From 6ecc0457b78a1ac3fab8f4ea4510da07e79e5cca Mon Sep 17 00:00:00 2001 From: Tony Date: Fri, 14 Mar 2025 17:41:36 +0800 Subject: [PATCH] chore(deps): pin art-template to 4.13.2 due to security concerns (#18603) * chore(deps): pin art-template to 4.13.2 due to security concerns * docs: add more related issues --- .github/dependabot.yml | 12 +++++++++++- package.json | 2 +- pnpm-lock.yaml | 38 +++++++++++++++----------------------- 3 files changed, 27 insertions(+), 25 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 72d8543ed..9c3675223 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -9,8 +9,18 @@ updates: labels: - dependencies ignore: + # pin to version before it is sold to potential suspicious party + # https://github.com/goofychris/art-template/issues/660 the issue created from original author stating v4.13.3 + # contains suspicious code and related issues (#658, #659) were deleted + # related: + # https://github.com/fastify/point-of-view/issues/463 https://github.com/cnpm/bug-versions/pull/266 + # https://github.com/yoimiya-kokomi/Miao-Yunzai/pull/515 https://github.com/zhangfisher/flex-tools/commit/09b565dfe6e2932bb829613ddbe09f6d0acbccd4 + # https://github.com/fastify/point-of-view/pull/461#issuecomment-2718888986 + - dependency-name: art-template + versions: ['>=4.13.3'] + # no longer includes KJUR.crypto.Cipher for RSA - dependency-name: jsrsasign - versions: ['>=11.0.0'] # no longer includes KJUR.crypto.Cipher for RSA + versions: ['>=11.0.0'] - package-ecosystem: 'github-actions' directory: '/' diff --git a/package.json b/package.json index 625619264..9a21ddf26 100644 --- a/package.json +++ b/package.json @@ -68,7 +68,7 @@ "@sentry/node": "9.5.0", "@tonyrl/rand-user-agent": "2.0.83", "aes-js": "3.1.2", - "art-template": "4.13.4", + "art-template": "4.13.2", "cheerio": "1.0.0", "chrono-node": "2.7.8", "city-timezones": "1.3.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 21d7266cc..01c6f6dee 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -71,8 +71,8 @@ importers: specifier: 3.1.2 version: 3.1.2 art-template: - specifier: 4.13.4 - version: 4.13.4 + specifier: 4.13.2 + version: 4.13.2 cheerio: specifier: 1.0.0 version: 1.0.0 @@ -2467,8 +2467,8 @@ packages: resolution: {integrity: sha512-sKpyeERZ02v1FeCZT8lrfJq5u6goHCtpTAzPwJYe7c8SPFOboNjNg1vz2L4VTn9T4PQxEx13TbXLmYUcS6Ug7Q==} engines: {node: '>=0.10.0'} - art-template@4.13.4: - resolution: {integrity: sha512-SoCdwWrj6VNoErheIKnDSzBEO0SsZJK9p34nliZUuChkfiReu8x4hLP/jBTLG6yEr+tWxdANufophDYsau52Fg==} + art-template@4.13.2: + resolution: {integrity: sha512-04ws5k+ndA5DghfheY4c8F1304XJKeTcaXqZCLpxFkNMSkaR3ChW1pX2i9d3sEEOZuLy7de8lFriRaik1jEeOQ==} engines: {node: '>= 1.0.0'} asap@2.0.6: @@ -2829,9 +2829,6 @@ packages: resolution: {integrity: sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==} engines: {node: '>=18'} - commander@2.17.1: - resolution: {integrity: sha512-wPMUt6FnH2yzG95SA6mzjQOEKUU3aLaDEmzs1ti+1E9h+CsrZghRlqEM/EJ4KscsQVG8uNN4uVreUeT8+drlgg==} - commander@2.19.0: resolution: {integrity: sha512-6tvAOO+D6OENvRAh524Dh9jcfKTYDQAqvqezbCW82xj5X0pSrcpxtvRKHLG0yBY6SD7PSDrJaj+0AiOcKVd1Xg==} @@ -3779,9 +3776,9 @@ packages: html-escaper@2.0.2: resolution: {integrity: sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==} - html-minifier@3.5.21: - resolution: {integrity: sha512-LKUKwuJDhxNa3uf/LPR/KVjm/l3rBqtYeCOAekvG8F1vItxMUpueGd94i/asDDr8/1u7InxzFA5EeGjhhG5mMA==} - engines: {node: '>=4'} + html-minifier@4.0.0: + resolution: {integrity: sha512-aoGxanpFPLg7MkIl/DDFYtb0iWz7jMFGqFhvEDZga6/4QTjneiD8I/NXL1x5aaoCp7FSIT6h/OhykDdPsbtMig==} + engines: {node: '>=6'} hasBin: true html-to-text@9.0.5: @@ -5732,8 +5729,8 @@ packages: ufo@1.5.4: resolution: {integrity: sha512-UsUk3byDzKd04EyoZ7U4DOlxQaD14JUKQl6/P7wiX4FNvUfm3XL246n9W5AmqwW5RSFJ27NAuM0iLscAOYUiGQ==} - uglify-js@3.4.10: - resolution: {integrity: sha512-Y2VsbPVs0FIshJztycsO2SfPk7/KAF/T72qzv9u5EpQ4kB2hQoHlhNQTsNyy6ul7lQtqJN/AoWeS23OzEiEFxw==} + uglify-js@3.19.3: + resolution: {integrity: sha512-v3Xu+yuwBXisp6QYTcH4UbH+xYJXqnq2m/LtQVWKWzYc1iehYnLixoQDN9FH6/j9/oybfd6W9Ghwkl8+UMKTKQ==} engines: {node: '>=0.8.0'} hasBin: true @@ -8357,12 +8354,12 @@ snapshots: arr-union@3.1.0: {} - art-template@4.13.4: + art-template@4.13.2: dependencies: acorn: 5.7.4 escodegen: 1.14.3 estraverse: 4.3.0 - html-minifier: 3.5.21 + html-minifier: 4.0.0 is-keyword-js: 1.0.3 js-tokens: 3.0.2 merge-source-map: 1.1.0 @@ -8764,8 +8761,6 @@ snapshots: commander@13.1.0: {} - commander@2.17.1: {} - commander@2.19.0: {} component-emitter@1.3.1: {} @@ -9867,15 +9862,15 @@ snapshots: html-escaper@2.0.2: {} - html-minifier@3.5.21: + html-minifier@4.0.0: dependencies: camel-case: 3.0.0 clean-css: 4.2.4 - commander: 2.17.1 + commander: 2.19.0 he: 1.2.0 param-case: 2.1.1 relateurl: 0.2.7 - uglify-js: 3.4.10 + uglify-js: 3.19.3 html-to-text@9.0.5: dependencies: @@ -11996,10 +11991,7 @@ snapshots: ufo@1.5.4: {} - uglify-js@3.4.10: - dependencies: - commander: 2.19.0 - source-map: 0.6.1 + uglify-js@3.19.3: {} unbzip2-stream@1.4.3: dependencies: