Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[Snyk] Upgrade swagger-ui from 4.1.3 to 4.6.2 #1

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Upgrade swagger-ui from 4.1.3 to 4.6.2 #1

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

Snyk has created this PR to upgrade swagger-ui from 4.1.3 to 4.6.2.

merge advice
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

  • The recommended version is 11 versions ahead of your current version.
  • The recommended version was released a month ago, on 2022-03-10.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Improper Input Validation
SNYK-JS-URLPARSE-2407770		 405/1000
Why? CVSS 8.1		 No Known Exploit
Authorization Bypass Through User-Controlled Key
SNYK-JS-URLPARSE-2412697		 405/1000
Why? CVSS 8.1		 Proof of Concept
Authorization Bypass
SNYK-JS-URLPARSE-2407759		 405/1000
Why? CVSS 8.1		 Proof of Concept
Access Restriction Bypass
SNYK-JS-URLPARSE-2401205		 405/1000
Why? CVSS 8.1		 Proof of Concept
Cross-site Scripting (XSS)
SNYK-JS-PRISMJS-2404333		 405/1000
Why? CVSS 8.1		 No Known Exploit
Information Exposure
SNYK-JS-NODEFETCH-2342118		 405/1000
Why? CVSS 8.1		 No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: swagger-ui
  • 4.6.2 - 2022-03-10

    4.6.2 (2022-03-10)

    Bug Fixes

    • examples: allow string created by regex pattern (#7829) (3d79c24)
    • swagger-ui-react: amend prop validation for plugins (#7900) (5874d2b)
  • 4.6.1 - 2022-03-02

    4.6.1 (2022-03-02)

    Bug Fixes

  • 4.6.0 - 2022-03-01

    4.6.0 (2022-03-01)

    Features

    • build: webpack@5 and webpack-dev-server@4 (#7826) (07d346b)
    • swagger-ui-react: add support for persistAuthorization prop (#7842) (67dd4f6), closes #7389

    Additional Notes

    SwaggerUI is now built using webpack@5, with dev support for webpack-dev-server@4

    • ES Module output bundle path now points to swagger-ui-es-bundle-core, which does not include dependencies
    • No change to CommonJS output bundle or path
    • Now uses Asset Modules, which replaces file-loader, raw-loader, and url-loader
    • Removed unused rules/loaders for .woff | .woff2 | .ttf | .eot fonts and html
    • Node polyfills are no longer bundled with webpack@5, and must be loaded separately and/or use resolve.fallback. As an example, SwaggerUI loads process, buffer, and stream-browserify as devDependencies in order to build development and production bundles.

    SwaggerUI-React:

    • Now imports swagger-ui-es-bundle-core, and similarly outputs swagger-ui-es-bundle-core to its dist directory

    Dev:

    • Order of execution matters for the production npm build scripts. build-stylesheets needs to get built first,
      then cleanup of any empty artifacts, before building the various production bundles
    • Dev-helpers now relies on HTMLWebpackPlugin to inject css and bundle files
  • 4.5.2 - 2022-02-21

    4.5.2 (2022-02-21)

    Bug Fixes

  • 4.5.1 - 2022-02-19

    4.5.1 (2022-02-19)

    Bug Fixes

    • build: do not pull whole highlight.js and refractor libs (#7852) (c73d718), closes #7851
  • 4.5.0 - 2022-02-04

    4.5.0 (2022-02-04)

    Features

    • requestSnippets: handle type: string, format: binary or base64 file upload data (#7545) (2b30a34)

    Bug Fixes

    • oauth2: generate default oauth2RedirectUrl based on page location and path (#7476) (a89c90e)
    • serverVariables: refresh state on definition change (#7821) (a0e9923)
  • 4.4.1 - 2022-01-31

    4.4.1 (2022-01-31)

    Bug Fixes

    • auth: compensate for uninitialized config (6c10e4a), closes #7814
  • 4.4.0 - 2022-01-27

    4.4.0 (2022-01-27)

    Bug Fixes

    Features

    • do not ask for client secret when using auth code with PKCE (#7438) (c6d8d77), closes #6290
  • 4.3.0 - 2022-01-25

    4.3.0 (2022-01-25)

    Bug Fixes

    • swagger-ui-react: fix prop type for defaultModelRendering (6b10708), closes #7783

    Features

    • error-handling: introduce unified and configurable error handling (#7761) (8b1c4a7), closes #7778

    This release comes with a release article that contains more information about the new unified SwaggerUI error handling mechanism

  • 4.2.1 - 2022-01-19

    4.2.1 (2022-01-19)

    This is a patch release that supersedes v4.2.0 to properly build the downstream swagger-ui-react package. No other /src changes in this version.

    • chore(deps-dev): babel plugins needed to build swagger-ui-react #7779
  • 4.2.0 - 2022-01-19
  • 4.1.3 - 2021-12-10
from swagger-ui GitHub release notes
Commit messages
Package name: swagger-ui

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

@github-actions GitHub Actions
Copy link

This pull request can no longer be automatically merged: a rebase is needed and changes have to be manually resolved

# for free to join this conversation on GitHub. Already have an account? # to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
needs-rebase
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@snyk-bot