[Snyk] Upgrade @nextcloud/vue from 3.2.0 to 3.10.1 by snyk-bot · Pull Request #20 · Zintexiss/server

snyk-bot · 2021-07-13T02:07:58Z

Snyk has created this PR to upgrade @nextcloud/vue from 3.2.0 to 3.10.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 18 versions ahead of your current version.
The recommended version was released a month ago, on 2021-06-02.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Prototype Pollution SNYK-JS-Y18N-1021887	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SSRI-1246392	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SSRI-1085630	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Command Injection SNYK-JS-LODASH-1040724	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-WS-1296835	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Improper Input Validation SNYK-JS-URLPARSE-1078283	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1090595	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1090595	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Prototype Pollution SNYK-JS-PATHVAL-596926	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Cross-site Scripting (XSS) SNYK-JS-NEXTCLOUDDIALOGS-1245465	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Cross-site Scripting (XSS) SNYK-JS-NEXTCLOUDDIALOGS-1245465	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-HANDLEBARS-1279029	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Remote Code Execution (RCE) SNYK-JS-HANDLEBARS-1056767	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Cryptographic Issues SNYK-JS-ELLIPTIC-1064899	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-BROWSERSLIST-1090194	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Server-Side Request Forgery (SSRF) SNYK-JS-AXIOS-1038255	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Server-Side Request Forgery (SSRF) SNYK-JS-AXIOS-1038255	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Cross-site Scripting (XSS) SNYK-JS-STRIPTAGS-1312310	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: @nextcloud/vue

3.10.1 - 2021-06-02
v3.10.1 (2021-06-02)

Full Changelog

Fixed bugs
- Ensure the closed event is dispatched in AppSidebar #1993 (artonge)
- AppNavigationItem: hide utils if edit mode is active #1996 (korelstar)
3.10.0 - 2021-05-27
v3.10.0 (2021-05-27)

Full Changelog

Enhancements
- [stable3] Add proper opening/opened/closing/closed events & fix events docs #1923 (backportbot-nextcloud[bot])
- Add timestamp tooltip #1971 (Pytal)
Fixed bugs
- [stable3] Fix counter margin #1933 (backportbot-nextcloud[bot])
- Allow to append datepicker to body #1921 (skjnldsv)
- [backport-1880-stable3] Fix datepicker overflow when week numbers are shown #1920 (backportbot-nextcloud[bot])
- Fix datepicker overflow when week numbers are shown #1917 (raimund-schluessler)
- Remove AppNavigationItem flex order for AppNavigationCaption #1911 (skjnldsv)
- [stable3] Fix appnavigationitem layout #1902 (backportbot-nextcloud[bot])
- [stable3] Fix first-action icon class not showing when Actions icon-slot is def… #1885 (backportbot-nextcloud[bot])
- [stable3] Fix ListItemIcon listeners #1871 (backportbot-nextcloud[bot])
3.9.0 - 2021-04-08
v3.9.0 (2021-04-07)

Full Changelog

Enhancements
- Add icon slot to emptycontent #1806 (skjnldsv)
Fixed bugs
- Make sure to pass all props and attributes to single-action Actions #1809 (skjnldsv)
- Ensure that crumbs to hide have correct class #1807 (raimund-schluessler)
- Fix compact sidebar subtitle not visible #1767 (raimund-schluessler)
Closed pull requests
- Fix translation extraction #1776 (jotoeri)
- Minimize bundled translations #1775 (jotoeri)
3.8.0 - 2021-03-26
Full Changelog

Added
- Actions now forward the focus and blur events on trigger - #1757 (Vincent Petry)
Changed
- Updated translations - #1755 #1758 #1782 (transifex-integration[bot])
- Bump @ babel/core from 7.13.8 to 7.13.10 - #1748 (dependabot[bot])
- Bump @ babel/preset-env from 7.13.9 to 7.13.12 - #1747 #1778 (dependabot[bot])
- Bump css-loader from 5.1.1 to 5.2.0 - #1764 #1785 (dependabot[bot])
- Bump cypress from 6.6.0 to 6.8.0 - #1765 (dependabot[bot])
- Bump elliptic from 6.5.3 to 6.5.4 - #1747 (dependabot[bot])
- Bump string-length from 4.0.1 to 4.0.2 - #1766 (dependabot[bot])
- Bump v-tooltip from 2.1.2 to 2.1.3 - #1773 (dependabot[bot])
- Bump vue-styleguidist from 4.35.0 to 4.36.1 - #1772 (dependabot[bot])
Fixed
- Fix actions dropdown focus timing - #1761 (Vincent Petry)
- Update AppNavigationCounter styles - #1769 (ma12-co)
- Fix settings css - #1770 (jotoeri)
- Allow last crumb to shrink if all crumbs collapsed - #1771 (raimund-schluessler)
- Fix multiselect listitemicon docs - #1787 (skjnldsv)
3.7.2 - 2021-03-10
v3.7.2 (2021-03-10)

