From 0acb6bf98c73a4a19f4c6f1b6b99b7c6ce5c7f26 Mon Sep 17 00:00:00 2001 From: Ian Clanton-Thuon Date: Wed, 23 Oct 2024 11:39:12 -0700 Subject: [PATCH 1/2] Update jsonpath-plus to ~10.1.0 --- ...update-jsonpath-plus_2024-10-23-18-42.json | 10 +++++ .../config/subspaces/default/pnpm-lock.yaml | 38 ++++++++++++++++++- .../config/subspaces/default/repo-state.json | 2 +- libraries/heft-config-file/package.json | 2 +- .../src/test/ConfigurationFile.test.ts | 8 ++-- 5 files changed, 52 insertions(+), 8 deletions(-) create mode 100644 common/changes/@rushstack/heft-config-file/update-jsonpath-plus_2024-10-23-18-42.json diff --git a/common/changes/@rushstack/heft-config-file/update-jsonpath-plus_2024-10-23-18-42.json b/common/changes/@rushstack/heft-config-file/update-jsonpath-plus_2024-10-23-18-42.json new file mode 100644 index 00000000000..8c6792ca477 --- /dev/null +++ b/common/changes/@rushstack/heft-config-file/update-jsonpath-plus_2024-10-23-18-42.json @@ -0,0 +1,10 @@ +{ + "changes": [ + { + "packageName": "@rushstack/heft-config-file", + "comment": "Update the `jsonpath-plus` dependency to mitigate CVE-2024-21534.\"", + "type": "patch" + } + ], + "packageName": "@rushstack/heft-config-file" +} \ No newline at end of file diff --git a/common/config/subspaces/default/pnpm-lock.yaml b/common/config/subspaces/default/pnpm-lock.yaml index 4bc180884a4..f8824bc7cc3 100644 --- a/common/config/subspaces/default/pnpm-lock.yaml +++ b/common/config/subspaces/default/pnpm-lock.yaml @@ -3053,8 +3053,8 @@ importers: specifier: workspace:* version: link:../terminal jsonpath-plus: - specifier: ~4.0.0 - version: 4.0.0 + specifier: ~10.1.0 + version: 10.1.0 devDependencies: '@rushstack/heft': specifier: 0.67.2 @@ -9463,6 +9463,24 @@ packages: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.4.15 + /@jsep-plugin/assignment@1.2.1(jsep@1.3.9): + resolution: {integrity: sha512-gaHqbubTi29aZpVbBlECRpmdia+L5/lh2BwtIJTmtxdbecEyyX/ejAOg7eQDGNvGOUmPY7Z2Yxdy9ioyH/VJeA==} + engines: {node: '>= 10.16.0'} + peerDependencies: + jsep: ^0.4.0||^1.0.0 + dependencies: + jsep: 1.3.9 + dev: false + + /@jsep-plugin/regex@1.0.3(jsep@1.3.9): + resolution: {integrity: sha512-XfZgry4DwEZvSFtS/6Y+R48D7qJYJK6R9/yJFyUFHCIUMEEHuJ4X95TDgJp5QkmzfLYvapMPzskV5HpIDrREug==} + engines: {node: '>= 10.16.0'} + peerDependencies: + jsep: ^0.4.0||^1.0.0 + dependencies: + jsep: 1.3.9 + dev: false + /@jsonjoy.com/base64@1.1.2(tslib@2.3.1): resolution: {integrity: sha512-q6XAnWQDIMA3+FTiOYajoYqySkO+JSat0ytXGSuRdq9uXE7o92gzuQwQM14xaCRlBLGq3v5miDGC4vkVTn54xA==} engines: {node: '>=10.0'} @@ -21843,6 +21861,11 @@ packages: - supports-color - utf-8-validate + /jsep@1.3.9: + resolution: {integrity: sha512-i1rBX5N7VPl0eYb6+mHNp52sEuaS2Wi8CDYx1X5sn9naevL78+265XJqy1qENEk7mRKwS06NHpUqiBwR7qeodw==} + engines: {node: '>= 10.16.0'} + dev: false + /jsesc@0.5.0: resolution: {integrity: sha512-uZz5UnB7u4T9LvwmFqXii7pZSouaRPorGs5who1Ip7VO0wxanFvBL7GkM6dTHlgX+jhBApRetaWpnDabOeTcnA==} hasBin: true @@ -21903,9 +21926,20 @@ packages: graceful-fs: 4.2.11 dev: true + /jsonpath-plus@10.1.0: + resolution: {integrity: sha512-gHfV1IYqH8uJHYVTs8BJX1XKy2/rR93+f8QQi0xhx95aCiXn1ettYAd5T+7FU6wfqyDoX/wy0pm/fL3jOKJ9Lg==} + engines: {node: '>=18.0.0'} + hasBin: true + dependencies: + '@jsep-plugin/assignment': 1.2.1(jsep@1.3.9) + '@jsep-plugin/regex': 1.0.3(jsep@1.3.9) + jsep: 1.3.9 + dev: false + /jsonpath-plus@4.0.0: resolution: {integrity: sha512-e0Jtg4KAzDJKKwzbLaUtinCn0RZseWBVRTRGihSpvFlM3wTR7ExSp+PTdeTsDrLNJUe7L7JYJe8mblHX5SCT6A==} engines: {node: '>=10.0'} + dev: true /jsonschema@1.4.1: resolution: {integrity: sha512-S6cATIPVv1z0IlxdN+zUk5EPjkGCdnhN4wVSBlvoUO1tOLJootbo9CquNJmbIh4yikWHiUedhRYrNPn1arpEmQ==} diff --git a/common/config/subspaces/default/repo-state.json b/common/config/subspaces/default/repo-state.json index 50d3034203e..4b98b2c83d0 100644 --- a/common/config/subspaces/default/repo-state.json +++ b/common/config/subspaces/default/repo-state.json @@ -1,5 +1,5 @@ // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush. { - "pnpmShrinkwrapHash": "673f7de41244835915a7947c11b6dbe80f944010", + "pnpmShrinkwrapHash": "eca705e24ac99810f28fecff4de2d89706db9065", "preferredVersionsHash": "ce857ea0536b894ec8f346aaea08cfd85a5af648" } diff --git a/libraries/heft-config-file/package.json b/libraries/heft-config-file/package.json index cbe9a8f7eed..56a244b63c8 100644 --- a/libraries/heft-config-file/package.json +++ b/libraries/heft-config-file/package.json @@ -24,7 +24,7 @@ "@rushstack/node-core-library": "workspace:*", "@rushstack/rig-package": "workspace:*", "@rushstack/terminal": "workspace:*", - "jsonpath-plus": "~4.0.0" + "jsonpath-plus": "~10.1.0" }, "devDependencies": { "local-eslint-config": "workspace:*", diff --git a/libraries/heft-config-file/src/test/ConfigurationFile.test.ts b/libraries/heft-config-file/src/test/ConfigurationFile.test.ts index 985a5c10c55..34790bca53b 100644 --- a/libraries/heft-config-file/src/test/ConfigurationFile.test.ts +++ b/libraries/heft-config-file/src/test/ConfigurationFile.test.ts @@ -804,7 +804,7 @@ describe(ConfigurationFile.name, () => { }, { plugin: FileSystem.getRealPath( - nodeJsPath.resolve(projectRoot, 'node_modules', 'jsonpath-plus', 'dist', 'index-umd.js') + nodeJsPath.resolve(projectRoot, 'node_modules', 'jsonpath-plus', 'dist', 'index-node-cjs.cjs') ) } ] @@ -885,7 +885,7 @@ describe(ConfigurationFile.name, () => { }, { plugin: await FileSystem.getRealPathAsync( - nodeJsPath.resolve(projectRoot, 'node_modules', 'jsonpath-plus', 'dist', 'index-umd.js') + nodeJsPath.resolve(projectRoot, 'node_modules', 'jsonpath-plus', 'dist', 'index-node-cjs.cjs') ) } ] @@ -968,7 +968,7 @@ describe(ConfigurationFile.name, () => { }, { plugin: FileSystem.getRealPath( - nodeJsPath.resolve(projectRoot, 'node_modules', 'jsonpath-plus', 'dist', 'index-umd.js') + nodeJsPath.resolve(projectRoot, 'node_modules', 'jsonpath-plus', 