Skip to content

chore(deps): update dependency luxon to v1.28.1 [security]#107

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-luxon-vulnerability/VF-000
Open

chore(deps): update dependency luxon to v1.28.1 [security]#107
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-luxon-vulnerability/VF-000

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Jan 11, 2023 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
luxon 1.21.3 → 1.28.1 age confidence

GitHub Vulnerability Alerts

CVE-2023-22467

Impact

Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.

This is the same bug as Moment's GHSA-wc69-rhjr-hc9g

Workarounds

Limit the length of the input.

References

There is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973

Details

DateTime.fromRFC2822("(".repeat(500000)) takes a couple minutes to complete.

Release Notes

moment/luxon (luxon)

v1.28.1

Compare Source

v1.28.0

Compare Source

  • Fix ISO parsing for offset specifiers in Year-Ordinal formats

v1.27.0

Compare Source

  • Fix GMT zone parsing for older versions of Node
  • Support multiple units in toRelative
  • Various documentation updates

v1.26.0

Compare Source

  • Add fromISOTime, toISOTime and toMillis to Duration (#​803)
  • Fix padding of negative years in IsoDate (#​871)
  • Fix hasSame unit comparison (#​798)
  • Export VERSION information (#​794)
  • Durations are considered equal with extra zero units. Fixes #​809 (#​811)

v1.25.0

Compare Source

  • fix fromFormat with Intl formats containing non-breaking spaces
  • Support higher precision in ISO milliseconds
  • Some fixes for 00:30 timezones
  • Fix some throwOnInvalid for invalid Intervals
  • Various doc fixes
  • Fix Interval#isSame for empty intervals
  • Mark package as side effect-free
  • Add support for intervals with a large number of seconds

v1.24.1

Compare Source

  • Remove erroneous console.log call

v1.24.0

Compare Source

  • Update polyfills for pollyfilled build

v1.23.0

Compare Source

  • Allow minus sign prefix when creating Duration from ISO

v1.22.2

Compare Source

  • Added more details to error messages for type errors

v1.22.0

Compare Source

  • Fix setZone's handling of pre-1970 dates with millisecond components
  • Fix keepLocalTime for large jumps near the target zone's DST
  • Fix cache perf for toRelative()

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added dependencies Pull requests that update a dependency file ready for review labels Jan 11, 2023
@renovate renovate bot requested review from jonahsnider and trs January 11, 2023 13:53
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Jan 11, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@renovate renovate bot force-pushed the renovate/npm-luxon-vulnerability/VF-000 branch from 548a473 to e8961be Compare March 16, 2023 15:46
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Mar 16, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@renovate renovate bot force-pushed the renovate/npm-luxon-vulnerability/VF-000 branch from e8961be to 44b6fb6 Compare June 19, 2023 17:37
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Jun 19, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@renovate renovate bot force-pushed the renovate/npm-luxon-vulnerability/VF-000 branch from 44b6fb6 to a4deba2 Compare November 16, 2023 16:51
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Nov 16, 2023

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

@renovate renovate bot force-pushed the renovate/npm-luxon-vulnerability/VF-000 branch 2 times, most recently from cba73b5 to bb4411e Compare February 5, 2024 18:47
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud bot commented Feb 5, 2024

Quality Gate Passed Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

@renovate renovate bot force-pushed the renovate/npm-luxon-vulnerability/VF-000 branch from bb4411e to 6192025 Compare January 30, 2025 11:42
@renovate renovate bot changed the title fix(deps): update dependency luxon to v1.28.1 [security] chore(deps): update dependency luxon to v1.28.1 [security] Sep 25, 2025
@renovate renovate bot changed the title chore(deps): update dependency luxon to v1.28.1 [security] chore(deps): update dependency luxon to v1.28.1 [security] - autoclosed Mar 27, 2026
@renovate renovate bot closed this Mar 27, 2026
@renovate renovate bot deleted the renovate/npm-luxon-vulnerability/VF-000 branch March 27, 2026 02:47
@renovate renovate bot changed the title chore(deps): update dependency luxon to v1.28.1 [security] - autoclosed chore(deps): update dependency luxon to v1.28.1 [security] Apr 1, 2026
@renovate renovate bot reopened this Apr 1, 2026
@renovate renovate bot force-pushed the renovate/npm-luxon-vulnerability/VF-000 branch 2 times, most recently from 6192025 to 9af42cb Compare April 1, 2026 15:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jonahsnider jonahsnider Awaiting requested review from jonahsnider

@trs trs Awaiting requested review from trs

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file ready for review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants