Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update dependency mathjs to v7 [security] #10841

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Dec 20, 2023

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
mathjs (source) ^5.0.4 -> ^7.0.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.


Prototype Pollution in mathjs

CVE-2020-7743 / GHSA-x2fc-mxcx-w4mf / SNYK-JAVA-ORGWEBJARS-1017113 / SNYK-JAVA-ORGWEBJARSBOWER-1017112 / SNYK-JAVA-ORGWEBJARSNPM-1017111 / SNYK-JS-MATHJS-1016401

More information

Details

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.

Severity

  • CVSS Score: 7.3 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).


Release Notes

josdejong/mathjs (mathjs)

v7.5.1

Compare Source

  • Fix object pollution vulnerability in math.config. Thanks Snyk.

v7.5.0

Compare Source

  • Function pickRandom now allows randomly picking elements from matrices
    with 2 or more dimensions instead of only from a vector, see #​1974.
    Thanks @​KonradLinkowski.

v7.4.0

Compare Source

  • Implemented support for passing a precision in functions ceil, floor,
    and fix, similar to round, see #​1967, #​1901. Thanks @​rnd-debug.
  • Implemented function rotationMatrix, see #​1160, #​1984. Thanks @​rnd-debug.
  • Implement a clear error message when using sqrtm with a matrix having
    more than two dimensions. Thanks @​KonradLinkowski.
  • Update dependency decimal.js to 10.2.1.

v7.3.0

Compare Source

  • Implemented functions usolveAll and lsolveAll, see #​1916. Thanks @​m93a.
  • Implemented support for units in functions std and variance, see #​1950.
    Thanks @​rnd-debug.
  • Implemented support for binary, octal, and hexadecimal notation in the
    expression parser, and implemented functions bin, oct, and hex for
    formatting. Thanks @​clnhlzmn.
  • Fix #​1964: inconsistent calculation of negative dividend modulo for
    BigNumber and Fraction. Thanks @​ovk.

v7.2.0

Compare Source

v7.1.0

Compare Source

  • Implement support for recursion (self-referencing) of typed-functions,
    new in [email protected]. This fixes #​1885: functions which where
    extended with a new data type did not always work. Thanks @​nickewing.
  • Fix #​1899: documentation on expression trees still using old namespace
    math.expression.node.* instead of math.*.

v7.0.2

Compare Source

  • Fix #​1882: have DenseMatrix.resize and SparseMatrix.resize accept
    DenseMatrix and SparseMatrix as inputs too, not only Array.
  • Fix functions sum, prod, min, and max not throwing a conversion error
    when passing a single string, like sum("abc").

v7.0.1

Compare Source

  • Fix #​1844: clarify the documentation of function eigs. Thanks @​Lazersmoke.
  • Fix #​1855: Fix error in the documentation for math.nthRoots(x).
  • Fix #​1856: make the library robust against Object prototype pollution.

v7.0.0

Compare Source

Breaking changes:

  • Improvements in calculation of the dot product of complex values.
    The first argument is now conjugated. See #​1761. Thanks @​m93a.
  • Dropped official support for Node.js v8 which has reached end of life.
  • Removed all deprecation warnings introduced in v6.
    To upgrade smoothly from v5 to v7 or higher, upgrade to v6 first
    and resolve all deprecation warnings.

v6.6.5

Compare Source

  • Fix #​1834: value Infinity cannot be serialized and deserialized.
    This is solved now with a new math.replacer function used as
    JSON.stringify(value, math.replacer).
  • Fix #​1842: value Infinity not turned into the latex symbol \\infty.

v6.6.4

Compare Source

  • Fix published files containing Windows line endings (CRLF instead of LF).

v6.6.3

Compare Source

  • Fix #​1813: bug in engineering notation for numbers of function format,
    sometimes resulting in needless trailing zeros.
  • Fix #​1808: methods .toNumber() and .toNumeric() not working on a
    unitless unit.
  • Fix #​1645: not being able to use named operators mod, and, not, or,
    xor, to, in as object keys. Thanks @​Veeloxfire.
  • Fix eigs not using config.epsilon.

v6.6.2

Compare Source

  • Fix #​1789: Function eigs not calculating with BigNumber precision
    when input contains BigNumbers.
  • Run the build script during npm prepare, so you can use the library
    directly when installing directly from git. See #​1751. Thanks @​cinderblock.