'dist', 'index-node-cjs.cjs') ) } ] @@ -1049,7 +1049,7 @@ describe(ConfigurationFile.name, () => { }, { plugin: await FileSystem.getRealPathAsync( - nodeJsPath.resolve(projectRoot, 'node_modules', 'jsonpath-plus', 'dist', 'index-umd.js') + nodeJsPath.resolve(projectRoot, 'node_modules', 'jsonpath-plus', 'dist', 'index-node-cjs.cjs') ) } ] From 4d23cbff93b8844888452ffb4a49c27ab51dbca7 Mon Sep 17 00:00:00 2001 From: Ian Clanton-Thuon Date: Wed, 23 Oct 2024 11:46:05 -0700 Subject: [PATCH 2/2] fixup! Update jsonpath-plus to ~10.1.0 --- .../build-tests-subspace/pnpm-lock.yaml | 57 +++++++++++++------ .../build-tests-subspace/repo-state.json | 4 +- 2 files changed, 43 insertions(+), 18 deletions(-) diff --git a/common/config/subspaces/build-tests-subspace/pnpm-lock.yaml b/common/config/subspaces/build-tests-subspace/pnpm-lock.yaml index d96170e3a18..6b04cdbf91f 100644 --- a/common/config/subspaces/build-tests-subspace/pnpm-lock.yaml +++ b/common/config/subspaces/build-tests-subspace/pnpm-lock.yaml @@ -126,10 +126,10 @@ importers: version: file:../../../apps/heft(@types/node@18.17.15) '@rushstack/heft-lint-plugin': specifier: file:../../heft-plugins/heft-lint-plugin - version: file:../../../heft-plugins/heft-lint-plugin(@rushstack/heft@0.68.2)(@types/node@18.17.15) + version: file:../../../heft-plugins/heft-lint-plugin(@rushstack/heft@0.68.5)(@types/node@18.17.15) '@rushstack/heft-typescript-plugin': specifier: file:../../heft-plugins/heft-typescript-plugin - version: file:../../../heft-plugins/heft-typescript-plugin(@rushstack/heft@0.68.2)(@types/node@18.17.15) + version: file:../../../heft-plugins/heft-typescript-plugin(@rushstack/heft@0.68.5)(@types/node@18.17.15) eslint: specifier: ~8.57.0 version: 8.57.0 @@ -830,6 +830,22 @@ packages: '@jridgewell/resolve-uri': 3.1.2 '@jridgewell/sourcemap-codec': 1.4.15 + /@jsep-plugin/assignment@1.2.1(jsep@1.3.9): + resolution: {integrity: sha512-gaHqbubTi29aZpVbBlECRpmdia+L5/lh2BwtIJTmtxdbecEyyX/ejAOg7eQDGNvGOUmPY7Z2Yxdy9ioyH/VJeA==} + engines: {node: '>= 10.16.0'} + peerDependencies: + jsep: ^0.4.0||^1.0.0 + dependencies: + jsep: 1.3.9 + + /@jsep-plugin/regex@1.0.3(jsep@1.3.9): + resolution: {integrity: sha512-XfZgry4DwEZvSFtS/6Y+R48D7qJYJK6R9/yJFyUFHCIUMEEHuJ4X95TDgJp5QkmzfLYvapMPzskV5HpIDrREug==} + engines: {node: '>= 10.16.0'} + peerDependencies: + jsep: ^0.4.0||^1.0.0 + dependencies: + jsep: 1.3.9 + /@microsoft/tsdoc-config@0.17.0: resolution: {integrity: sha512-v/EYRXnCAIHxOHW+Plb6OWuUoMotxTN0GLatnpOb1xq0KuTNw/WI3pamJx/UbsoJP5k9MCw1QxvvhPcF9pH3Zg==} dependencies: @@ -4114,6 +4130,10 @@ packages: engines: {node: '>=12.0.0'} dev: true + /jsep@1.3.9: + resolution: {integrity: sha512-i1rBX5N7VPl0eYb6+mHNp52sEuaS2Wi8CDYx1X5sn9naevL78+265XJqy1qENEk7mRKwS06NHpUqiBwR7qeodw==} + engines: {node: '>= 10.16.0'} + /jsesc@2.5.2: resolution: {integrity: sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==} engines: {node: '>=4'} @@ -4153,9 +4173,14 @@ packages: optionalDependencies: graceful-fs: 4.2.11 - /jsonpath-plus@4.0.0: - resolution: {integrity: sha512-e0Jtg4KAzDJKKwzbLaUtinCn0RZseWBVRTRGihSpvFlM3wTR7ExSp+PTdeTsDrLNJUe7L7JYJe8mblHX5SCT6A==} - engines: {node: '>=10.0'} + /jsonpath-plus@10.1.0: + resolution: {integrity: sha512-gHfV1IYqH8uJHYVTs8BJX1XKy2/rR93+f8QQi0xhx95aCiXn1ettYAd5T+7FU6wfqyDoX/wy0pm/fL3jOKJ9Lg==} + engines: {node: '>=18.0.0'} + hasBin: true + dependencies: + '@jsep-plugin/assignment': 1.2.1(jsep@1.3.9) + '@jsep-plugin/regex': 1.0.3(jsep@1.3.9) + jsep: 1.3.9 /jsx-ast-utils@3.3.5: resolution: {integrity: sha512-ZZow9HBI5O6EPgSJLUb8n2NKgmVWTwCvHGwFuJlMjvLFqlGG6pjirPhtdsseaLZjSibD8eegzmYpUZwoIlj2cQ==} @@ -6240,7 +6265,7 @@ packages: - typescript dev: true - file:../../../heft-plugins/heft-api-extractor-plugin(@rushstack/heft@0.68.2)(@types/node@18.17.15): + file:../../../heft-plugins/heft-api-extractor-plugin(@rushstack/heft@0.68.5)(@types/node@18.17.15): resolution: {directory: ../../../heft-plugins/heft-api-extractor-plugin, type: directory} id: file:../../../heft-plugins/heft-api-extractor-plugin name: '@rushstack/heft-api-extractor-plugin' @@ -6255,7 +6280,7 @@ packages: - '@types/node' dev: true - file:../../../heft-plugins/heft-jest-plugin(@rushstack/heft@0.68.2)(@types/node@18.17.15)(jest-environment-node@29.5.0): + file:../../../heft-plugins/heft-jest-plugin(@rushstack/heft@0.68.5)(@types/node@18.17.15)(jest-environment-node@29.5.0): resolution: {directory: ../../../heft-plugins/heft-jest-plugin, type: directory} id: file:../../../heft-plugins/heft-jest-plugin name: '@rushstack/heft-jest-plugin' @@ -6289,7 +6314,7 @@ packages: - ts-node dev: true - file:../../../heft-plugins/heft-lint-plugin(@rushstack/heft@0.68.2)(@types/node@18.17.15): + file:../../../heft-plugins/heft-lint-plugin(@rushstack/heft@0.68.5)(@types/node@18.17.15): resolution: {directory: ../../../heft-plugins/heft-lint-plugin, type: directory} id: file:../../../heft-plugins/heft-lint-plugin name: '@rushstack/heft-lint-plugin' @@ -6303,7 +6328,7 @@ packages: - '@types/node' dev: true - file:../../../heft-plugins/heft-typescript-plugin(@rushstack/heft@0.68.2)(@types/node@18.17.15): + file:../../../heft-plugins/heft-typescript-plugin(@rushstack/heft@0.68.5)(@types/node@18.17.15): resolution: {directory: ../../../heft-plugins/heft-typescript-plugin, type: directory} id: file:../../../heft-plugins/heft-typescript-plugin name: '@rushstack/heft-typescript-plugin' @@ -6341,7 +6366,7 @@ packages: '@rushstack/node-core-library': file:../../../libraries/node-core-library(@types/node@18.17.15) '@rushstack/rig-package': file:../../../libraries/rig-package '@rushstack/terminal': file:../../../libraries/terminal(@types/node@18.17.15) - jsonpath-plus: 4.0.0 + jsonpath-plus: 10.1.0 transitivePeerDependencies: - '@types/node' @@ -6528,7 +6553,7 @@ packages: transitivePeerDependencies: - '@types/node' - file:../../../rigs/heft-node-rig(@rushstack/heft@0.68.2)(@types/node@18.17.15): + file:../../../rigs/heft-node-rig(@rushstack/heft@0.68.5)(@types/node@18.17.15): resolution: {directory: ../../../rigs/heft-node-rig, type: directory} id: file:../../../rigs/heft-node-rig name: '@rushstack/heft-node-rig' @@ -6538,10 +6563,10 @@ packages: '@microsoft/api-extractor': file:../../../apps/api-extractor(@types/node@18.17.15) '@rushstack/eslint-config': file:../../../eslint/eslint-config(eslint@8.57.0)(typescript@5.4.5) '@rushstack/heft': file:../../../apps/heft(@types/node@18.17.15) - '@rushstack/heft-api-extractor-plugin': file:../../../heft-plugins/heft-api-extractor-plugin(@rushstack/heft@0.68.2)(@types/node@18.17.15) - '@rushstack/heft-jest-plugin': file:../../../heft-plugins/heft-jest-plugin(@rushstack/heft@0.68.2)(@types/node@18.17.15)(jest-environment-node@29.5.0) - '@rushstack/heft-lint-plugin': file:../../../heft-plugins/heft-lint-plugin(@rushstack/heft@0.68.2)(@types/node@18.17.15) - '@rushstack/heft-typescript-plugin': file:../../../heft-plugins/heft-typescript-plugin(@rushstack/heft@0.68.2)(@types/node@18.17.15) + '@rushstack/heft-api-extractor-plugin': file:../../../heft-plugins/heft-api-extractor-plugin(@rushstack/heft@0.68.5)(@types/node@18.17.15) + '@rushstack/heft-jest-plugin': file:../../../heft-plugins/heft-jest-plugin(@rushstack/heft@0.68.5)(@types/node@18.17.15)(jest-environment-node@29.5.0) + '@rushstack/heft-lint-plugin': file:../../../heft-plugins/heft-lint-plugin(@rushstack/heft@0.68.5)(@types/node@18.17.15) + '@rushstack/heft-typescript-plugin': file:../../../heft-plugins/heft-typescript-plugin(@rushstack/heft@0.68.5)(@types/node@18.17.15) '@types/heft-jest': 1.0.1 eslint: 8.57.0 jest-environment-node: 29.5.0 @@ -6561,7 +6586,7 @@ packages: dependencies: '@microsoft/api-extractor': file:../../../apps/api-extractor(@types/node@18.17.15) '@rushstack/heft': file:../../../apps/heft(@types/node@18.17.15) - '@rushstack/heft-node-rig': file:../../../rigs/heft-node-rig(@rushstack/heft@0.68.2)(@types/node@18.17.15) + '@rushstack/heft-node-rig': file:../../../rigs/heft-node-rig(@rushstack/heft@0.68.5)(@types/node@18.17.15) '@types/heft-jest': 1.0.1 '@types/node': 18.17.15 eslint: 8.57.0 diff --git a/common/config/subspaces/build-tests-subspace/repo-state.json b/common/config/subspaces/build-tests-subspace/repo-state.json index cb6f5ac7ac7..4f4fb9d7720 100644 --- a/common/config/subspaces/build-tests-subspace/repo-state.json +++ b/common/config/subspaces/build-tests-subspace/repo-state.json @@ -1,6 +1,6 @@ // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush. { - "pnpmShrinkwrapHash": "5b75a8ef91af53a8caf52319e5eb0042c4d06852", + "pnpmShrinkwrapHash": "158eddd923799186d56f184f9ad0df261598e7ef", "preferredVersionsHash": "ce857ea0536b894ec8f346aaea08cfd85a5af648", - "packageJsonInjectedDependenciesHash": "31e2e4a94050edab124897e4049a6c1d94c21c91" + "packageJsonInjectedDependenciesHash": "780ed5a8b4dcd8c24fe68939798e54a2073c1c3c" }