mause/vercel-openapi

Hi there 👋

• 🔭 I’m currently working on duckdb_engine, DuckDB, and a couple of related projects

• ☕ If you appreciate my work on these projects, feel free to buy me a coffee:

• 🌱 I’m currently learning Rust

• 📫 How to reach me:

  • [email protected]
  • @Mause on Discord
  • @Mause_me on Twitter
  • or @[email protected] on mastodon

• 😄 Pronouns: she/her

• ⚡ Fun fact: I live in Western Australia!

vercel-openapi's Issues

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• fix(deps): update dependency class-validator to ^0.14.0 [security]
• fix(deps): update dependency yaml to v2.2.2 [security]
• chore(deps): update actions/setup-node action to v3.6.0
• fix(deps): update dependency @oclif/core to v2
• fix(deps): update dependency class-validator-jsonschema to v5
• fix(deps): update dependency glob to v10
• fix(deps): update dependency openapi3-ts to v4
• fix(deps): update dependency pino-pretty to v10
• fix(deps): update dependency typescript to v5
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

github-actions

.github/workflows/build.yaml

• actions/checkout v3
• actions/setup-node v3.5.1
• actions/upload-artifact v3

.github/workflows/publish.yml

• actions/checkout v3
• actions/setup-node v3

.github/workflows/update-readme.yaml

• actions/checkout v3
• actions/setup-node v3.5.1
• technote-space/create-pr-action v2

npm

package.json

• @oclif/core ^1
• @oclif/plugin-help ^5.1.12
• @oclif/plugin-warn-if-update-available ^2.0.4
• @types/glob ^8.0.0
• @types/validator ^13.7.10
• class-transformer ^0.5.0
• class-validator ^0.13.2
• class-validator-jsonschema ^3.1.1
• glob ^8.0.0
• isomorphic-git ^1.21.0
• openapi3-ts ^3.0.0
• pino ^8.7.0
• pino-pretty ^9.1.1
• ts-node ^10
• tslib ^2
• typescript ^4.8
• yaml ^2.1.3
• @oclif/test ^2.2.10
• @types/chai ^4
• @types/mocha ^10.0.0
• @types/node ^18
• @vercel/node *
• chai ^4
• eslint ^8.27.0
• eslint-config-oclif ^4.0
• eslint-config-oclif-typescript ^1.0
• husky >=8
• lint-staged >=13
• mocha ^10.1.0
• mocha-chai-jest-snapshot ^1.1.4
• oclif ^3.2.25
• prettier ^2.7.1
• shx ^0.3.4
• @types/node ^18
• @vercel/node *
• node >=8.0.0

---

• Check this box to trigger a request for Renovate to run again on this repository

Support exporting metadata as single object

Vercel now supports config objects - can we piggyback on this?

Support dynamic routes

Allow setting environment variables via flags

Support including git hash in version

Don't override securitySchemes

Fix dynamic paths

• #41
• #42

Test multiple segment paths

Fix generation of paths

Default content type

class-validator-0.13.1.tgz: 1 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - class-validator-0.13.1.tgz

Decorator-based property validation for classes.

Library home page: https://registry.npmjs.org/class-validator/-/class-validator-0.13.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/class-validator/package.json

Found in HEAD commit: ea1e16f3c638bffb5b7c0c62c4b47f4354b5e41f

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2019-18413	High	9.8	class-validator-0.13.1.tgz	Direct	0.13.2	❌

Details

CVE-2019-18413

Vulnerable Library - class-validator-0.13.1.tgz

Decorator-based property validation for classes.

Library home page: https://registry.npmjs.org/class-validator/-/class-validator-0.13.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/class-validator/package.json

Dependency Hierarchy:

• ❌ class-validator-0.13.1.tgz (Vulnerable Library)

Found in HEAD commit: ea1e16f3c638bffb5b7c0c62c4b47f4354b5e41f

Found in base branch: main

Vulnerability Details

In TypeStack class-validator 0.10.2, validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.

Publish Date: 2019-10-24

URL: CVE-2019-18413

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-18413

Release Date: 2019-10-24

Fix Resolution: 0.13.2

Step up your Open Source Security Game with Mend here

Glob nested functions