Skip to content

fix(deps): update dependency semver to v7.5.2 [security] #262

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
renovate wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(deps): update dependency semver to v7.5.2 [security] #262

renovate wants to merge 1 commit into from

Conversation

@renovate
Copy link

@renovate renovate bot commented Jul 11, 2023 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
semver 7.1.1 → 7.5.2 age confidence
semver 6.3.0 → 7.5.2 age confidence

GitHub Vulnerability Alerts

CVE-2022-25883

Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Release Notes

npm/node-semver (semver)

v7.5.2

Compare Source

Bug Fixes

v7.5.1

Compare Source

Bug Fixes

v7.5.0

Compare Source

Features
Bug Fixes

v7.4.0

Compare Source

Features
Bug Fixes
Documentation

v7.3.8

Compare Source

Bug Fixes
Documentation
7.3.7 (2022-04-11)
Bug Fixes
Dependencies
  • revert to lru-cache@​6 (22ae54d)
7.3.6 (2022-04-05)
Bug Fixes
Documentation
  • clarify * range behavior (cb1ca1d)
Dependencies

v7.3.7

Compare Source

Bug Fixes
Documentation
7.3.7 (2022-04-11)
Bug Fixes
Dependencies
  • revert to lru-cache@​6 (22ae54d)
7.3.6 (2022-04-05)
Bug Fixes
Documentation
  • clarify * range behavior (cb1ca1d)
Dependencies

v7.3.6

Compare Source

Bug Fixes
Documentation
7.3.7 (2022-04-11)
Bug Fixes
Dependencies
  • revert to lru-cache@​6 (22ae54d)
7.3.6 (2022-04-05)
Bug Fixes
Documentation
  • clarify * range behavior (cb1ca1d)
Dependencies

v7.3.5

Compare Source

Bug Fixes
Documentation
7.3.7 (2022-04-11)
Bug Fixes
Dependencies
  • revert to lru-cache@​6 (22ae54d)
7.3.6 (2022-04-05)
Bug Fixes
Documentation
  • clarify * range behavior (cb1ca1d)
Dependencies

v7.3.4

Compare Source

v7.3.3

Compare Source

v7.3.2

Compare Source

v7.3.1

Compare Source

v7.3.0

Compare Source

  • Add subset(r1, r2) method to determine if r1 range is entirely
    contained by r2 range.

v7.2.3

Compare Source

  • Fix handling of includePrelease mode where version ranges like 1.0.0 - 2.0.0 would include 3.0.0-pre and not 1.0.0-pre.

v7.2.2

Compare Source

  • Fix bug where 2.0.0-pre would be included in ^1.0.0 if
    includePrerelease was set to true.

v7.2.1

Compare Source

v7.2.0

Compare Source

  • Add simplifyRange method to attempt to generate a more human-readable
    range expression that is equivalent to a supplied range, for a given set
    of versions.

v7.1.3

Compare Source

v7.1.2

Compare Source

  • Remove fancy lazy-loading logic, as it was causing problems for webpack
    users.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
Copy link
Author

renovate bot commented Jul 11, 2023 •
edited
Loading

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: backend/package-lock.json
/usr/local/bin/docker: line 4: .: filename argument required
.: usage: . filename [arguments]
npm WARN ignoring workspace config at /tmp/worker/cbae8c/480623/repos/github/hweeks/dcpm/backend/.npmrc 
npm WARN ignoring workspace config at /tmp/worker/cbae8c/480623/repos/github/hweeks/dcpm/backend/.npmrc 
npm WARN ignoring workspace config at /tmp/worker/cbae8c/480623/repos/github/hweeks/dcpm/backend/.npmrc 
npm ERR! code EUNSUPPORTEDPROTOCOL
npm ERR! Unsupported URL Type "workspace:": workspace:*

npm ERR! A complete log of this run can be found in: /tmp/worker/cbae8c/480623/cache/others/npm/_logs/2023-07-12T04_06_05_466Z-debug-0.log

@renovate renovate bot force-pushed the renovate/npm-semver-vulnerability branch from 1fc1682 to 2ef78d6 Compare July 12, 2023 04:06
@renovate renovate bot changed the title fix(deps): update dependency semver to v6.3.1 [security] fix(deps): update dependency semver [security] Jul 12, 2023
@renovate renovate bot changed the title fix(deps): update dependency semver [security] fix(deps): update dependency semver to v6.3.1 [security] Jul 12, 2023
@renovate renovate bot force-pushed the renovate/npm-semver-vulnerability branch from 2ef78d6 to f6a4234 Compare August 6, 2024 09:20
@renovate renovate bot changed the title fix(deps): update dependency semver to v6.3.1 [security] fix(deps): update dependency semver to v7.5.2 [security] Aug 6, 2024
@renovate
Copy link
Author

renovate bot commented Aug 6, 2024 •
edited
Loading

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: backend/package-lock.json
npm ERR! code EUNSUPPORTEDPROTOCOL
npm ERR! Unsupported URL Type "workspace:": workspace:*

npm ERR! A complete log of this run can be found in:
npm ERR!     /runner/cache/others/npm/_logs/2026-01-19T19_52_15_912Z-debug-0.log
File name: yarn.lock
➤ YN0000: ┌ Resolution step
➤ YN0002: │ @dcpm/frontend@workspace:frontend doesn't provide @types/node (p72969), requested by ts-node
➤ YN0060: │ @dcpm/frontend@workspace:frontend provides react (p5b86c) with version 17.0.2, which doesn't satisfy what @hot-loader/react-dom requests
➤ YN0060: │ @dcpm/frontend@workspace:frontend provides react (p57493) with version 17.0.2, which doesn't satisfy what react-markdown and some of its descendants request
➤ YN0060: │ @dcpm/frontend@workspace:frontend provides semantic-release (pbffd9) with version 15.14.0, which doesn't satisfy what hweeks-semantic-release-monorepo and some of its descendants request
➤ YN0002: │ @octokit/rest@npm:16.43.2 doesn't provide @octokit/core (p84523), requested by @octokit/plugin-request-log
➤ YN0060: │ semantic-release@npm:17.0.4 provides marked (p53cc6) with version 0.8.2, which doesn't satisfy what marked-terminal requests
➤ YN0000: │ Some peer dependencies are incorrectly met; run yarn explain peer-requirements <hash> for details, where <hash> is the six-letter p-prefixed code
➤ YN0000: └ Completed in 0s 624ms
➤ YN0000: ┌ Fetch step
➤ YN0013: │ 1900 packages were already cached, one had to be fetched (semver@npm:7.5.2)
➤ YN0019: │ semver-npm-7.1.1-a2a8d1c74c-58a3082bb3.zip appeared to be unused and was removed
➤ YN0000: └ Completed in 1s 312ms
➤ YN0000: ┌ Link step
➤ YN0001: │ TypeError: Failed to open the cache entry for fsevents@patch:fsevents@npm%3A2.3.2#~builtin<compat/fsevents>::version=2.3.2&hash=18f3a7: (0 , QO.isDate) is not a function
    at ihe (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:317:10860)
    at Jr.utimesImpl (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:317:28773)
    at Jr.utimesSync (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:317:28366)
    at Jr.mkdirpSync (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:312:13525)
    at Jr.mkdirSync (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:317:28953)
    at g (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:432:330)
    at Jr.baseFs (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:432:2835)
    at /tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:432:2907
    at Mv (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:382:4076)
    at oh.factory (/tmp/containerbase/cache/.cache/node/corepack/v1/yarn/3.1.1/yarn.js:432:2898)
➤ YN0000: └ Completed in 1s 41ms
➤ YN0000: Failed with errors in 3s 181ms

@renovate renovate bot force-pushed the renovate/npm-semver-vulnerability branch from f6a4234 to c787842 Compare November 10, 2025 16:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant