@verdaccio/test-helper 4.1.3 → 4.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/CHANGELOG.md +15 -0
  2. package/package.json +3 -3
package/CHANGELOG.md CHANGED
@@ -1,5 +1,20 @@
1
1
  # Change Log
2
2
 
3
+ ## 4.1.4
4
+
5
+ ### Patch Changes
6
+
7
+ - 437767b: Update express to 4.22.3 so these packages resolve qs 6.16.0, closing several
8
+ denial-of-service advisories in query-string handling that `pnpm audit` reports against
9
+ the previous qs 6.15.x: a remotely triggerable crash in `qs.stringify` (TypeError on
10
+ crafted input), an `arrayLimit` bypass through bracket-key comma parsing that allows
11
+ memory exhaustion, and a DoS via an attacker-controlled `isBuffer` check
12
+ (GHSA-4mjr-xmp4-gh2g). Request parsing behaviour is otherwise unchanged and operators
13
+ need no configuration change; verdaccio 6.x picks the fix up when it bumps these
14
+ dependencies.
15
+ - Updated dependencies [437767b]
16
+ - @verdaccio/middleware@8.1.4
17
+
3
18
  ## 4.1.3
4
19
 
5
20
  ### Patch Changes
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@verdaccio/test-helper",
3
- "version": "4.1.3",
3
+ "version": "4.1.4",
4
4
  "description": "Verdaccio Test Helpers",
5
5
  "homepage": "https://verdaccio.org",
6
6
  "bugs": {
@@ -38,11 +38,11 @@
38
38
  "@verdaccio/config": "8.3.0",
39
39
  "@verdaccio/core": "8.3.0",
40
40
  "@verdaccio/logger": "8.1.3",
41
- "@verdaccio/middleware": "8.1.3",
41
+ "@verdaccio/middleware": "8.1.4",
42
42
  "@verdaccio/types": "13.0.6",
43
43
  "body-parser": "1.20.6",
44
44
  "debug": "4.4.3",
45
- "express": "4.22.2",
45
+ "express": "4.22.3",
46
46
  "fs-extra": "11.2.0",
47
47
  "supertest": "7.1.4"
48
48
  },