JakeHillion/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
f13b08e900
nixpkgs/pkgs/servers/web-apps/hedgedoc/yarn.nix

12590 lines
468 KiB
Nix
Raw Normal View History

hedgedoc: fix eval with `allowAliases = false`
2021-09-18 23:23:28 +01:00
{ fetchurl, fetchgit, linkFarm, runCommand, gnutar }: rec {
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
offline_cache = linkFarm "offline" packages;
packages = [
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_babel_code_frame___code_frame_7.12.11.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_babel_code_frame___code_frame_7.12.11.tgz";
url = "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.12.11.tgz";
sha1 = "f4ad435aa263db935b8f10f2c552d23fb716a63f";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_babel_code_frame___code_frame_7.14.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_babel_code_frame___code_frame_7.14.5.tgz";
url = "https://registry.yarnpkg.com/@babel/code-frame/-/code-frame-7.14.5.tgz";
sha1 = "23b08d740e83f49c5e59945fbf1b43e80bbf4edb";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_babel_helper_validator_identifier___helper_validator_identifier_7.14.9.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_babel_helper_validator_identifier___helper_validator_identifier_7.14.9.tgz";
url = "https://registry.yarnpkg.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.14.9.tgz";
sha1 = "6654d171b2024f6d8ee151bf2509699919131d48";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_babel_highlight___highlight_7.14.5.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_babel_highlight___highlight_7.14.5.tgz";
url = "https://registry.yarnpkg.com/@babel/highlight/-/highlight-7.14.5.tgz";
sha1 = "6861a52f03966405001f6aa534a01a24d99e8cd9";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_braintree_sanitize_url___sanitize_url_3.1.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_braintree_sanitize_url___sanitize_url_3.1.0.tgz";
url = "https://registry.yarnpkg.com/@braintree/sanitize-url/-/sanitize-url-3.1.0.tgz";
sha1 = "8ff71d51053cd5ee4981e5a501d80a536244f7fd";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_dabh_diagnostics___diagnostics_2.0.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_dabh_diagnostics___diagnostics_2.0.2.tgz";
url = "https://registry.yarnpkg.com/@dabh/diagnostics/-/diagnostics-2.0.2.tgz";
sha1 = "290d08f7b381b8f94607dc8f471a12c675f9db31";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_discoveryjs_json_ext___json_ext_0.5.3.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_discoveryjs_json_ext___json_ext_0.5.3.tgz";
url = "https://registry.yarnpkg.com/@discoveryjs/json-ext/-/json-ext-0.5.3.tgz";
sha1 = "90420f9f9c6d3987f176a19a7d8e764271a2f55d";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_eslint_eslintrc___eslintrc_0.4.3.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_eslint_eslintrc___eslintrc_0.4.3.tgz";
url = "https://registry.yarnpkg.com/@eslint/eslintrc/-/eslintrc-0.4.3.tgz";
sha1 = "9e42981ef035beb3dd49add17acb96e8ff6f394c";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_gar_promisify___promisify_1.1.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_gar_promisify___promisify_1.1.2.tgz";
url = "https://registry.yarnpkg.com/@gar/promisify/-/promisify-1.1.2.tgz";
sha1 = "30aa825f11d438671d585bd44e7fd564535fc210";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_humanwhocodes_config_array___config_array_0.5.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_humanwhocodes_config_array___config_array_0.5.0.tgz";
url = "https://registry.yarnpkg.com/@humanwhocodes/config-array/-/config-array-0.5.0.tgz";
sha1 = "1407967d4c6eecd7388f83acf1eaf4d0c6e58ef9";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_humanwhocodes_object_schema___object_schema_1.2.0.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_humanwhocodes_object_schema___object_schema_1.2.0.tgz";
url = "https://registry.yarnpkg.com/@humanwhocodes/object-schema/-/object-schema-1.2.0.tgz";
sha1 = "87de7af9c231826fdd68ac7258f77c429e0e5fcf";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_nodelib_fs.scandir___fs.scandir_2.1.5.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_nodelib_fs.scandir___fs.scandir_2.1.5.tgz";
url = "https://registry.yarnpkg.com/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz";
sha1 = "7619c2eb21b25483f6d167548b4cfd5a7488c3d5";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_nodelib_fs.stat___fs.stat_2.0.5.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_nodelib_fs.stat___fs.stat_2.0.5.tgz";
url = "https://registry.yarnpkg.com/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz";
sha1 = "5bd262af94e9d25bd1e71b05deed44876a222e8b";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_nodelib_fs.walk___fs.walk_1.2.8.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_nodelib_fs.walk___fs.walk_1.2.8.tgz";
url = "https://registry.yarnpkg.com/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz";
sha1 = "e95737e8bb6746ddedf69c556953494f196fe69a";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_npmcli_fs___fs_1.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_npmcli_fs___fs_1.0.0.tgz";
url = "https://registry.yarnpkg.com/@npmcli/fs/-/fs-1.0.0.tgz";
sha1 = "589612cfad3a6ea0feafcb901d29c63fd52db09f";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "_npmcli_move_file___move_file_1.1.2.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "_npmcli_move_file___move_file_1.1.2.tgz";
url = "https://registry.yarnpkg.com/@npmcli/move-file/-/move-file-1.1.2.tgz";
sha1 = "1a82c3e372f7cae9253eb66d72543d6b8685c674";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "_passport_next_passport_openid___passport_openid_1.0.0.tgz";
path = fetchurl {
name = "_passport_next_passport_openid___passport_openid_1.0.0.tgz";
url = "https://registry.yarnpkg.com/@passport-next/passport-openid/-/passport-openid-1.0.0.tgz";
sha1 = "d3b5e067a9aa1388ed172ab7cc02c39b8634283d";
};
}
{
name = "_passport_next_passport_strategy___passport_strategy_1.1.0.tgz";
path = fetchurl {
name = "_passport_next_passport_strategy___passport_strategy_1.1.0.tgz";
url = "https://registry.yarnpkg.com/@passport-next/passport-strategy/-/passport-strategy-1.1.0.tgz";
sha1 = "4c0df069e2ec9262791b9ef1e23320c1d73bdb74";
};
}
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_tokenizer_token___token_0.3.0.tgz";
path = fetchurl {
name = "_tokenizer_token___token_0.3.0.tgz";
url = "https://registry.yarnpkg.com/@tokenizer/token/-/token-0.3.0.tgz";
sha1 = "fe98a93fe789247e998c75e74e9c7c63217aa276";
};
}
{
name = "_trysound_sax___sax_0.2.0.tgz";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_trysound_sax___sax_0.2.0.tgz";
url = "https://registry.yarnpkg.com/@trysound/sax/-/sax-0.2.0.tgz";
sha1 = "cccaab758af56761eb7bf37af6f03f326dd798ad";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "_types_accepts___accepts_1.3.5.tgz";
path = fetchurl {
name = "_types_accepts___accepts_1.3.5.tgz";
url = "https://registry.yarnpkg.com/@types/accepts/-/accepts-1.3.5.tgz";
sha1 = "c34bec115cfc746e04fe5a059df4ce7e7b391575";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_body_parser___body_parser_1.19.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_body_parser___body_parser_1.19.1.tgz";
url = "https://registry.yarnpkg.com/@types/body-parser/-/body-parser-1.19.1.tgz";
sha1 = "0c0174c42a7d017b818303d4b5d969cb0b75929c";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_concat_stream___concat_stream_1.6.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_concat_stream___concat_stream_1.6.1.tgz";
url = "https://registry.yarnpkg.com/@types/concat-stream/-/concat-stream-1.6.1.tgz";
sha1 = "24bcfc101ecf68e886aaedce60dfd74b632a1b74";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_connect___connect_3.4.35.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_connect___connect_3.4.35.tgz";
url = "https://registry.yarnpkg.com/@types/connect/-/connect-3.4.35.tgz";
sha1 = "5fcf6ae445e4021d1fc2219a4873cc73a3bb2ad1";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_content_disposition___content_disposition_0.5.4.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_content_disposition___content_disposition_0.5.4.tgz";
url = "https://registry.yarnpkg.com/@types/content-disposition/-/content-disposition-0.5.4.tgz";
sha1 = "de48cf01c79c9f1560bcfd8ae43217ab028657f8";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_cookies___cookies_0.7.7.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_cookies___cookies_0.7.7.tgz";
url = "https://registry.yarnpkg.com/@types/cookies/-/cookies-0.7.7.tgz";
sha1 = "7a92453d1d16389c05a5301eef566f34946cfd81";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_debug___debug_4.1.7.tgz";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_debug___debug_4.1.7.tgz";
url = "https://registry.yarnpkg.com/@types/debug/-/debug-4.1.7.tgz";
sha1 = "7cc0ea761509124709b8b2d1090d8f6c17aadb82";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_express_serve_static_core___express_serve_static_core_4.17.24.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_express_serve_static_core___express_serve_static_core_4.17.24.tgz";
url = "https://registry.yarnpkg.com/@types/express-serve-static-core/-/express-serve-static-core-4.17.24.tgz";
sha1 = "ea41f93bf7e0d59cd5a76665068ed6aab6815c07";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_express___express_4.17.13.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_express___express_4.17.13.tgz";
url = "https://registry.yarnpkg.com/@types/express/-/express-4.17.13.tgz";
sha1 = "a76e2995728999bab51a33fabce1d705a3709034";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_geojson___geojson_7946.0.8.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_geojson___geojson_7946.0.8.tgz";
url = "https://registry.yarnpkg.com/@types/geojson/-/geojson-7946.0.8.tgz";
sha1 = "30744afdb385e2945e22f3b033f897f76b1f12ca";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_hast___hast_2.3.4.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_hast___hast_2.3.4.tgz";
url = "https://registry.yarnpkg.com/@types/hast/-/hast-2.3.4.tgz";
sha1 = "8aa5ef92c117d20d974a82bdfb6a648b08c0bafc";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_html_minifier_terser___html_minifier_terser_5.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_html_minifier_terser___html_minifier_terser_5.1.2.tgz";
url = "https://registry.yarnpkg.com/@types/html-minifier-terser/-/html-minifier-terser-5.1.2.tgz";
sha1 = "693b316ad323ea97eed6b38ed1a3cc02b1672b57";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_http_assert___http_assert_1.5.3.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_http_assert___http_assert_1.5.3.tgz";
url = "https://registry.yarnpkg.com/@types/http-assert/-/http-assert-1.5.3.tgz";
sha1 = "ef8e3d1a8d46c387f04ab0f2e8ab8cb0c5078661";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_http_errors___http_errors_1.8.1.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_http_errors___http_errors_1.8.1.tgz";
url = "https://registry.yarnpkg.com/@types/http-errors/-/http-errors-1.8.1.tgz";
sha1 = "e81ad28a60bee0328c6d2384e029aec626f1ae67";
};
}
{
name = "_types_is_empty___is_empty_1.2.0.tgz";
path = fetchurl {
name = "_types_is_empty___is_empty_1.2.0.tgz";
url = "https://registry.yarnpkg.com/@types/is-empty/-/is-empty-1.2.0.tgz";
sha1 = "16bc578060c9b0b6953339eea906c255a375bf86";
};
}
{
name = "_types_js_yaml___js_yaml_4.0.3.tgz";
path = fetchurl {
name = "_types_js_yaml___js_yaml_4.0.3.tgz";
url = "https://registry.yarnpkg.com/@types/js-yaml/-/js-yaml-4.0.3.tgz";
sha1 = "9f33cd6fbf0d5ec575dc8c8fc69c7fec1b4eb200";
};
}
{
name = "_types_json_schema___json_schema_7.0.9.tgz";
path = fetchurl {
name = "_types_json_schema___json_schema_7.0.9.tgz";
url = "https://registry.yarnpkg.com/@types/json-schema/-/json-schema-7.0.9.tgz";
sha1 = "97edc9037ea0c38585320b28964dde3b39e4660d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_types_json5___json5_0.0.29.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_types_json5___json5_0.0.29.tgz";
url = "https://registry.yarnpkg.com/@types/json5/-/json5-0.0.29.tgz";
sha1 = "ee28707ae94e11d2b827bcbe5270bcea7f3e71ee";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "_types_keygrip___keygrip_1.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "_types_keygrip___keygrip_1.0.2.tgz";
url = "https://registry.yarnpkg.com/@types/keygrip/-/keygrip-1.0.2.tgz";
sha1 = "513abfd256d7ad0bf1ee1873606317b33b1b2a72";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "_types_koa_compose___koa_compose_3.2.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "_types_koa_compose___koa_compose_3.2.5.tgz";
url = "https://registry.yarnpkg.com/@types/koa-compose/-/koa-compose-3.2.5.tgz";
sha1 = "85eb2e80ac50be95f37ccf8c407c09bbe3468e9d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_koa___koa_2.13.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_koa___koa_2.13.4.tgz";
url = "https://registry.yarnpkg.com/@types/koa/-/koa-2.13.4.tgz";
sha1 = "10620b3f24a8027ef5cbae88b393d1b31205726b";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_ldapjs___ldapjs_1.0.11.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_ldapjs___ldapjs_1.0.11.tgz";
url = "https://registry.yarnpkg.com/@types/ldapjs/-/ldapjs-1.0.11.tgz";
