Skip to content

[cherry-pick][utils] Fix GitHub-reported prototype pollution vulnerability in deepmerge (#41652) #42608

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Jun 11, 2024
Merged

[cherry-pick][utils] Fix GitHub-reported prototype pollution vulnerability in deepmerge (#41652) #42608

merged 1 commit into from
Jun 11, 2024

Conversation

@DiegoAndai
Copy link
Member

@DiegoAndai DiegoAndai commented Jun 10, 2024

Closes #42607

Cherry-pick #41652 to master

@DiegoAndai DiegoAndai added package: utils Specific to the utils package. security Pull requests that address a security vulnerability. cherry-pick The PR was cherry-picked from the newer alpha/beta/stable branch. labels Jun 10, 2024
@DiegoAndai DiegoAndai requested review from Janpot and mnajdova June 10, 2024 19:21
@DiegoAndai DiegoAndai self-assigned this Jun 10, 2024
@mui-bot
Copy link

mui-bot commented Jun 10, 2024 •
edited
Loading

Netlify deploy preview

https://deploy-preview-42608--material-ui.netlify.app/

Bundle size report

Details of bundle changes (Toolpad)
Details of bundle changes

Generated by 🚫 dangerJS against ee8a57b

@oliviertassinari oliviertassinari added type: bug It doesn't behave as expected. and removed security Pull requests that address a security vulnerability. labels Jun 10, 2024
@oliviertassinari
Copy link
Member

oliviertassinari commented Jun 10, 2024 •
edited
Loading

I removed the "security" label per #41652 (comment), there is no security flaw from what I can understand, it's a bug fix.

@DiegoAndai DiegoAndai merged commit fab86c8 into mui:master Jun 11, 2024
@DiegoAndai DiegoAndai deleted the cherry-pick-41652 branch June 11, 2024 12:54
@DiegoAndai DiegoAndai mentioned this pull request Jun 11, 2024
Merged
1 task
@tjcouch-sil
Copy link
Contributor

tjcouch-sil commented Jun 18, 2024

Indeed Snyk has revoked the report as this was a false positive https://security.snyk.io/vuln/SNYK-JS-MUIUTILS-7231125

@JamesUoM JamesUoM mentioned this pull request Jul 3, 2024
Open
@azeemyoonus azeemyoonus mentioned this pull request Jul 4, 2024
Open
This was referenced Jul 4, 2024
Open
Open
This was referenced Jul 4, 2024
Open
Open
This was referenced Jul 4, 2024
Open
Merged
@heliumtank92 heliumtank92 mentioned this pull request Jul 4, 2024
Open
@OOCAZ OOCAZ mentioned this pull request Jul 4, 2024
Closed
@abjerry97 abjerry97 mentioned this pull request Jul 4, 2024
Open
@nachodev-ui nachodev-ui mentioned this pull request Jul 4, 2024
Open
This was referenced Jul 4, 2024
Closed
Closed
This was referenced Aug 2, 2024
Open
Open
@kazimanzurrashid kazimanzurrashid mentioned this pull request Aug 2, 2024
Open
@Type-Style Type-Style mentioned this pull request Aug 2, 2024
Closed
This was referenced Aug 2, 2024
Closed
Closed
@nachodev-ui nachodev-ui mentioned this pull request Aug 2, 2024
Open
This was referenced Aug 2, 2024
Open
Open
@mattboddy47 mattboddy47 mentioned this pull request Aug 2, 2024
Open
@Poseidon-G Poseidon-G mentioned this pull request Aug 2, 2024
Open
This was referenced Aug 2, 2024
Open
Open
@sufi0900 sufi0900 mentioned this pull request Aug 2, 2024
Open
@loka-capco loka-capco mentioned this pull request Aug 2, 2024
Open
This was referenced Aug 2, 2024
Open
Open
@sumn2u sumn2u mentioned this pull request Aug 2, 2024
Open
This was referenced Aug 2, 2024
Open
Open
This was referenced Aug 3, 2024
Open
Open
This was referenced Aug 4, 2024
Open
Open
This was referenced Aug 5, 2024
Open
Open
@Crushoverride007 Crushoverride007 mentioned this pull request Aug 6, 2024
Open
@DanneelsSophie DanneelsSophie mentioned this pull request Aug 6, 2024
Open
@loka-capco loka-capco mentioned this pull request Aug 6, 2024
Open
@FaroukAmr FaroukAmr mentioned this pull request Aug 6, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Janpot Janpot Janpot approved these changes

@mnajdova mnajdova Awaiting requested review from mnajdova

Assignees

@DiegoAndai DiegoAndai

Labels

cherry-pick The PR was cherry-picked from the newer alpha/beta/stable branch. package: utils Specific to the utils package. type: bug It doesn't behave as expected.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@DiegoAndai @mui-bot @oliviertassinari @tjcouch-sil @Janpot