Skip to content

Commit fddb3c9

Browse files
committed
STCLI-226: Upgrade Mocha from 9 to 10 fixing ReDoS
mocha before version 10.1.0 has a Regular Expression Denial of Service (ReDoS) vulnerability in the clean function in utils.js: * https://github.com/mochajs/mocha/releases/tag/v10.1.0 Mocha 9 has reached its end of life and is no longer supported. stripes-cli uses mocha ^9.0.0 and should upgrade to a supported version that is not vulnerable.
1 parent 7106815 commit fddb3c9

File tree

3 files changed

+6
-2
lines changed

3 files changed

+6
-2
lines changed

CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# Change history for stripes-cli
22

3+
## 2.6.3 IN PROGRESS
4+
5+
* Upgrade `mocha` from 9 to 10 fixing ReDoS. Refs STCLI-226.
6+
37
## [2.6.2](https://github.com/folio-org/stripes-cli/tree/v2.6.2) (2023-01-30)
48
[Full Changelog](https://github.com/folio-org/stripes-cli/compare/v2.6.1...v2.6.2)
59

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Stripes CLI
22

3-
Copyright (C) 2017-2020 The Open Library Foundation
3+
Copyright (C) 2017-2023 The Open Library Foundation
44

55
This software is distributed under the terms of the Apache License,
66
Version 2.0. See the file "[LICENSE](LICENSE)" for more information.

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@
5252
"karma-webpack": "^5.0.0",
5353
"kopy": "^9.4.2",
5454
"lodash": "^4.17.5",
55-
"mocha": "^9.0.0",
55+
"mocha": "^10.2.0",
5656
"mocha-jenkins-reporter": "^0.4.1",
5757
"morgan": "^1.10.0",
5858
"node-fetch-npm": "^2.0.2",

0 commit comments

Comments
 (0)