sha1 = "34077176af2b06186bd54e4a38ceb6e852387fa4";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_mdast___mdast_3.0.10.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_mdast___mdast_3.0.10.tgz";
url = "https://registry.yarnpkg.com/@types/mdast/-/mdast-3.0.10.tgz";
sha1 = "4724244a82a4598884cbbe9bcfd73dff927ee8af";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
name = "_types_mime___mime_1.3.2.tgz";
path = fetchurl {
name = "_types_mime___mime_1.3.2.tgz";
url = "https://registry.yarnpkg.com/@types/mime/-/mime-1.3.2.tgz";
sha1 = "93e25bf9ee75fe0fd80b594bc4feb0e862111b5a";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_ms___ms_0.7.31.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_ms___ms_0.7.31.tgz";
url = "https://registry.yarnpkg.com/@types/ms/-/ms-0.7.31.tgz";
sha1 = "31b7ca6407128a3d2bbc27fe2d21b345397f6197";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_node___node_16.9.1.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_node___node_16.9.1.tgz";
url = "https://registry.yarnpkg.com/@types/node/-/node-16.9.1.tgz";
sha1 = "0611b37db4246c937feef529ddcc018cf8e35708";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_node___node_14.17.15.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_node___node_14.17.15.tgz";
url = "https://registry.yarnpkg.com/@types/node/-/node-14.17.15.tgz";
sha1 = "d5ebfb62a69074ebb85cbe0529ad917bb8f2bae8";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_parse5___parse5_6.0.1.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_parse5___parse5_6.0.1.tgz";
url = "https://registry.yarnpkg.com/@types/parse5/-/parse5-6.0.1.tgz";
sha1 = "f8ae4fbcd2b9ba4ff934698e28778961f9cb22ca";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_qs___qs_6.9.7.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_qs___qs_6.9.7.tgz";
url = "https://registry.yarnpkg.com/@types/qs/-/qs-6.9.7.tgz";
sha1 = "63bb7d067db107cc1e457c303bc25d511febf6cb";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_range_parser___range_parser_1.2.4.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_range_parser___range_parser_1.2.4.tgz";
url = "https://registry.yarnpkg.com/@types/range-parser/-/range-parser-1.2.4.tgz";
sha1 = "cd667bcfdd025213aafb7ca5915a932590acdcdc";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_serve_static___serve_static_1.13.10.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_serve_static___serve_static_1.13.10.tgz";
url = "https://registry.yarnpkg.com/@types/serve-static/-/serve-static-1.13.10.tgz";
sha1 = "f5e0ce8797d2d7cc5ebeda48a52c96c4fa47a8d9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_source_list_map___source_list_map_0.1.2.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_source_list_map___source_list_map_0.1.2.tgz";
url = "https://registry.yarnpkg.com/@types/source-list-map/-/source-list-map-0.1.2.tgz";
sha1 = "0078836063ffaf17412349bba364087e0ac02ec9";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_supports_color___supports_color_8.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_supports_color___supports_color_8.1.1.tgz";
url = "https://registry.yarnpkg.com/@types/supports-color/-/supports-color-8.1.1.tgz";
sha1 = "1b44b1b096479273adf7f93c75fc4ecc40a61ee4";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_tapable___tapable_1.0.8.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_tapable___tapable_1.0.8.tgz";
url = "https://registry.yarnpkg.com/@types/tapable/-/tapable-1.0.8.tgz";
sha1 = "b94a4391c85666c7b73299fd3ad79d4faa435310";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_text_table___text_table_0.2.2.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_text_table___text_table_0.2.2.tgz";
url = "https://registry.yarnpkg.com/@types/text-table/-/text-table-0.2.2.tgz";
sha1 = "774c90cfcfbc8b4b0ebb00fecbe861dc8b1e8e26";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_uglify_js___uglify_js_3.13.1.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_uglify_js___uglify_js_3.13.1.tgz";
url = "https://registry.yarnpkg.com/@types/uglify-js/-/uglify-js-3.13.1.tgz";
sha1 = "5e889e9e81e94245c75b6450600e1c5ea2878aea";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_unist___unist_2.0.6.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_unist___unist_2.0.6.tgz";
url = "https://registry.yarnpkg.com/@types/unist/-/unist-2.0.6.tgz";
sha1 = "250a7b16c3b91f672a24552ec64678eeb1d3a08d";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_webpack_sources___webpack_sources_3.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_webpack_sources___webpack_sources_3.2.0.tgz";
url = "https://registry.yarnpkg.com/@types/webpack-sources/-/webpack-sources-3.2.0.tgz";
sha1 = "16d759ba096c289034b26553d2df1bf45248d38b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_webpack___webpack_4.41.31.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_types_webpack___webpack_4.41.31.tgz";
url = "https://registry.yarnpkg.com/@types/webpack/-/webpack-4.41.31.tgz";
sha1 = "c35f252a3559ddf9c85c0d8b0b42019025e581aa";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
name = "_ungap_promise_all_settled___promise_all_settled_1.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "_ungap_promise_all_settled___promise_all_settled_1.1.2.tgz";
url = "https://registry.yarnpkg.com/@ungap/promise-all-settled/-/promise-all-settled-1.1.2.tgz";
sha1 = "aa58042711d6e3275dd37dc597e5d31e8c290a44";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_ast___ast_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_ast___ast_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/ast/-/ast-1.9.0.tgz";
sha1 = "bd850604b4042459a5a41cd7d338cbed695ed964";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_floating_point_hex_parser___floating_point_hex_parser_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_floating_point_hex_parser___floating_point_hex_parser_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.9.0.tgz";
sha1 = "3c3d3b271bddfc84deb00f71344438311d52ffb4";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_api_error___helper_api_error_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_api_error___helper_api_error_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/helper-api-error/-/helper-api-error-1.9.0.tgz";
sha1 = "203f676e333b96c9da2eeab3ccef33c45928b6a2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_buffer___helper_buffer_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_buffer___helper_buffer_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/helper-buffer/-/helper-buffer-1.9.0.tgz";
sha1 = "a1442d269c5feb23fcbc9ef759dac3547f29de00";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_code_frame___helper_code_frame_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_code_frame___helper_code_frame_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/helper-code-frame/-/helper-code-frame-1.9.0.tgz";
sha1 = "647f8892cd2043a82ac0c8c5e75c36f1d9159f27";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_fsm___helper_fsm_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_fsm___helper_fsm_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/helper-fsm/-/helper-fsm-1.9.0.tgz";
sha1 = "c05256b71244214671f4b08ec108ad63b70eddb8";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_module_context___helper_module_context_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_module_context___helper_module_context_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/helper-module-context/-/helper-module-context-1.9.0.tgz";
sha1 = "25d8884b76839871a08a6c6f806c3979ef712f07";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_wasm_bytecode___helper_wasm_bytecode_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_wasm_bytecode___helper_wasm_bytecode_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.9.0.tgz";
sha1 = "4fed8beac9b8c14f8c58b70d124d549dd1fe5790";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_wasm_section___helper_wasm_section_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_helper_wasm_section___helper_wasm_section_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.9.0.tgz";
sha1 = "5a4138d5a6292ba18b04c5ae49717e4167965346";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_ieee754___ieee754_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_ieee754___ieee754_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/ieee754/-/ieee754-1.9.0.tgz";
sha1 = "15c7a0fbaae83fb26143bbacf6d6df1702ad39e4";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_leb128___leb128_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_leb128___leb128_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/leb128/-/leb128-1.9.0.tgz";
sha1 = "f19ca0b76a6dc55623a09cffa769e838fa1e1c95";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_utf8___utf8_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_utf8___utf8_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/utf8/-/utf8-1.9.0.tgz";
sha1 = "04d33b636f78e6a6813227e82402f7637b6229ab";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_wasm_edit___wasm_edit_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_wasm_edit___wasm_edit_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/wasm-edit/-/wasm-edit-1.9.0.tgz";
sha1 = "3fe6d79d3f0f922183aa86002c42dd256cfee9cf";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_wasm_gen___wasm_gen_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_wasm_gen___wasm_gen_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/wasm-gen/-/wasm-gen-1.9.0.tgz";
sha1 = "50bc70ec68ded8e2763b01a1418bf43491a7a49c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_wasm_opt___wasm_opt_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_wasm_opt___wasm_opt_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/wasm-opt/-/wasm-opt-1.9.0.tgz";
sha1 = "2211181e5b31326443cc8112eb9f0b9028721a61";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_wasm_parser___wasm_parser_1.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "_webassemblyjs_wasm_parser___wasm_parser_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/wasm-parser/-/wasm-parser-1.9.0.tgz";
sha1 = "9d48e44826df4a6598294aa6c87469d642fff65e";
};
}
{
name = "_webassemblyjs_wast_parser___wast_parser_1.9.0.tgz";
path = fetchurl {
name = "_webassemblyjs_wast_parser___wast_parser_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/wast-parser/-/wast-parser-1.9.0.tgz";
sha1 = "3031115d79ac5bd261556cecc3fa90a3ef451914";
};
}
{
name = "_webassemblyjs_wast_printer___wast_printer_1.9.0.tgz";
path = fetchurl {
name = "_webassemblyjs_wast_printer___wast_printer_1.9.0.tgz";
url = "https://registry.yarnpkg.com/@webassemblyjs/wast-printer/-/wast-printer-1.9.0.tgz";
sha1 = "4935d54c85fef637b00ce9f52377451d00d47899";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_webpack_cli_configtest___configtest_1.0.4.tgz";
path = fetchurl {
name = "_webpack_cli_configtest___configtest_1.0.4.tgz";
url = "https://registry.yarnpkg.com/@webpack-cli/configtest/-/configtest-1.0.4.tgz";
sha1 = "f03ce6311c0883a83d04569e2c03c6238316d2aa";
};
}
{
name = "_webpack_cli_info___info_1.3.0.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_webpack_cli_info___info_1.3.0.tgz";
url = "https://registry.yarnpkg.com/@webpack-cli/info/-/info-1.3.0.tgz";
sha1 = "9d78a31101a960997a4acd41ffd9b9300627fe2b";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_webpack_cli_serve___serve_1.5.2.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_webpack_cli_serve___serve_1.5.2.tgz";
url = "https://registry.yarnpkg.com/@webpack-cli/serve/-/serve-1.5.2.tgz";
sha1 = "ea584b637ff63c5a477f6f21604b5a205b72c9ec";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_xmldom_xmldom___xmldom_0.7.4.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "_xmldom_xmldom___xmldom_0.7.4.tgz";
url = "https://registry.yarnpkg.com/@xmldom/xmldom/-/xmldom-0.7.4.tgz";
sha1 = "93b2f9486c88b6464e97f76c9ab49b0a548fbe57";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "_xtuc_ieee754___ieee754_1.2.0.tgz";
path = fetchurl {
name = "_xtuc_ieee754___ieee754_1.2.0.tgz";
url = "https://registry.yarnpkg.com/@xtuc/ieee754/-/ieee754-1.2.0.tgz";
sha1 = "eef014a3145ae477a1cbc00cd1e552336dceb790";
};
}
{
name = "_xtuc_long___long_4.2.2.tgz";
path = fetchurl {
name = "_xtuc_long___long_4.2.2.tgz";
url = "https://registry.yarnpkg.com/@xtuc/long/-/long-4.2.2.tgz";
sha1 = "d291c6a4e97989b5c61d9acf396ae4fe133a718d";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "_zxing_text_encoding___text_encoding_0.9.0.tgz";
path = fetchurl {
name = "_zxing_text_encoding___text_encoding_0.9.0.tgz";
url = "https://registry.yarnpkg.com/@zxing/text-encoding/-/text-encoding-0.9.0.tgz";
sha1 = "fb50ffabc6c7c66a0c96b4c03e3d9be74864b70b";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "Idle.js";
path =
let
repo = fetchgit {
url = "https://github.com/shawnmclean/Idle.js";
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
rev = "2b57cc6e49d177b7ddce0cca00ef5cbe07453541";
sha256 = "194m65wax0q2iqc1237iix6gsyyzjjmbifk4lm0bni7x2qa5alrx";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
in
hedgedoc: fix eval with `allowAliases = false`
2021-09-18 23:23:28 +01:00
runCommand "Idle.js" { buildInputs = [gnutar]; } ''
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
# Set u+w because tar-fs can't unpack archives with read-only dirs
# https://github.com/mafintosh/tar-fs/issues/79
tar cf $out --mode u+w -C ${repo} .
