Skip to content

Commit

Permalink
[2.x backport] Bump joi to v14 to avoid the possibility of prototyp…
Browse files Browse the repository at this point in the history
…e poisoning in a nested dependency (#4206)

Backport PR
#3952

Signed-off-by: Miki <[email protected]>
Co-authored-by: Miki <[email protected]>
  • Loading branch information
ananzh and AMoo-Miki authored Jun 15, 2023
1 parent b19344a commit dca4640
Show file tree
Hide file tree
Showing 5 changed files with 9 additions and 13 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
- [CVE-2023-26486] Bump vega from `5.22.1` to `5.23.0` ([#3533](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3533))
- [CVE-2023-26487] Bump vega from `5.22.1` to `5.23.0` ([#3533](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3533))
- [CVE-2023-0842] Bump xml2js from `0.4.23` to `0.5.0` ([#3842](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3842))
- Bump `joi` to v14 to avoid the possibility of prototype poisoning in a nested dependency ([#3952](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/3952))

### 📈 Features/Enhancements

Expand Down
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -188,7 +188,7 @@
"https-proxy-agent": "^5.0.0",
"inline-style": "^2.0.0",
"ip-cidr": "^2.1.0",
"joi": "^13.5.2",
"joi": "^14.3.1",
"js-yaml": "^3.14.0",
"json-stable-stringify": "^1.0.1",
"json-stringify-safe": "5.0.1",
Expand Down
2 changes: 1 addition & 1 deletion packages/osd-config-schema/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
},
"peerDependencies": {
"lodash": "^4.17.21",
"joi": "^13.5.2",
"joi": "^14.3.1",
"moment": "^2.24.0",
"type-detect": "^4.0.8"
}
Expand Down
2 changes: 1 addition & 1 deletion packages/osd-test/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
"exit-hook": "^2.2.0",
"getopts": "^2.2.5",
"glob": "^7.1.7",
"joi": "^13.5.2",
"joi": "^14.3.1",
"lodash": "^4.17.21",
"parse-link-header": "^2.0.0",
"rxjs": "^6.5.5",
Expand Down
15 changes: 5 additions & 10 deletions yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -9833,11 +9833,6 @@ hmac-drbg@^1.0.1:
minimalistic-assert "^1.0.0"
minimalistic-crypto-utils "^1.0.1"

[email protected]:
version "5.0.4"
resolved "https://registry.yarnpkg.com/hoek/-/hoek-5.0.4.tgz#0f7fa270a1cafeb364a4b2ddfaa33f864e4157da"
integrity sha512-Alr4ZQgoMlnere5FZJsIyfIjORBqZll5POhDsF4q64dPuJR6rNxXdDxtHSQq8OXRurhmx+PWYEE8bXRROY8h0w==

[email protected]:
version "6.1.3"
resolved "https://registry.yarnpkg.com/hoek/-/hoek-6.1.3.tgz#73b7d33952e01fe27a38b0457294b79dd8da242c"
Expand Down Expand Up @@ -11440,12 +11435,12 @@ [email protected]:
resolved "https://registry.yarnpkg.com/jmespath/-/jmespath-0.16.0.tgz#b15b0a85dfd4d930d43e69ed605943c802785076"
integrity sha512-9FzQjJ7MATs1tSpnco1K6ayiYE3figslrXA72G2HQ/n76RzvYlofyi5QM+iX4YRs/pu3yzxlVQSST23+dMDknw==

joi@^13.5.2:
version "13.7.0"
resolved "https://registry.yarnpkg.com/joi/-/joi-13.7.0.tgz#cfd85ebfe67e8a1900432400b4d03bbd93fb879f"
integrity sha512-xuY5VkHfeOYK3Hdi91ulocfuFopwgbSORmIwzcwHKESQhC7w1kD5jaVSPnqDxS2I8t3RZ9omCKAxNwXN5zG1/Q==
joi@^14.3.1:
version "14.3.1"
resolved "https://registry.yarnpkg.com/joi/-/joi-14.3.1.tgz#164a262ec0b855466e0c35eea2a885ae8b6c703c"
integrity sha512-LQDdM+pkOrpAn4Lp+neNIFV3axv1Vna3j38bisbQhETPMANYRbFJFUyOZcOClYvM/hppMhGWuKSFEK9vjrB+bQ==
dependencies:
hoek "5.x.x"
hoek "6.x.x"
isemail "3.x.x"
topo "3.x.x"

Expand Down

0 comments on commit dca4640

Please sign in to comment.