From 811ff4bcf4ef7b1c5be91405ebe3ab06290d6ab4 Mon Sep 17 00:00:00 2001 From: Jan Socha <92743635+js0cha@users.noreply.github.com> Date: Thu, 2 Jun 2022 14:45:42 +0200 Subject: [PATCH 1/2] chore(deps): upgrade swagger-ui-react to 4.11.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mitigate the current XSS vulnerabilities (https://www.npmjs.com/advisories/1070339) Signed-off-by: Jan Socha Signed-off-by: Fredrik Adelöw --- .changeset/tender-weeks-help.md | 6 ++++++ plugins/api-docs/package.json | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 .changeset/tender-weeks-help.md diff --git a/.changeset/tender-weeks-help.md b/.changeset/tender-weeks-help.md new file mode 100644 index 0000000000..7b70a3a925 --- /dev/null +++ b/.changeset/tender-weeks-help.md @@ -0,0 +1,6 @@ +--- +'@backstage/plugin-api-docs': patch +--- + +Updated `swagger-ui-react` to 4.11.1 in order to address a [XSS +vulnerability](https://github.com/advisories/GHSA-hqq7-2q2v-82xq) in `@braintree/sanitize-url` diff --git a/plugins/api-docs/package.json b/plugins/api-docs/package.json index e544c2812e..4878d4d7cd 100644 --- a/plugins/api-docs/package.json +++ b/plugins/api-docs/package.json @@ -50,7 +50,7 @@ "react-router": "6.0.0-beta.0", "react-router-dom": "6.0.0-beta.0", "react-use": "^17.2.4", - "swagger-ui-react": "^4.1.3" + "swagger-ui-react": "^4.11.1" }, "peerDependencies": { "@types/react": "^16.13.1 || ^17.0.0", From e9fd3bbbc366cf0b7f6df01dfca8f96e22ad3a1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Wed, 8 Jun 2022 10:15:52 +0200 Subject: [PATCH 2/2] fixup MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fredrik Adelöw --- .changeset/tender-weeks-help.md | 2 +- yarn.lock | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.changeset/tender-weeks-help.md b/.changeset/tender-weeks-help.md index 7b70a3a925..c1e0e99945 100644 --- a/.changeset/tender-weeks-help.md +++ b/.changeset/tender-weeks-help.md @@ -2,5 +2,5 @@ '@backstage/plugin-api-docs': patch --- -Updated `swagger-ui-react` to 4.11.1 in order to address a [XSS +Updated `swagger-ui-react` to 4.11.1 in order to address a [XSS vulnerability](https://github.com/advisories/GHSA-hqq7-2q2v-82xq) in `@braintree/sanitize-url` diff --git a/yarn.lock b/yarn.lock index b198961d73..0c811b3394 100644 --- a/yarn.lock +++ b/yarn.lock @@ -24157,7 +24157,7 @@ swagger-client@^3.18.5: traverse "~0.6.6" url "~0.11.0" -swagger-ui-react@^4.1.3: +swagger-ui-react@^4.11.1: version "4.12.0" resolved "https://registry.npmjs.org/swagger-ui-react/-/swagger-ui-react-4.12.0.tgz#bfdf67bd0679fdd62ec3fb98bd827afb81fb7fe6" integrity sha512-pkSkUe4WVb7omoScK8GG2qgD6LxwZEIA+fKcxeACC7PCW52vFEjle6WO6lFOLj1JmfWriL7Ngi0+wJtVjfhnWw==