[Snyk] Upgrade: electron-builder, electron-updater #34

MarcelRaschke · 2022-08-20T00:27:13Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on
electron-builder from 22.8.1 to 23.3.3	57 versions ahead of your current version ⚠️ This is a major version upgrade, and may be a breaking change	24 days ago on 2022-07-27
electron-updater from 4.3.5 to 5.2.1	36 versions ahead of your current version ⚠️ This is a major version upgrade, and may be a breaking change	a month ago on 2022-07-18

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Prototype Pollution SNYK-JS-Y18N-1021887	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Arbitrary File Write SNYK-JS-TAR-1579155	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579147	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536528	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579155	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579147	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536528	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Remote Code Execution (RCE) SNYK-JS-SHELLQUOTE-1766506	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Improper Privilege Management SNYK-JS-SHELLJS-2332187	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVERREGEX-1585624	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVERREGEX-1584358	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Prototype Pollution SNYK-JS-MERGEDEEP-1070277	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Prototype Pollution SNYK-JS-I18NEXT-1065979	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Remote Code Execution (RCE) SNYK-JS-EJS-2803307	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-ASYNC-2441827	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-ASYNC-2441827	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-AJV-584908	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVERREGEX-2824151	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVERREGEX-1047770	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-PATHVAL-596926	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Information Exposure SNYK-JS-NODEFETCH-2342118	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Information Exposure SNYK-JS-NANOID-2332193	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-I18NEXT-585930	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Buffer Overflow SNYK-JS-I18NEXT-575536	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-HAPISTATEHOOD-2769251	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Prototype Pollution SNYK-JS-FLAT-596927	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Arbitrary Code Injection SNYK-JS-EJS-1049328	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-COLORSTRING-1082939	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-2429795	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: electron-builder

23.3.3 - 2022-07-27
What's Changed
- docs: highlight, thanks by @ gaoyia in #7010
- fix: Duplicate values during deep assign of extra files by @ mmaietta in #7019
New Contributors
- @ gaoyia made their first contribution in #7010
Full Changelog: v23.3.2...v23.3.3
23.3.2 - 2022-07-18
What's Changed
- fix: Wrap the nsProcess include in a !ifndef by @ titus-anromedonn in #6996
- fix: installDir definition #6907 by @ panther7 in #6995
- fix(electron-updater): fix backward compatibility for GitHub provider without channels by @ matejkriz in #6998
- chore: Adding allowPrerelease github integration tests by @ mmaietta in #7003
- docs: Add customWelcomePage example to Custom NSIS script by @ hueyyeng in #7001
New Contributors
- @ titus-anromedonn made their first contribution in #6996
- @ matejkriz made their first contribution in #6998
- @ hueyyeng made their first contribution in #7001
Full Changelog: v23.3.1...v23.3.2
23.3.1 - 2022-07-08
What's Changed
- feat: Add installDir property for NsisUpdater by @ panther7 in #6907
- chore(deps): update dependency @ types/archiver to v5.3.1 by @ renovate in #6979
- chore(deps): update dependency @ types/node to v16.11.43 by @ renovate in #6980
- fix: parallel release creation with Keygen publisher by @ ezekg in #6989
- fix: add product scope to Keygen publisher by @ ezekg in #6990
Full Changelog: v23.3.0...v23.3.1
23.3.0 - 2022-07-04
What's Changed
- feat: upgrade Keygen integration to v1.1 by @ ezekg in #6941
- fix(mac): allow Mac Developer certs for non Mac App Store builds by @ regentcid434 in #6956
- fix: prevent infinite looping of overwriteArtifact by @ CCInc in #6958
- fix: add product scope to keygen provider by @ ezekg in #6975
- fix(mas): Allow signing with "3rd Party Mac Developer Application" by @ csett86 in #6970
- fix(nsis): fix typo in German installer message by @ tkleinke in #6960
- fix: nsis-web target set APP_PACKAGE_URL_IS_INCOMPLETE by @ geovie in #6964
- fix: regenerate schema.json for x64ArchFiles by @ mmaietta in #6983
- docs: add missing PORTABLE_EXECUTABLE_FILE by @ felipecrs in #6981
- fix: Remove DISABLE_WAYLAND for snaps by @ aripollak in #6961
New Contributors
- @ regentcid434 made their first contribution in #6956
- @ CCInc made their first contribution in #6958
- @ tkleinke made their first contribution in #6960
- @ felipecrs made their first contribution in #6981
- @ aripollak made their first contribution in #6961
Full Changelog: v23.2.0...v23.3.0
23.2.0 - 2022-06-17
Read more
23.1.0 - 2022-05-29
23.0.9 - 2022-05-08
23.0.8 - 2022-04-24
23.0.7 - 2022-04-21
23.0.6 - 2022-04-13
23.0.4 - 2022-04-09
23.0.3 - 2022-03-20
23.0.2 - 2022-03-06
23.0.1 - 2022-02-25
23.0.0 - 2022-02-19
23.0.0-alpha.4 - 2022-02-17
23.0.0-alpha.3 - 2022-02-06
23.0.0-alpha.2 - 2022-01-26
23.0.0-alpha.1 - 2022-01-24
23.0.0-alpha.0 - 2022-01-17
22.14.13 - 2022-01-11
22.14.12 - 2022-01-02
22.14.11 - 2021-12-21
22.14.10 - 2021-12-01
22.14.9 - 2021-11-30
22.14.8 - 2021-11-26
22.14.7 - 2021-11-11
22.14.6 - 2021-11-09
22.14.5 - 2021-10-13
22.14.4 - 2021-10-05
22.14.3 - 2021-09-25
22.14.2 - 2021-09-10
22.14.1 - 2021-09-09
22.14.0 - 2021-09-08
22.13.1 - 2021-08-27
22.13.0 - 2021-08-25
22.12.1 - 2021-08-22
22.12.0 - 2021-08-09
22.11.11 - 2021-07-29
22.11.10 - 2021-07-24
22.11.9 - 2021-07-14
22.11.8 - 2021-07-01
22.11.7 - 2021-06-11
22.11.6 - 2021-06-11
22.11.5 - 2021-05-19
22.11.4 - 2021-05-14
22.11.3 - 2021-05-11
22.11.2 - 2021-05-10
22.11.1 - 2021-05-03
22.10.5 - 2021-02-18
22.10.4 - 2020-12-22
22.10.3 - 2020-12-14
22.10.2 - 2020-12-14
22.10.1 - 2020-12-14
22.10.0 - 2020-12-14
22.9.1 - 2020-09-22
22.9.0 - 2020-09-20
22.8.1 - 2020-07-28

