Skip to content

Update dependency react-dom to v16.2.1 [SECURITY]#80

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-react-dom-vulnerability
Open

Update dependency react-dom to v16.2.1 [SECURITY]#80
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-react-dom-vulnerability

Conversation

@renovate
Copy link

@renovate renovate bot commented Mar 11, 2019

WhiteSource Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
react-dom (source) 16.2.0 -> 16.2.1 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2018-6341

Affected versions of react-dom are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:

  • be a server-side React app
  • be rendered to HTML using ReactDOMServer
  • include an attribute name from user input in an HTML tag

Recommendation

If you are using react-dom 16.0.x, upgrade to 16.0.1 or later.
If you are using react-dom 16.1.x, upgrade to 16.1.2 or later.
If you are using react-dom 16.2.x, upgrade to 16.2.1 or later.
If you are using react-dom 16.3.x, upgrade to 16.3.3 or later.
If you are using react-dom 16.4.x, upgrade to 16.4.2 or later.


Release Notes

facebook/react

v16.2.1

React DOM Server

Renovate configuration

📅 Schedule: "" (UTC).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by WhiteSource Renovate. View repository job log here.

@renovate renovate bot changed the title Update dependency react-dom to v16.8.4 [SECURITY] Update dependency react-dom to v16.8.5 [SECURITY] Mar 22, 2019
@renovate renovate bot force-pushed the renovate/npm-react-dom-vulnerability branch 2 times, most recently from 5eedbe1 to ab46275 Compare March 28, 2019 09:49
@renovate renovate bot changed the title Update dependency react-dom to v16.8.5 [SECURITY] Update dependency react-dom to v16.8.6 [SECURITY] Mar 28, 2019
@renovate renovate bot force-pushed the renovate/npm-react-dom-vulnerability branch from ab46275 to c8de7e2 Compare May 22, 2019 13:56
@renovate renovate bot changed the title Update dependency react-dom to v16.8.6 [SECURITY] Update dependency react-dom to v16.2.1 [SECURITY] May 22, 2019
@codecov-io
Copy link

Codecov Report

Merging #80 into master will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master      #80   +/-   ##
=======================================
  Coverage   86.21%   86.21%           
=======================================
  Files          18       18           
  Lines         537      537           
  Branches      174      174           
=======================================
  Hits          463      463           
  Misses         64       64           
  Partials       10       10

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9058cc2...c8de7e2. Read the comment docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants

Comments