New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(deps): update dependency luxon to v1.28.1 [security] #42

Open

renovate wants to merge 1 commit into master from renovate/npm-luxon-vulnerability

renovate bot commented Mar 16, 2023 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
luxon	`1.12.1` -> `1.28.1`

GitHub Vulnerability Alerts

CVE-2023-22467

Impact

Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.

This is the same bug as Moment's GHSA-wc69-rhjr-hc9g

Workarounds

Limit the length of the input.

References

There is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973

Details

DateTime.fromRFC2822("(".repeat(500000)) takes a couple minutes to complete.

Release Notes

moment/luxon (luxon)

`v1.28.1`

`v1.28.0`

Fix ISO parsing for offset specifiers in Year-Ordinal formats

`v1.27.0`

Fix GMT zone parsing for older versions of Node
Support multiple units in toRelative
Various documentation updates

`v1.26.0`

Add fromISOTime, toISOTime and toMillis to Duration (#803)
Fix padding of negative years in IsoDate (#871)
Fix hasSame unit comparison (#798)
Export VERSION information (#794)
Durations are considered equal with extra zero units. Fixes #809 (#811)

`v1.25.0`

fix fromFormat with Intl formats containing non-breaking spaces
Support higher precision in ISO milliseconds
Some fixes for 00:30 timezones
Fix some throwOnInvalid for invalid Intervals
Various doc fixes
Fix Interval#isSame for empty intervals
Mark package as side effect-free
Add support for intervals with a large number of seconds

`v1.24.1`

Remove erroneous console.log call

`v1.24.0`

Update polyfills for pollyfilled build

`v1.23.0`

Allow minus sign prefix when creating Duration from ISO

`v1.22.2`

Added more details to error messages for type errors

`v1.22.0`

Fix setZone's handling of pre-1970 dates with millisecond components
Fix keepLocalTime for large jumps near the target zone's DST
Fix cache perf for toRelative()

`v1.21.3`

Fix parsing of meridiems in macro tokens in newer versions of v8

`v1.21.2`

Fix bug in Chrome Canary that threw off time zone calculations

`v1.21.1`

Fix for quarter parsing
Some documentation updates

`v1.21.0`

Added quarter support to the parser
Fix some rounding issues in ISO formatting

`v1.20.0`

Added Duration#mapUnits
added Interval#toISODate and Interval#toISOTime
Some documentation fixes

`v1.19.3`

Cache offset values
Fix handling of negative sub 1-hour offsets

`v1.19.2`

Speculative fix for Node 6

`v1.19.1`

Fix Intl.DateTimeFormat usage for polyfills

`v1.19.0`

Interval#splitAt now ignores input dates outside the interval
Don't allow decimals in DateTime creation

`v1.18.2`

Fix handling of decimals in DateTime#plus and #minus

`v1.18.1`

Fix validity when adding or subtracting time that exceeds Date max/min boundaries

`v1.18.0`

Add support for macro tokens in the parser

`v1.17.3`

`v1.17.2`

Fix issue with toRelative using style: short with plural days

`v1.17.1`

Reject out-of-range numbers in DateTime.fromMillis
Reject 0s in ISO date inputs

`v1.17.0`

DateTime.min and DateTime.max throw if they get the wrong kind of arguments
Fixed throwOnInvalid logic for Interval
Added DATETIME_MED_WITH_WEEKDAY preset

`v1.16.1`

Catch errors trying to use Intl in weird versions of IE 11

`v1.16.0`

Fixed locale default logic for `DateTime#toFormat("ZZZZ")

`v1.15.0`

Added formatOffset to Zones

`v1.14.0`

Allow the zone argument to Interval.fromISO with duration components
Ignore the zone argument to Duration factory methods

`v1.13.3`

Fix keepLocalTime calculations that span offset changes

`v1.13.2`

Fixed ISO formatting for dates > 999

`v1.13.1`

Performance improvements for regex parsing

`v1.13.0`

Support numberSystem in fromFormat
Fix validity for bad initial zone specifiers

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.


          fix(deps): update dependency luxon to v1.28.1 [security]

0327e13

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet