fix(deps): update dependency mathjs to v15 [security]#4282
fix(deps): update dependency mathjs to v15 [security]#4282renovate-bot wants to merge 1 commit intoGoogleCloudPlatform:mainfrom
Conversation
product-auto-label
bot
added
samples
|
/gcbrun |
trusted-contributions-gcf
bot
added
kokoro:force-run
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the mathjs dependency from version 13.0.0 to 15.2.0 in the automl and cloud-language packages. Feedback indicates that this update introduces a compatibility issue because mathjs v15 requires Node.js >= 18.0.0, while the engines field in both package.json files still specifies Node.js >= 16.0.0. The engines field needs to be updated to prevent installation or runtime issues for users on older Node.js versions.
| "dependencies": { | ||
| "@google-cloud/automl": "^4.0.0", | ||
| "mathjs": "^13.0.0" | ||
| "mathjs": "^15.2.0" |
There was a problem hiding this comment.
The update to mathjs v15 introduces a requirement for Node.js >= 18.0.0. However, the engines field in this file (line 7) still specifies >=16.0.0, which is incompatible with this update. This mismatch will cause installation or runtime issues for users on Node.js 16. Please update the engines field to reflect the new requirement of the updated dependency.
| "@google-cloud/language": "^6.1.0", | ||
| "@google-cloud/storage": "^7.0.0", | ||
| "mathjs": "^13.0.0", | ||
| "mathjs": "^15.2.0", |
There was a problem hiding this comment.
The update to mathjs v15 introduces a requirement for Node.js >= 18.0.0. However, the engines field in this file (line 6) still specifies >=16.0.0, which is incompatible with this update. This mismatch will cause installation or runtime issues for users on Node.js 16. Please update the engines field to reflect the new requirement of the updated dependency.
2 participants
This PR contains the following updates:
^13.0.0→^15.2.0GitHub Vulnerability Alerts
GHSA-jvff-x2qm-6286
Impact
Two security vulnerabilities where detected that allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.
Patches
The problem is patched in mathjs v15.2.0.
Workarounds
There is no workaround without upgrading.
Release Notes
josdejong/mathjs (mathjs)
v15.2.0Compare Source
Ah(#3617). Thanks @adrfantini.numanddenfunctions returning the parts ofa fraction (#3605). Thanks @AnslemHack.
Thanks @NilsDietrich.
via the expression parser. Thanks @CykuTW for finding and reporting them.
v15.1.1Compare Source
compareNatural(#3632). Thanks @Dheemanth07.Thanks @gwhitney.
and add History (#3630). Thanks @Anadian.
setDistinctsorts the elements (see #3602).v15.1.0Compare Source
Thanks @gwhitney.
v15.0.0Compare Source
!!! BE CAREFUL: BREAKING CHANGES !!!
modulus operator (that both use symbol
%), and raise the former (#3432).Thanks @kiprobinsonknack.
#3455). Thanks @gwhitney and @Delaney.
Thanks @dvd101x.
%as unary only when not followed by a term (#3505).Thanks @gwhitney.
sizeto always return anArray(#3535).SparseMatrix(#3536).v14.9.1Compare Source
v14.8.2underv14.9.0.v14.9.0Compare Source
mapwith multiple arguments (#3526).Thanks @dvd101x.
(#3548). Thanks @dvd101x.
v14.8.2Compare Source
mapwhen passing a unaryfunction (#3546). Thanks @dvd101x.
abs(complex)which returns anumber(#3543). Thanks @joshkel.
ctranspose(#3545). Thanks @joshkel.v14.8.1Compare Source
configprinting a warning when using{ number: 'bigint' }(#3540).
v14.8.0Compare Source
??in theexpression parser (#3497). Thanks @ikemHood.
v14.7.0Compare Source
DenseMatrixsymbol iterator (#3521). Thanks @dvd101x.Parser, fixing #3509 (#3525).missing from the generated function overview.
printTransformDependenciesnot exported in the type definitions.diff(#3520). Thanks @dodokw.range.by removing
core-js(#3524).v14.6.0Compare Source
toBest(unit, unitList, offset), and correspondingmethod
unit.toBest(...)(#3484). Thanks @Mundi93, @EliaAlesiani, and@HeavyRainLQ.
signof zero not returning zero in case of a fraction (#3513).Thanks @kyle-compute.
v14.5.3Compare Source
as white space(#3487). Thanks donmccurdy.
scope(#3490). Thanks @JayChang4w.unit(number)(#3495). Thanks @mrft.unit.to(unit)(#3495).Thanks @mrft.
addandmultiplyto not allow zeroor one argument (#3495). Thanks @mrft.
v14.5.2Compare Source
coulomb,see #3472.
