chore(deps): update dependency chromedriver to v119 [security] #4280
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
forking-renovate
bot
added
the
dependencies
Codecov Report
@@ Coverage Diff @@
## main #4280 +/- ##
=======================================
Coverage 92.31% 92.31%
=======================================
Files 330 330
Lines 9419 9419
Branches 1995 1995
=======================================
Hits 8695 8695
Misses 724 724 |
pichlermarc
approved these changes
Nov 13, 2023
dyladan
added a commit
that referenced
this pull request
Nov 15, 2023
* chore: track package-lock.json (#4238) * chore: track package-lock.json * Pin to old versions for node 14 * Use version range * Remove unused cached directories * Temporarily disable other tests * Temporarily enable only api test * Enable only some packages * Test only api packages * Test trace exporters * Fix line ordering * Test all packages except otlp exporters * Add trace http exporter * Add trace proto exporter * Test all but grpc exporters * chore: use npm workspaces and degrade lerna to v6 * chore: get rid of lerna bootstrap * chore: use npx * chore: allow install scripts to setup buf * chore: fix w3c-integration-test cache key * chore: fix cache key * chore: disable resource compat test * chore: fix node_modules assumptions * chore: fix hoisted karma issue * chore: fix markdown linter complaints * chore: lock @grpc/grpc-js to v1.8.21 * Break caches * chore: remove cache * chore: fixup inline commands --------- Co-authored-by: Daniel Dyla <dyladan@users.noreply.github.com> * docs: fixed link to benchmark results (#4233) Co-authored-by: Chengzhong Wu <legendecas@gmail.com> * chore(deps): update all patch versions (#4215) * fix: otlp json encoding (#4220) Co-authored-by: Marc Pichler <marc.pichler@dynatrace.com> * fix: remove duplicate export star from version.ts (#4225) Co-authored-by: Marc Pichler <marc.pichler@dynatrace.com> * docs: fix sdk-node config instructions (#4249) Co-authored-by: Marc Pichler <marc.pichler@dynatrace.com> * feat(api): publish api esnext target (#4231) * chore: release API 1.7.0/Core 1.18.0/Experimental 0.45.0 (#4254) * fix(sdk-metrics): hand-roll MetricAdvice type as older API versions do not include it (#4260) * chore: prepare release 1.18.1/0.45.1 (#4261) * chore: no need for 'packages' in "lerna.json" (#4264) * Benchmark tests for trace OTLP transform and BatchSpanProcessor (#4218) Co-authored-by: Marc Pichler <marc.pichler@dynatrace.com> * chore: type reference on zone.js (#4257) Co-authored-by: Marc Pichler <marc.pichler@dynatrace.com> * docs: add docker-compose to run prometheus for the experimental example (#4268) Co-authored-by: Marc Pichler <marc.pichler@dynatrace.com> * fix(sdk-logs): avoid map attribute set when count limit exceeded (#4195) Co-authored-by: Marc Pichler <marc.pichler@dynatrace.com> * chore(deps): update dependency chromedriver to v119 [security] (#4280) * chore(deps): update actions/setup-node action to v4 (#4236) * fix(sdk-trace-base): processor onStart called with a span having empty attributes (#4277) Co-authored-by: artahmetaj <artahmetaj@yahoo.com> * Update fetch instrumentation to be runtime agnostic (#4063) Co-authored-by: Marc Pichler <marc.pichler@dynatrace.com> --------- Co-authored-by: Chengzhong Wu <legendecas@gmail.com> Co-authored-by: Martin Kuba <martin@martinkuba.com> Co-authored-by: Mend Renovate <bot@renovateapp.com> Co-authored-by: Siim Kallas <siimkallas@gmail.com> Co-authored-by: Marc Pichler <marc.pichler@dynatrace.com> Co-authored-by: David Luna <david.luna@elastic.co> Co-authored-by: Dinko Osrecki <dinko.osrecki@emarsys.com> Co-authored-by: Trent Mick <trentm@gmail.com> Co-authored-by: François <32224751+Lp-Francois@users.noreply.github.com> Co-authored-by: Hyun Oh <hyunnoh01@gmail.com> Co-authored-by: André Cruz <andremiguelcruz@msn.com> Co-authored-by: artahmetaj <artahmetaj@yahoo.com> Co-authored-by: drewcorlin1 <82601620+drewcorlin1@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
116.0.0->119.0.1GitHub Vulnerability Alerts
CVE-2023-26156
Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system.
Note:
An attacker must have access to the system running the vulnerable chromedriver library to exploit it. The success of exploitation also depends on the permissions and privileges of the process running chromedriver.
Release Notes
giggio/node-chromedriver (chromedriver)
v119.0.1Compare Source
v119.0.0Compare Source
v118.0.1Compare Source
v118.0.0Compare Source
v117.0.3Compare Source
v117.0.2Compare Source
v117.0.1Compare Source
v117.0.0Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.