Thanks to visit codestin.com
Credit goes to github.com

Skip to content
This repository was archived by the owner on May 26, 2023. It is now read-only.

chore(deps): bump color-string from 1.5.4 to 1.6.0 in /examples/webpack/react #315

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 28, 2021

Bumps color-string from 1.5.4 to 1.6.0.

Release notes

Sourced from color-string's releases.

1.6.0

Minor release 1.6.0

  • #55 - Add support for space-separated HSL

Thanks @​htunnicliff for the contribution :)

1.5.5 (Patch/Security Release) - hwb() ReDos patch (low-severity)

Release notes copied verbatim from the commit message, which can be found here: 0789e21284c33d89ebc4ab4ca6f759b9375ac9d3

Discovered by Yeting Li, c/o Colin Ife via Snyk.io.

A ReDos (Regular Expression Denial of Service) vulnerability was responsibly disclosed to me via email by Colin on Mar 5 2021 regarding an exponential time complexity for linearly increasing input lengths for hwb() color strings.

Strings reaching more than 5000 characters would see several milliseconds of processing time; strings reaching more than 50,000 characters began seeing 1500ms (1.5s) of processing time.

The cause was due to a the regular expression that parses hwb() strings - specifically, the hue value - where the integer portion of the hue value used a 0-or-more quantifier shortly thereafter followed by a 1-or-more quantifier.

This caused excessive backtracking and a cartesian scan, resulting in exponential time complexity given a linear increase in input length.

Thank you Yeting Li and Colin Ife for bringing this to my attention in a secure, responsible and professional manner.

A CVE will not be assigned for this vulnerability.

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [color-string](https://github.com/Qix-/color-string) from 1.5.4 to 1.6.0.
- [Release notes](https://github.com/Qix-/color-string/releases)
- [Changelog](https://github.com/Qix-/color-string/blob/master/CHANGELOG.md)
- [Commits](Qix-/color-string@1.5.4...1.6.0)

---
updated-dependencies:
- dependency-name: color-string
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested review from AmritKumar and bb111189 as code owners July 28, 2021 05:43
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jul 28, 2021
@bb111189 bb111189 requested review from a user and teye July 28, 2021 05:43
@codecov-commenter
Copy link

codecov-commenter commented Jul 28, 2021

Codecov Report

Merging #315 (027f433) into dev (0f60d91) will not change coverage.
The diff coverage is n/a.

❗ Current head 027f433 differs from pull request most recent head 023f59e. Consider uploading reports for the commit 023f59e to get more accurate results
Impacted file tree graph

@@           Coverage Diff           @@
##              dev     #315   +/-   ##
=======================================
  Coverage   79.02%   79.02%           
=======================================
  Files          45       45           
  Lines        1821     1821           
  Branches      306      306           
=======================================
  Hits         1439     1439           
  Misses        381      381           
  Partials        1        1           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0f60d91...023f59e. Read the comment docs.

@bb111189 bb111189 merged commit fd10ef5 into dev Jul 29, 2021
@dependabot dependabot bot deleted the dependabot/npm_and_yarn/examples/webpack/react/color-string-1.6.0 branch July 29, 2021 08:35
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants