@prenta/core 0.120.0 → 0.120.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +66 -0
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,71 @@
|
|
|
1
1
|
# @actuate-media/cms-core
|
|
2
2
|
|
|
3
|
+
## 0.120.2
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 7f60722: Patch four runtime dependency advisories
|
|
8
|
+
|
|
9
|
+
Eight open Dependabot alerts, all **runtime** scope, two of them high:
|
|
10
|
+
|
|
11
|
+
| Package | Sev | Was | Now |
|
|
12
|
+
| --------------- | ------ | ------- | ------ |
|
|
13
|
+
| `ip-address` ×3 | high | 10.2.0 | 10.4.0 |
|
|
14
|
+
| `fast-uri` | high | 3.1.4 | 3.1.5 |
|
|
15
|
+
| `undici` ×3 | medium | 6.27.0 | 6.28.0 |
|
|
16
|
+
| `hono` | medium | 4.12.27 | 4.13.0 |
|
|
17
|
+
|
|
18
|
+
**A different failure from the last batch.** The brace-expansion fix corrected
|
|
19
|
+
override _keys_ whose ranges no longer selected the resolved version. Here every
|
|
20
|
+
caret range already permitted the patched release — `^3.1.2` allows 3.1.5 — and
|
|
21
|
+
the lockfile simply had not moved. Raising each floor to the advisory's patched
|
|
22
|
+
version forces resolution and leaves the intent legible in the file: the number
|
|
23
|
+
in the override is now the number the advisory requires, not the number that
|
|
24
|
+
happened to be current when it was written.
|
|
25
|
+
|
|
26
|
+
`undici` had resolved to both 6.27.0 and 6.28.0; only the patched one remains.
|
|
27
|
+
|
|
28
|
+
**The overrides block was audited, not spot-checked.** Every entry was compared
|
|
29
|
+
against what the lockfile actually resolved, allowing for the normal case where
|
|
30
|
+
a package resolves to several majors and each has its own scoped rule. After
|
|
31
|
+
these four, every override is in effect. Two things that audit had to get right
|
|
32
|
+
before its answer meant anything: pnpm echoes the overrides block at the top of
|
|
33
|
+
the lockfile in the same shape as a package entry, so a naive scan reports every
|
|
34
|
+
override key as a resolved version; and an unscoped rule is outranked by any
|
|
35
|
+
scoped rule that selects the same version, so `js-yaml: ^4.2.0` sitting above a
|
|
36
|
+
resolved 3.15.0 is correct rather than stale.
|
|
37
|
+
|
|
38
|
+
## 0.120.1
|
|
39
|
+
|
|
40
|
+
### Patch Changes
|
|
41
|
+
|
|
42
|
+
- 931e466: Patch sanitize-html and brace-expansion advisories
|
|
43
|
+
|
|
44
|
+
**sanitize-html → ^2.17.5** (GHSA-vccv-cmxp-4j9h). The library applied its
|
|
45
|
+
URI-scheme check to `href` and `src` but not to `action`, `formaction`, `data`,
|
|
46
|
+
`poster` or `background`, so a `javascript:` URI survived in any of those five.
|
|
47
|
+
|
|
48
|
+
This repo's own two call sites were never exposed: neither the default
|
|
49
|
+
allowlist nor the SVG allowlist in `routes/media.ts` permits any of the five
|
|
50
|
+
attributes, nor any of their tags (`form`, `button`, `object`, `video`,
|
|
51
|
+
`body`). But `sanitizeHtml` is exported from `@prenta/core` and takes
|
|
52
|
+
caller-supplied allowlists, so a consumer permitting `video[poster]` inherited
|
|
53
|
+
the hole — which is why the version floor is the fix rather than the config.
|
|
54
|
+
|
|
55
|
+
Pinned by a test written against explicitly-permitted attributes, because
|
|
56
|
+
asserting on the defaults would pass on a vulnerable version: the defaults
|
|
57
|
+
strip these attributes wholesale and never reach the scheme check. Confirmed to
|
|
58
|
+
reproduce on 2.17.4 (five of the five vulnerable, `href`/`src` already safe)
|
|
59
|
+
and to be closed on the installed 2.17.6.
|
|
60
|
+
|
|
61
|
+
**brace-expansion → ^1.1.18 / ^5.0.9** (GHSA-rgw5-rvv9-x895,
|
|
62
|
+
GHSA-mh99-v99m-4gvg). Development-scope only, reached through `minimatch`
|
|
63
|
+
alone. Overrides for these already existed but their range keys had been
|
|
64
|
+
outrun: `brace-expansion@>=1.0.0 <1.1.13` no longer matches the 1.1.16 that
|
|
65
|
+
`^1.1.13` resolves to, and the 5.x key had the same problem at 5.0.8. An
|
|
66
|
+
override whose key stops matching silently stops overriding, so both keys now
|
|
67
|
+
name the current vulnerable ranges.
|
|
68
|
+
|
|
3
69
|
## 0.120.0
|
|
4
70
|
|
|
5
71
|
### Minor Changes
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@prenta/core",
|
|
3
|
-
"version": "0.120.
|
|
3
|
+
"version": "0.120.2",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -186,7 +186,7 @@
|
|
|
186
186
|
"@prisma/client": "^7.8.0",
|
|
187
187
|
"arctic": "^3.5.0",
|
|
188
188
|
"jose": "^6.0.0",
|
|
189
|
-
"sanitize-html": "^2.17.
|
|
189
|
+
"sanitize-html": "^2.17.5",
|
|
190
190
|
"sharp": "^0.35.0",
|
|
191
191
|
"turndown": "^7.2.4",
|
|
192
192
|
"yjs": "^13.6.0",
|