react-ssr-advanced-seed

react-ssr-advanced-seed copied to clipboard

This PR contains the following updates:

Package	Change
immer	1.10.0 -> 9.0.6

GitHub Vulnerability Alerts

CVE-2021-23436

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "proto" || p === "constructor") in applyPatches_ returns false if p is ['proto'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.

CVE-2021-3757

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• [ ] If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by Mend Renovate. View repository job log here.

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm WARN config global `--global`, `--local` are deprecated. Use `--location=global` instead.
npm WARN deprecated @evocateur/[email protected]: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm WARN deprecated @evocateur/[email protected]: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm WARN deprecated [email protected]: The functionality that this package provided is now in @npmcli/arborist
npm WARN deprecated [email protected]: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated [email protected]: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated [email protected]: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated [email protected]: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated [email protected]: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated [email protected]: this library is no longer supported
npm WARN deprecated [email protected]: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated [email protected]: This package is broken and no longer maintained. 'mkdirp' itself supports promises now, please switch to that.
npm WARN deprecated @evocateur/[email protected]: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm WARN deprecated @evocateur/[email protected]: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.
npm WARN @octokit/[email protected] requires a peer of @octokit/core@>=3 but none is installed. You must install peer dependencies yourself.

ERR! lerna Unknown command "info"
ERR! lerna Did you mean init?
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@~2.3.2 (node_modules/@storybook/core-common/node_modules/chokidar/node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for [email protected]: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of react-dom@^16.6.0 || ^17.0.0 || ^18.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of react-dom@^16.6.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of react-dom@^16.8.0 || ^17 || ^18 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of react-dom@^16.6.0 || ^17.0.0 || ^18.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of react-dom@^16.6.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of react-dom@^16.8.0 || ^17 || ^18 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of react@>=16.12.0 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of react-dom@>=16.8.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @storybook/[email protected] requires a peer of react-dom@^16.8.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of react-dom@^16.6.0 || ^17.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of react-dom@^16.8.0 || ^17 || ^18 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] requires a peer of react-dom@^16.6.0 || ^17.0.0 || ^18.0.0 but none is installed. You must install peer dependencies yourself.
npm WARN @babel/[email protected] requires a peer of @babel/core@^7.13.0 but none is installed. You must install peer dependencies yourself.
npm WARN @babel/[email protected] requires a peer of @babel/core@^7.12.0 but none is installed. You must install peer dependencies yourself.
npm WARN [email protected] No repository field.

lerna notice cli v3.18.4
lerna info versioning independent
lerna notice filter excluding "__tests__"
lerna info filter [ '!__tests__' ]
lerna info Bootstrapping 27 packages
lerna info Installing external dependencies
lerna ERR! npm install --ignore-scripts --no-package-lock --ignore-scripts --no-audit --package-lock-only exited 1 in 'omega-web'
lerna ERR! npm install --ignore-scripts --no-package-lock --ignore-scripts --no-audit --package-lock-only stderr:
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: [email protected]
npm ERR! Found: [email protected]
npm ERR! node_modules/react
npm ERR!   peer react@"^16.8.0" from @material-ui/[email protected]
npm ERR!   node_modules/@material-ui/core
npm ERR!     @material-ui/core@"4.4.2" from the root project
npm ERR!     peer @material-ui/core@"^4.0.0" from @material-ui/[email protected]
npm ERR!     node_modules/@material-ui/icons
npm ERR!       @material-ui/icons@"4.4.1" from the root project
npm ERR!   peer react@"^16.0.0" from [email protected]
npm ERR!   node_modules/react-dom
npm ERR!     react-dom@"16.8.6" from the root project
npm ERR!     peer react-dom@"^16.8.0" from @material-ui/[email protected]
npm ERR!     node_modules/@material-ui/core
npm ERR!       @material-ui/core@"4.4.2" from the root project
npm ERR!       1 more (@material-ui/icons)
npm ERR!     2 more (@material-ui/icons, @material-ui/styles)
npm ERR!   2 more (@material-ui/icons, @material-ui/styles)
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! react-fade-in@"0.1.6" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: [email protected]
npm ERR! node_modules/react
npm ERR!   peer react@"^15.4.1" from [email protected]
npm ERR!   node_modules/react-fade-in
npm ERR!     react-fade-in@"0.1.6" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! See /tmp/renovate-cache/others/npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /tmp/renovate-cache/others/npm/_logs/2022-06-18T21_53_12_296Z-debug-0.log

lerna ERR! npm install --ignore-scripts --no-package-lock --ignore-scripts --no-audit --package-lock-only exited 1 in 'omega-web'

:warning: We detected 36 security issues in this pull request:

Vulnerable Libraries (36)

Severity	Details
High	@lerna/[email protected] (t) upgrade to: >3.21.0
High	@lerna/[email protected] (t) upgrade to: >3.21.0
High	@lerna/[email protected] (t) upgrade to: >3.21.0
High	@lerna/[email protected] (t) upgrade to: >3.21.0
High	@lerna/[email protected] (t) upgrade to: >3.21.0
High	@lerna/[email protected] (t) upgrade to: >3.21.0
High	@lerna/[email protected] (t) upgrade to: >3.22.0
High	@lerna/[email protected] (t) upgrade to: >3.21.0
High	@lerna/[email protected] (t) upgrade to: >3.21.0
High	@lerna/[email protected] (t) upgrade to: >3.21.0
High	@lerna/[email protected] (t) upgrade to: >3.22.1
High	@lerna/[email protected] (t) upgrade to: >3.21.0
High	@lerna/[email protected] (t) upgrade to: >3.22.1
High	@pm2/[email protected] (t) upgrade to: >2.0.0
High	@pm2/[email protected] (t) upgrade to: >0.6.1
Medium	@storybook/[email protected] (t) upgrade to: >6.0.28
High	@svgr/[email protected] (t) upgrade to: >5.5.0
High	[email protected] (t) upgrade to: >1.0.0-rc.3
High	[email protected] (t) upgrade to: >4.2.1
High	[email protected] (t) upgrade to: >=1.3.2
Medium	[email protected] (t) upgrade to: >=6.5.4
Critical	[email protected] (t) upgrade to: >=1.1.1
High	[email protected] (t) upgrade to: ***
Critical	[email protected] (t) upgrade to: >=4.7.7
Medium	[email protected] (t) upgrade to: >=2.8.9
Critical	[email protected] (t) upgrade to: >1.4.1 || >2.0.1
Medium	[email protected] (t) upgrade to: >=3.7.0
Critical	[email protected] (t) upgrade to: >=3.0.3
High	[email protected] (t) upgrade to: >=2.29.2
Medium	[email protected] (t) upgrade to: >=8.0.1
Medium	[email protected] (t) upgrade to: >=1.0.7
High	[email protected] (t) upgrade to: >2.0.5
High	[email protected] (t) upgrade to: >5.6.3
High	[email protected] (t) upgrade to: >=1.0.5
Medium	[email protected] (t) upgrade to: >=1.0.3
Critical	[email protected] (t) upgrade to: >1.5.8

More info on how to fix Vulnerable Libraries in JavaScript.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.