Bump url-parse and original in /patrimonio-ui
Open
Number: #22
Type: Pull Request
State: Open
Type: Pull Request
State: Open
Author:
![dependabot[bot]](https://github.com/dependabot.png)
dependabot[bot]
Association: Unknown
Comments: 1
dependabot[bot]Association: Unknown
Comments: 1
Created:
January 23, 2026 at 05:47 PM UTC
(4 months ago)
(4 months ago)
Updated:
January 23, 2026 at 05:47 PM UTC
(4 months ago)
(4 months ago)
Labels:
dependencies javascript
dependencies javascript
Description:
Bumps url-parse and original. These dependencies needed to be updated together.
Updates url-parse from 1.2.0 to 1.5.10
Commits
8cd4c6c1.5.10ce7a01f[fix] Improve handling of empty port0071490[doc] Update JSDoc commenta7044e3[minor] Use more descriptive variable named547792[security] Add credits for CVE-2022-0691ad233571.5.90e3fb54[fix] Strip all control characters from the beginning of the URL61864a8[security] Add credits for CVE-2022-0686bb0104d1.5.8d5c6479[fix] Handle the case where the port is specified but empty- Additional commits viewable in compare view
Updates original from 1.0.0 to 1.0.2
Commits
3a6b7df[dist] 1.0.27658407[pkg] Bump url-parse to latestf060834[dist] 1.0.1da879e4chore(package): update assume to version 2.0.1 (#14)42e0299fix(package): update url-parse to version 1.4.0 (#13)4dd4e5bfix(package): update url-parse to version 1.3.0 (#12)0575557fix(package): update url-parse to version 1.2.0 (#10)075f761chore(package): update mocha to version 3.5.0 (#8)d9bb779chore(package): update mocha to version 3.4.0 (#7)d45f349chore(package): update mocha to version 3.3.0 (#6)- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.
Package Dependencies
Security Advisories
Authorization Bypass Through User-Controlled Key in url-parse
GHSA-hgjh-723h-mx2j
CVE-2022-0686
CRITICAL
url-parse prior to version 1.5.8 is vulnerable to Authorization Bypass Through User-Controlled Key.
url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.
GHSA-jf5r-8hm2-f872
CVE-2022-0691
MODERATE
Leading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a relative URL without a hostname and protocol, while t...
Technical Details
| ID: | 13061695 |
| UUID: | 3848501039 |
| Node ID: | PR_kwDOB2j14s6-_MKk |
| Host: | GitHub |
| Repository: | shiol/angular-java-spring |