from electron-builder GitHub release notes

Package name: electron-updater

5.2.1 - 2022-07-18
Patch Changes
- #6998 d6115bc5 Thanks @ matejkriz! - fix(electron-updater): fix backward compatibility for GitHub provider without channels
- #6995 c9f0da51 Thanks @ panther7! - Fix installDir definition #6907
5.2.0 - 2022-07-08
Read more
5.1.0 - 2022-07-04
Read more
5.0.6 - 2022-06-17
5.0.5 - 2022-05-29
5.0.4 - 2022-05-08
5.0.3 - 2022-04-24
5.0.2 - 2022-04-13
5.0.1 - 2022-04-09
5.0.0 - 2022-02-19
5.0.0-alpha.4 - 2022-02-06
5.0.0-alpha.3 - 2022-01-31
5.0.0-alpha.2 - 2022-01-28
5.0.0-alpha.1 - 2022-01-26
5.0.0-alpha.0 - 2022-01-17
4.6.5 - 2021-12-01
4.6.4 - 2021-11-30
4.6.3 - 2021-11-26
4.6.2 - 2021-11-09
4.6.1 - 2021-10-13
4.6.0 - 2021-09-08
4.5.2 - 2021-09-02
4.5.1 - 2021-08-27
4.5.0 - 2021-08-25
4.4.6 - 2021-08-22
4.4.5 - 2021-08-12
4.4.4 - 2021-08-09
4.4.3 - 2021-07-29
4.4.2 - 2021-07-24
4.4.1 - 2021-07-14
4.4.0 - 2021-07-01
4.3.10 - 2021-06-11
4.3.9 - 2021-05-11
4.3.8 - 2021-02-18
4.3.7 - 2020-12-14
4.3.6 - 2020-12-14
4.3.5 - 2020-07-28

from electron-updater GitHub release notes

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade: - electron-builder from 22.8.1 to 23.3.3. See this package in npm: https://www.npmjs.com/package/electron-builder - electron-updater from 4.3.5 to 5.2.1. See this package in npm: https://www.npmjs.com/package/electron-updater See this project in Snyk: https://app.snyk.io/org/marcelraschke/project/c43862e2-04e0-46c7-9027-49ad8d871d46?utm_source=github&utm_medium=referral&page=upgrade-pr

MarcelRaschke self-assigned this Sep 28, 2022

MarcelRaschke added the ⤵️ pull label Sep 28, 2022

MarcelRaschke added this to the snyk milestone Sep 28, 2022

Merge branch 'master' into snyk-upgrade-142144d9df93ee2aed44409fd305138c

f7b4ec2

MarcelRaschke merged commit 1830f40 into master Sep 28, 2022

delete-merged-branch bot deleted the snyk-upgrade-142144d9df93ee2aed44409fd305138c branch September 28, 2022 23:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: electron-builder, electron-updater #34

[Snyk] Upgrade: electron-builder, electron-updater #34

MarcelRaschke commented Aug 20, 2022

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Patch Changes

[Snyk] Upgrade: electron-builder, electron-updater #34

[Snyk] Upgrade: electron-builder, electron-updater #34

Conversation

MarcelRaschke commented Aug 20, 2022

Snyk has created this PR to upgrade multiple dependencies.

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

New Contributors

Patch Changes