'';
}
{
name = "JSV___JSV_4.0.2.tgz";
path = fetchurl {
name = "JSV___JSV_4.0.2.tgz";
url = "https://registry.yarnpkg.com/JSV/-/JSV-4.0.2.tgz";
sha1 = "d077f6825571f82132f9dffaed587b4029feff57";
};
}
{
name = "abbrev___abbrev_1.1.1.tgz";
path = fetchurl {
name = "abbrev___abbrev_1.1.1.tgz";
url = "https://registry.yarnpkg.com/abbrev/-/abbrev-1.1.1.tgz";
sha1 = "f8f2c887ad10bf67f634f005b6987fed3179aac8";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "abcjs___abcjs_5.10.3.tgz";
path = fetchurl {
name = "abcjs___abcjs_5.10.3.tgz";
url = "https://registry.yarnpkg.com/abcjs/-/abcjs-5.10.3.tgz";
sha1 = "294702140ec1caa292859ba9d2af0452f7e9e046";
};
}
{
name = "abcjs___abcjs_5.11.0.tgz";
path = fetchurl {
name = "abcjs___abcjs_5.11.0.tgz";
url = "https://registry.yarnpkg.com/abcjs/-/abcjs-5.11.0.tgz";
sha1 = "397592ea6a56948aee64a8364f9a7a589e254300";
};
}
{
name = "abcjs___abcjs_5.12.0.tgz";
path = fetchurl {
name = "abcjs___abcjs_5.12.0.tgz";
url = "https://registry.yarnpkg.com/abcjs/-/abcjs-5.12.0.tgz";
sha1 = "06fec076d570821309b0a12598cd356cd589eb08";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "abstract_logging___abstract_logging_2.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "abstract_logging___abstract_logging_2.0.1.tgz";
url = "https://registry.yarnpkg.com/abstract-logging/-/abstract-logging-2.0.1.tgz";
sha1 = "6b0c371df212db7129b57d2e7fcf282b8bf1c839";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "accepts___accepts_1.3.7.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "accepts___accepts_1.3.7.tgz";
url = "https://registry.yarnpkg.com/accepts/-/accepts-1.3.7.tgz";
sha1 = "531bc726517a3b2b41f850021c6cc15eaab507cd";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "acorn_jsx___acorn_jsx_5.3.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "acorn_jsx___acorn_jsx_5.3.2.tgz";
url = "https://registry.yarnpkg.com/acorn-jsx/-/acorn-jsx-5.3.2.tgz";
sha1 = "7ed5bb55908b3b2f1bc55c6af1653bada7f07937";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "acorn___acorn_6.4.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "acorn___acorn_6.4.2.tgz";
url = "https://registry.yarnpkg.com/acorn/-/acorn-6.4.2.tgz";
sha1 = "35866fd710528e92de10cf06016498e47e39e1e6";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "acorn___acorn_7.4.1.tgz";
path = fetchurl {
name = "acorn___acorn_7.4.1.tgz";
url = "https://registry.yarnpkg.com/acorn/-/acorn-7.4.1.tgz";
sha1 = "feaed255973d2e77555b83dbc08851a6c63520fa";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "after___after_0.8.2.tgz";
path = fetchurl {
name = "after___after_0.8.2.tgz";
url = "https://registry.yarnpkg.com/after/-/after-0.8.2.tgz";
sha1 = "fedb394f9f0e02aa9768e702bda23b505fae7e1f";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "aggregate_error___aggregate_error_3.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "aggregate_error___aggregate_error_3.1.0.tgz";
url = "https://registry.yarnpkg.com/aggregate-error/-/aggregate-error-3.1.0.tgz";
sha1 = "92670ff50f5359bdb7a3e0d40d0ec30c5737687a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ajv_errors___ajv_errors_1.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ajv_errors___ajv_errors_1.0.1.tgz";
url = "https://registry.yarnpkg.com/ajv-errors/-/ajv-errors-1.0.1.tgz";
sha1 = "f35986aceb91afadec4102fbd85014950cefa64d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ajv_keywords___ajv_keywords_3.5.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ajv_keywords___ajv_keywords_3.5.2.tgz";
url = "https://registry.yarnpkg.com/ajv-keywords/-/ajv-keywords-3.5.2.tgz";
sha1 = "31f29da5ab6e00d1c2d329acf7b5929614d5014d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ajv___ajv_6.12.6.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ajv___ajv_6.12.6.tgz";
url = "https://registry.yarnpkg.com/ajv/-/ajv-6.12.6.tgz";
sha1 = "baf5a62e802b07d977034586f8c3baf5adf26df4";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "ajv___ajv_8.6.3.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "ajv___ajv_8.6.3.tgz";
url = "https://registry.yarnpkg.com/ajv/-/ajv-8.6.3.tgz";
sha1 = "11a66527761dc3e9a3845ea775d2d3c0414e8764";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "alphanum_sort___alphanum_sort_1.0.2.tgz";
path = fetchurl {
name = "alphanum_sort___alphanum_sort_1.0.2.tgz";
url = "https://registry.yarnpkg.com/alphanum-sort/-/alphanum-sort-1.0.2.tgz";
sha1 = "97a1119649b211ad33691d9f9f486a8ec9fbe0a3";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "ansi_colors___ansi_colors_4.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "ansi_colors___ansi_colors_4.1.1.tgz";
url = "https://registry.yarnpkg.com/ansi-colors/-/ansi-colors-4.1.1.tgz";
sha1 = "cbb9ae256bf750af1eab344f229aa27fe94ba348";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "ansi_regex___ansi_regex_2.1.1.tgz";
path = fetchurl {
name = "ansi_regex___ansi_regex_2.1.1.tgz";
url = "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-2.1.1.tgz";
sha1 = "c3b33ab5ee360d86e0e628f0468ae7ef27d654df";
};
}
{
name = "ansi_regex___ansi_regex_3.0.0.tgz";
path = fetchurl {
name = "ansi_regex___ansi_regex_3.0.0.tgz";
url = "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-3.0.0.tgz";
sha1 = "ed0317c322064f79466c02966bddb605ab37d998";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "ansi_regex___ansi_regex_5.0.0.tgz";
path = fetchurl {
name = "ansi_regex___ansi_regex_5.0.0.tgz";
url = "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-5.0.0.tgz";
sha1 = "388539f55179bf39339c81af30a654d69f87cb75";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "ansi_regex___ansi_regex_6.0.1.tgz";
path = fetchurl {
name = "ansi_regex___ansi_regex_6.0.1.tgz";
url = "https://registry.yarnpkg.com/ansi-regex/-/ansi-regex-6.0.1.tgz";
sha1 = "3183e38fae9a65d7cb5e53945cd5897d0260a06a";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "ansi_styles___ansi_styles_2.2.1.tgz";
path = fetchurl {
name = "ansi_styles___ansi_styles_2.2.1.tgz";
url = "https://registry.yarnpkg.com/ansi-styles/-/ansi-styles-2.2.1.tgz";
sha1 = "b432dd3358b634cf75e1e4664368240533c1ddbe";
};
}
{
name = "ansi_styles___ansi_styles_3.2.1.tgz";
path = fetchurl {
name = "ansi_styles___ansi_styles_3.2.1.tgz";
url = "https://registry.yarnpkg.com/ansi-styles/-/ansi-styles-3.2.1.tgz";
sha1 = "41fbb20243e50b12be0f04b8dedbf07520ce841d";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ansi_styles___ansi_styles_4.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ansi_styles___ansi_styles_4.3.0.tgz";
url = "https://registry.yarnpkg.com/ansi-styles/-/ansi-styles-4.3.0.tgz";
sha1 = "edd803628ae71c04c85ae7a0906edad34b648937";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ansi_styles___ansi_styles_1.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ansi_styles___ansi_styles_1.0.0.tgz";
url = "https://registry.yarnpkg.com/ansi-styles/-/ansi-styles-1.0.0.tgz";
sha1 = "cb102df1c56f5123eab8b67cd7b98027a0279178";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
name = "any_promise___any_promise_1.3.0.tgz";
path = fetchurl {
name = "any_promise___any_promise_1.3.0.tgz";
url = "https://registry.yarnpkg.com/any-promise/-/any-promise-1.3.0.tgz";
sha1 = "abc6afeedcea52e809cdc0376aed3ce39635d17f";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "anymatch___anymatch_1.3.2.tgz";
path = fetchurl {
name = "anymatch___anymatch_1.3.2.tgz";
url = "https://registry.yarnpkg.com/anymatch/-/anymatch-1.3.2.tgz";
sha1 = "553dcb8f91e3c889845dfdba34c77721b90b9d7a";
};
}
{
name = "anymatch___anymatch_2.0.0.tgz";
path = fetchurl {
name = "anymatch___anymatch_2.0.0.tgz";
url = "https://registry.yarnpkg.com/anymatch/-/anymatch-2.0.0.tgz";
sha1 = "bcb24b4f37934d9aa7ac17b4adaf89e7c76ef2eb";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "anymatch___anymatch_3.1.2.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "anymatch___anymatch_3.1.2.tgz";
url = "https://registry.yarnpkg.com/anymatch/-/anymatch-3.1.2.tgz";
sha1 = "c0557c096af32f106198f4f4e2a383537e378716";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "aproba___aproba_1.2.0.tgz";
path = fetchurl {
name = "aproba___aproba_1.2.0.tgz";
url = "https://registry.yarnpkg.com/aproba/-/aproba-1.2.0.tgz";
sha1 = "6802e6264efd18c790a1b0d517f0f2627bf2c94a";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "archiver_utils___archiver_utils_2.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "archiver_utils___archiver_utils_2.1.0.tgz";
url = "https://registry.yarnpkg.com/archiver-utils/-/archiver-utils-2.1.0.tgz";
sha1 = "e8a460e94b693c3e3da182a098ca6285ba9249e2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "archiver___archiver_5.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "archiver___archiver_5.3.0.tgz";
url = "https://registry.yarnpkg.com/archiver/-/archiver-5.3.0.tgz";
sha1 = "dd3e097624481741df626267564f7dd8640a45ba";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "are_we_there_yet___are_we_there_yet_1.1.7.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "are_we_there_yet___are_we_there_yet_1.1.7.tgz";
url = "https://registry.yarnpkg.com/are-we-there-yet/-/are-we-there-yet-1.1.7.tgz";
sha1 = "b15474a932adab4ff8a50d9adfa7e4e926f21146";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "argparse___argparse_1.0.10.tgz";
path = fetchurl {
name = "argparse___argparse_1.0.10.tgz";
url = "https://registry.yarnpkg.com/argparse/-/argparse-1.0.10.tgz";
sha1 = "bcd6791ea5ae09725e17e5ad988134cd40b3d911";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "argparse___argparse_2.0.1.tgz";
path = fetchurl {
name = "argparse___argparse_2.0.1.tgz";
url = "https://registry.yarnpkg.com/argparse/-/argparse-2.0.1.tgz";
sha1 = "246f50f3ca78a3240f6c997e8a9bd1eac49e4b38";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "arr_diff___arr_diff_2.0.0.tgz";
path = fetchurl {
name = "arr_diff___arr_diff_2.0.0.tgz";
url = "https://registry.yarnpkg.com/arr-diff/-/arr-diff-2.0.0.tgz";
sha1 = "8f3b827f955a8bd669697e4a4256ac3ceae356cf";
};
}
{
name = "arr_diff___arr_diff_4.0.0.tgz";
path = fetchurl {
name = "arr_diff___arr_diff_4.0.0.tgz";
url = "https://registry.yarnpkg.com/arr-diff/-/arr-diff-4.0.0.tgz";
sha1 = "d6461074febfec71e7e15235761a329a5dc7c520";
};
}
{
name = "arr_flatten___arr_flatten_1.1.0.tgz";
path = fetchurl {
name = "arr_flatten___arr_flatten_1.1.0.tgz";
url = "https://registry.yarnpkg.com/arr-flatten/-/arr-flatten-1.1.0.tgz";
sha1 = "36048bbff4e7b47e136644316c99669ea5ae91f1";
};
}
{
name = "arr_union___arr_union_3.1.0.tgz";
path = fetchurl {
name = "arr_union___arr_union_3.1.0.tgz";
url = "https://registry.yarnpkg.com/arr-union/-/arr-union-3.1.0.tgz";
sha1 = "e39b09aea9def866a8f206e288af63919bae39c4";
};
}
{
name = "array_flatten___array_flatten_1.1.1.tgz";
path = fetchurl {
name = "array_flatten___array_flatten_1.1.1.tgz";
url = "https://registry.yarnpkg.com/array-flatten/-/array-flatten-1.1.1.tgz";
sha1 = "9a5f699051b1e7073328f2a008968b64ea2955d2";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "array_includes___array_includes_3.1.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "array_includes___array_includes_3.1.3.tgz";
url = "https://registry.yarnpkg.com/array-includes/-/array-includes-3.1.3.tgz";
sha1 = "c7f619b382ad2afaf5326cddfdc0afc61af7690a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "array_union___array_union_2.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "array_union___array_union_2.1.0.tgz";
url = "https://registry.yarnpkg.com/array-union/-/array-union-2.1.0.tgz";
sha1 = "b798420adbeb1de828d84acd8a2e23d3efe85e8d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "array_unique___array_unique_0.2.1.tgz";
path = fetchurl {
name = "array_unique___array_unique_0.2.1.tgz";
url = "https://registry.yarnpkg.com/array-unique/-/array-unique-0.2.1.tgz";
sha1 = "a1d97ccafcbc2625cc70fadceb36a50c58b01a53";
};
}
{
name = "array_unique___array_unique_0.3.2.tgz";
path = fetchurl {
name = "array_unique___array_unique_0.3.2.tgz";
url = "https://registry.yarnpkg.com/array-unique/-/array-unique-0.3.2.tgz";
sha1 = "a894b75d4bc4f6cd679ef3244a9fd8f46ae2d428";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "array.prototype.flat___array.prototype.flat_1.2.4.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "array.prototype.flat___array.prototype.flat_1.2.4.tgz";
url = "https://registry.yarnpkg.com/array.prototype.flat/-/array.prototype.flat-1.2.4.tgz";
sha1 = "6ef638b43312bd401b4c6199fdec7e2dc9e9a123";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "arraybuffer.slice___arraybuffer.slice_0.0.7.tgz";
path = fetchurl {
name = "arraybuffer.slice___arraybuffer.slice_0.0.7.tgz";
url = "https://registry.yarnpkg.com/arraybuffer.slice/-/arraybuffer.slice-0.0.7.tgz";
sha1 = "3bbc4275dd584cc1b10809b89d4e8b63a69e7675";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "asn1.js___asn1.js_5.4.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "asn1.js___asn1.js_5.4.1.tgz";
url = "https://registry.yarnpkg.com/asn1.js/-/asn1.js-5.4.1.tgz";
sha1 = "11a980b84ebb91781ce35b0fdc2ee294e3783f07";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "asn1___asn1_0.2.4.tgz";
path = fetchurl {
name = "asn1___asn1_0.2.4.tgz";
url = "https://registry.yarnpkg.com/asn1/-/asn1-0.2.4.tgz";
sha1 = "8d2475dfab553bb33e77b54e59e880bb8ce23136";
};
}
{
name = "assert_plus___assert_plus_1.0.0.tgz";
path = fetchurl {
name = "assert_plus___assert_plus_1.0.0.tgz";
url = "https://registry.yarnpkg.com/assert-plus/-/assert-plus-1.0.0.tgz";
sha1 = "f12e0f3c5d77b0b1cdd9146942e4e96c1e4dd525";
};
}
{
name = "assert___assert_1.5.0.tgz";
path = fetchurl {
name = "assert___assert_1.5.0.tgz";
url = "https://registry.yarnpkg.com/assert/-/assert-1.5.0.tgz";
sha1 = "55c109aaf6e0aefdb3dc4b71240c70bf574b18eb";
};
}
{
name = "assign_symbols___assign_symbols_1.0.0.tgz";
path = fetchurl {
name = "assign_symbols___assign_symbols_1.0.0.tgz";
url = "https://registry.yarnpkg.com/assign-symbols/-/assign-symbols-1.0.0.tgz";
sha1 = "59667f41fadd4f20ccbc2bb96b8d4f7f78ec0367";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "astral_regex___astral_regex_2.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "astral_regex___astral_regex_2.0.0.tgz";
url = "https://registry.yarnpkg.com/astral-regex/-/astral-regex-2.0.0.tgz";
sha1 = "483143c567aeed4785759c0865786dc77d7d2e31";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "async_each___async_each_1.0.3.tgz";
path = fetchurl {
name = "async_each___async_each_1.0.3.tgz";
url = "https://registry.yarnpkg.com/async-each/-/async-each-1.0.3.tgz";
sha1 = "b727dbf87d7651602f06f4d4ac387f47d91b0cbf";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "async___async_0.9.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "async___async_0.9.2.tgz";
url = "https://registry.yarnpkg.com/async/-/async-0.9.2.tgz";
sha1 = "aea74d5e61c1f899613bf64bda66d4c78f2fd17d";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "async___async_1.5.2.tgz";
path = fetchurl {
name = "async___async_1.5.2.tgz";
url = "https://registry.yarnpkg.com/async/-/async-1.5.2.tgz";
sha1 = "ec6a61ae56480c0c3cb241c95618e20892f9672a";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "async___async_3.2.1.tgz";
path = fetchurl {
name = "async___async_3.2.1.tgz";
url = "https://registry.yarnpkg.com/async/-/async-3.2.1.tgz";
sha1 = "d3274ec66d107a47476a4c49136aacdb00665fc8";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "asynckit___asynckit_0.4.0.tgz";
path = fetchurl {
name = "asynckit___asynckit_0.4.0.tgz";
url = "https://registry.yarnpkg.com/asynckit/-/asynckit-0.4.0.tgz";
sha1 = "c79ed97f7f34cb8f2ba1bc9790bcc366474b4b79";
};
}
{
name = "atob___atob_2.1.2.tgz";
path = fetchurl {
name = "atob___atob_2.1.2.tgz";
url = "https://registry.yarnpkg.com/atob/-/atob-2.1.2.tgz";
sha1 = "6d9517eb9e030d2436666651e86bd9f6f13533c9";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "available_typed_arrays___available_typed_arrays_1.0.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "available_typed_arrays___available_typed_arrays_1.0.5.tgz";
url = "https://registry.yarnpkg.com/available-typed-arrays/-/available-typed-arrays-1.0.5.tgz";
sha1 = "92f95616501069d07d10edb2fc37d3e1c65123b7";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "aws_sdk___aws_sdk_2.988.0.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "aws_sdk___aws_sdk_2.988.0.tgz";
url = "https://registry.yarnpkg.com/aws-sdk/-/aws-sdk-2.988.0.tgz";
sha1 = "46538de14c4c5cd3d7718badedffd31471a0c0e9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "aws_sign2___aws_sign2_0.7.0.tgz";
path = fetchurl {
name = "aws_sign2___aws_sign2_0.7.0.tgz";
url = "https://registry.yarnpkg.com/aws-sign2/-/aws-sign2-0.7.0.tgz";
sha1 = "b46e890934a9591f2d2f6f86d7e6a9f1b3fe76a8";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "aws4___aws4_1.11.0.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "aws4___aws4_1.11.0.tgz";
url = "https://registry.yarnpkg.com/aws4/-/aws4-1.11.0.tgz";
sha1 = "d61f46d83b2519250e2784daf5b09479a8b41c59";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "axios___axios_0.21.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "axios___axios_0.21.4.tgz";
url = "https://registry.yarnpkg.com/axios/-/axios-0.21.4.tgz";
sha1 = "c67b90dc0568e5c1cf2b0b858c43ba28e2eda575";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "azure_storage___azure_storage_2.10.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "azure_storage___azure_storage_2.10.4.tgz";
url = "https://registry.yarnpkg.com/azure-storage/-/azure-storage-2.10.4.tgz";
sha1 = "c481d207eabc05f57f019b209f7faa8737435104";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "babel_cli___babel_cli_6.26.0.tgz";
path = fetchurl {
name = "babel_cli___babel_cli_6.26.0.tgz";
url = "https://registry.yarnpkg.com/babel-cli/-/babel-cli-6.26.0.tgz";
sha1 = "502ab54874d7db88ad00b887a06383ce03d002f1";
};
}
{
name = "babel_code_frame___babel_code_frame_6.26.0.tgz";
path = fetchurl {
name = "babel_code_frame___babel_code_frame_6.26.0.tgz";
url = "https://registry.yarnpkg.com/babel-code-frame/-/babel-code-frame-6.26.0.tgz";
sha1 = "63fd43f7dc1e3bb7ce35947db8fe369a3f58c74b";
};
}
{
name = "babel_core___babel_core_6.26.3.tgz";
path = fetchurl {
name = "babel_core___babel_core_6.26.3.tgz";
url = "https://registry.yarnpkg.com/babel-core/-/babel-core-6.26.3.tgz";
sha1 = "b2e2f09e342d0f0c88e2f02e067794125e75c207";
};
}
{
name = "babel_generator___babel_generator_6.26.1.tgz";
path = fetchurl {
name = "babel_generator___babel_generator_6.26.1.tgz";
url = "https://registry.yarnpkg.com/babel-generator/-/babel-generator-6.26.1.tgz";
sha1 = "1844408d3b8f0d35a404ea7ac180f087a601bd90";
};
}
{
name = "babel_helper_builder_binary_assignment_operator_visitor___babel_helper_builder_binary_assignment_operator_visitor_6.24.1.tgz";
path = fetchurl {
name = "babel_helper_builder_binary_assignment_operator_visitor___babel_helper_builder_binary_assignment_operator_visitor_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-helper-builder-binary-assignment-operator-visitor/-/babel-helper-builder-binary-assignment-operator-visitor-6.24.1.tgz";
sha1 = "cce4517ada356f4220bcae8a02c2b346f9a56664";
};
}
{
name = "babel_helper_call_delegate___babel_helper_call_delegate_6.24.1.tgz";
path = fetchurl {
name = "babel_helper_call_delegate___babel_helper_call_delegate_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-helper-call-delegate/-/babel-helper-call-delegate-6.24.1.tgz";
sha1 = "ece6aacddc76e41c3461f88bfc575bd0daa2df8d";
};
}
{
name = "babel_helper_define_map___babel_helper_define_map_6.26.0.tgz";
path = fetchurl {
name = "babel_helper_define_map___babel_helper_define_map_6.26.0.tgz";
url = "https://registry.yarnpkg.com/babel-helper-define-map/-/babel-helper-define-map-6.26.0.tgz";
sha1 = "a5f56dab41a25f97ecb498c7ebaca9819f95be5f";
};
}
{
name = "babel_helper_explode_assignable_expression___babel_helper_explode_assignable_expression_6.24.1.tgz";
path = fetchurl {
name = "babel_helper_explode_assignable_expression___babel_helper_explode_assignable_expression_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-helper-explode-assignable-expression/-/babel-helper-explode-assignable-expression-6.24.1.tgz";
sha1 = "f25b82cf7dc10433c55f70592d5746400ac22caa";
};
}
{
name = "babel_helper_function_name___babel_helper_function_name_6.24.1.tgz";
path = fetchurl {
name = "babel_helper_function_name___babel_helper_function_name_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-helper-function-name/-/babel-helper-function-name-6.24.1.tgz";
sha1 = "d3475b8c03ed98242a25b48351ab18399d3580a9";
};
}
{
name = "babel_helper_get_function_arity___babel_helper_get_function_arity_6.24.1.tgz";
path = fetchurl {
name = "babel_helper_get_function_arity___babel_helper_get_function_arity_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-helper-get-function-arity/-/babel-helper-get-function-arity-6.24.1.tgz";
sha1 = "8f7782aa93407c41d3aa50908f89b031b1b6853d";
};
}
{
name = "babel_helper_hoist_variables___babel_helper_hoist_variables_6.24.1.tgz";
path = fetchurl {
name = "babel_helper_hoist_variables___babel_helper_hoist_variables_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-helper-hoist-variables/-/babel-helper-hoist-variables-6.24.1.tgz";
sha1 = "1ecb27689c9d25513eadbc9914a73f5408be7a76";
};
}
{
name = "babel_helper_optimise_call_expression___babel_helper_optimise_call_expression_6.24.1.tgz";
path = fetchurl {
name = "babel_helper_optimise_call_expression___babel_helper_optimise_call_expression_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-helper-optimise-call-expression/-/babel-helper-optimise-call-expression-6.24.1.tgz";
sha1 = "f7a13427ba9f73f8f4fa993c54a97882d1244257";
};
}
{
name = "babel_helper_regex___babel_helper_regex_6.26.0.tgz";
path = fetchurl {
name = "babel_helper_regex___babel_helper_regex_6.26.0.tgz";
url = "https://registry.yarnpkg.com/babel-helper-regex/-/babel-helper-regex-6.26.0.tgz";
sha1 = "325c59f902f82f24b74faceed0363954f6495e72";
};
}
{
name = "babel_helper_remap_async_to_generator___babel_helper_remap_async_to_generator_6.24.1.tgz";
path = fetchurl {
name = "babel_helper_remap_async_to_generator___babel_helper_remap_async_to_generator_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-helper-remap-async-to-generator/-/babel-helper-remap-async-to-generator-6.24.1.tgz";
sha1 = "5ec581827ad723fecdd381f1c928390676e4551b";
};
}
{
name = "babel_helper_replace_supers___babel_helper_replace_supers_6.24.1.tgz";
path = fetchurl {
name = "babel_helper_replace_supers___babel_helper_replace_supers_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-helper-replace-supers/-/babel-helper-replace-supers-6.24.1.tgz";
sha1 = "bf6dbfe43938d17369a213ca8a8bf74b6a90ab1a";
};
}
{
name = "babel_helpers___babel_helpers_6.24.1.tgz";
path = fetchurl {
name = "babel_helpers___babel_helpers_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-helpers/-/babel-helpers-6.24.1.tgz";
sha1 = "3471de9caec388e5c850e597e58a26ddf37602b2";
};
}
{
name = "babel_loader___babel_loader_7.1.5.tgz";
path = fetchurl {
name = "babel_loader___babel_loader_7.1.5.tgz";
url = "https://registry.yarnpkg.com/babel-loader/-/babel-loader-7.1.5.tgz";
sha1 = "e3ee0cd7394aa557e013b02d3e492bfd07aa6d68";
};
}
{
name = "babel_messages___babel_messages_6.23.0.tgz";
path = fetchurl {
name = "babel_messages___babel_messages_6.23.0.tgz";
url = "https://registry.yarnpkg.com/babel-messages/-/babel-messages-6.23.0.tgz";
sha1 = "f3cdf4703858035b2a2951c6ec5edf6c62f2630e";
};
}
{
name = "babel_plugin_check_es2015_constants___babel_plugin_check_es2015_constants_6.22.0.tgz";
path = fetchurl {
name = "babel_plugin_check_es2015_constants___babel_plugin_check_es2015_constants_6.22.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-check-es2015-constants/-/babel-plugin-check-es2015-constants-6.22.0.tgz";
sha1 = "35157b101426fd2ffd3da3f75c7d1e91835bbf8a";
};
}
{
name = "babel_plugin_syntax_async_functions___babel_plugin_syntax_async_functions_6.13.0.tgz";
path = fetchurl {
name = "babel_plugin_syntax_async_functions___babel_plugin_syntax_async_functions_6.13.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-syntax-async-functions/-/babel-plugin-syntax-async-functions-6.13.0.tgz";
sha1 = "cad9cad1191b5ad634bf30ae0872391e0647be95";
};
}
{
name = "babel_plugin_syntax_exponentiation_operator___babel_plugin_syntax_exponentiation_operator_6.13.0.tgz";
path = fetchurl {
name = "babel_plugin_syntax_exponentiation_operator___babel_plugin_syntax_exponentiation_operator_6.13.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-syntax-exponentiation-operator/-/babel-plugin-syntax-exponentiation-operator-6.13.0.tgz";
sha1 = "9ee7e8337290da95288201a6a57f4170317830de";
};
}
{
name = "babel_plugin_syntax_trailing_function_commas___babel_plugin_syntax_trailing_function_commas_6.22.0.tgz";
path = fetchurl {
name = "babel_plugin_syntax_trailing_function_commas___babel_plugin_syntax_trailing_function_commas_6.22.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-syntax-trailing-function-commas/-/babel-plugin-syntax-trailing-function-commas-6.22.0.tgz";
sha1 = "ba0360937f8d06e40180a43fe0d5616fff532cf3";
};
}
{
name = "babel_plugin_transform_async_to_generator___babel_plugin_transform_async_to_generator_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_async_to_generator___babel_plugin_transform_async_to_generator_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-async-to-generator/-/babel-plugin-transform-async-to-generator-6.24.1.tgz";
sha1 = "6536e378aff6cb1d5517ac0e40eb3e9fc8d08761";
};
}
{
name = "babel_plugin_transform_es2015_arrow_functions___babel_plugin_transform_es2015_arrow_functions_6.22.0.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_arrow_functions___babel_plugin_transform_es2015_arrow_functions_6.22.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-arrow-functions/-/babel-plugin-transform-es2015-arrow-functions-6.22.0.tgz";
sha1 = "452692cb711d5f79dc7f85e440ce41b9f244d221";
};
}
{
name = "babel_plugin_transform_es2015_block_scoped_functions___babel_plugin_transform_es2015_block_scoped_functions_6.22.0.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_block_scoped_functions___babel_plugin_transform_es2015_block_scoped_functions_6.22.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-block-scoped-functions/-/babel-plugin-transform-es2015-block-scoped-functions-6.22.0.tgz";
sha1 = "bbc51b49f964d70cb8d8e0b94e820246ce3a6141";
};
}
{
name = "babel_plugin_transform_es2015_block_scoping___babel_plugin_transform_es2015_block_scoping_6.26.0.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_block_scoping___babel_plugin_transform_es2015_block_scoping_6.26.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-block-scoping/-/babel-plugin-transform-es2015-block-scoping-6.26.0.tgz";
sha1 = "d70f5299c1308d05c12f463813b0a09e73b1895f";
};
}
{
name = "babel_plugin_transform_es2015_classes___babel_plugin_transform_es2015_classes_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_classes___babel_plugin_transform_es2015_classes_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-classes/-/babel-plugin-transform-es2015-classes-6.24.1.tgz";
sha1 = "5a4c58a50c9c9461e564b4b2a3bfabc97a2584db";
};
}
{
name = "babel_plugin_transform_es2015_computed_properties___babel_plugin_transform_es2015_computed_properties_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_computed_properties___babel_plugin_transform_es2015_computed_properties_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-computed-properties/-/babel-plugin-transform-es2015-computed-properties-6.24.1.tgz";
sha1 = "6fe2a8d16895d5634f4cd999b6d3480a308159b3";
};
}
{
name = "babel_plugin_transform_es2015_destructuring___babel_plugin_transform_es2015_destructuring_6.23.0.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_destructuring___babel_plugin_transform_es2015_destructuring_6.23.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-destructuring/-/babel-plugin-transform-es2015-destructuring-6.23.0.tgz";
sha1 = "997bb1f1ab967f682d2b0876fe358d60e765c56d";
};
}
{
name = "babel_plugin_transform_es2015_duplicate_keys___babel_plugin_transform_es2015_duplicate_keys_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_duplicate_keys___babel_plugin_transform_es2015_duplicate_keys_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-duplicate-keys/-/babel-plugin-transform-es2015-duplicate-keys-6.24.1.tgz";
sha1 = "73eb3d310ca969e3ef9ec91c53741a6f1576423e";
};
}
{
name = "babel_plugin_transform_es2015_for_of___babel_plugin_transform_es2015_for_of_6.23.0.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_for_of___babel_plugin_transform_es2015_for_of_6.23.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-for-of/-/babel-plugin-transform-es2015-for-of-6.23.0.tgz";
sha1 = "f47c95b2b613df1d3ecc2fdb7573623c75248691";
};
}
{
name = "babel_plugin_transform_es2015_function_name___babel_plugin_transform_es2015_function_name_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_function_name___babel_plugin_transform_es2015_function_name_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-function-name/-/babel-plugin-transform-es2015-function-name-6.24.1.tgz";
sha1 = "834c89853bc36b1af0f3a4c5dbaa94fd8eacaa8b";
};
}
{
name = "babel_plugin_transform_es2015_literals___babel_plugin_transform_es2015_literals_6.22.0.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_literals___babel_plugin_transform_es2015_literals_6.22.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-literals/-/babel-plugin-transform-es2015-literals-6.22.0.tgz";
sha1 = "4f54a02d6cd66cf915280019a31d31925377ca2e";
};
}
{
name = "babel_plugin_transform_es2015_modules_amd___babel_plugin_transform_es2015_modules_amd_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_modules_amd___babel_plugin_transform_es2015_modules_amd_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-modules-amd/-/babel-plugin-transform-es2015-modules-amd-6.24.1.tgz";
sha1 = "3b3e54017239842d6d19c3011c4bd2f00a00d154";
};
}
{
name = "babel_plugin_transform_es2015_modules_commonjs___babel_plugin_transform_es2015_modules_commonjs_6.26.2.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_modules_commonjs___babel_plugin_transform_es2015_modules_commonjs_6.26.2.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-modules-commonjs/-/babel-plugin-transform-es2015-modules-commonjs-6.26.2.tgz";
sha1 = "58a793863a9e7ca870bdc5a881117ffac27db6f3";
};
}
{
name = "babel_plugin_transform_es2015_modules_systemjs___babel_plugin_transform_es2015_modules_systemjs_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_modules_systemjs___babel_plugin_transform_es2015_modules_systemjs_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-modules-systemjs/-/babel-plugin-transform-es2015-modules-systemjs-6.24.1.tgz";
sha1 = "ff89a142b9119a906195f5f106ecf305d9407d23";
};
}
{
name = "babel_plugin_transform_es2015_modules_umd___babel_plugin_transform_es2015_modules_umd_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_modules_umd___babel_plugin_transform_es2015_modules_umd_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-modules-umd/-/babel-plugin-transform-es2015-modules-umd-6.24.1.tgz";
sha1 = "ac997e6285cd18ed6176adb607d602344ad38468";
};
}
{
name = "babel_plugin_transform_es2015_object_super___babel_plugin_transform_es2015_object_super_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_object_super___babel_plugin_transform_es2015_object_super_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-object-super/-/babel-plugin-transform-es2015-object-super-6.24.1.tgz";
sha1 = "24cef69ae21cb83a7f8603dad021f572eb278f8d";
};
}
{
name = "babel_plugin_transform_es2015_parameters___babel_plugin_transform_es2015_parameters_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_parameters___babel_plugin_transform_es2015_parameters_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-parameters/-/babel-plugin-transform-es2015-parameters-6.24.1.tgz";
sha1 = "57ac351ab49caf14a97cd13b09f66fdf0a625f2b";
};
}
{
name = "babel_plugin_transform_es2015_shorthand_properties___babel_plugin_transform_es2015_shorthand_properties_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_shorthand_properties___babel_plugin_transform_es2015_shorthand_properties_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-shorthand-properties/-/babel-plugin-transform-es2015-shorthand-properties-6.24.1.tgz";
sha1 = "24f875d6721c87661bbd99a4622e51f14de38aa0";
};
}
{
name = "babel_plugin_transform_es2015_spread___babel_plugin_transform_es2015_spread_6.22.0.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_spread___babel_plugin_transform_es2015_spread_6.22.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-spread/-/babel-plugin-transform-es2015-spread-6.22.0.tgz";
sha1 = "d6d68a99f89aedc4536c81a542e8dd9f1746f8d1";
};
}
{
name = "babel_plugin_transform_es2015_sticky_regex___babel_plugin_transform_es2015_sticky_regex_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_sticky_regex___babel_plugin_transform_es2015_sticky_regex_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-sticky-regex/-/babel-plugin-transform-es2015-sticky-regex-6.24.1.tgz";
sha1 = "00c1cdb1aca71112cdf0cf6126c2ed6b457ccdbc";
};
}
{
name = "babel_plugin_transform_es2015_template_literals___babel_plugin_transform_es2015_template_literals_6.22.0.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_template_literals___babel_plugin_transform_es2015_template_literals_6.22.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-template-literals/-/babel-plugin-transform-es2015-template-literals-6.22.0.tgz";
sha1 = "a84b3450f7e9f8f1f6839d6d687da84bb1236d8d";
};
}
{
name = "babel_plugin_transform_es2015_typeof_symbol___babel_plugin_transform_es2015_typeof_symbol_6.23.0.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_typeof_symbol___babel_plugin_transform_es2015_typeof_symbol_6.23.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-typeof-symbol/-/babel-plugin-transform-es2015-typeof-symbol-6.23.0.tgz";
sha1 = "dec09f1cddff94b52ac73d505c84df59dcceb372";
};
}
{
name = "babel_plugin_transform_es2015_unicode_regex___babel_plugin_transform_es2015_unicode_regex_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_es2015_unicode_regex___babel_plugin_transform_es2015_unicode_regex_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-es2015-unicode-regex/-/babel-plugin-transform-es2015-unicode-regex-6.24.1.tgz";
sha1 = "d38b12f42ea7323f729387f18a7c5ae1faeb35e9";
};
}
{
name = "babel_plugin_transform_exponentiation_operator___babel_plugin_transform_exponentiation_operator_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_exponentiation_operator___babel_plugin_transform_exponentiation_operator_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-exponentiation-operator/-/babel-plugin-transform-exponentiation-operator-6.24.1.tgz";
sha1 = "2ab0c9c7f3098fa48907772bb813fe41e8de3a0e";
};
}
{
name = "babel_plugin_transform_regenerator___babel_plugin_transform_regenerator_6.26.0.tgz";
path = fetchurl {
name = "babel_plugin_transform_regenerator___babel_plugin_transform_regenerator_6.26.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-regenerator/-/babel-plugin-transform-regenerator-6.26.0.tgz";
sha1 = "e0703696fbde27f0a3efcacf8b4dca2f7b3a8f2f";
};
}
{
name = "babel_plugin_transform_runtime___babel_plugin_transform_runtime_6.23.0.tgz";
path = fetchurl {
name = "babel_plugin_transform_runtime___babel_plugin_transform_runtime_6.23.0.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-runtime/-/babel-plugin-transform-runtime-6.23.0.tgz";
sha1 = "88490d446502ea9b8e7efb0fe09ec4d99479b1ee";
};
}
{
name = "babel_plugin_transform_strict_mode___babel_plugin_transform_strict_mode_6.24.1.tgz";
path = fetchurl {
name = "babel_plugin_transform_strict_mode___babel_plugin_transform_strict_mode_6.24.1.tgz";
url = "https://registry.yarnpkg.com/babel-plugin-transform-strict-mode/-/babel-plugin-transform-strict-mode-6.24.1.tgz";
sha1 = "d5faf7aa578a65bbe591cf5edae04a0c67020758";
};
}
{
name = "babel_polyfill___babel_polyfill_6.26.0.tgz";
path = fetchurl {
name = "babel_polyfill___babel_polyfill_6.26.0.tgz";
url = "https://registry.yarnpkg.com/babel-polyfill/-/babel-polyfill-6.26.0.tgz";
sha1 = "379937abc67d7895970adc621f284cd966cf2153";
};
}
{
name = "babel_preset_env___babel_preset_env_1.7.0.tgz";
path = fetchurl {
name = "babel_preset_env___babel_preset_env_1.7.0.tgz";
url = "https://registry.yarnpkg.com/babel-preset-env/-/babel-preset-env-1.7.0.tgz";
sha1 = "dea79fa4ebeb883cd35dab07e260c1c9c04df77a";
};
}
{
name = "babel_register___babel_register_6.26.0.tgz";
path = fetchurl {
name = "babel_register___babel_register_6.26.0.tgz";
url = "https://registry.yarnpkg.com/babel-register/-/babel-register-6.26.0.tgz";
sha1 = "6ed021173e2fcb486d7acb45c6009a856f647071";
};
}
{
name = "babel_runtime___babel_runtime_6.26.0.tgz";
path = fetchurl {
name = "babel_runtime___babel_runtime_6.26.0.tgz";
url = "https://registry.yarnpkg.com/babel-runtime/-/babel-runtime-6.26.0.tgz";
sha1 = "965c7058668e82b55d7bfe04ff2337bc8b5647fe";
};
}
{
name = "babel_template___babel_template_6.26.0.tgz";
path = fetchurl {
name = "babel_template___babel_template_6.26.0.tgz";
url = "https://registry.yarnpkg.com/babel-template/-/babel-template-6.26.0.tgz";
sha1 = "de03e2d16396b069f46dd9fff8521fb1a0e35e02";
};
}
{
name = "babel_traverse___babel_traverse_6.26.0.tgz";
path = fetchurl {
name = "babel_traverse___babel_traverse_6.26.0.tgz";
url = "https://registry.yarnpkg.com/babel-traverse/-/babel-traverse-6.26.0.tgz";
sha1 = "46a9cbd7edcc62c8e5c064e2d2d8d0f4035766ee";
};
}
{
name = "babel_types___babel_types_6.26.0.tgz";
path = fetchurl {
name = "babel_types___babel_types_6.26.0.tgz";
url = "https://registry.yarnpkg.com/babel-types/-/babel-types-6.26.0.tgz";
sha1 = "a3b073f94ab49eb6fa55cd65227a334380632497";
};
}
{
name = "babylon___babylon_6.18.0.tgz";
path = fetchurl {
name = "babylon___babylon_6.18.0.tgz";
