Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[cherry-pick][utils] Fix GitHub-reported prototype pollution vulnerability in deepmerge (#41652) #42608

Merged
merged 1 commit into from
Jun 11, 2024
Merged

[cherry-pick][utils] Fix GitHub-reported prototype pollution vulnerability in deepmerge (#41652) #42608

merged 1 commit into from
Jun 11, 2024

Conversation

DiegoAndai
Copy link
Member

Closes #42607

Cherry-pick #41652 to master

@DiegoAndai DiegoAndai added package: utils Specific to the @mui/utils package security Pull requests that address a security vulnerability cherry-pick The PR was cherry-picked from the newer alpha/beta/stable branch labels Jun 10, 2024
@DiegoAndai DiegoAndai requested review from Janpot and mnajdova June 10, 2024 19:21
@DiegoAndai DiegoAndai self-assigned this Jun 10, 2024
@mui-bot
Copy link

mui-bot commented Jun 10, 2024 •
edited
Loading

Netlify deploy preview

https://deploy-preview-42608--material-ui.netlify.app/

Bundle size report

Details of bundle changes (Toolpad)
Details of bundle changes

Generated by 🚫 dangerJS against ee8a57b

@oliviertassinari oliviertassinari added bug 🐛 Something doesn't work and removed security Pull requests that address a security vulnerability labels Jun 10, 2024
@oliviertassinari
Copy link
Member

oliviertassinari commented Jun 10, 2024 •
edited
Loading

I removed the "security" label per #41652 (comment), there is no security flaw from what I can understand, it's a bug fix.

@DiegoAndai DiegoAndai merged commit fab86c8 into mui:master Jun 11, 2024
24 checks passed
@DiegoAndai DiegoAndai deleted the cherry-pick-41652 branch June 11, 2024 12:54
@DiegoAndai DiegoAndai mentioned this pull request Jun 11, 2024
Merged
1 task
@tjcouch-sil
Copy link
Contributor

Indeed Snyk has revoked the report as this was a false positive https://security.snyk.io/vuln/SNYK-JS-MUIUTILS-7231125

@JamesUoM JamesUoM mentioned this pull request Jul 3, 2024
Open
@azeemyoonus azeemyoonus mentioned this pull request Jul 4, 2024
Open
This was referenced Jul 4, 2024
Open
Open
This was referenced Jul 4, 2024
Open
Open
This was referenced Jul 4, 2024
Open
Merged
@heliumtank92 heliumtank92 mentioned this pull request Jul 4, 2024
Open
@OOCAZ OOCAZ mentioned this pull request Jul 4, 2024
Open
@abjerry97 abjerry97 mentioned this pull request Jul 4, 2024
Open
@amylank22 amylank22 mentioned this pull request Jul 4, 2024
Open
@nachodev-ui nachodev-ui mentioned this pull request Jul 4, 2024
Open
@leoo1992 leoo1992 mentioned this pull request Jul 4, 2024
Closed
@kazimanzurrashid kazimanzurrashid mentioned this pull request Aug 2, 2024
Open
@Type-Style Type-Style mentioned this pull request Aug 2, 2024
Closed
This was referenced Aug 2, 2024
Closed
Closed
@nachodev-ui nachodev-ui mentioned this pull request Aug 2, 2024
Open
This was referenced Aug 2, 2024
Open
Open
@mattboddy47 mattboddy47 mentioned this pull request Aug 2, 2024
Open
@amylank22 amylank22 mentioned this pull request Aug 2, 2024
Open
@Poseidon-G Poseidon-G mentioned this pull request Aug 2, 2024
Open
This was referenced Aug 2, 2024
Open
Open
@sufi0900 sufi0900 mentioned this pull request Aug 2, 2024
Open
@loka-capco loka-capco mentioned this pull request Aug 2, 2024
Open
This was referenced Aug 2, 2024
Open
Open
@sumn2u sumn2u mentioned this pull request Aug 2, 2024
Open
This was referenced Aug 2, 2024
Open
Open
This was referenced Aug 3, 2024
Open
Open
This was referenced Aug 4, 2024
Open
Open
This was referenced Aug 5, 2024
Open
Open
@Chanuth-silva10 Chanuth-silva10 mentioned this pull request Aug 6, 2024
Open
@Crushoverride007 Crushoverride007 mentioned this pull request Aug 6, 2024
Open
@DanneelsSophie DanneelsSophie mentioned this pull request Aug 6, 2024
Open
@loka-capco loka-capco mentioned this pull request Aug 6, 2024
Open
@FaroukAmr FaroukAmr mentioned this pull request Aug 6, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Janpot Janpot Janpot approved these changes

@mnajdova mnajdova Awaiting requested review from mnajdova

Assignees

@DiegoAndai DiegoAndai

Labels
bug 🐛 Something doesn't work cherry-pick The PR was cherry-picked from the newer alpha/beta/stable branch package: utils Specific to the @mui/utils package
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@DiegoAndai @mui-bot @oliviertassinari @tjcouch-sil @Janpot