: Leniency in checking digestAlgorithm structure can lead to signature forgery.

The code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. For more information, please see "Bleichenbacher's RSA signature forgery based on implementation error" by Hal Finney.

CVE ID: CVE-2022-24771

GHSA ID: GHSA-cfm4-qjh2-4765

HIGH: Failing to check tailing garbage bytes can lead to signature forgery.

The code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. For more information, please see "Bleichenbacher's RSA signature forgery based on implementation error" by Hal Finney.

CVE ID: CVE-2022-24772

GHSA ID: GHSA-x4jg-mjrx-434g

MEDIUM: Leniency in checking type octet.

DigestInfo is not properly checked for proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.

CVE ID: CVE-2022-24773

GHSA ID: GHSA-2r2c-g63r-vccr

Fixed

[asn1] Add fallback to pretty print invalid UTF8 data.

[asn1] fromDer is now more strict and will default to ensuring all input bytes are parsed or throw an error. A new option parseAllBytes can disable this behavior.

NOTE: The previous behavior is being changed since it can lead to security issues with crafted inputs. It is possible that code doing custom DER parsing may need to adapt to this new behavior and optional flag.

[rsa] Add and use a validator to check for proper structure of parsed ASN.1

... (truncated)

Commits

a0a4a42 Release 1.3.1.
a33830f Update changelog.
740954d Allow optional DigestAlgorithm parameters.
56f4316 Allow DigestInfo.DigestAlgorith.parameters to be optional
cbf0bd5 Start 1.3.1-0.
6c5b901...
Description has been truncated

Aug 07 '24 21:08 dependabot[bot]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

Aug 07 '24 21:08 CLAassistant

Superseded by #1431.

Feb 05 '25 18:02 dependabot[bot]

data-transfer-project data-transfer-project copied to clipboard

Bump the npm_and_yarn group across 1 directory with 16 updates

18.2.0-rc.0 (2024-08-07)

Breaking Changes

zone.js

compiler

compiler-cli

core

18.1.4 (2024-08-07)

compiler

compiler-cli

language-service

18.2.0-next.4 (2024-08-05)

compiler-cli

core

8.4.38

8.4.37

8.4.36

8.4.35

8.4.34

8.4.33

8.4.32

8.4.31

8.4.30

8.4.29

8.4.28

8.4.27

8.4.26

8.4.25

8.4.24

8.4.38

8.4.37

8.4.36

8.4.35

8.4.34

8.4.33

8.4.32

8.4.31

8.4.30

8.4.29

8.4.28

8.4.27

8.4.26

8.4.25

8.4.24

v18.1.4

18.1.4 (2024-08-07)

@​angular/build

v18.1.3

18.1.3 (2024-07-31)

@​angular/build

v18.1.2

18.1.2 (2024-07-24)

@​angular/build

v18.1.1

18.1.1 (2024-07-17)

@​angular-devkit/build-angular

@​angular/build

v18.1.0

18.1.0 (2024-07-10)

@​schematics/angular

18.1.4 (2024-08-07)

@​angular/build

18.2.0-next.3 (2024-07-31)

@​angular/build

18.1.3 (2024-07-31)

@​angular/build

18.2.0-next.2 (2024-07-24)

@​angular/build

v2.2.3

v2.2.2

v2.2.1

v2.2.0

v2.1.3 [code, diff]

v2.1.2

v2.1.1

v2.1.0

v2.0.1

v2.0.0

v2.2.3 [code, diff]

data-transfer-project
data-transfer-project copied to clipboard

`@angular/build`

`@angular/build`

`@angular/build`

`@angular-devkit/build-angular`

`@angular/build`

`@schematics/angular`

`@angular/build`

`@angular/build`

`@angular/build`

`@angular/build`