Update dependency @yaireo/tagify to v4.9.8 [SECURITY] #1151
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
force-pushed
the
renovate/npm-yaireo-tagify-vulnerability
branch
from
17badd2
to
9926050
Compare
renovate
bot
force-pushed
the
renovate/npm-yaireo-tagify-vulnerability
branch
from
9926050
to
5835ee3
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
4.1.1->4.9.8GitHub Vulnerability Alerts
CVE-2022-25854
This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the cross-site scripting (XSS) payload.
Release Notes
yairEO/tagify (@yaireo/tagify)
v4.9.8Compare Source
198c04593f729cd675c3f9d0787d0f1ebbcv4.9.7Compare Source
95aab5180d623fv4.9.6Compare Source
c2a995188ab9c4cd9e13a4894c53cf2be53f3ad3a6dropdown.enabled:falsehas no effect45b2a8ae91e0f7v4.9.5Compare Source
48c166f155c3fc317ac66tagify.removeAllTags()in select-modeab5ec3135ea533fe8833ff74c157v4.9.4Compare Source
v4.9.3Compare Source
v4.9.2Compare Source
addcallback moved to be triggered after DOM has been modifiedb70061areadonlyeven though tagData has keyreadonly:false4fbc41cv4.9.1Compare Source
05c643cv4.9.0Compare Source
eb13d838b44f9c604255266a6402f29e6d6loadOriginalValueswithin a setTimeout because it's automatically fired from "observeOriginalInputValue"a1c446c790bf987cf3d9ftransformTagcallback to be called before valitation happensb196a7124eee59d1b1124ee0e93cd277e43v4.8.1Compare Source
d2ba4f63486590d0f993909ce6f1b9e5be7e58f740v4.8.0Compare Source
387b799f4833bd7a4738940a25d9d53d661cd354efde2b05881e45d075384da8fccd5b2e725c0dropdown.sortbysetting with two possible values: a function or a string (startsWith) for smarter suggestions sorting863cf75selectmode - when an option was selected, do not show a filtered dropdown but show all resultsd0770dfselectmode - if a certain whitelist item has is missing thetagTextPropproperty, use thevalueonede14c0bselectmode, allow backspace to delete characters only if no tag has been selected, else remove the whole tag (only whenenforceWhitelististrue)ae31de0f8d7daca8c080c98b3114v4.7.2Compare Source
bfc8144v4.7.1Compare Source
dropdown.togglemethodenabledto0to solve this.f60b434v4.7.0Compare Source
7b07f912294d4bcd611a9afc093322ecf088016cf8aa162f54e4ee88cf5b748v4.6.0Compare Source
0b881ee171a78f07761c8e92a2557d7f6837c1001940a8c4dv4.5.0Compare Source
7fbf6dbbde9cdc60c9ca8caf90009e95da8a547872v4.4.0Compare Source
2657781695f5173cb4b5d005a33279f2c2679408ea2f9b41c06df9c62dfda82f7711a66664903v4.3.1: Minor bugfix for invalid edited tags' title tooltipCompare Source
8f9067bv4.3.0Compare Source
0d9bb5fd78069695e25b612eab06ceada65v4.2.0Compare Source
2cf8a9bf142d1b4d3dcd5e0d23eebc157eddropdown:scrollevent could not be binded through the settings object "callbacks"8835449f592a37v4.1.4Compare Source
1b49ff111c1a3d2d44c52v4.1.3Compare Source
1b492ef86488777667dcbe5c813av4.1.2Compare Source
440c16fConfiguration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.