cea.ac.in
cea.ac.in copied to clipboard
[Security] Bump npm from 6.9.0 to 6.14.3
Bumps npm from 6.9.0 to 6.14.3. This update includes security fixes.
Vulnerabilities fixed
Sourced from The GitHub Security Advisory Database.
Low severity vulnerability that affects npm
Unauthorized File Access
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of the
node_modules
folder through thebin
field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed.This behavior is possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
Thank you Daniel Ruf for responsibly reporting the issue!
Further information: npm blog post
Affected versions: < 6.13.3
Sourced from The GitHub Security Advisory Database.
Low severity vulnerability that affects npm
Arbitrary File Write
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended
node_modules
folder through thebin
field. A properly constructed entry in the package.jsonbin
field would allow a package publisher to modify and/or gain access to arbitrary files on a user’s system when the package is installed.This behavior is possible through install scripts. This vulnerability bypasses a user using the
--ignore-scripts
install option.Thank you Daniel Ruf for reporting the issue!
Further information: npm blog post
Affected versions: < 6.13.3
Sourced from The GitHub Security Advisory Database.
Low severity vulnerability that affects npm
Arbitrary File Overwrite
Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a
serve
binary, any subsequent installs of packages that also create aserve
binary would overwrite the previousserve
binary.This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
Thank you to Daniel Ruf for reporting the issue!
Further information: npm blog post
Affected versions: < 6.13.4
Release notes
Sourced from npm's releases.
v6.14.3
6.14.3 (2020-03-19)
DOCUMENTATION
4ad221487
#1020 docs(teams): updated team docs to reflect MFA workflow (@blkdm0n)4a31a4ba2
#1034 docs: cleanup (@ruyadorno)0eac801cd
#1013 docs: fix links to cli commands (@alenros)7d8e5b99c
#755 docs: correction tonpm update -g
behaviour (@johnkennedy9147)DEPENDENCIES
e11167646
[email protected]
c50d679c6
[email protected]
a2de99ff9
[email protected]
217debeb9
[email protected]
v6.14.2
6.14.2 (2020-03-03)
DOCUMENTATION
f9248c0be
#730 chore(docs): update unpublish docs & policy reference (@nomadtechie, @mikemimik)DEPENDENCIES
909cc3918
[email protected]
(@darcyclarke)
5038b1891
fix: regression in old node versions w/ respect to url.URL implmentation9204ffa58
[email protected]
(@isaacs)
6bcf0860a
fix: treat non-http/https login urls as invalid0365d39bd
[email protected]
(@isaacs)dab030536
[email protected]
(@rvagg)v6.14.1
6.14.1 (2020-02-26)
303e5c11e
[email protected]
Fixes a regression where scp-style git urls are passed to the WhatWG URL parser, which does not handle them properly. (@isaacs)v6.14.0
6.14.0 (2020-02-25)
FEATURES
30f170877
#731 add support for multiple funding sources (@ljharb & @ruyadorno)BUG FIXES
55916b130
#508 fix: checknpm.config
before accessing its members (@kaiyoma)7d0cd65b2
#733 fix: access grant with unscoped packages (@netanelgilad)28c3d40d6
,0769c5b20
#945, #697 fix: allow new major versions of node to be automatically considered "supported" (@isaacs, @ljharb)DEPENDENCIES
... (truncated)
Changelog
Sourced from npm's changelog.
6.14.3 (2020-03-19)
DOCUMENTATION
4ad221487
#1020 docs(teams): updated team docs to reflect MFA workflow (@blkdm0n)4a31a4ba2
#1034 docs: cleanup (@ruyadorno)0eac801cd
#1013 docs: fix links to cli commands (@alenros)7d8e5b99c
#755 docs: correction tonpm update -g
behaviour (@johnkennedy9147)DEPENDENCIES
e11167646
[email protected]
c50d679c6
[email protected]
a2de99ff9
[email protected]
217debeb9
[email protected]
6.14.2 (2020-03-03)
DOCUMENTATION
f9248c0be
#730 chore(docs): update unpublish docs & policy reference (@nomadtechie, @mikemimik)DEPENDENCIES
909cc3918
[email protected]
(@darcyclarke)
5038b1891
fix: regression in old node versions w/ respect to url.URL implmentation9204ffa58
[email protected]
(@isaacs)
6bcf0860a
fix: treat non-http/https login urls as invalid0365d39bd
[email protected]
(@isaacs)dab030536
[email protected]
(@rvagg)6.14.1 (2020-02-26)
303e5c11e
[email protected]
Fixes a regression where scp-style git urls are passed to the WhatWG URL parser, which does not handle them properly. (@isaacs)6.14.0 (2020-02-25)
FEATURES
30f170877
#731 add support for multiple funding sources (@ljharb & @ruyadorno)BUG FIXES
55916b130
#508 fix: checknpm.config
before accessing its members (@kaiyoma)7d0cd65b2
#733 fix: access grant with unscoped packages (@netanelgilad)28c3d40d6
,0769c5b20
#945, #697 fix: allow new major versions of node to be automatically considered "supported" (@isaacs, @ljharb)DEPENDENCIES
... (truncated)
Commits
cc3122a
6.14.3c0de153
update AUTHORS069d3b0
docs: changelog for 6.14.3ee35ca5
docs: cleanup4ad2214
docs(teams): updated team docs to reflect new MFA workflow for npm team api7d8e5b9
docs:correction to npm update -g behaviour0eac801
Fixed links to cli commands217debe
[email protected]a2de99f
[email protected]c50d679
[email protected]- Additional commits viewable in compare view
Maintainer changes
This version was pushed to npm by darcyclarke, a new releaser for npm since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase
.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
-
@dependabot rebase
will rebase this PR -
@dependabot recreate
will recreate this PR, overwriting any edits that have been made to it -
@dependabot merge
will merge this PR after your CI passes on it -
@dependabot squash and merge
will squash and merge this PR after your CI passes on it -
@dependabot cancel merge
will cancel a previously requested merge and block automerging -
@dependabot reopen
will reopen this PR if it is closed -
@dependabot close
will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually -
@dependabot ignore this major version
will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this minor version
will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this dependency
will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) -
@dependabot use these labels
will set the current labels as the default for future PRs for this repo and language -
@dependabot use these reviewers
will set the current reviewers as the default for future PRs for this repo and language -
@dependabot use these assignees
will set the current assignees as the default for future PRs for this repo and language -
@dependabot use this milestone
will set the current milestone as the default for future PRs for this repo and language -
@dependabot badge me
will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot dashboard:
- Update frequency (including time of day and day of week)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)