Skip to content

Commit

Permalink
Merge pull request #1430 from guardian/path-to-regexp-vuln-fix
Browse files Browse the repository at this point in the history 
path-to-regexp dependency vuln fix
  • Loading branch information
@rBangay
rBangay authored Dec 16, 2024
2 parents 1c582c4 + 82d74bd commit 6162a6f
Show file tree
Hide file tree
Showing 2 changed files with 32 additions and 70 deletions.
8 changes: 4 additions & 4 deletions package.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@
"@types/bunyan": "1.8.6",
"@types/color": "3.0.0",
"@types/cookie-parser": "1.4.1",
"@types/csurf": "1.9.35",
"@types/csurf": "1.11.5",
"@types/express": "4.16.1",
"@types/helmet": "0.0.37",
"@types/jest": "29.5.6",
Expand Down Expand Up @@ -145,7 +145,7 @@
"@emotion/react": "11.11.1",
"@guardian/ab-core": "2.0.0",
"@guardian/ab-react": "2.0.1",
"@guardian/commercial": "23.7.4",
"@guardian/commercial": "^23.7.5",
"@guardian/libs": "16.1.0",
"@guardian/source": "1.0.2",
"@guardian/source-development-kitchen": "1.0.0",
Expand All @@ -159,9 +159,9 @@
"base-64": "0.1.0",
"color": "3.1.0",
"cookie-parser": "1.4.4",
"csurf": "1.10.0",
"csurf": "1.11.0",
"date-fns": "2.16.1",
"express": "4.21.0",
"express": "4.21.2",
"formik": "2.4.6",
"helmet": "3.23.3",
"jest-environment-jsdom": "29.7.0",
Expand Down
94 changes: 28 additions & 66 deletions yarn.lock
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3227,10 +3227,10 @@
resolved "https://registry.yarnpkg.com/@guardian/ab-react/-/ab-react-2.0.1.tgz#f018898de584c8e70a48e69ec9e499e08f512cc5"
integrity sha512-iOKbIxoLwRMv2eHddxL5l9mNBy/B9QaOOJgA3VUdo/jH5cUVzbF6W8yYDGcZJTolIVhSu5GPR8fitsOoup6Vww==

"@guardian/[email protected].4":
version "23.7.4"
resolved "https://registry.yarnpkg.com/@guardian/commercial/-/commercial-23.7.4.tgz#aa22a11582e7c0625a3c627de8543a88d58b55b8"
integrity sha512-VMRRWR0pUMcZkDYfJ8kf8LD5OK/x29WPjbphizCAB0h7zJTeRKhUiJfQQ3l0YNZA+MrRXzY+PZIaf2IZvQJbGg==
"@guardian/commercial@^23.7.5":
version "23.7.5"
resolved "https://registry.yarnpkg.com/@guardian/commercial/-/commercial-23.7.5.tgz#f77cb0ce1e5f650458f547a63f81ceb44efe87c0"
integrity sha512-qSq3Y2RYifb3tyBdsnTJsgD7DjRABrco/xk32IzKgRRb4gvjol/Uc9TfazhAwaBUwLiDjrAZvgrVssv8V+wlBA==
dependencies:
"@guardian/prebid.js" "8.52.0-8"
"@octokit/core" "^6.1.2"
Expand Down Expand Up @@ -5029,12 +5029,11 @@
dependencies:
"@types/node" "*"

"@types/csurf@1.9.35":
version "1.9.35"
resolved "https://registry.yarnpkg.com/@types/csurf/-/csurf-1.9.35.tgz#cecf3a9c09a9eb235d368ddf70b7c80588f29f72"
integrity sha512-2EVN+Bt2Vd8u+11xeJ64BjCYVOlhqaob82FPAw8VzOOWAYfP8TFvB7RD67CShEz45JXiI+38mlNJHKrArCzFMw==
"@types/csurf@1.11.5":
version "1.11.5"
resolved "https://registry.yarnpkg.com/@types/csurf/-/csurf-1.11.5.tgz#16c3502fb534004a04d9cb8a48f031577528573b"
integrity sha512-5rw87+5YGixyL2W8wblSUl5DSZi5YOlXE6Awwn2ofLvqKr/1LruKffrQipeJKUX44VaxKj8m5es3vfhltJTOoA==
dependencies:
"@types/express" "*"
"@types/express-serve-static-core" "*"

"@types/detect-port@^1.3.0":
Expand Down Expand Up @@ -7668,10 +7667,10 @@ [email protected]:
resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.3.1.tgz#e7e0a1f9ef43b4c8ba925c5c5a96e806d16873bb"
integrity sha512-+IJOX0OqlHCszo2mBUq+SrEbCj6w7Kpffqx60zYbPTFaO4+yYgRjHwcZNpWvaTylDHaV7PPmBHzSecZiMhtPgw==

cookie@0.6.0:
version "0.6.0"
resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.6.0.tgz#2798b04b071b0ecbff0dbb62a505a8efa4e19051"
integrity sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==
cookie@0.4.0:
version "0.4.0"
resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.4.0.tgz#beb437e7022b3b6d49019d088665303ebe9c14ba"
integrity sha512-+Hp8fLp57wnUSt0tY0tHEXh4voZRDnoIrZPqlo3DPiI4y9lwg/jqx+1Om94/W6ZaPDOUbnjOt/99w66zk+l1Xg==

[email protected]:
version "0.7.1"
Expand Down Expand Up @@ -7948,15 +7947,15 @@ csstype@^3.0.2:
resolved "https://registry.yarnpkg.com/csstype/-/csstype-3.1.2.tgz#1d4bf9d572f11c14031f0436e1c10bc1f571f50b"
integrity sha512-I7K1Uu0MBPzaFKg4nI5Q7Vs2t+3gWWW648spaF+Rg7pI9ds18Ugn+lvg4SHczUdKlHI5LWBXyqfS8+DufyBsgQ==

csurf@1.10.0:
version "1.10.0"
resolved "https://registry.yarnpkg.com/csurf/-/csurf-1.10.0.tgz#c3bafb66ff218a7b61ad09f39e85edb2ee818b7f"
integrity sha512-fh725p0R83wA5JukCik5hdEko/LizW/Vl7pkKDa1WJUVCosg141mqaAWCScB+nkEaRMFMGbutHMOr6oBNc/j9A==
csurf@1.11.0:
version "1.11.0"
resolved "https://registry.yarnpkg.com/csurf/-/csurf-1.11.0.tgz#ab0c3c6634634192bd3d6f4b861be20800eeb61a"
integrity sha512-UCtehyEExKTxgiu8UHdGvHj4tnpE/Qctue03Giq5gPgMQ9cg/ciod5blZQ5a4uCEenNQjxyGuzygLdKUmee/bQ==
dependencies:
cookie "0.3.1"
cookie "0.4.0"
cookie-signature "1.0.6"
csrf "3.1.0"
http-errors "~1.7.2"
http-errors "~1.7.3"

[email protected]:
version "1.0.2"
Expand Down Expand Up @@ -9250,47 +9249,10 @@ expect@^29.7.0:
jest-message-util "^29.7.0"
jest-util "^29.7.0"

[email protected], express@^4.15.4, express@^4.17.3:
version "4.21.0"
resolved "https://registry.yarnpkg.com/express/-/express-4.21.0.tgz#d57cb706d49623d4ac27833f1cbc466b668eb915"
integrity sha512-VqcNGcj/Id5ZT1LZ/cfihi3ttTn+NJmkli2eZADigjq29qTlWi/hAQ43t/VLPq8+UX06FCEx3ByOYet6ZFblng==
dependencies:
accepts "~1.3.8"
array-flatten "1.1.1"
body-parser "1.20.3"
content-disposition "0.5.4"
content-type "~1.0.4"
cookie "0.6.0"
cookie-signature "1.0.6"
debug "2.6.9"
depd "2.0.0"
encodeurl "~2.0.0"
escape-html "~1.0.3"
etag "~1.8.1"
finalhandler "1.3.1"
fresh "0.5.2"
http-errors "2.0.0"
merge-descriptors "1.0.3"
methods "~1.1.2"
on-finished "2.4.1"
parseurl "~1.3.3"
path-to-regexp "0.1.10"
proxy-addr "~2.0.7"
qs "6.13.0"
range-parser "~1.2.1"
safe-buffer "5.2.1"
send "0.19.0"
serve-static "1.16.2"
setprototypeof "1.2.0"
statuses "2.0.1"
type-is "~1.6.18"
utils-merge "1.0.1"
vary "~1.1.2"

express@^4.19.2:
version "4.21.1"
resolved "https://registry.yarnpkg.com/express/-/express-4.21.1.tgz#9dae5dda832f16b4eec941a4e44aa89ec481b281"
integrity sha512-YSFlK1Ee0/GC8QaO91tHcDxJiE/X4FbpAyQWkxAvG6AXCuR65YzK8ua6D9hvi/TzUfZMpc+BwuM1IPw8fmQBiQ==
[email protected], express@^4.15.4, express@^4.17.3, express@^4.19.2:
version "4.21.2"
resolved "https://registry.yarnpkg.com/express/-/express-4.21.2.tgz#cf250e48362174ead6cea4a566abef0162c1ec32"
integrity sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==
dependencies:
accepts "~1.3.8"
array-flatten "1.1.1"
Expand All @@ -9311,7 +9273,7 @@ express@^4.19.2:
methods "~1.1.2"
on-finished "2.4.1"
parseurl "~1.3.3"
path-to-regexp "0.1.10"
path-to-regexp "0.1.12"
proxy-addr "~2.0.7"
qs "6.13.0"
range-parser "~1.2.1"
Expand Down Expand Up @@ -10381,7 +10343,7 @@ http-errors@~1.6.2:
setprototypeof "1.1.0"
statuses ">= 1.4.0 < 2"

http-errors@~1.7.2:
http-errors@~1.7.3:
version "1.7.3"
resolved "https://registry.yarnpkg.com/http-errors/-/http-errors-1.7.3.tgz#6c619e4f9c60308c38519498c14fbb10aacebb06"
integrity sha512-ZTTX0MWrsQ2ZAhA1cejAwDLycFsd7I7nVtnkT3Ol0aqodaKW+0CTZDQ1uBv5whptCnc8e8HeRRJxRs0kmm/Qfw==
Expand Down Expand Up @@ -13048,10 +13010,10 @@ path-scurry@^1.10.1:
lru-cache "^9.1.1 || ^10.0.0"
minipass "^5.0.0 || ^6.0.2 || ^7.0.0"

[email protected].10:
version "0.1.10"
resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.10.tgz#67e9108c5c0551b9e5326064387de4763c4d5f8b"
integrity sha512-7lf7qcQidTku0Gu3YDPc8DJ1q7OOucfa/BSsIwjuh56VU7katFvuM8hULfkwB3Fns/rsVF7PwPKVw1sl5KQS9w==
[email protected].12:
version "0.1.12"
resolved "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.12.tgz#d5e1a12e478a976d432ef3c58d534b9923164bb7"
integrity sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ==

path-to-regexp@^6.3.0:
version "6.3.0"
Expand Down

0 comments on commit 6162a6f

Please sign in to comment.