Merge main (v3.2.2) into develop - #698
Conversation
…(v3.1.1) (#682) * chore: move the signpost next to answer text and remove default label (v3.1.1) * remove unnecessary test * Update snapshots * prettier button * Update snapshots --------- Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
* add feedback buttons * rename var * Update snapshots * Update snapshots --------- Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
* fix: js-yaml vulnerabilities (v3.2.2) * Update snapshots --------- Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com>
![semgrep-code-yext[bot]](https://avatars.githubusercontent.com/u/931250?s=60&v=4){kind=small}
| @@ -16167,13 +16011,13 @@ | |||
| "license": "Unlicense" | |||
| }, | |||
| "node_modules/rollup": { | |||
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 16013 lists a dependency (rollup) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of rollup are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rollup is vulnerable to arbitrary file write via path traversal: chunk/asset names derived from user-controlled inputs (e.g., CLI named inputs, manual chunk aliases, or malicious plugins) are insufficiently sanitized, allowing ../ sequences to survive and be passed into path.resolve when computing output paths. This lets an attacker escape the configured output directory and overwrite arbitrary files on the host filesystem that the build process can write to, potentially leading to persistent RCE by clobbering shell/profile or other executable/config files.
To resolve this comment:
Check if you are running rollup --input.
- If you're affected, upgrade this dependency to at least version 4.59.0 at test-site/package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| "dev": true, | ||
| "license": "MIT" | ||
| }, | ||
| "node_modules/fix-dts-default-cjs-exports/node_modules/rollup": { |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 12330 lists a dependency (rollup) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of rollup are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rollup is vulnerable to arbitrary file write via path traversal: chunk/asset names derived from user-controlled inputs (e.g., CLI named inputs, manual chunk aliases, or malicious plugins) are insufficiently sanitized, allowing ../ sequences to survive and be passed into path.resolve when computing output paths. This lets an attacker escape the configured output directory and overwrite arbitrary files on the host filesystem that the build process can write to, potentially leading to persistent RCE by clobbering shell/profile or other executable/config files.
To resolve this comment:
Check if you are running rollup --input.
- If you're affected, upgrade this dependency to at least version 4.59.0 at package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
|
Current unit coverage is 89.37598736176935% |
|
coverage: 84.727%. remained the same — dev/merge-v3.2.2-aefd014-into-develop into develop |
3 participants
Merge main (v3.2.2) into develop