Skip to content
This repository has been archived by the owner on Jan 29, 2023. It is now read-only.

Update dependency grunt to v1 [SECURITY] #28

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented May 9, 2021

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
grunt (source) 0.4.5 -> 1.5.3 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2020-7729

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

CVE-2022-0436

Grunt prior to version 1.5.2 is vulnerable to path traversal.

CVE-2022-1537

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.


Release Notes

gruntjs/grunt

v1.5.3

Compare Source

v1.5.2

Compare Source

v1.5.1

Compare Source

v1.5.0

Compare Source

v1.4.1

Compare Source

v1.4.0

Compare Source

v1.3.0

Compare Source

  • Merge pull request #​1720 from gruntjs/update-changelog-deps faab6be
  • Update Changelog and legacy-util dependency 520fedb
  • Merge pull request #​1719 from gruntjs/yaml-refactor 7e669ac
  • Switch to use safeLoad for loading YML files via file.readYAML. e350cea
  • Merge pull request #​1718 from gruntjs/legacy-log-bumo 7125f49
  • Bump legacy-log 00d5907

v1.2.1

Compare Source

v1.2.0

Compare Source

v1.1.0

Compare Source

  • Update to mkdirp ~1.0.3
  • Only support versions of Node >= 8

v1.0.4

Compare Source

v1.0.3

Compare Source

v1.0.2

Compare Source

v1.0.1

Compare Source

v1.0.0

Compare Source


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

@renovate renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from cf38eb7 to 4cddddf Compare May 16, 2022 00:08
@renovate renovate bot force-pushed the renovate/npm-grunt-vulnerability branch from 4cddddf to cf93cc0 Compare June 18, 2022 17:48
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants