Skip to content

Commit 3bc4964

Browse files
github-actions[bot]github-actions[bot]
authored
Preparing for v4.5.0 release.
1 parent 93e501d commit 3bc4964

File tree

3 files changed

+606
-618
lines changed

3 files changed

+606
-618
lines changed

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "@salesforce/sfdx-scanner",
33
"description": "Static code scanner that applies quality and security rules to Apex code, and provides feedback.",
4-
"version": "4.4.0",
4+
"version": "4.5.0",
55
"author": "Salesforce Code Analyzer Team",
66
"bugs": "https://github.com/forcedotcom/sfdx-scanner/issues",
77
"dependencies": {

‎retire-js/RetireJsVulns.json‎

Lines changed: 97 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -119,54 +119,6 @@
119119
"https://nvd.nist.gov/vuln/detail/CVE-2015-9251"
120120
]
121121
},
122-
{
123-
"atOrAbove": "1.8.0",
124-
"below": "1.12.0",
125-
"cwe": [
126-
"CWE-79"
127-
],
128-
"severity": "medium",
129-
"identifiers": {
130-
"summary": "3rd party CORS request may execute",
131-
"issue": "2432",
132-
"CVE": [
133-
"CVE-2015-9251"
134-
],
135-
"githubID": "GHSA-rmxg-73gg-4p98"
136-
},
137-
"info": [
138-
"http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/",
139-
"http://research.insecurelabs.org/jquery/test/",
140-
"https://bugs.jquery.com/ticket/11974",
141-
"https://github.com/advisories/GHSA-rmxg-73gg-4p98",
142-
"https://github.com/jquery/jquery/issues/2432",
143-
"https://nvd.nist.gov/vuln/detail/CVE-2015-9251"
144-
]
145-
},
146-
{
147-
"atOrAbove": "1.12.2",
148-
"below": "2.2.0",
149-
"cwe": [
150-
"CWE-79"
151-
],
152-
"severity": "medium",
153-
"identifiers": {
154-
"summary": "3rd party CORS request may execute",
155-
"issue": "2432",
156-
"CVE": [
157-
"CVE-2015-9251"
158-
],
159-
"githubID": "GHSA-rmxg-73gg-4p98"
160-
},
161-
"info": [
162-
"http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/",
163-
"http://research.insecurelabs.org/jquery/test/",
164-
"https://bugs.jquery.com/ticket/11974",
165-
"https://github.com/advisories/GHSA-rmxg-73gg-4p98",
166-
"https://github.com/jquery/jquery/issues/2432",
167-
"https://nvd.nist.gov/vuln/detail/CVE-2015-9251"
168-
]
169-
},
170122
{
171123
"below": "2.999.999",
172124
"cwe": [
@@ -175,7 +127,8 @@
175127
"severity": "low",
176128
"identifiers": {
177129
"summary": "jQuery 1.x and 2.x are End-of-Life and no longer receiving security updates",
178-
"retid": "73"
130+
"retid": "73",
131+
"issue": "162"
179132
},
180133
"info": [
181134
"https://github.com/jquery/jquery.com/issues/162"
@@ -205,30 +158,6 @@
205158
"https://nvd.nist.gov/vuln/detail/CVE-2015-9251"
206159
]
207160
},
208-
{
209-
"atOrAbove": "2.2.2",
210-
"below": "3.0.0",
211-
"cwe": [
212-
"CWE-79"
213-
],
214-
"severity": "medium",
215-
"identifiers": {
216-
"summary": "3rd party CORS request may execute",
217-
"issue": "2432",
218-
"CVE": [
219-
"CVE-2015-9251"
220-
],
221-
"githubID": "GHSA-rmxg-73gg-4p98"
222-
},
223-
"info": [
224-
"http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/",
