Update dependency mpath to ^0.8.0 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
mpath	^0.6.0 → ^0.8.0

---

Type confusion in mpath

CVE-2021-23438 / GHSA-p92x-r36w-9395

More information

Details

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.

Severity

• CVSS Score: 5.6 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-23438
• https://github.com/aheckmann/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc
• https://snyk.io/vuln/SNYK-JS-MPATH-1577289
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1579548
• https://github.com/mongoosejs/mpath/commit/89402d2880d4ea3518480a8c9847c541f2d824fc
• https://github.com/advisories/GHSA-p92x-r36w-9395

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

aheckmann/mpath (mpath)

v0.8.4

Compare Source

==================

• fix: throw error if parts contains an element that isn't a string or number #​13

v0.8.3

Compare Source

==================

• fix: use var instead of let/const for Node.js 4.x support

v0.8.2

Compare Source

==================

• fix(stringToParts): fall back to legacy treatment for square brackets if square brackets contents aren't a number Automattic/mongoose#9640
• chore: add eslint

v0.8.1

Compare Source

==================

• fix(stringToParts): handle empty string and trailing dot the same way that split() does for backwards compat

v0.8.0

Compare Source

==================

• feat: support square bracket indexing for get(), set(), has(), and unset()

v0.7.0

Compare Source

==================

• BREAKING CHANGE: remove component.json #​9 AlexeyGrigorievBoost

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.