v6.6.1

Compare Source

v6.6.0

Compare Source

  • Implemented function eigs, see #​1705, #​542 #​1175. Thanks @​arkajitmandal.
  • Fixed #​1727: validate matrix size when creating a DenseMatrix using
    fromJSON.
  • Fixed DenseMatrix.map copying the size and datatype from the original
    matrix instead of checking the returned dimensions and type of the callback.
  • Add a caret to dependencies (like) ^1.2.3) to allow downstream updates
    without having to await a new release of mathjs.

v6.5.0

Compare Source

v6.4.0

Compare Source

  • Extended function dimension with support for n-dimensional points.
    Thanks @​Veeloxfire.

v6.3.0

Compare Source

  • Improved performance of factorial for BigNumber up to a factor two,
    see #​1687. Thanks @​kmdrGroch.

v6.2.5

Compare Source

  • Fixed IndexNode using a hardcoded, one-based implementation of index,
    making it impossible to instantiate a zero-based version of the expression
    parser. See #​782.

v6.2.4

Compare Source

v6.2.3

Compare Source

  • Fixed #​1640: function mean not working for units. Thanks @​clintonc.
  • Fixed #​1639: function min listed twice in the "See also" section of the
    embedded docs of function std.
  • Improved performance of isPrime, see #​1641. Thanks @​arguiot.

v6.2.2

Compare Source

  • Fixed methods map and clone not copying the dotNotation property of
    IndexNode. Thanks @​rianmcguire.
  • Fixed a typo in the documentation of toHTML. Thanks @​maytanthegeek.
  • Fixed #​1615: error in the docs of isNumeric.
  • Fixed #​1628: Cannot call methods on empty strings or numbers with value 0.

v6.2.1

Compare Source

  • Fixed #​1606: function format not working for expressions.

v6.2.0

Compare Source

  • Improved performance of combinationsWithRep. Thanks @​waseemyusuf.
  • Add unit aliases bit and byte.
  • Fix docs referring to bit and byte instead of bits and bytes.
  • Updated dependency [email protected].

v6.1.0

Compare Source

v6.0.4

Compare Source

  • Fixed #​1554, #​1565: ES Modules where not transpiled to ES5, giving issues on
    old browsers. Thanks @​mockdeep for helping to find a solution.

v6.0.3

Compare Source

  • Add unpkg and jsdelivr fields in package.json pointing to UMD build.
    Thanks @​tmcw.
  • Fix #​1550: nested user defined function not receiving variables of an
    outer user defined function.

v6.0.2

Compare Source

  • Fix not being able to set configuration after disabling function import
    (regression since v6.0.0).

v6.0.1

Compare Source

  • Fix function reference not published in npm library.
  • Fix function evaluate and parse missing in generated docs.

v6.0.0

Compare Source

!!! BE CAREFUL: BREAKING CHANGES !!!

Most notable changes
  1. Full support for ES modules. Support for tree-shaking out of the box.

    Load all functions:

    import * as math from 'mathjs'

    Use a few functions:

    import { add, multiply } from 'mathjs'

    Load all functions with custom configuration:

    import { create, all } from 'mathjs'
    const config = { number: 'BigNumber' }
    const math = create(all, config)

    Load a few functions with custom configuration:

    import { create, addDependencies, multiplyDependencies } from 'mathjs'
    const config = { number: 'BigNumber' }
    const { add, multiply } = create({
      addDependencies,
      multiplyDependencies
    }, config)
  2. Support for lightweight, number-only implementations of all functions:

    import { add, multiply } from 'mathjs/number'
    
  3. New dependency injection solution used under the hood.

Breaking changes
  • Node 6 is no longer supported.

  • Functions config and import are not available anymore in the global
    context:

    // v5
    import * as mathjs from 'mathjs'
    mathjs.config(...) // error in v6.0.0
    mathjs.import(...) // error in v6.0.0

    Instead, create your own mathjs instance and pass config and imports
    there:

    // v6
    import { create, all } from 'mathjs'
    const config = { number: 'BigNumber' }
    const mathjs = create(all, config)
    mathjs.import(...)
  • Renamed function typeof to typeOf, var to variance,
    and eval to evaluate. (the old function names are reserved keywords
    which can not be used as a variable name).

  • Deprecated the Matrix.storage function. Use math.matrix instead to create
    a matrix.

  • Deprecated function math.expression.parse, use math.parse instead.
    Was used before for example to customize supported characters by replacing
    math.parse.isAlpha.

  • Moved all classes like math.type.Unit and math.expression.Parser to
    math.Unit and math.Parser respectively.

  • Fixed #​1428: transform iterating over replaced nodes. New behavior
    is that it stops iterating when a node is replaced.

  • Dropped support for renaming factory functions when importing them.

  • Dropped fake BigNumber support of function erf.

  • Removed all index.js files used to load specific functions instead of all, like:

    // v5
    // ... set up empty instance of mathjs, then load a set of functions:
    math.import(require('mathjs/lib/function/arithmetic'))
    

    Individual functions are now loaded simply like:

    // v6
    import { add, multiply } from 'mathjs'

    To set a specific configuration on the functions:

    // v6
    import { create, addDependencies, multiplyDependencies } from 'mathjs'
    const config = { number: 'BigNumber' }
    const math = create({ addDependencies, multiplyDependencies }, config)

    See example advanced/custom_loading.js.

  • Updated the values of all physical units to their latest official values.
    See #​1529. Thanks @​ericman314.

Non breaking changes
  • Implemented units t, tonne, bel, decibel, dB, and prefixes
    for candela. Thanks @​mcvladthegoat.
  • Fixed epsilon setting being applied globally to Complex numbers.
  • Fix math.simplify('add(2, 3)') throwing an error.
  • Fix #​1530: number formatting first applied lowerExp and upperExp
    and after that rounded the value instead of the other way around.
  • Fix #​1473: remove 'use strict' in every file, not needed anymore.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner December 20, 2023 16:04
@renovate renovate bot requested a review from a team December 20, 2023 16:04
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch 2 times, most recently from 0029a7e to dc6061f Compare December 22, 2023 17:31
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch 7 times, most recently from a5c487f to d7c53a2 Compare January 9, 2024 11:24
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch 9 times, most recently from 82bc066 to f30f451 Compare January 17, 2024 11:23
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch 3 times, most recently from c983823 to f322b37 Compare January 23, 2024 17:58
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch 5 times, most recently from 13729a3 to 593196f Compare February 1, 2024 15:14
@renovate renovate bot changed the title fix(deps): update dependency mathjs to v7 [security] (release/core-contracts/11_old) fix(deps): update dependency mathjs to v7 [security] (release/core-contracts/12) Jun 19, 2024
@renovate renovate bot changed the base branch from release/core-contracts/11_old to release/core-contracts/12 June 19, 2024 16:46
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch from 66b0b56 to 1ae8153 Compare June 21, 2024 08:01
@renovate renovate bot changed the title fix(deps): update dependency mathjs to v7 [security] (release/core-contracts/12) fix(deps): update dependency mathjs to v7 [security] (release/core-contracts/10) Jun 21, 2024
@renovate renovate bot changed the base branch from release/core-contracts/12 to release/core-contracts/10 June 21, 2024 08:01
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch from 1ae8153 to 60ffe67 Compare June 21, 2024 08:05
@renovate renovate bot changed the title fix(deps): update dependency mathjs to v7 [security] (release/core-contracts/10) fix(deps): update dependency mathjs to v7 [security] (release/core-contracts/11) Jun 21, 2024
@renovate renovate bot changed the base branch from release/core-contracts/10 to release/core-contracts/11 June 21, 2024 08:05
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch from 60ffe67 to 7484416 Compare June 21, 2024 08:09
@renovate renovate bot requested a review from a team as a code owner June 21, 2024 08:09
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch 2 times, most recently from 31ec7d0 to 74c2ae7 Compare June 25, 2024 12:50
@renovate renovate bot changed the title fix(deps): update dependency mathjs to v7 [security] (release/core-contracts/11) fix(deps): update dependency mathjs to v7 [security] Jun 25, 2024
@renovate renovate bot changed the base branch from release/core-contracts/11 to master June 25, 2024 12:50
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch 4 times, most recently from 8ab873f to 3314812 Compare July 2, 2024 10:20
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch 2 times, most recently from 98d3f22 to 571f2de Compare July 4, 2024 18:56
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch from 571f2de to 1dee7da Compare July 29, 2024 08:09
Copy link

socket-security bot commented Jul 29, 2024

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/[email protected] None +8 11.2 MB josdejong

🚮 Removed packages: npm/[email protected]

View full report↗︎

@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch from 1dee7da to 9688166 Compare July 29, 2024 12:19
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch 2 times, most recently from 41fbf5d to 6c4399d Compare August 19, 2024 15:05
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch 2 times, most recently from 29be941 to 293398e Compare September 13, 2024 16:18
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch from 293398e to 6f282ec Compare September 23, 2024 11:17
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
@renovate renovate bot force-pushed the renovate/npm-mathjs-vulnerability branch from 6f282ec to 9900825 Compare September 23, 2024 18:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants