chore(deps): update dependency npm-user-validate to 1.0.1 [security]

[renovate]

This PR contains the following updates:

Package	Change
npm-user-validate	1.0.0 -> 1.0.1

GitHub Vulnerability Alerts

GHSA-xgh6-85xh-479p

npm-user-validate before version 1.0.1 is vulnerable to a Regular Expression Denial of Service (REDos). The regex that validates user emails took exponentially longer to process long input strings beginning with @ characters.

Impact

The issue affects the email function. If you use this function to process arbitrary user input with no character limit the application may be susceptible to Denial of Service.

Patches

The issue is patched in version 1.0.1 by improving the regular expression used and also enforcing a 254 character limit.

Workarounds

Restrict the character length to a reasonable degree before passing a value to .emal(); Also, consider doing a more rigorous sanitizing/validation beforehand.

CVE-2020-7754

This affects the package npm-user-validate before 1.0.1. The regex that validates user emails took exponentially longer to process long input strings beginning with @​ characters.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, click this checkbox.

---

This PR has been generated by Mend Renovate. View repository job log here.