Full Changelog

Fixed bugs:
- Render the first action icon slot if single action #1753 (skjnldsv)
- Fix formattedOptions var in multiselect docs #1744 (skjnldsv)
3.7.1 - 2021-03-10
3.7.0 - 2021-03-03
3.6.0 - 2021-02-25
3.5.5 - 2021-02-24
3.5.4 - 2021-01-27
3.5.3 - 2021-01-25
3.5.2 - 2021-01-22
3.5.1 - 2021-01-20
3.5.0 - 2021-01-20
3.4.0 - 2021-01-18
3.3.2 - 2020-12-16
3.3.1 - 2020-12-02
3.3.0 - 2020-11-26
3.2.0 - 2020-11-09

from @nextcloud/vue GitHub release notes

Commit messages

Package name: @nextcloud/vue

3524fd7 3.10.1
596f317 Update changelog
4d6ac29 Merge pull request Allow to run autotest with phpunit options nextcloud/server#1996 from nextcloud/backport/1992/stable3
ee5355d hide utils if edit mode is active
10b223d Merge pull request adjust autotest.sh to also wait 600 seconds for mysqlmb4 nextcloud/server#1993 from nextcloud/fix/ensure_closed_event_is_dispatched
341eac8 Ensure the closed event is dispatched in AppSidebar
c49c1fb Merge pull request improved error messages in case federated sharing fails nextcloud/server#1984 from nextcloud/npm/3.10.0
6e3b533 3.10.0
207ef80 Merge pull request Need a nice app icon for share by mail nextcloud/server#1979 from nextcloud/backport/1971/stable3
61d859e Add timestamp tooltip
1d94995 Merge pull request Updated doc link version in default theme from 9 to 11 nextcloud/server#1933 from nextcloud/backport/1912/stable3
f6a00d7 Fix counter margin
62f79b3 Merge pull request Fix issue template url nextcloud/server#1923 from nextcloud/backport/1914/stable3
c4af8ab Add proper open/close events events docs
90c58af Merge pull request Ignore .htaccess So no one commits the crappy 403 and 404 anymore nextcloud/server#1921 from nextcloud/backport-1880-stable3
6409f63 Merge pull request Add nonce also to legacy CSP nextcloud/server#1920 from nextcloud/backport/1917/backport-1880-stable3
cd027d2 Add class to datepicker if showWeekNumber is true
efe7fd3 Allow to append datepicker to body
ed0cb2a Merge pull request The dates before 1970 are not well displayed nextcloud/server#1909 from nextcloud/revert-1902-backport/1897/stable3
8598eb6 Revert "[stable3] Fix appnavigationitem layout"
26a0169 Merge pull request Remove not existent function call nextcloud/server#1902 from nextcloud/backport/1897/stable3
e09aa2e Fix appnavigationitem layout
ff089de Merge pull request App dependencies are now analysed on app enable as well - not only on… nextcloud/server#1885 from nextcloud/backport/1879/stable3
d513862 Fix first-action icon class not showing when Actions icon-slot is defined

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade @nextcloud/vue from 3.2.0 to 3.10.1. See this package in npm: https://www.npmjs.com/package/@nextcloud/vue See this project in Snyk: https://app.snyk.io/org/hafixo/project/07d2ed4b-02e6-4fe0-b904-00db95204285?utm_source=github&utm_medium=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Upgrade @nextcloud/vue from 3.2.0 to 3.10.1#20

[Snyk] Upgrade @nextcloud/vue from 3.2.0 to 3.10.1#20
snyk-bot wants to merge 1 commit into
masterfrom
snyk-upgrade-2588d1aa6cf33a26976503b6cac46711

snyk-bot commented Jul 13, 2021

v3.10.1 (2021-06-02)

Fixed bugs

v3.10.0 (2021-05-27)

Enhancements

Fixed bugs

v3.9.0 (2021-04-07)

Enhancements

Fixed bugs

Closed pull requests

Added

Changed

Fixed

v3.7.2 (2021-03-10)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

snyk-bot commented Jul 13, 2021

Snyk has created this PR to upgrade @nextcloud/vue from 3.2.0 to 3.10.1.

v3.10.1 (2021-06-02)

Fixed bugs

v3.10.0 (2021-05-27)

Enhancements

Fixed bugs

v3.9.0 (2021-04-07)

Enhancements

Fixed bugs

Closed pull requests

Added

Changed

Fixed

v3.7.2 (2021-03-10)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant