@wdio/ocr-service 2.2.8 → 2.2.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +33 -0
- package/package.json +7 -7
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,38 @@
|
|
|
1
1
|
# @wdio/ocr-service
|
|
2
2
|
|
|
3
|
+
## 2.2.10
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- 6cd5742: ### Dependency updates
|
|
8
|
+
|
|
9
|
+
Updated dependencies across all packages to their latest compatible versions. This includes the WebdriverIO toolchain (`webdriverio`, `@wdio/*`) to `9.29.1`, the TypeScript ESLint plugins to `8.62.0`, Vitest to `3.2.6`, and various other packages such as `sharp`, `@remix-run/*`, `fuse.js` and `expect-webdriverio`. There are no functional or API changes.
|
|
10
|
+
|
|
11
|
+
### Committers: 1
|
|
12
|
+
|
|
13
|
+
- Wim Selles ([@wswebcreation](https://github.com/wswebcreation))
|
|
14
|
+
|
|
15
|
+
## 2.2.9
|
|
16
|
+
|
|
17
|
+
### Patch Changes
|
|
18
|
+
|
|
19
|
+
- db33fa7: #### `@wdio/image-comparison-core` and `@wdio/ocr-service` Security: update jimp (CVE in `file-type` transitive dep)
|
|
20
|
+
|
|
21
|
+
Bumped `jimp` to the latest version to resolve a reported vulnerability in its `file-type` transitive dependency (see [#1130](https://github.com/webdriverio/visual-testing/issues/1130), raised by [@denis-sokolov](https://github.com/denis-sokolov), thank you!).
|
|
22
|
+
|
|
23
|
+
**Actual impact on these packages**
|
|
24
|
+
`file-type` is used by `@jimp/core` solely to detect image MIME types when reading a buffer. In both `@wdio/image-comparison-core` and `@wdio/ocr-service`, every image passed to jimp originates from either WebDriver screenshots (browser-controlled base64 data) or local files written by the framework itself. There is no code path where untrusted external input is fed directly into jimp, which removes the exploitability that the CVE describes.
|
|
25
|
+
|
|
26
|
+
That said, the reputational and compliance risk was real, security scanners flag the package as vulnerable, enterprise users hit audit failures, and some organisations block installation of packages with known CVEs. The update addresses all of that.
|
|
27
|
+
|
|
28
|
+
#### `@wdio/visual-reporter` and `@wdio/visual-service`
|
|
29
|
+
|
|
30
|
+
Updated internal dependencies to pick up the jimp bump in `@wdio/image-comparison-core`.
|
|
31
|
+
|
|
32
|
+
### Committers: 1
|
|
33
|
+
|
|
34
|
+
- Wim Selles ([@wswebcreation](https://github.com/wswebcreation))
|
|
35
|
+
|
|
3
36
|
## 2.2.8
|
|
4
37
|
|
|
5
38
|
### Patch Changes
|
package/package.json
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
"name": "@wdio/ocr-service",
|
|
3
3
|
"author": "Wim Selles - wswebcreation",
|
|
4
4
|
"description": "A WebdriverIO service that is using Tesseract OCR for Desktop/Mobile Web and Mobile Native App tests.",
|
|
5
|
-
"version": "2.2.
|
|
5
|
+
"version": "2.2.10",
|
|
6
6
|
"license": "MIT",
|
|
7
7
|
"homepage": "https://webdriver.io/docs/visual-testing",
|
|
8
8
|
"repository": {
|
|
@@ -22,18 +22,18 @@
|
|
|
22
22
|
"type": "module",
|
|
23
23
|
"types": "./dist/index.d.ts",
|
|
24
24
|
"dependencies": {
|
|
25
|
-
"@wdio/globals": "^9.
|
|
26
|
-
"@wdio/logger": "^9.
|
|
27
|
-
"@wdio/types": "^9.
|
|
28
|
-
"fuse.js": "^7.
|
|
25
|
+
"@wdio/globals": "^9.29.1",
|
|
26
|
+
"@wdio/logger": "^9.29.1",
|
|
27
|
+
"@wdio/types": "^9.29.1",
|
|
28
|
+
"fuse.js": "^7.4.2",
|
|
29
29
|
"@inquirer/prompts": "7.10.1",
|
|
30
|
-
"jimp": "^1.6.
|
|
30
|
+
"jimp": "^1.6.1",
|
|
31
31
|
"node-tesseract-ocr": "^2.2.1",
|
|
32
32
|
"tesseract.js": "^5.1.1",
|
|
33
33
|
"xml2js": "^0.6.2"
|
|
34
34
|
},
|
|
35
35
|
"devDependencies": {
|
|
36
|
-
"@types/inquirer": "~9.0.
|
|
36
|
+
"@types/inquirer": "~9.0.10",
|
|
37
37
|
"@types/xml2js": "~0.4.14"
|
|
38
38
|
},
|
|
39
39
|
"scripts": {
|