🚨 [security] [js] Update grunt: 1.4.1 → 1.5.3 (minor)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ grunt (1.4.1 → 1.5.3) · Repo · Changelog

Security Advisories 🚨

🚨 Race Condition in Grunt

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.

🚨 Path Traversal in Grunt

Grunt prior to version 1.5.2 is vulnerable to path traversal.

Release Notes

1.5.3

• Merge pull request #1745 from gruntjs/fix-copy-op 572d79b
• Patch up race condition in symlink copying. 58016ff
• Merge pull request #1746 from JamieSlome/patch-1 0749e1d
• Create SECURITY.md 69b7c50

v1.5.2...v1.5.3

1.5.2

• Update Changelog 7f15fd5
• Merge pull request #1743 from gruntjs/cleanup-link b0ec6e1
• Clean up link handling 433f91b

v1.5.1...v1.5.2

1.5.1

• Merge pull request #1742 from gruntjs/update-symlink-test ad22608
• Fix symlink test 0652305

v1.5.0...v1.5.1

1.5.0

• Updated changelog b2b2c2b
• Merge pull request #1740 from gruntjs/update-deps-22-10 3eda6ae
• Update testing matrix 47d32de
• More updates 2e9161c
• Remove console log 04b960e
• Update dependencies, tests... aad3d45
• Merge pull request #1736 from justlep/main fdc7056
• support .cjs extension e35fe54

v1.4.1...v1.5.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 21 commits:

• 1.5.3
• Merge pull request #1745 from gruntjs/fix-copy-op
• Patch up race condition in symlink copying.
• Merge pull request #1746 from JamieSlome/patch-1
• Create SECURITY.md
• 1.5.2
• Update Changelog
• Merge pull request #1743 from gruntjs/cleanup-link
• Clean up link handling
• 1.5.1
• Merge pull request #1742 from gruntjs/update-symlink-test
• Fix symlink test
• 1.5.0
• Updated changelog
• Merge pull request #1740 from gruntjs/update-deps-22-10
• Update testing matrix
• More updates
• Remove console log
• Update dependencies, tests...
• Merge pull request #1736 from justlep/main
• support .cjs extension

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)