url = "https://registry.yarnpkg.com/babylon/-/babylon-6.18.0.tgz";
sha1 = "af2f3b88fa6f5c1e4c634d1a0f8eac4f55b395e3";
};
}
{
name = "backo2___backo2_1.0.2.tgz";
path = fetchurl {
name = "backo2___backo2_1.0.2.tgz";
url = "https://registry.yarnpkg.com/backo2/-/backo2-1.0.2.tgz";
sha1 = "31ab1ac8b129363463e35b3ebb69f4dfcfba7947";
};
}
{
name = "backoff___backoff_2.5.0.tgz";
path = fetchurl {
name = "backoff___backoff_2.5.0.tgz";
url = "https://registry.yarnpkg.com/backoff/-/backoff-2.5.0.tgz";
sha1 = "f616eda9d3e4b66b8ca7fca79f695722c5f8e26f";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "bail___bail_2.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "bail___bail_2.0.1.tgz";
url = "https://registry.yarnpkg.com/bail/-/bail-2.0.1.tgz";
sha1 = "d676736373a374058a935aec81b94c12ba815771";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "balanced_match___balanced_match_1.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "balanced_match___balanced_match_1.0.2.tgz";
url = "https://registry.yarnpkg.com/balanced-match/-/balanced-match-1.0.2.tgz";
sha1 = "e83e3a7e3f300b34cb9d87f615fa0cbf357690ee";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "base64_arraybuffer___base64_arraybuffer_0.1.4.tgz";
path = fetchurl {
name = "base64_arraybuffer___base64_arraybuffer_0.1.4.tgz";
url = "https://registry.yarnpkg.com/base64-arraybuffer/-/base64-arraybuffer-0.1.4.tgz";
sha1 = "9818c79e059b1355f97e0428a017c838e90ba812";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "base64_js___base64_js_1.5.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "base64_js___base64_js_1.5.1.tgz";
url = "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz";
sha1 = "1b1b440160a5bf7ad40b650f095963481903930a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "base64id___base64id_2.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "base64id___base64id_2.0.0.tgz";
url = "https://registry.yarnpkg.com/base64id/-/base64id-2.0.0.tgz";
sha1 = "2770ac6bc47d312af97a8bf9a634342e0cd25cb6";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "base64url___base64url_3.0.1.tgz";
path = fetchurl {
name = "base64url___base64url_3.0.1.tgz";
url = "https://registry.yarnpkg.com/base64url/-/base64url-3.0.1.tgz";
sha1 = "6399d572e2bc3f90a9a8b22d5dbb0a32d33f788d";
};
}
{
name = "base___base_0.11.2.tgz";
path = fetchurl {
name = "base___base_0.11.2.tgz";
url = "https://registry.yarnpkg.com/base/-/base-0.11.2.tgz";
sha1 = "7bde5ced145b6d551a90db87f83c558b4eb48a8f";
};
}
{
name = "basic_auth___basic_auth_2.0.1.tgz";
path = fetchurl {
name = "basic_auth___basic_auth_2.0.1.tgz";
url = "https://registry.yarnpkg.com/basic-auth/-/basic-auth-2.0.1.tgz";
sha1 = "b998279bf47ce38344b4f3cf916d4679bbf51e3a";
};
}
{
name = "bcrypt_pbkdf___bcrypt_pbkdf_1.0.2.tgz";
path = fetchurl {
name = "bcrypt_pbkdf___bcrypt_pbkdf_1.0.2.tgz";
url = "https://registry.yarnpkg.com/bcrypt-pbkdf/-/bcrypt-pbkdf-1.0.2.tgz";
sha1 = "a4301d389b6a43f9b67ff3ca11a3f6637e360e9e";
};
}
{
name = "bcryptjs___bcryptjs_2.4.3.tgz";
path = fetchurl {
name = "bcryptjs___bcryptjs_2.4.3.tgz";
url = "https://registry.yarnpkg.com/bcryptjs/-/bcryptjs-2.4.3.tgz";
sha1 = "9ab5627b93e60621ff7cdac5da9733027df1d0cb";
};
}
{
name = "big.js___big.js_5.2.2.tgz";
path = fetchurl {
name = "big.js___big.js_5.2.2.tgz";
url = "https://registry.yarnpkg.com/big.js/-/big.js-5.2.2.tgz";
sha1 = "65f0af382f578bcdc742bd9c281e9cb2d7768328";
};
}
{
name = "binary_extensions___binary_extensions_1.13.1.tgz";
path = fetchurl {
name = "binary_extensions___binary_extensions_1.13.1.tgz";
url = "https://registry.yarnpkg.com/binary-extensions/-/binary-extensions-1.13.1.tgz";
sha1 = "598afe54755b2868a5330d2aff9d4ebb53209b65";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "binary_extensions___binary_extensions_2.2.0.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "binary_extensions___binary_extensions_2.2.0.tgz";
url = "https://registry.yarnpkg.com/binary-extensions/-/binary-extensions-2.2.0.tgz";
sha1 = "75f502eeaf9ffde42fc98829645be4ea76bd9e2d";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "bindings___bindings_1.5.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "bindings___bindings_1.5.0.tgz";
url = "https://registry.yarnpkg.com/bindings/-/bindings-1.5.0.tgz";
sha1 = "10353c9e945334bc0511a6d90b38fbc7c9c504df";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "bintrees___bintrees_1.0.1.tgz";
path = fetchurl {
name = "bintrees___bintrees_1.0.1.tgz";
url = "https://registry.yarnpkg.com/bintrees/-/bintrees-1.0.1.tgz";
sha1 = "0e655c9b9c2435eaab68bf4027226d2b55a34524";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "bl___bl_4.1.0.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "bl___bl_4.1.0.tgz";
url = "https://registry.yarnpkg.com/bl/-/bl-4.1.0.tgz";
sha1 = "451535264182bec2fbbc83a62ab98cf11d9f7b3a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "blob___blob_0.0.5.tgz";
path = fetchurl {
name = "blob___blob_0.0.5.tgz";
url = "https://registry.yarnpkg.com/blob/-/blob-0.0.5.tgz";
sha1 = "d680eeef25f8cd91ad533f5b01eed48e64caf683";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "block_stream2___block_stream2_2.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "block_stream2___block_stream2_2.1.0.tgz";
url = "https://registry.yarnpkg.com/block-stream2/-/block-stream2-2.1.0.tgz";
sha1 = "ac0c5ef4298b3857796e05be8ebed72196fa054b";
};
}
{
name = "block_stream___block_stream_0.0.9.tgz";
path = fetchurl {
name = "block_stream___block_stream_0.0.9.tgz";
url = "https://registry.yarnpkg.com/block-stream/-/block-stream-0.0.9.tgz";
sha1 = "13ebfe778a03205cfe03751481ebb4b3300c126a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "bluebird___bluebird_3.7.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "bluebird___bluebird_3.7.2.tgz";
url = "https://registry.yarnpkg.com/bluebird/-/bluebird-3.7.2.tgz";
sha1 = "9f229c15be272454ffa973ace0dbee79a1b0c36f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "bn.js___bn.js_4.12.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "bn.js___bn.js_4.12.0.tgz";
url = "https://registry.yarnpkg.com/bn.js/-/bn.js-4.12.0.tgz";
sha1 = "775b3f278efbb9718eec7361f483fb36fbbfea88";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "bn.js___bn.js_5.2.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "bn.js___bn.js_5.2.0.tgz";
url = "https://registry.yarnpkg.com/bn.js/-/bn.js-5.2.0.tgz";
sha1 = "358860674396c6997771a9d051fcc1b57d4ae002";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "body_parser___body_parser_1.19.0.tgz";
path = fetchurl {
name = "body_parser___body_parser_1.19.0.tgz";
url = "https://registry.yarnpkg.com/body-parser/-/body-parser-1.19.0.tgz";
sha1 = "96b2709e57c9c4e09a6fd66a8fd979844f69f08a";
};
}
{
name = "boolbase___boolbase_1.0.0.tgz";
path = fetchurl {
name = "boolbase___boolbase_1.0.0.tgz";
url = "https://registry.yarnpkg.com/boolbase/-/boolbase-1.0.0.tgz";
sha1 = "68dff5fbe60c51eb37725ea9e3ed310dcc1e776e";
};
}
{
name = "bootstrap_validator___bootstrap_validator_0.11.9.tgz";
path = fetchurl {
name = "bootstrap_validator___bootstrap_validator_0.11.9.tgz";
url = "https://registry.yarnpkg.com/bootstrap-validator/-/bootstrap-validator-0.11.9.tgz";
sha1 = "fb7058eef53623e78f5aa7967026f98f875a9404";
};
}
{
name = "bootstrap___bootstrap_3.4.1.tgz";
path = fetchurl {
name = "bootstrap___bootstrap_3.4.1.tgz";
url = "https://registry.yarnpkg.com/bootstrap/-/bootstrap-3.4.1.tgz";
sha1 = "c3a347d419e289ad11f4033e3c4132b87c081d72";
};
}
{
name = "brace_expansion___brace_expansion_1.1.11.tgz";
path = fetchurl {
name = "brace_expansion___brace_expansion_1.1.11.tgz";
url = "https://registry.yarnpkg.com/brace-expansion/-/brace-expansion-1.1.11.tgz";
sha1 = "3c7fcbf529d87226f3d2f52b966ff5271eb441dd";
};
}
{
name = "braces___braces_1.8.5.tgz";
path = fetchurl {
name = "braces___braces_1.8.5.tgz";
url = "https://registry.yarnpkg.com/braces/-/braces-1.8.5.tgz";
sha1 = "ba77962e12dff969d6b76711e914b737857bf6a7";
};
}
{
name = "braces___braces_2.3.2.tgz";
path = fetchurl {
name = "braces___braces_2.3.2.tgz";
url = "https://registry.yarnpkg.com/braces/-/braces-2.3.2.tgz";
sha1 = "5979fd3f14cd531565e5fa2df1abfff1dfaee729";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "braces___braces_3.0.2.tgz";
path = fetchurl {
name = "braces___braces_3.0.2.tgz";
url = "https://registry.yarnpkg.com/braces/-/braces-3.0.2.tgz";
sha1 = "3454e1a462ee8d599e236df336cd9ea4f8afe107";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "brorand___brorand_1.1.0.tgz";
path = fetchurl {
name = "brorand___brorand_1.1.0.tgz";
url = "https://registry.yarnpkg.com/brorand/-/brorand-1.1.0.tgz";
sha1 = "12c25efe40a45e3c323eb8675a0a0ce57b22371f";
};
}
{
name = "browser_stdout___browser_stdout_1.3.1.tgz";
path = fetchurl {
name = "browser_stdout___browser_stdout_1.3.1.tgz";
url = "https://registry.yarnpkg.com/browser-stdout/-/browser-stdout-1.3.1.tgz";
sha1 = "baa559ee14ced73452229bad7326467c61fabd60";
};
}
{
name = "browserify_aes___browserify_aes_1.2.0.tgz";
path = fetchurl {
name = "browserify_aes___browserify_aes_1.2.0.tgz";
url = "https://registry.yarnpkg.com/browserify-aes/-/browserify-aes-1.2.0.tgz";
sha1 = "326734642f403dabc3003209853bb70ad428ef48";
};
}
{
name = "browserify_cipher___browserify_cipher_1.0.1.tgz";
path = fetchurl {
name = "browserify_cipher___browserify_cipher_1.0.1.tgz";
url = "https://registry.yarnpkg.com/browserify-cipher/-/browserify-cipher-1.0.1.tgz";
sha1 = "8d6474c1b870bfdabcd3bcfcc1934a10e94f15f0";
};
}
{
name = "browserify_des___browserify_des_1.0.2.tgz";
path = fetchurl {
name = "browserify_des___browserify_des_1.0.2.tgz";
url = "https://registry.yarnpkg.com/browserify-des/-/browserify-des-1.0.2.tgz";
sha1 = "3af4f1f59839403572f1c66204375f7a7f703e9c";
};
}
{
name = "browserify_mime___browserify_mime_1.2.9.tgz";
path = fetchurl {
name = "browserify_mime___browserify_mime_1.2.9.tgz";
url = "https://registry.yarnpkg.com/browserify-mime/-/browserify-mime-1.2.9.tgz";
sha1 = "aeb1af28de6c0d7a6a2ce40adb68ff18422af31f";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "browserify_rsa___browserify_rsa_4.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "browserify_rsa___browserify_rsa_4.1.0.tgz";
url = "https://registry.yarnpkg.com/browserify-rsa/-/browserify-rsa-4.1.0.tgz";
sha1 = "b2fd06b5b75ae297f7ce2dc651f918f5be158c8d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "browserify_sign___browserify_sign_4.2.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "browserify_sign___browserify_sign_4.2.1.tgz";
url = "https://registry.yarnpkg.com/browserify-sign/-/browserify-sign-4.2.1.tgz";
sha1 = "eaf4add46dd54be3bb3b36c0cf15abbeba7956c3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "browserify_zlib___browserify_zlib_0.2.0.tgz";
path = fetchurl {
name = "browserify_zlib___browserify_zlib_0.2.0.tgz";
url = "https://registry.yarnpkg.com/browserify-zlib/-/browserify-zlib-0.2.0.tgz";
sha1 = "2869459d9aa3be245fe8fe2ca1f46e2e7f54d73f";
};
}
{
name = "browserslist___browserslist_3.2.8.tgz";
path = fetchurl {
name = "browserslist___browserslist_3.2.8.tgz";
url = "https://registry.yarnpkg.com/browserslist/-/browserslist-3.2.8.tgz";
sha1 = "b0005361d6471f0f5952797a76fc985f1f978fc6";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "browserslist___browserslist_4.17.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "browserslist___browserslist_4.17.0.tgz";
url = "https://registry.yarnpkg.com/browserslist/-/browserslist-4.17.0.tgz";
sha1 = "1fcd81ec75b41d6d4994fb0831b92ac18c01649c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "buffer_crc32___buffer_crc32_0.2.13.tgz";
path = fetchurl {
name = "buffer_crc32___buffer_crc32_0.2.13.tgz";
url = "https://registry.yarnpkg.com/buffer-crc32/-/buffer-crc32-0.2.13.tgz";
sha1 = "0d333e3f00eac50aa1454abd30ef8c2a5d9a7242";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "buffer_from___buffer_from_1.1.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "buffer_from___buffer_from_1.1.2.tgz";
url = "https://registry.yarnpkg.com/buffer-from/-/buffer-from-1.1.2.tgz";
sha1 = "2b146a6fd72e80b4f55d255f35ed59a3a9a41bd5";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "buffer_writer___buffer_writer_2.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "buffer_writer___buffer_writer_2.0.0.tgz";
url = "https://registry.yarnpkg.com/buffer-writer/-/buffer-writer-2.0.0.tgz";
sha1 = "ce7eb81a38f7829db09c873f2fbb792c0c98ec04";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "buffer_xor___buffer_xor_1.0.3.tgz";
path = fetchurl {
name = "buffer_xor___buffer_xor_1.0.3.tgz";
url = "https://registry.yarnpkg.com/buffer-xor/-/buffer-xor-1.0.3.tgz";
sha1 = "26e61ed1422fb70dd42e6e36729ed51d855fe8d9";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "buffer___buffer_4.9.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "buffer___buffer_4.9.2.tgz";
url = "https://registry.yarnpkg.com/buffer/-/buffer-4.9.2.tgz";
sha1 = "230ead344002988644841ab0244af8c44bbe3ef8";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "buffer___buffer_5.7.1.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "buffer___buffer_5.7.1.tgz";
url = "https://registry.yarnpkg.com/buffer/-/buffer-5.7.1.tgz";
sha1 = "ba62e7c13133053582197160851a8f648e99eed0";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "bufferutil___bufferutil_4.0.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "bufferutil___bufferutil_4.0.3.tgz";
url = "https://registry.yarnpkg.com/bufferutil/-/bufferutil-4.0.3.tgz";
sha1 = "66724b756bed23cd7c28c4d306d7994f9943cc6b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "builtin_status_codes___builtin_status_codes_3.0.0.tgz";
path = fetchurl {
name = "builtin_status_codes___builtin_status_codes_3.0.0.tgz";
url = "https://registry.yarnpkg.com/builtin-status-codes/-/builtin-status-codes-3.0.0.tgz";
sha1 = "85982878e21b98e1c66425e03d0174788f569ee8";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "builtins___builtins_4.0.0.tgz";
path = fetchurl {
name = "builtins___builtins_4.0.0.tgz";
url = "https://registry.yarnpkg.com/builtins/-/builtins-4.0.0.tgz";
sha1 = "a8345420de82068fdc4d6559d0456403a8fb1905";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "bytes___bytes_3.0.0.tgz";
path = fetchurl {
name = "bytes___bytes_3.0.0.tgz";
url = "https://registry.yarnpkg.com/bytes/-/bytes-3.0.0.tgz";
sha1 = "d32815404d689699f85a4ea4fa8755dd13a96048";
};
}
{
name = "bytes___bytes_3.1.0.tgz";
path = fetchurl {
name = "bytes___bytes_3.1.0.tgz";
url = "https://registry.yarnpkg.com/bytes/-/bytes-3.1.0.tgz";
sha1 = "f6cf7933a360e0588fa9fde85651cdc7f805d1f6";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "cacache___cacache_12.0.4.tgz";
path = fetchurl {
name = "cacache___cacache_12.0.4.tgz";
url = "https://registry.yarnpkg.com/cacache/-/cacache-12.0.4.tgz";
sha1 = "668bcbd105aeb5f1d92fe25570ec9525c8faa40c";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "cacache___cacache_15.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "cacache___cacache_15.3.0.tgz";
url = "https://registry.yarnpkg.com/cacache/-/cacache-15.3.0.tgz";
sha1 = "dc85380fb2f556fe3dda4c719bfa0ec875a7f1eb";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "cache_base___cache_base_1.0.1.tgz";
path = fetchurl {
name = "cache_base___cache_base_1.0.1.tgz";
url = "https://registry.yarnpkg.com/cache-base/-/cache-base-1.0.1.tgz";
sha1 = "0a7f46416831c8b662ee36fe4e7c59d76f666ab2";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "call_bind___call_bind_1.0.2.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "call_bind___call_bind_1.0.2.tgz";
url = "https://registry.yarnpkg.com/call-bind/-/call-bind-1.0.2.tgz";
sha1 = "b1d4e89e688119c3c9a903ad30abb2f6a919be3c";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "callsites___callsites_3.1.0.tgz";
path = fetchurl {
name = "callsites___callsites_3.1.0.tgz";
url = "https://registry.yarnpkg.com/callsites/-/callsites-3.1.0.tgz";
sha1 = "b3630abd8943432f54b3f0519238e33cd7df2f73";
};
}
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "camel_case___camel_case_4.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "camel_case___camel_case_4.1.2.tgz";
url = "https://registry.yarnpkg.com/camel-case/-/camel-case-4.1.2.tgz";
sha1 = "9728072a954f805228225a6deea6b38461e1bd5a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "camelcase___camelcase_6.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "camelcase___camelcase_6.2.0.tgz";
url = "https://registry.yarnpkg.com/camelcase/-/camelcase-6.2.0.tgz";
sha1 = "924af881c9d525ac9d87f40d964e5cea982a1809";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "caniuse_api___caniuse_api_3.0.0.tgz";
path = fetchurl {
name = "caniuse_api___caniuse_api_3.0.0.tgz";
url = "https://registry.yarnpkg.com/caniuse-api/-/caniuse-api-3.0.0.tgz";
sha1 = "5e4d90e2274961d46291997df599e3ed008ee4c0";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "caniuse_lite___caniuse_lite_1.0.30001257.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "caniuse_lite___caniuse_lite_1.0.30001257.tgz";
url = "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001257.tgz";
sha1 = "150aaf649a48bee531104cfeda57f92ce587f6e5";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "caseless___caseless_0.12.0.tgz";
path = fetchurl {
name = "caseless___caseless_0.12.0.tgz";
url = "https://registry.yarnpkg.com/caseless/-/caseless-0.12.0.tgz";
sha1 = "1b681c21ff84033c826543090689420d187151dc";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "ccount___ccount_2.0.0.tgz";
path = fetchurl {
name = "ccount___ccount_2.0.0.tgz";
url = "https://registry.yarnpkg.com/ccount/-/ccount-2.0.0.tgz";
sha1 = "3d6fb55803832766a24c6f339abc507297eb5d25";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "chalk___chalk_1.1.3.tgz";
path = fetchurl {
name = "chalk___chalk_1.1.3.tgz";
url = "https://registry.yarnpkg.com/chalk/-/chalk-1.1.3.tgz";
sha1 = "a8115c55e4a702fe4d150abd3872822a7e09fc98";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "chalk___chalk_2.4.2.tgz";
path = fetchurl {
name = "chalk___chalk_2.4.2.tgz";
url = "https://registry.yarnpkg.com/chalk/-/chalk-2.4.2.tgz";
sha1 = "cd42541677a54333cf541a49108c1432b44c9424";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "chalk___chalk_4.1.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "chalk___chalk_4.1.2.tgz";
url = "https://registry.yarnpkg.com/chalk/-/chalk-4.1.2.tgz";
sha1 = "aac4e2b7734a740867aeb16bf02aad556a1e7a01";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "chalk___chalk_0.4.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "chalk___chalk_0.4.0.tgz";
url = "https://registry.yarnpkg.com/chalk/-/chalk-0.4.0.tgz";
sha1 = "5199a3ddcd0c1efe23bc08c1b027b06176e0c64f";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "chance___chance_1.1.8.tgz";
path = fetchurl {
name = "chance___chance_1.1.8.tgz";
url = "https://registry.yarnpkg.com/chance/-/chance-1.1.8.tgz";
sha1 = "5d6c2b78c9170bf6eb9df7acdda04363085be909";
};
}
{
name = "character_entities_html4___character_entities_html4_2.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "character_entities_html4___character_entities_html4_2.0.0.tgz";
url = "https://registry.yarnpkg.com/character-entities-html4/-/character-entities-html4-2.0.0.tgz";
sha1 = "55fcf3ed00febfe41f8f6a5709d25ab8ed73a449";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "character_entities_legacy___character_entities_legacy_2.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "character_entities_legacy___character_entities_legacy_2.0.0.tgz";
url = "https://registry.yarnpkg.com/character-entities-legacy/-/character-entities-legacy-2.0.0.tgz";
sha1 = "57f4d00974c696e8f74e9f493e7fcb75b44d7ee7";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "character_entities___character_entities_2.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "character_entities___character_entities_2.0.0.tgz";
url = "https://registry.yarnpkg.com/character-entities/-/character-entities-2.0.0.tgz";
sha1 = "508355fcc8c73893e0909efc1a44d28da2b6fdf3";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "character_reference_invalid___character_reference_invalid_2.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "character_reference_invalid___character_reference_invalid_2.0.0.tgz";
url = "https://registry.yarnpkg.com/character-reference-invalid/-/character-reference-invalid-2.0.0.tgz";
sha1 = "a0bdeb89c051fe7ed5d3158b2f06af06984f2813";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "cheerio___cheerio_0.22.0.tgz";
path = fetchurl {
name = "cheerio___cheerio_0.22.0.tgz";
url = "https://registry.yarnpkg.com/cheerio/-/cheerio-0.22.0.tgz";
sha1 = "a9baa860a3f9b595a6b81b1a86873121ed3a269e";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "chokidar___chokidar_3.5.2.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "chokidar___chokidar_3.5.2.tgz";
url = "https://registry.yarnpkg.com/chokidar/-/chokidar-3.5.2.tgz";
sha1 = "dba3976fcadb016f66fd365021d91600d01c1e75";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "chokidar___chokidar_1.7.0.tgz";
path = fetchurl {
name = "chokidar___chokidar_1.7.0.tgz";
url = "https://registry.yarnpkg.com/chokidar/-/chokidar-1.7.0.tgz";
sha1 = "798e689778151c8076b4b360e5edd28cda2bb468";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "chokidar___chokidar_2.1.8.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "chokidar___chokidar_2.1.8.tgz";
url = "https://registry.yarnpkg.com/chokidar/-/chokidar-2.1.8.tgz";
sha1 = "804b3a7b6a99358c3c5c61e71d8728f041cff917";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "chownr___chownr_1.1.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "chownr___chownr_1.1.4.tgz";
url = "https://registry.yarnpkg.com/chownr/-/chownr-1.1.4.tgz";
sha1 = "6fc9d7b42d32a583596337666e7d08084da2cc6b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "chownr___chownr_2.0.0.tgz";
path = fetchurl {
name = "chownr___chownr_2.0.0.tgz";
url = "https://registry.yarnpkg.com/chownr/-/chownr-2.0.0.tgz";
sha1 = "15bfbe53d2eab4cf70f18a8cd68ebe5b3cb1dece";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "chrome_trace_event___chrome_trace_event_1.0.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "chrome_trace_event___chrome_trace_event_1.0.3.tgz";
url = "https://registry.yarnpkg.com/chrome-trace-event/-/chrome-trace-event-1.0.3.tgz";
sha1 = "1015eced4741e15d06664a957dbbf50d041e26ac";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "cipher_base___cipher_base_1.0.4.tgz";
path = fetchurl {
name = "cipher_base___cipher_base_1.0.4.tgz";
url = "https://registry.yarnpkg.com/cipher-base/-/cipher-base-1.0.4.tgz";
sha1 = "8760e4ecc272f4c363532f926d874aae2c1397de";
};
}
{
name = "class_utils___class_utils_0.3.6.tgz";
path = fetchurl {
name = "class_utils___class_utils_0.3.6.tgz";
url = "https://registry.yarnpkg.com/class-utils/-/class-utils-0.3.6.tgz";
sha1 = "f93369ae8b9a7ce02fd41faad0ca83033190c463";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "clean_css___clean_css_4.2.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "clean_css___clean_css_4.2.3.tgz";
url = "https://registry.yarnpkg.com/clean-css/-/clean-css-4.2.3.tgz";
sha1 = "507b5de7d97b48ee53d84adb0160ff6216380f78";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "clean_stack___clean_stack_2.2.0.tgz";
path = fetchurl {
name = "clean_stack___clean_stack_2.2.0.tgz";
url = "https://registry.yarnpkg.com/clean-stack/-/clean-stack-2.2.0.tgz";
sha1 = "ee8472dbb129e727b31e8a10a427dee9dfe4008b";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "cliui___cliui_7.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "cliui___cliui_7.0.4.tgz";
url = "https://registry.yarnpkg.com/cliui/-/cliui-7.0.4.tgz";
sha1 = "a0265ee655476fc807aea9df3df8df7783808b4f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "clone_deep___clone_deep_4.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "clone_deep___clone_deep_4.0.1.tgz";
url = "https://registry.yarnpkg.com/clone-deep/-/clone-deep-4.0.1.tgz";
sha1 = "c19fd9bdbbf85942b4fd979c84dcf7d5f07c2387";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
name = "cls_bluebird___cls_bluebird_2.1.0.tgz";
path = fetchurl {
name = "cls_bluebird___cls_bluebird_2.1.0.tgz";
url = "https://registry.yarnpkg.com/cls-bluebird/-/cls-bluebird-2.1.0.tgz";
sha1 = "37ef1e080a8ffb55c2f4164f536f1919e7968aee";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "code_point_at___code_point_at_1.1.0.tgz";
path = fetchurl {
name = "code_point_at___code_point_at_1.1.0.tgz";
url = "https://registry.yarnpkg.com/code-point-at/-/code-point-at-1.1.0.tgz";
sha1 = "0d070b4d043a5bea33a2f1a40e2edb3d9a4ccf77";
};
}
{
name = "CodeMirror.git";
path =
let
repo = fetchgit {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
url = "https://github.com/hedgedoc/CodeMirror.git";
rev = "f780b569b3717cdff4c8507538cc63101bfa02e1";
sha256 = "0b6axzi9kwsd24pcqfk5rmy9nhsdyklpd3z8w9wiynd64435dilz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
in
hedgedoc: fix eval with `allowAliases = false`
2021-09-18 23:23:28 +01:00
runCommand "CodeMirror.git" { buildInputs = [gnutar]; } ''
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
# Set u+w because tar-fs can't unpack archives with read-only dirs
# https://github.com/mafintosh/tar-fs/issues/79
tar cf $out --mode u+w -C ${repo} .
