Browse Source

[Security] Bump atob from 2.0.3 to 2.1.2 (#153)

Bumps [atob](https://github.com/coolaj86/node-browser-compat) from 2.0.3 to 2.1.2. **This update includes security fixes.**
<details>
<summary>Vulnerabilities fixed</summary>

*Sourced from [The Sonatype OSS Index](https://ossindex.sonatype.org/vuln/e391a58d-4a81-448b-8ffc-e19016807d73).*

> **CWE-125: Out-of-bounds Read**
> The software reads data past the end, or before the beginning, of the intended buffer.
> 
> Affected versions: <=2.0.3

*Sourced from [The Node Security Working Group](https://github.com/nodejs/security-wg/blob/master/vuln/npm/403.json).*

> **Out-of-bounds Read**
> `atob` allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below
> 
> Affected versions: <=2.0.3

</details>
<details>
<summary>Commits</summary>

- See full diff in [compare view](https://github.com/coolaj86/node-browser-compat/commits)
</details>
<br />

[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=atob&package-manager=npm_and_yarn&previous-version=2.0.3&new-version=2.1.2)](https://dependabot.com/compatibility-score.html?dependency-name=atob&package-manager=npm_and_yarn&previous-version=2.0.3&new-version=2.1.2)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

</details>
pull/152/head
dependabot[bot] 6 years ago committed by Ned Zimmerman
parent
commit
5631cc49b6
  1. 6
      package-lock.json

6
package-lock.json generated

@ -670,9 +670,9 @@
"integrity": "sha1-x57Zf380y48robyXkLzDZkdLS3k="
},
"atob": {
"version": "2.0.3",
"resolved": "https://registry.npmjs.org/atob/-/atob-2.0.3.tgz",
"integrity": "sha1-GcenYEc3dEaPILLS0DNyrX1Mv10="
"version": "2.1.2",
"resolved": "https://registry.npmjs.org/atob/-/atob-2.1.2.tgz",
"integrity": "sha512-Wm6ukoaOGJi/73p/cl2GvLjTI5JM1k/O14isD73YML8StrH/7/lRFgmg8nICZgD3bZZvjwCGxtMOD3wWNAu8cg=="
},
"autoprefixer": {
"version": "7.2.6",

Loading…
Cancel
Save