forecast.io
forecast.io copied to clipboard

Published 20 hours ago •

Reame
Issues

Update dependency debug to v4 [SECURITY]

Open renovate[bot] opened this issue 5 years ago • 1 comments

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
debug	`^0.8.0` -> `^4.0.0`

GitHub Vulnerability Alerts

CVE-2017-16137

Affected versions of debug are vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter.

As it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.

Recommendation

Version 2.x.x: Update to version 2.6.9 or later. Version 3.x.x: Update to version 3.1.0 or later.

CVE-2017-20165

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The name of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability. The patch has been backported to the 2.6.x branch in version 2.6.9.

Release Notes

debug-js/debug

`v4.3.4`

What's Changed

Add section about configuring JS console to show debug messages by @gitname in https://github.com/debug-js/debug/pull/866
Replace deprecated String.prototype.substr() by @CommanderRoot in https://github.com/debug-js/debug/pull/876

New Contributors

@gitname made their first contribution in https://github.com/debug-js/debug/pull/866
@CommanderRoot made their first contribution in https://github.com/debug-js/debug/pull/876

Full Changelog: https://github.com/debug-js/debug/compare/4.3.3...4.3.4

`v4.3.3`

Patch Release 4.3.3

This is a documentation-only release. Further, the repository was transferred. Please see notes below.

Migrates repository from https://github.com/visionmedia/debug to https://github.com/debug-js/debug. Please see notes below as to why this change was made.
Updates repository maintainership information
Updates the copyright (no license terms change has been made)
Removes accidental epizeuxis (#828)
Adds README section regarding usage in child procs (#850)

Thank you to @taylor1791 and @kristofkalocsai for their contributions.

Repository Migration Information

I've formatted this as a FAQ, please feel free to open an issue for any additional question and I'll add the response here.

Q: What impact will this have on me?

In most cases, you shouldn't notice any change.

The only exception I can think of is if you pull code directly from https://github.com/visionmedia/debug, e.g. via a "debug": "visionmedia/debug"-type version entry in your package.json - in which case, you should still be fine due to the automatic redirection Github sets up, but you should also update any references as soon as possible.

Q: What are the security implications of this change?

If you pull code directly from the old URL, you should update the URL to https://github.com/debug-js/debug as soon as possible. The old organization has many approved owners and thus a new repository could (in theory) be created at the old URL, circumventing Github's automatic redirect that is in place now and serving malicious code. I (@qix-) also wouldn't have access to that repository, so while I don't think it would happen, it's still something to consider.

Even in such a case, however, the officially released package on npm (debug) would not be affected. That package is still very much under control (even more than it used to be).

Q: What should I do if I encounter an issue related to the migration?

Search the issues first to see if someone has already reported it, and then open a new issue if someone has not.

Q: Why was this done as a 'patch' release? Isn't this breaking?

No, it shouldn't be breaking. The package on npm shouldn't be affected (aside from this patch release) and any references to the old repository should automatically redirect.

Thus, according to all of the "APIs" (loosely put) involved, nothing should have broken.

I understand there are a lot of edge cases so please open issues as needed so I can assist in any way necessary.

Q: Why was the repository transferred?

I'll just list them off in no particular order.

The old organization was defunct and abandoned.
I was not an owner of the old organization and thus could not ban the non-trivial amount of spam users or the few truly abusive users from the org. This hindered my ability to properly maintain this package.
The debug ecosystem intends to grow beyond a single package, and since new packages could not be created in the old org (nor did it make sense for them to live there), a new org made the most sense - especially from a security point of view.
The old org has way, way too many approved members with push access, for which there was nothing I could do. This presented a pretty sizable security risk given that many packages in recent years have fallen victim to backdoors and the like due to lax security access.

Q: Was this approved?

Q: Do I need to worry about another migration sometime in the future?

No.

`v4.3.2`

Patch release 4.3.2

Caches enabled statuses on a per-logger basis to speed up .enabled checks (#799)

Thank you @omg!

`v4.3.1`

Patch release 4.3.1

Fixes a ReDOS regression (#458) - see #797 for details.

`v4.3.0`

Minor release

Deprecated debugInstance.destroy(). Future major versions will not have this method; please remove it from your codebases as it currently does nothing.
Fixed quoted percent sign
Fixed memory leak within debug instances that are created dynamically

`v4.2.0`

Minor Release

Replaced phantomJS with chrome backend for browser tests
Deprecated and later removed Changelog.md in lieu of releases page
Removed bower.json (#602)
Removed .eslintrc (since we've switched to XO)
Removed .coveralls.yml
Removed the build system that was in place for various alternate package managers
Removed the examples folder (#650)
Switched to console.debug in the browser only when it is available (#600)
Copied custom logger to namespace extension (#646)
Added issue and pull request templates
Added "engines" key to package.json
Added ability to control selectColor (#747)
Updated dependencies
Marked supports-color as an optional peer dependency

`v4.1.1`

This backport fixes a bug in coveralls configuration as well as the .extend() function.

Patches

test: only run coveralls on travis (#663, #664, d0e498f)
copy custom logger to namespace extension (#646, 57ef085)

`v4.1.0`

Minor Changes

migrate Makefile to npm scripts (4236585)
feat: Return namespaces string when invoking disable() (7ef8b41)

Massive thank you to @mblarsen and @outsideris for knocking out two long-awaited changes.

`v4.0.1`

This patch restores browserify functionality as well as keeping the intended functionality with Unpkg.com.

Patches

fix browserify and supply alternative unpkg entry point (closes #606): 99c95e3

`v4.0.0`

A long-awaited release to debug is available now: 4.0.0.

Due to the delay in release and the number of changes made (including bumping dependencies in order to mitigate vulnerabilities), it is highly recommended maintainers update to the latest package version and test thoroughly.

This release drops support for Node 4 and 5 in alignment with the Node.js LTS Release Schedule.

Major Changes

move to XO (closes #397): ba8a424
add Node.js 10, remove Node.js 4 (#583): 05b0ceb

Minor Changes

bump vulnerable packages: 853853f
Fix nwjs support (#569): 207a6a2
add instance extends feature (#524): e43e5fe
Add TVMLKit support (#579): 02b9ea9

Patches

clean up builds: 3ca2331
remove needless command aliases in makefile: 9f4f8f5
no longer checking for BROWSER=1: 623c08e
fix tests: 57cde56
clean up makefile: 62822f1
fix tests: 833b6f8
add .editorconfig: 2d2509e
add yarn-error.log to .gitignore: 7e1d5d9
Improve usability of Windows notes w/ examples for prompts & npm script (#577): 1ad1e4a
Drop usage of chrome.storage (or make the storage backend pluggable): 71d2aa7
Detect 'process' package: 225c66f
Update ms to 2.1.1 (#539): 22f9932
Update .npmignore (#527): a5ca7a2
fix colors with supports-color@5: 285dfe1
Document enable() (#517): ab5083f
refactor to make the common code be a setup function (#507): 7116906
Simplify and improve: da51af8
use babel-ified distributed source for browsers: b3f8f8e

Credits

Huge thanks to @DanielRuf, @EirikBirkeland, @KyleStay, @Qix-, @abenhamdine, @alexey-pelykh, @DiegoRBaquero, @febbraro, @kwolfy, and @TooTallNate for their help!

`v3.2.7`

`v3.2.6`

This backport fixes a 4x performance regression when debug is disabled.

Patches

fix: performance issue (f312a89) (#625)

`v3.2.5`

This patch restores browserify functionality as well as keeping the intended functionality with Unpkg.com.

It is a backport of the 4.0.1 release.

Patches

fix browserify and supply alternative unpkg entry point (closes #606): cc5f146

`v3.2.4`

3.2.4 is DEPRECATED. See https://github.com/visionmedia/debug/issues/603#issuecomment-420237335 for details.

This released fixed the missing files entry in package.json, mitigating the faulty 3.2.3 release.

`v3.2.3`

3.2.3 is DEPRECATED. See https://github.com/visionmedia/debug/issues/603#issuecomment-420237335 for details.

This release mitigated the breaking changes introduced in 3.2.0 where ./node.js was removed, breaking a very select few users on older releases of babel-core, as well as users that used an undocumented require('debug/node').

./node.js was temporarily added to the repository at this time; however, this release failed to include node.js in the files key in package.json and thus didn't fix the issue. 3.2.4 rectified this issue.

`v3.2.2`

3.2.2 is DEPRECATED. See https://github.com/visionmedia/debug/issues/603#issuecomment-420237335 for details.

This release mitigated the breaking changes introduced in 3.2.0 where ES6 features were being used on users of Node 4, causing crashes upon inclusion.

It employed a temporary Babel pass on the entire codebase in lieu of a hard reversion (so this version is, effectively, a backport of the fixes and features ultimately introduced in 4.0.0).

`v3.2.1`

3.2.1 is DEPRECATED. See https://github.com/visionmedia/debug/issues/603#issuecomment-420237335 for details.

This release, along with 3.2.0, were subsequently released together as 4.0.0 (a major bump). You can review the complete changes in that release's details.

A quick hotfix to address Browser builds - debug is now compiled down to IE8-compatible code via Babel upon release.

CDNs that honor the "browser": key in package.json should now reflect these changes (previously, they would serve the non-bundled ES6 version).

Patches

use babel-ified distributed source for browsers: b3f8f8e

`v3.2.0`

3.2.0 is DEPRECATED. See https://github.com/visionmedia/debug/issues/603#issuecomment-420237335 for details.

This release was intended to be the next release of Debug but introduced breaking changes that were overlooked at the time of release. As such it has been deprecated on npm and should not be used.

This release, along with 3.2.1, were subsequently released together as 4.0.0 (a major bump). You can review the included changes in that release's details.

`v3.1.0`

Minor Changes

Ignore package-lock.json: e7e568a
Remove component.json: 47747f3
Remove "component" from package.json: bdb7e01
Add DEBUG_HIDE_DATE env var: #486

Patches

Correct spelling mistake: daf1a7c
Examples: fix colors printout: 7cd9e53
Fix browser detection: fdfa0f5
Remove ReDoS regexp in %o formatter: #504

Credits

Huge thanks to @amejiarosario and @zhuangya for their help!

`v3.0.1`

`v3.0.0`

Featuring pretty new colors!

Major Changes

Remove DEBUG_FD: #406
Make millisecond timer namespace specific and allow 'always enabled' output: #408
Use Date#toISOString() instead to Date#toUTCString() when output is not a TTY: #418
enabled() updates existing debug instances: #440

Minor Changes

Add destroy() function: #440
Document enabled flag: #465
Support 256 colors: #481
Update "browserify" to v14.4.0: 826fd94
Separate Node.js and web browser examples: 87880f6
Example: use %o formatter: 31f3343
More readme screenshots replaced: 25eb545
Add Namespace Colors section to readme: 8b5c438
Separate the Node and Browser tests in Travis: f178d86

Patches

Readme: fix typo: #473
Component: update "ms" to v2.0.0: d2dd80a

Credits

Huge thanks to @gtjoseph, @timruffles and @FantasticFiasco for their help!

`v2.6.9`

Patches

Remove ReDoS regexp in %o formatter: #504

Credits

Huge thanks to @zhuangya for their help!

`v2.6.8`

`v2.6.7`

`v2.6.6`

`v2.6.5`

`v2.6.4`

`v2.6.3`

`v2.6.2`

`v2.6.1`

`v2.6.0`

`v2.5.2`

`v2.5.1`

`v2.5.0`

`v2.4.5`

`v2.4.4`

`v2.4.3`

`v2.4.2`

`v2.4.1`

`v2.4.0`

`v2.3.3`

`v2.3.2`

`v2.3.1`

`v2.3.0`

`v2.2.0`

`v2.1.3`

`v2.1.2`

`v2.1.1`

`v2.1.0`

`v2.0.0`

`v1.0.5`

`v1.0.4`

`v1.0.3`

`v1.0.2`

`v1.0.1`

`v1.0.0`

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

[ ] If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

Mar 11 '19 09:03 renovate[bot]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠ Warning: custom changes will be lost.

Mar 24 '23 19:03 renovate[bot]