[GHSA-457r-cqc8-9vj9] sweetalert2 v10.16.10 and above contains hidden functionality #6031
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR updates a security advisory for sweetalert2 to correctly specify the patched version. The change addresses an issue where the patched version was not tagged correctly in the vulnerability database.
- Updates the modified timestamp to reflect the correction
- Adds explicit "fixed" version information to properly indicate version 11.0.0 resolves the vulnerability
- Removes the less precise "last_known_affected_version_range" field in favor of explicit version ranges
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
| @@ -19,13 +19,13 @@ | |||
| "events": [ | |||
| { | |||
| "introduced": "10.16.10" | |||
| }, | |||
There was a problem hiding this comment.
[nitpick] The trailing comma after the 'introduced' object creates an inconsistent JSON structure. Consider removing the comma on line 22 to maintain clean JSON formatting.
Copilot uses AI. Check for mistakes.
|
Hi @Humni, your proposed fixed version does not address the hidden-functionality vulnerability identified in this GHSA, therefore we are not merging this contribution. We have updated the advisory with the correct patched version. |
Updates
Comments
patched version not tagged correctly