225-
"http://research.insecurelabs.org/jquery/test/",
226-
"https://bugs.jquery.com/ticket/11974",
227-
"https://github.com/advisories/GHSA-rmxg-73gg-4p98",
228-
"https://github.com/jquery/jquery/issues/2432",
229-
"https://nvd.nist.gov/vuln/detail/CVE-2015-9251"
230-
]
231-
},
232161
{
233162
"atOrAbove": "3.0.0-rc.1",
234163
"below": "3.0.0",
@@ -898,7 +827,7 @@
898827
"jquery-deparam": {
899828
"vulnerabilities": [
900829
{
901-
"below": "999",
830+
"below": "0.5.4",
902831
"severity": "high",
903832
"cwe": [
904833
"CWE-1321"
@@ -3227,21 +3156,7 @@
32273156
]
32283157
},
32293158
{
3230-
"below": "1.999",
3231-
"severity": "low",
3232-
"cwe": [
3233-
"CWE-1104"
3234-
],
3235-
"identifiers": {
3236-
"summary": "End-of-Life: Long term support for AngularJS has been discontinued as of December 31, 2021",
3237-
"retid": "54"
3238-
},
3239-
"info": [
3240-
"https://blog.angular.io/discontinued-long-term-support-for-angularjs-cc066b82e65a?gi=9d3103b5445c"
3241-
]
3242-
},
3243-
{
3244-
"below": "999",
3159+
"below": "1.8.4",
32453160
"severity": "medium",
32463161
"cwe": [
32473162
"CWE-1333"
@@ -3258,7 +3173,7 @@
32583173
]
32593174
},
32603175
{
3261-
"below": "999",
3176+
"below": "1.8.4",
32623177
"severity": "medium",
32633178
"cwe": [
32643179
"CWE-1333"
@@ -3275,7 +3190,7 @@
32753190
]
32763191
},
32773192
{
3278-
"below": "999",
3193+
"below": "1.8.4",
32793194
"severity": "medium",
32803195
"cwe": [
32813196
"CWE-79"
@@ -3292,7 +3207,7 @@
32923207
]
32933208
},
32943209
{
3295-
"below": "999",
3210+
"below": "1.8.4",
32963211
"severity": "medium",
32973212
"cwe": [
32983213
"CWE-1333"
@@ -3310,7 +3225,7 @@
33103225
},
33113226
{
33123227
"atOrAbove": "1.3.0",
3313-
"below": "999",
3228+
"below": "1.8.4",
33143229
"cwe": [
33153230
"CWE-1333"
33163231
],
@@ -3332,6 +3247,20 @@
33323247
"https://stackblitz.com/edit/angularjs-vulnerability-ng-srcset-redos"
33333248
]
33343249
},
3250+
{
3251+
"below": "1.999",
3252+
"severity": "low",
3253+
"cwe": [
3254+
"CWE-1104"
3255+
],
3256+
"identifiers": {
3257+
"summary": "End-of-Life: Long term support for AngularJS has been discontinued as of December 31, 2021",
3258+
"retid": "54"
3259+
},
3260+
"info": [
3261+
"https://docs.angularjs.org/misc/version-support-status"
3262+
]
3263+
},
33353264
{
33363265
"atOrAbove": "1.7.0",
33373266
"below": "999",
@@ -5055,6 +4984,29 @@
50554984
"https://github.com/twbs/bootstrap/issues/28236"
50564985
]
50574986
},
4987+
{
4988+
"atOrAbove": "2.0.0",
4989+
"below": "3.4.2",
4990+
"cwe": [
4991+
"CWE-79"
4992+
],
4993+
"severity": "medium",
4994+
"identifiers": {
4995+
"summary": "Bootstrap Cross-Site Scripting (XSS) vulnerability",
4996+
"CVE": [
4997+
"CVE-2024-6484"
4998+
],
4999+
"githubID": "GHSA-9mvj-f7w8-pvh2"
5000+
},
5001+
"info": [
5002+
"https://github.com/advisories/GHSA-9mvj-f7w8-pvh2",
5003+
"https://nvd.nist.gov/vuln/detail/CVE-2024-6484",
5004+
"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-sass/CVE-2024-6484.yml",
5005+
"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2024-6484.yml",
5006+
"https://github.com/twbs/bootstrap",
5007+
"https://www.herodevs.com/vulnerability-directory/cve-2024-6484"
5008+
]
5009+
},
50585010
{
50595011
"below": "3.999.999",
50605012
"severity": "low",
@@ -5164,6 +5116,28 @@
51645116
"https://github.com/advisories/GHSA-9v3m-8fp8-mj99",
51655117
"https://github.com/twbs/bootstrap/issues/28236"
51665118
]
5119+
},
5120+
{
5121+
"atOrAbove": "4.0.0",
5122+
"below": "4.6.3",
5123+
"cwe": [
5124+
"CWE-79"
5125+
],
5126+
"severity": "medium",
5127+
"identifiers": {
5128+
"summary": "Bootstrap Cross-Site Scripting (XSS) vulnerability",
5129+
"CVE": [
5130+
"CVE-2024-6531"
5131+
],
5132+
"githubID": "GHSA-vc8w-jr9v-vj7f"
5133+
},
5134+
"info": [
5135+
"https://github.com/advisories/GHSA-vc8w-jr9v-vj7f",
5136+
"https://nvd.nist.gov/vuln/detail/CVE-2024-6531",
5137+
"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2024-6531.yml",
5138+
"https://github.com/twbs/bootstrap",
5139+
"https://www.herodevs.com/vulnerability-directory/cve-2024-6531"
5140+
]
51675141
}
51685142
],
51695143
"extractors": {
@@ -5887,6 +5861,33 @@
58875861
"info": [
58885862
"https://github.com/axios/axios/pull/6300"
58895863
]
5864+
},
5865+
{
5866+
"atOrAbove": "1.3.2",
5867+
"below": "1.7.4",
5868+
"cwe": [
5869+
"CWE-918"
5870+
],
5871+
"severity": "high",
5872+
"identifiers": {
5873+
"summary": "Server-Side Request Forgery in axios",
5874+
"CVE": [
5875+
"CVE-2024-39338"
5876+
],
5877+
"githubID": "GHSA-8hc4-vh64-cxmj"
5878+
},
5879+
"info": [
5880+
"https://github.com/advisories/GHSA-8hc4-vh64-cxmj",
5881+
"https://nvd.nist.gov/vuln/detail/CVE-2024-39338",
5882+
"https://github.com/axios/axios/issues/6463",
5883+
"https://github.com/axios/axios/pull/6539",
5884+
"https://github.com/axios/axios/pull/6543",
5885+
"https://github.com/axios/axios/commit/6b6b605eaf73852fb2dae033f1e786155959de3a",
5886+
"https://github.com/axios/axios",
5887+
"https://github.com/axios/axios/releases",
5888+
"https://github.com/axios/axios/releases/tag/v1.7.4",
5889+
"https://jeffhacks.com/advisories/2024/06/24/CVE-2024-39338.html"
5890+
]
58905891
}
58915892
],
58925893
"extractors": {
@@ -6562,7 +6563,8 @@
65626563
"extractors": {
65636564
"filecontent": [
65646565
"version=\"(§§version§§)\".{1,1500}document\\.getElementById\\(\"__NEXT_DATA__\"\\)\\.textContent",
6565-
"document\\.getElementById\\(\"__NEXT_DATA__\"\\)\\.textContent\\);window\\.__NEXT_DATA__=.;.\\.version=\"(§§version§§)\""
6566+
"document\\.getElementById\\(\"__NEXT_DATA__\"\\)\\.textContent\\);window\\.__NEXT_DATA__=.;.\\.version=\"(§§version§§)\"",
6567+
"=\"(§§version§§)\"[\\s\\S]{10,100}Component[\\s\\S]{1,10}componentDidCatch[\\s\\S]{10,30}componentDidMount"
65666568
]
65676569
}
65686570
},
@@ -7403,7 +7405,7 @@
74037405
},
74047406
{
74057407
"atOrAbove": "0",
7406-
"below": "999",
7408+
"below": "2.7.10",
74077409
"cwe": [
74087410
"CWE-1333"
74097411
],

0 commit comments

Comments
 (0)