fix(deps): update dependency squirrelly to v9 [security] #30012
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
See the guidelines for reviewing dependency updates for info on how to review dependency update PRs. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
7.9.2->9.0.0GitHub Vulnerability Alerts
CVE-2021-32819
Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options remote code execution may be triggered in downstream applications. Version 9.0.0 has a fix for this issue. For complete details refer to the referenced GHSL-2021-023.
Release Notes
squirrellyjs/squirrelly (squirrelly)
v9.0.0: Version 9.0.0Compare Source
TL;DR
The main news in this commit is that the
settingsfield in the data object is no longer merged with your configuration. This resolves several security issues.This may cause changes in the way you use Express.js with Squirrelly, since you'll have to configure caching and the views directory for both Express and Squirrelly separately.
Example:
Commits
e1a554baf6018fc12418adca7a1ed460cc1ba66a3f5d5b2fef51c3046400940cbdd42f31833df9b8afbe51dd9be151bbd68321eda75a8687c7fd5fe5b5259fe148698a9bdfe7021c6a56235b55d60d32523008f08a6f4fa96eb06276c15ca9967601ec3ebd620664b9b037db119e05ae50652e63710f94bd9106b44424c709b0dfe34476ccf862efe1ee720cfdae9278038a7de30a761df63f2e72d61255744f06817f32507c994d27fadf259b4a7f3d333dd8318455v8.0.8: Version 8.0.8Compare Source
TL;DR
FilterFunctioncontainers.tsintocontainer-utils.ts, and wrote accompanying tests 🎉Commits
0383045ad6fe3dd158e6481c09e993d299756e8685d200f89c1c71d54ba4f2b4fd4a5708c72d2bf3e9bd009073ddb7ef0fb97041c82fa1bf6211864v8.0.7: Version 8.0.7Compare Source
TL;DR
Mainly minor updates. One important fix by @futurelucas4502 preventing
renderFilefrom erroring if the data argument was undefined or null; see #201.Commits
a5b40f6b3108309744133d15e60aa62f36f31d02684b9e964e9a023d386c3aaContributors
v8.0.6: Version 8.0.6Compare Source
TL;DR
Nothing exciting here, just a little package cleanup! All our dev dependencies are now up-to-date.
Commits
4c66bdcf15847b8a6588120f9a3ev8.0.5: Version 8.0.5Compare Source
TL;DR
This release just contains a few quick README updates.
Commits
9a0ee15519e4efv8.0.4: Version 8.0.4Compare Source
TL;DR
Changes in this release:
e) is now applied after all other filters by default. See #189 and #198Commits
b61f2b0623dc42264c2301e5d7470e511f0f6a49205bb49a70d647a1v8.0.3: Version 8.0.3Compare Source
TL;DR
Just updated the README to add a note about the contributors to Version 7 (who unfortunately aren't listed in the README) and removed the badge for David-DM (which has had downtime problems).
Commits
e2f97a7v8.0.2: Version 8.0.2Compare Source
TL;DR
This commit merged #195 (which fixes a compilation error thrown in newer versions of TypeScript), updated dev dependencies, and updated some unit tests to import functions from
index.ts(to improve test coverage)Commits
4ae327b2092ec857a9a9dffd9c9e0c534bce36ad3a4b9944d139a9d0v8.0.1: Version 8.0.1Compare Source
Commits
08755632a0dc7dv8.0.0: Version 8Compare Source
Version 8 is now stable!
Thank you to all those who helped with development or gave feedback!
Documentation is at https://squirrelly.js.org
Configuration
📅 Schedule: Branch creation - "" in timezone America/New_York, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.