Commit 2b50d6a
![bors[bot]](https://avatars.githubusercontent.com/in/1847?v=4&size=40){kind=avatar}
![dependabot-preview[bot]](https://avatars.githubusercontent.com/in/2141?v=4&size=40){kind=avatar}
Merge #192
192: [Security] Bump node-notifier from 8.0.0 to 8.0.1 r=curquiza a=dependabot-preview[bot]
Bumps [node-notifier](https://github.com/mikaelbr/node-notifier) from 8.0.0 to 8.0.1. **This update includes a security fix.**
<details>
<summary>Vulnerabilities fixed</summary>
<p><em>Sourced from <a href="https://github.com/advisories/GHSA-5fw9-fq32-wv5p">The GitHub Security Advisory Database</a>.</em></p>
<blockquote>
<p><strong>OS Command Injection in node-notifier</strong>
This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.</p>
<p>Affected versions: < 8.0.1</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/mikaelbr/node-notifier/blob/v8.0.1/CHANGELOG.md">node-notifier's changelog</a>.</em></p>
<blockquote>
<h3><code>v8.0.1</code></h3>
<ul>
<li>fixes possible injection issue for notify-send</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/mikaelbr/node-notifier/commit/5d62799dab88505a709cd032653b2320c5813fce"><code>5d62799</code></a> v8.0.1</li>
<li><a href="https://github.com/mikaelbr/node-notifier/commit/0c4a80df9a3b5015cd1e1ab858e008be3fece082"><code>0c4a80d</code></a> chore: adds changelog</li>
<li><a href="https://github.com/mikaelbr/node-notifier/commit/f5a7bc647589fc89ac64b0f1d259a853fcf057bc"><code>f5a7bc6</code></a> fix: test cases</li>
<li><a href="https://github.com/mikaelbr/node-notifier/commit/b9d148d697d3db807f653e2e6953c3de57dfeb8a"><code>b9d148d</code></a> patch: fixes possible injection issue for notify-send</li>
<li>See full diff in <a href="https://github.com/mikaelbr/node-notifier/compare/v8.0.0...v8.0.1">compare view</a></li>
</ul>
</details>
<br />
[](https://dependabot.com/compatibility-score/?dependency-name=node-notifier&package-manager=npm_and_yarn&previous-version=8.0.0&new-version=8.0.1)
You can trigger a rebase of this PR by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
</details>
Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>1 file changed
+23
-44
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
1316 | 1316 | | |
1317 | 1317 | | |
1318 | 1318 | | |
1319 | | - | |
1320 | | - | |
1321 | | - | |
1322 | | - | |
1323 | | - | |
1324 | | - | |
1325 | | - | |
1326 | | - | |
1327 | 1319 | | |
1328 | 1320 | | |
1329 | 1321 | | |
1330 | 1322 | | |
1331 | 1323 | | |
1332 | | - | |
1333 | | - | |
1334 | | - | |
1335 | | - | |
1336 | | - | |
1337 | 1324 | | |
1338 | 1325 | | |
1339 | 1326 | | |
| |||
1348 | 1335 | | |
1349 | 1336 | | |
1350 | 1337 | | |
1351 | | - | |
1352 | | - | |
1353 | | - | |
1354 | | - | |
1355 | | - | |
1356 | | - | |
1357 | | - | |
1358 | | - | |
1359 | | - | |
1360 | | - | |
1361 | | - | |
1362 | | - | |
1363 | | - | |
1364 | | - | |
1365 | 1338 | | |
1366 | 1339 | | |
1367 | 1340 | | |
| |||
1370 | 1343 | | |
1371 | 1344 | | |
1372 | 1345 | | |
1373 | | - | |
1374 | | - | |
1375 | | - | |
1376 | | - | |
1377 | | - | |
1378 | | - | |
1379 | | - | |
1380 | | - | |
1381 | 1346 | | |
1382 | 1347 | | |
1383 | 1348 | | |
| |||
4076 | 4041 | | |
4077 | 4042 | | |
4078 | 4043 | | |
| 4044 | + | |
| 4045 | + | |
| 4046 | + | |
| 4047 | + | |
| 4048 | + | |
| 4049 | + | |
| 4050 | + | |
4079 | 4051 | | |
4080 | 4052 | | |
4081 | 4053 | | |
| |||
4256 | 4228 | | |
4257 | 4229 | | |
4258 | 4230 | | |
4259 | | - | |
4260 | | - | |
4261 | | - | |
| 4231 | + | |
| 4232 | + | |
| 4233 | + | |
4262 | 4234 | | |
4263 | 4235 | | |
4264 | 4236 | | |
| |||
5057 | 5029 | | |
5058 | 5030 | | |
5059 | 5031 | | |
5060 | | - | |
5061 | | - | |
5062 | | - | |
| 5032 | + | |
| 5033 | + | |
| 5034 | + | |
| 5035 | + | |
| 5036 | + | |
5063 | 5037 | | |
5064 | 5038 | | |
5065 | 5039 | | |
| |||
5678 | 5652 | | |
5679 | 5653 | | |
5680 | 5654 | | |
5681 | | - | |
5682 | | - | |
5683 | | - | |
| 5655 | + | |
| 5656 | + | |
| 5657 | + | |
5684 | 5658 | | |
5685 | 5659 | | |
5686 | 5660 | | |
| |||
5845 | 5819 | | |
5846 | 5820 | | |
5847 | 5821 | | |
| 5822 | + | |
| 5823 | + | |
| 5824 | + | |
| 5825 | + | |
| 5826 | + | |
5848 | 5827 | | |
5849 | 5828 | | |
5850 | 5829 | | |
| |||
0 commit comments