Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

build(deps): always resolve momentjs version 2.29.4 #3182

Merged
merged 1 commit into from
Dec 4, 2023
Merged

build(deps): always resolve momentjs version 2.29.4 #3182

merged 1 commit into from
Dec 4, 2023

Commits on Nov 22, 2023

  1. build(deps): always resolve momentjs version 2.29.4 

    Before this change both version 2.29.1 and version 2.29.4 of momentjs
were brougth in. The bump from v2.29.1 -> v2.29.4 remediates two CVEs:
CVE-2022-24785 [1] and CVE-2022-31129 [2]. The most notable change comes
with the bump from v2.29.1 -> v2.29.2 which introduces a breaking change
to remediate CVE-2022-24785: Forward slash and backward slash is no
longer allowed in locale names. Locales containing either of those
characters will not be loaded from the filesystem any longer [3]. Other
than that it looks like there's only patch fixes which can be seen in
the full changelog [4].

[1] GHSA-8hfj-j24r-96c4
[2] GHSA-wc69-rhjr-hc9g
[3] https://gist.github.com/ichernev/1904b564f6679d9aac1ae08ce13bc45c
[4] https://github.com/moment/moment/blob/536ad0c348f2f99009755698f491080757a48221/CHANGELOG.md

Signed-off-by: Linus Ekman <[email protected]>
    @linus345
    linus345 committed Nov 22, 2023
    Configuration menu
    Copy the full SHA
    e9e1457 View commit details
    Browse the repository at this point in the history