Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

fix(deps): update dependency luxon to v3.2.1 [security] #483

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Mar 17, 2023

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
luxon 3.0.1 -> 3.2.1 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2023-22467

Impact

Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.

This is the same bug as Moment's GHSA-wc69-rhjr-hc9g

Workarounds

Limit the length of the input.

References

There is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973

Details

DateTime.fromRFC2822("(".repeat(500000)) takes a couple minutes to complete.


Release Notes

moment/luxon (luxon)

v3.2.1

Compare Source

  • Fix for RFC-2822 regex vulnerability
  • Better handling of BCP tags with -x- extensions

v3.2.0

Compare Source

  • Allow timeZone to be specified as an intl option
  • Fix for diff's handling of end-of-month when crossing leap years (#​1340)
  • Add Interval.toLocaleString() (#​1320)

v3.1.1

Compare Source

  • Add Settings.twoDigitCutoffYear

v3.1.0

Compare Source

  • Add Duration.rescale

v3.0.4

Compare Source

v3.0.3

Compare Source

v3.0.2

Compare Source

  • Lots of doc changes
  • Added DateTime.expandFormat
  • Added support for custom conversion matrices in Durations

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@vercel
Copy link

vercel bot commented Mar 17, 2023

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated
blog ✅ Ready (Inspect) Visit Preview 💬 Add your feedback Mar 17, 2023 at 2:04AM (UTC)

@renovate renovate bot changed the title chore(deps): update dependency luxon to 3.2.1 [security] fix(deps): update dependency luxon to v3.2.1 [security] Mar 23, 2023
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants