[Snyk] Upgrade nunjucks from 3.2.0 to 3.2.3 #14

snyk-bot · 2022-09-16T22:46:48Z

Snyk has created this PR to upgrade nunjucks from 3.2.0 to 3.2.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 3 versions ahead of your current version.
The recommended version was released 2 years ago, on 2021-02-15.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Prototype Pollution SNYK-JS-Y18N-1021887	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-UNSETVALUE-2400660	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579155	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579147	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536528	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Prototype Pollution SNYK-JS-NUNJUCKS-1079083	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-INI-1048974	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-559764	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-559764	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-2429795	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-MINIMIST-2429795	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: nunjucks

3.2.3 - 2021-02-15
- Add support for nested attributes on sort filter; respect throwOnUndefined if sort attribute is undefined.
- Add base arg to int filter.
- Move chokidar to peerDependencies and mark it optional in peerDependenciesMeta.
- Fix prototype pollution issue for template variables. Merge of #1330; fixes #1331. Thanks ChenKS12138!
3.2.2 - 2020-07-20
- Add select and reject filters. Merge of #1278 and #1279; fixes #282. Thanks ogonkov!
- Fix precompile binary script TypeError: name.replace is not a function. Fixes #1295.
- Add support for nested attributes on groupby filter; respect throwOnUndefined option, if the groupby attribute is undefined. Merge of #1276; fixes #1198. Thanks ogonkov!
- Fix bug that prevented errors in included templates from being raised when rendering templates synchronously. Fixes #1272.
- The indent filter no longer appends an additional newline. Fixes #1231.
3.2.1 - 2020-03-17
- Replace yargs with commander to reduce number of dependencies. Merge of #1253. Thanks AlynxZhou.
- Update optional dependency chokidar from ^2.0.0 to ^3.3.0. Merge of #1254. Thanks eklingen.
- Prevent optional dependency Chokidar from loading when not watching. Merge of #1250. Thanks eklingen.
3.2.0 - 2019-03-05
- Adds NodeResolveLoader, a Loader that loads templates using node's require.resolve. Fixes #1175.
- Emit 'load' events on Environment instances, to allow runtime dependency tracking. Fixes #1153.

from nunjucks GitHub release notes

Commit messages

Package name: nunjucks

fd50090 Release v3.2.3
d34fdbf Temporarily comment out codecov action
cefad41 Replace README.md travis badge with github actions
7601ff4 Fixup github actions workflow file
de9dc67 Add GitHub Workflow for tests. fixes #1333
aa9e5b9 Fix prototype pollution security issue. fixes #1331
f51afa3 Move chokidar to peerDependencies and make it optional via peerDependenciesMeta (#1329)
f91f1c3 Fix `groupby` example formatting
7ef121c Add base and default args to int filter
0c02062 Use attribute getter for `sort` filter
c7337e7 Release v3.2.2
bea3a43 CHANGELOG: Fix issue link
8186d4f Don't append extra newline when using |indent filter
73a4eb3 Document `with context` behavior for `import` directive (fr)
eea081c Document `with context` behavior for `import` directive
bbcbaf3 Fix issue where sync render would not raise errors in included templates
63c4baf Remove development files from NPM package. Fixes #984
85918ef Document `if` statement with multiple conditions (fr). refs #1284
7ddd747 Document `if` statement with multiple conditions
1e29863 Add support for nested attributes in `groupBy` filter. Fixes #1198
7087fa9 Fix precompile bin TypeError: name.replace is not a function
1736334 Modify CHANGELOG message for select/reject filters
62565a1 Add `reject` filter
647fc11 Change version query