build(deps-dev): bump typescript to v5.9.3 - #209
Conversation
renovate
Bot
changed the title
34c2ec7 to
a843127
Compare
a843127 to
1559816
Compare
renovate
Bot
changed the title
1559816 to
793df1e
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
793df1e to
f7262e9
Compare
renovate
Bot
changed the title
f7262e9 to
7cf6773
Compare
7cf6773 to
b6adc87
Compare
renovate
Bot
changed the title
b6adc87 to
27164f8
Compare
renovate
Bot
changed the title
27164f8 to
c5b6463
Compare
renovate
Bot
changed the title
c5b6463 to
90e0811
Compare
renovate
Bot
changed the title
22f26ea to
77bd2a6
Compare
f96ce0f to
db19b43
Compare
renovate
Bot
changed the title
db19b43 to
381dc87
Compare
381dc87 to
f6538a6
Compare
f6538a6 to
eac9880
Compare
eac9880 to
26a2c04
Compare
26a2c04 to
6fcc1d2
Compare
08f60e0 to
484dfe2
Compare
484dfe2 to
934df5c
Compare
934df5c to
b86a90a
Compare
887a5ed to
b048dac
Compare
b048dac to
6d381c8
Compare
6d381c8 to
c941c89
Compare
8d97e36 to
4dbd963
Compare
4dcc7ff to
9d5022c
Compare
9d5022c to
d76f99e
Compare
![semgrep-app[bot]](https://avatars.githubusercontent.com/in/60555?s=60&v=4){kind=small}
| resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==} | ||
| hasBin: true | ||
|
|
||
| js-yaml@3.6.1: |
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 558 lists a dependency (js-yaml) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of js-yaml are vulnerable to Uncontrolled Resource Consumption. js-yaml is vulnerable to denial of service when parsing untrusted YAML: a document that uses nested arrays as mapping keys combined with anchors and aliases triggers exponential string expansion during parsing, stalling the Node.js process and exhausting memory. Any call to a js-yaml load function (load, loadAll, safeLoad, safeLoadAll) on attacker-controlled input is affected.
References: GHSA
To resolve this comment:
Check if you are using js-yaml on the CLI.
- If you're affected, upgrade this dependency to at least version 3.13.0 at pnpm-lock.yaml.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| resolution: {integrity: sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==} | ||
| hasBin: true | ||
|
|
||
| js-yaml@3.6.1: |
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 558 lists a dependency (js-yaml) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of js-yaml are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). js-yaml is vulnerable to prototype pollution through its YAML merge key (<<) handling. When parsing untrusted YAML with load, loadAll, safeLoad, or safeLoadAll, a crafted document containing a __proto__ key inside a merged mapping can modify the prototype of the resulting object, leading to integrity violations in the application.
To resolve this comment:
Check if you are using js-yaml on the CLI.
- If you're affected, upgrade this dependency to at least version 3.14.2 at pnpm-lock.yaml.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
c250f13 to
f883173
Compare
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
All alerts resolved. Learn more about Socket for GitHub. This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored. |
ed3ecaf to
e1a8433
Compare
e1a8433 to
23805cb
Compare
| resolution: {integrity: sha512-ttBQIIQPDeLjpPOohtUdXuXUVoA2uIB6fEH9HyJ7234s5mBJ5wTx20njxplLZQgLaOfpmPQA7X2t5AX6tIPbog==} | ||
| hasBin: true | ||
|
|
||
| js-yaml@3.6.1: |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 551 lists a dependency (js-yaml) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity / Uncontrolled Resource Consumption. An attacker can supply a YAML document containing a chain of mappings that each merge the previous one via the merge key (<<), causing js-yaml to spend quadratic CPU time while parsing input whose size grows only linearly, resulting in a denial of service.
To resolve this comment:
Check if you are using js-yaml on the CLI.
- If you're affected, upgrade this dependency to at least version 3.15.0 at pnpm-lock.yaml.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
23805cb to
392876a
Compare
| resolution: {integrity: sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==} | ||
| hasBin: true | ||
|
|
||
| js-yaml@3.6.1: |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 551 lists a dependency (js-yaml) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of js-yaml are vulnerable to Inefficient Algorithmic Complexity. An attacker can supply a YAML document containing a large !!omap sequence, which js-yaml resolves with a linear duplicate-key scan inside its per-element loop. Resolution is therefore quadratic in the number of entries, so a modestly sized document consumes disproportionate CPU inside the load call and blocks the event loop, resulting in a denial of service.
References: GHSA
To resolve this comment:
Check if you are using js-yaml on the CLI.
- If you're affected, upgrade this dependency to at least version 3.15.1 at pnpm-lock.yaml.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
392876a to
29bc8a1
Compare
This PR contains the following updates:
5.4.5→5.9.3Release Notes
microsoft/TypeScript (typescript)
v5.9.3: TypeScript 5.9.3Compare Source
Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.
For release notes, check out the release announcement
Downloads are available on:
v5.9.2: TypeScript 5.9Compare Source
Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.
For release notes, check out the release announcement
Downloads are available on:
v5.8.3: TypeScript 5.8.3Compare Source
Note: this tag was recreated to point at the correct commit. The npm package contained the correct content.
For release notes, check out the release announcement.
Downloads are available on:
v5.8.2: TypeScript 5.8Compare Source
For release notes, check out the release announcement.
Downloads are available on:
v5.7.3: TypeScript 5.7.3Compare Source
For release notes, check out the release announcement.
Downloads are available on npm
v5.7.2: TypeScript 5.7Compare Source
For release notes, check out the release announcement.
Downloads are available on:
v5.6.3: TypeScript 5.6.3Compare Source
For release notes, check out the release announcement.
For the complete list of fixed issues, check out the
Downloads are available on:
v5.6.2: TypeScript 5.6Compare Source
For release notes, check out the release announcement.
For the complete list of fixed issues, check out the
Downloads are available on:
v5.5.4: TypeScript 5.5.4Compare Source
For release notes, check out the release announcement.
For the complete list of fixed issues, check out the
Downloads are available on:
v5.5.3: TypeScript 5.5.3Compare Source
For release notes, check out the release announcement.
For the complete list of fixed issues, check out the
Downloads are available on:
v5.5.2: TypeScript 5.5Compare Source
For release notes, check out the release announcement.
For the complete list of fixed issues, check out the
Downloads are available on:
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.