Skip to content

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Feb 25, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
solid-js (source) 1.9.3 -> 1.9.4 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2025-27109

Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments.

For instance, ?text=<svg/onload=alert(1)> would trigger XSS here.

  const [text] = createResource(() => {
    return new URL(getRequestEvent().request.url).searchParams.get("text");
  });

  return (
    <>
      Text: {text()}
    </>
  );

Release Notes

solidjs/solid (solid-js)

v1.9.4

Compare Source


Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions
Copy link

github-actions bot commented Feb 25, 2025

built with Refined Cloudflare Pages Action

⚡ Cloudflare Pages Deployment

Name Status Preview Last Commit
enclosed-docs ✅ Ready (View Log) Visit Preview 091619a
enclosed ✅ Ready (View Log) Visit Preview 091619a

@renovate renovate bot force-pushed the renovate/npm-solid-js-vulnerability branch from b58579b to 091619a Compare March 11, 2025 13:29
@sonarqubecloud
Copy link

@renovate renovate bot changed the title fix(deps): update dependency solid-js to v1.9.4 [security] fix(deps): update dependency solid-js to v1.9.4 [security] - autoclosed Mar 21, 2025
@renovate renovate bot closed this Mar 21, 2025
@renovate renovate bot deleted the renovate/npm-solid-js-vulnerability branch March 21, 2025 19:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants