Update dependency mpath to ~0.8.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mpath	~0.5.0 → ~0.8.0

GitHub Vulnerability Alerts

CVE-2021-23438

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

---

Release Notes

aheckmann/mpath (mpath)

v0.8.4

Compare Source

==================

• fix: throw error if parts contains an element that isn't a string or number #​13

v0.8.3

Compare Source

==================

• fix: use var instead of let/const for Node.js 4.x support

v0.8.2

Compare Source

==================

• fix(stringToParts): fall back to legacy treatment for square brackets if square brackets contents aren't a number Automattic/mongoose#9640
• chore: add eslint

v0.8.1

Compare Source

==================

• fix(stringToParts): handle empty string and trailing dot the same way that split() does for backwards compat

v0.8.0

Compare Source

==================

• feat: support square bracket indexing for get(), set(), has(), and unset()

v0.7.0

Compare Source

==================

• BREAKING CHANGE: remove component.json #​9 AlexeyGrigorievBoost

v0.6.0

Compare Source

==================

• feat: support setting dotted paths within nested arrays

v0.5.2

Compare Source

==================

• fix: avoid using subclassed array constructor when doing map()

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.