ResultSetinterface and improveisResultSettyping(#3481). Thanks @ranidam.
v14.5.1Compare Source
BigIntwhen loading inspecific environments.
numeric(see #3448).coulombtocoulombConstant. The oldname is still available for backward compatibility.
v14.5.0Compare Source
mapandforEachmethods ofDenseMatrix(#3446). Thanks @dvd101x.subset(#3467). Thanks @dvd101x.compile,evaluate,parse, andparser,and add tests for the examples in embedded docs (#3413). Thanks @dvd101x.
(#3454).
(lbf in)(#3476). Thanks @costerwi.v14.4.0Compare Source
flatten(#3400). Thanks @dvd101x.mapandforEach(#3409).Thanks @dvd101x.
nthRootslatex function template string (#3427).Thanks @aitee.
@babel/runtime.v14.3.1Compare Source
v14.3.0Compare Source
flatten(#3354). Thanks @dvd101x.DenseMatrixSymbol.iterator (#3395).Thanks @dvd101x.
mapandforEach(#3399).Thanks @dvd101x.
argument types (#3394). Thanks @dvd101x.
(#3397). Thanks @porst17.
multiply(#3408). Thanks @orelbn.math.isNaNfor consistentmaxandminresults(#3389). Thanks @orelbn.
v14.2.1Compare Source
@lambdatest/node-tunnel.v14.2.0Compare Source
applytomapSlices(#3357). Functionapplyis still available but is now marked deprecated. Thanks @gwhitney.(#3369). Thanks @gwhitney.
Thanks @gwhitney.
and @gwhitney.
v14.1.0Compare Source
bigintsupport in functionslog,log2,log10,larger,smaller,max,min(#3345). Thanks @gwhitney.bigint(#3348).randomInt()not working (#3345).signin the embedded docs (#3338).Thanks @witer33.
v14.0.1Compare Source
Fractiontype from thefraction.jslibrary instead ofusing a custom interface (#3330). Thanks @fchu.
v14.0.0Compare Source
!!! BE CAREFUL: BREAKING CHANGES !!!
fraction.js@5, usingbigintunder the hood (#3283).Unitin functionsceil,floor, andfix.Possible breaking changes in the type definitions of arrays and matrices
due to the introduction of generics (#3269). Thanks @orelbn.
log(x: Fraction, base: Fraction).%(mod) being higher than*and/(#3311).Thanks @nkumawat34.
math.import(...)from overriding units unless youspecify
{ override: true }(#3225).dotDivide,dotPow,bitXor,xor,equal,larger,largerEq,smaller,smallerEq, andunequalreturn a sparsematrix when the input is two sparse matrices (#3307). Thanks @Aakash-Rana.
v13.2.3Compare Source
indices of
map,filter, andforEach.clone.Thanks @emmanuel-ferdman.
v13.2.2Compare Source
inis incorrect(#3315). Thanks @nkumawat34.
v13.2.1Compare Source
complex.js.Index.dimension(dim)accepting non-numeric input.Parser.set(#3308).Thanks @nkumawat34.
v13.2.0Compare Source
map,filterandforEach(#3256).Thanks @dvd101x.
map()andforEach()of
DenseMatrix(#3251). Thanks @Galm007.derivative.ConstantNodeto support all datatypes (#3257). Thanks @smith120bh.
symbolicEqualmissing in the TypeScript definitions.leafCountmissing in the TypeScript definitions.in.mapandforEachin the expression parser(#3272). Thanks @dvd101x.
v13.1.1Compare Source
import,createUnitandreviver, allowing to get access to the internalmath namespace and allowing arbitrary code execution. Thanks @StarlightPWN.
rawArgsfunction with anon-
rawArgsfunction, it was still called with raw arguments. This was botha functional issue and a security issue. Thanks @StarlightPWN.
ObjectWrappingMapcannot deleteunsafe properties. Thanks @StarlightPWN.
expression parser.
v13.1.0Compare Source
map(#3228, #3196).Thanks @dvd101x.
isMap,isPartitionedMap, andisObjectWrappingMap.mapnot always working with matrices (#3242).Thanks @dvd101x.
ResultSetin the docs about classes.from the function
evaluate(see #3238).scopeand fix the examplecustom_scope_objects.js(#3150)v13.0.3Compare Source
formatto support notationshex,bin, andoct.Thanks @Vistinum.
Thanks @orelbn.
v13.0.2Compare Source
quantileSeq(#3223).Thanks @domdomegg.
v13.0.1Compare Source
catchblocks without parameters.Parsermethods (#3226).Thanks @orelbn.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.