'';
}
{
name = "collection_visit___collection_visit_1.0.0.tgz";
path = fetchurl {
name = "collection_visit___collection_visit_1.0.0.tgz";
url = "https://registry.yarnpkg.com/collection-visit/-/collection-visit-1.0.0.tgz";
sha1 = "4bc0373c164bc3291b4d368c829cf1a80a59dca0";
};
}
{
name = "color_convert___color_convert_1.9.3.tgz";
path = fetchurl {
name = "color_convert___color_convert_1.9.3.tgz";
url = "https://registry.yarnpkg.com/color-convert/-/color-convert-1.9.3.tgz";
sha1 = "bb71850690e1f136567de629d2d5471deda4c1e8";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "color_convert___color_convert_2.0.1.tgz";
path = fetchurl {
name = "color_convert___color_convert_2.0.1.tgz";
url = "https://registry.yarnpkg.com/color-convert/-/color-convert-2.0.1.tgz";
sha1 = "72d3a68d598c9bdb3af2ad1e84f21d896abd4de3";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "color_name___color_name_1.1.3.tgz";
path = fetchurl {
name = "color_name___color_name_1.1.3.tgz";
url = "https://registry.yarnpkg.com/color-name/-/color-name-1.1.3.tgz";
sha1 = "a7d0558bd89c42f795dd42328f740831ca53bc25";
};
}
{
name = "color_name___color_name_1.1.4.tgz";
path = fetchurl {
name = "color_name___color_name_1.1.4.tgz";
url = "https://registry.yarnpkg.com/color-name/-/color-name-1.1.4.tgz";
sha1 = "c2a09a87acbde69543de6f63fa3995c826c536a2";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "color_string___color_string_1.6.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "color_string___color_string_1.6.0.tgz";
url = "https://registry.yarnpkg.com/color-string/-/color-string-1.6.0.tgz";
sha1 = "c3915f61fe267672cb7e1e064c9d692219f6c312";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "color___color_3.0.0.tgz";
path = fetchurl {
name = "color___color_3.0.0.tgz";
url = "https://registry.yarnpkg.com/color/-/color-3.0.0.tgz";
sha1 = "d920b4328d534a3ac8295d68f7bd4ba6c427be9a";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "colord___colord_2.7.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "colord___colord_2.7.0.tgz";
url = "https://registry.yarnpkg.com/colord/-/colord-2.7.0.tgz";
sha1 = "706ea36fe0cd651b585eb142fe64b6480185270e";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "colorette___colorette_1.4.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "colorette___colorette_1.4.0.tgz";
url = "https://registry.yarnpkg.com/colorette/-/colorette-1.4.0.tgz";
sha1 = "5190fbb87276259a86ad700bff2c6d6faa3fca40";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "colors___colors_1.4.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "colors___colors_1.4.0.tgz";
url = "https://registry.yarnpkg.com/colors/-/colors-1.4.0.tgz";
sha1 = "c50491479d4c1bdaed2c9ced32cf7c7dc2360f78";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "colorspace___colorspace_1.1.2.tgz";
path = fetchurl {
name = "colorspace___colorspace_1.1.2.tgz";
url = "https://registry.yarnpkg.com/colorspace/-/colorspace-1.1.2.tgz";
sha1 = "e0128950d082b86a2168580796a0aa5d6c68d8c5";
};
}
{
name = "combined_stream___combined_stream_1.0.8.tgz";
path = fetchurl {
name = "combined_stream___combined_stream_1.0.8.tgz";
url = "https://registry.yarnpkg.com/combined-stream/-/combined-stream-1.0.8.tgz";
sha1 = "c3d45a8b34fd730631a110a8a2520682b31d5a7f";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "comma_separated_tokens___comma_separated_tokens_2.0.2.tgz";
path = fetchurl {
name = "comma_separated_tokens___comma_separated_tokens_2.0.2.tgz";
url = "https://registry.yarnpkg.com/comma-separated-tokens/-/comma-separated-tokens-2.0.2.tgz";
sha1 = "d4c25abb679b7751c880be623c1179780fe1dd98";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "commander___commander_2.20.3.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "commander___commander_2.20.3.tgz";
url = "https://registry.yarnpkg.com/commander/-/commander-2.20.3.tgz";
sha1 = "fd485e84c03eb4881c20722ba48035e8531aeb33";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "commander___commander_4.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "commander___commander_4.1.1.tgz";
url = "https://registry.yarnpkg.com/commander/-/commander-4.1.1.tgz";
sha1 = "9fd602bd936294e9e9ef46a3f4d6964044b18068";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "commander___commander_7.2.0.tgz";
path = fetchurl {
name = "commander___commander_7.2.0.tgz";
url = "https://registry.yarnpkg.com/commander/-/commander-7.2.0.tgz";
sha1 = "a36cb57d0b501ce108e4d20559a150a391d97ab7";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "commondir___commondir_1.0.1.tgz";
path = fetchurl {
name = "commondir___commondir_1.0.1.tgz";
url = "https://registry.yarnpkg.com/commondir/-/commondir-1.0.1.tgz";
sha1 = "ddd800da0c66127393cca5950ea968a3aaf1253b";
};
}
{
name = "component_bind___component_bind_1.0.0.tgz";
path = fetchurl {
name = "component_bind___component_bind_1.0.0.tgz";
url = "https://registry.yarnpkg.com/component-bind/-/component-bind-1.0.0.tgz";
sha1 = "00c608ab7dcd93897c0009651b1d3a8e1e73bbd1";
};
}
{
name = "component_emitter___component_emitter_1.2.1.tgz";
path = fetchurl {
name = "component_emitter___component_emitter_1.2.1.tgz";
url = "https://registry.yarnpkg.com/component-emitter/-/component-emitter-1.2.1.tgz";
sha1 = "137918d6d78283f7df7a6b7c5a63e140e69425e6";
};
}
{
name = "component_emitter___component_emitter_1.3.0.tgz";
path = fetchurl {
name = "component_emitter___component_emitter_1.3.0.tgz";
url = "https://registry.yarnpkg.com/component-emitter/-/component-emitter-1.3.0.tgz";
sha1 = "16e4070fba8ae29b679f2215853ee181ab2eabc0";
};
}
{
name = "component_inherit___component_inherit_0.0.3.tgz";
path = fetchurl {
name = "component_inherit___component_inherit_0.0.3.tgz";
url = "https://registry.yarnpkg.com/component-inherit/-/component-inherit-0.0.3.tgz";
sha1 = "645fc4adf58b72b649d5cae65135619db26ff143";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "compress_commons___compress_commons_4.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "compress_commons___compress_commons_4.1.1.tgz";
url = "https://registry.yarnpkg.com/compress-commons/-/compress-commons-4.1.1.tgz";
sha1 = "df2a09a7ed17447642bad10a85cc9a19e5c42a7d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "compressible___compressible_2.0.18.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "compressible___compressible_2.0.18.tgz";
url = "https://registry.yarnpkg.com/compressible/-/compressible-2.0.18.tgz";
sha1 = "af53cca6b070d4c3c0750fbd77286a6d7cc46fba";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "compression___compression_1.7.4.tgz";
path = fetchurl {
name = "compression___compression_1.7.4.tgz";
url = "https://registry.yarnpkg.com/compression/-/compression-1.7.4.tgz";
sha1 = "95523eff170ca57c29a0ca41e6fe131f41e5bb8f";
};
}
{
name = "concat_map___concat_map_0.0.1.tgz";
path = fetchurl {
name = "concat_map___concat_map_0.0.1.tgz";
url = "https://registry.yarnpkg.com/concat-map/-/concat-map-0.0.1.tgz";
sha1 = "d8a96bd77fd68df7793a73036a3ba0d5405d477b";
};
}
{
name = "concat_stream___concat_stream_1.6.2.tgz";
path = fetchurl {
name = "concat_stream___concat_stream_1.6.2.tgz";
url = "https://registry.yarnpkg.com/concat-stream/-/concat-stream-1.6.2.tgz";
sha1 = "904bdf194cd3122fc675c77fc4ac3d4ff0fd1a34";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "concat_stream___concat_stream_2.0.0.tgz";
path = fetchurl {
name = "concat_stream___concat_stream_2.0.0.tgz";
url = "https://registry.yarnpkg.com/concat-stream/-/concat-stream-2.0.0.tgz";
sha1 = "414cf5af790a48c60ab9be4527d56d5e41133cb1";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "connect_flash___connect_flash_0.1.1.tgz";
path = fetchurl {
name = "connect_flash___connect_flash_0.1.1.tgz";
url = "https://registry.yarnpkg.com/connect-flash/-/connect-flash-0.1.1.tgz";
sha1 = "d8630f26d95a7f851f9956b1e8cc6732f3b6aa30";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "connect_session_sequelize___connect_session_sequelize_7.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "connect_session_sequelize___connect_session_sequelize_7.1.2.tgz";
url = "https://registry.yarnpkg.com/connect-session-sequelize/-/connect-session-sequelize-7.1.2.tgz";
sha1 = "03ae9a1bd2221526c63a66959b6ddd18599be2ac";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "console_browserify___console_browserify_1.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "console_browserify___console_browserify_1.2.0.tgz";
url = "https://registry.yarnpkg.com/console-browserify/-/console-browserify-1.2.0.tgz";
sha1 = "67063cef57ceb6cf4993a2ab3a55840ae8c49336";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "console_control_strings___console_control_strings_1.1.0.tgz";
path = fetchurl {
name = "console_control_strings___console_control_strings_1.1.0.tgz";
url = "https://registry.yarnpkg.com/console-control-strings/-/console-control-strings-1.1.0.tgz";
sha1 = "3d7cf4464db6446ea644bf4b39507f9851008e8e";
};
}
{
name = "constants_browserify___constants_browserify_1.0.0.tgz";
path = fetchurl {
name = "constants_browserify___constants_browserify_1.0.0.tgz";
url = "https://registry.yarnpkg.com/constants-browserify/-/constants-browserify-1.0.0.tgz";
sha1 = "c20b96d8c617748aaf1c16021760cd27fcb8cb75";
};
}
{
name = "content_disposition___content_disposition_0.5.3.tgz";
path = fetchurl {
name = "content_disposition___content_disposition_0.5.3.tgz";
url = "https://registry.yarnpkg.com/content-disposition/-/content-disposition-0.5.3.tgz";
sha1 = "e130caf7e7279087c5616c2007d0485698984fbd";
};
}
{
name = "content_type___content_type_1.0.4.tgz";
path = fetchurl {
name = "content_type___content_type_1.0.4.tgz";
url = "https://registry.yarnpkg.com/content-type/-/content-type-1.0.4.tgz";
sha1 = "e138cc75e040c727b1966fe5e5f8c9aee256fe3b";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "convert_source_map___convert_source_map_1.8.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "convert_source_map___convert_source_map_1.8.0.tgz";
url = "https://registry.yarnpkg.com/convert-source-map/-/convert-source-map-1.8.0.tgz";
sha1 = "f3373c32d21b4d780dd8004514684fb791ca4369";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "cookie_parser___cookie_parser_1.4.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "cookie_parser___cookie_parser_1.4.5.tgz";
url = "https://registry.yarnpkg.com/cookie-parser/-/cookie-parser-1.4.5.tgz";
sha1 = "3e572d4b7c0c80f9c61daf604e4336831b5d1d49";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "cookie_signature___cookie_signature_1.0.6.tgz";
path = fetchurl {
name = "cookie_signature___cookie_signature_1.0.6.tgz";
url = "https://registry.yarnpkg.com/cookie-signature/-/cookie-signature-1.0.6.tgz";
sha1 = "e303a882b342cc3ee8ca513a79999734dab3ae2c";
};
}
{
name = "cookie___cookie_0.4.0.tgz";
path = fetchurl {
name = "cookie___cookie_0.4.0.tgz";
url = "https://registry.yarnpkg.com/cookie/-/cookie-0.4.0.tgz";
sha1 = "beb437e7022b3b6d49019d088665303ebe9c14ba";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "cookie___cookie_0.4.1.tgz";
path = fetchurl {
name = "cookie___cookie_0.4.1.tgz";
url = "https://registry.yarnpkg.com/cookie/-/cookie-0.4.1.tgz";
sha1 = "afd713fe26ebd21ba95ceb61f9a8116e50a537d1";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "cookiejar___cookiejar_2.0.6.tgz";
path = fetchurl {
name = "cookiejar___cookiejar_2.0.6.tgz";
url = "https://registry.yarnpkg.com/cookiejar/-/cookiejar-2.0.6.tgz";
sha1 = "0abf356ad00d1c5a219d88d44518046dd026acfe";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "copy_anything___copy_anything_2.0.3.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "copy_anything___copy_anything_2.0.3.tgz";
url = "https://registry.yarnpkg.com/copy-anything/-/copy-anything-2.0.3.tgz";
sha1 = "842407ba02466b0df844819bbe3baebbe5d45d87";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "copy_concurrently___copy_concurrently_1.0.5.tgz";
path = fetchurl {
name = "copy_concurrently___copy_concurrently_1.0.5.tgz";
url = "https://registry.yarnpkg.com/copy-concurrently/-/copy-concurrently-1.0.5.tgz";
sha1 = "92297398cae34937fcafd6ec8139c18051f0b5e0";
};
}
{
name = "copy_descriptor___copy_descriptor_0.1.1.tgz";
path = fetchurl {
name = "copy_descriptor___copy_descriptor_0.1.1.tgz";
url = "https://registry.yarnpkg.com/copy-descriptor/-/copy-descriptor-0.1.1.tgz";
sha1 = "676f6eb3c39997c2ee1ac3a924fd6124748f578d";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "copy_webpack_plugin___copy_webpack_plugin_6.4.1.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "copy_webpack_plugin___copy_webpack_plugin_6.4.1.tgz";
url = "https://registry.yarnpkg.com/copy-webpack-plugin/-/copy-webpack-plugin-6.4.1.tgz";
sha1 = "138cd9b436dbca0a6d071720d5414848992ec47e";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "core_js___core_js_2.6.12.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "core_js___core_js_2.6.12.tgz";
url = "https://registry.yarnpkg.com/core-js/-/core-js-2.6.12.tgz";
sha1 = "d9333dfa7b065e347cc5682219d6f690859cc2ec";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "core_util_is___core_util_is_1.0.2.tgz";
path = fetchurl {
name = "core_util_is___core_util_is_1.0.2.tgz";
url = "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.2.tgz";
sha1 = "b5fd54220aa2bc5ab57aab7140c940754503c1a7";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "core_util_is___core_util_is_1.0.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "core_util_is___core_util_is_1.0.3.tgz";
url = "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.3.tgz";
sha1 = "a6042d3634c2b27e9328f837b965fac83808db85";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "crc_32___crc_32_1.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "crc_32___crc_32_1.2.0.tgz";
url = "https://registry.yarnpkg.com/crc-32/-/crc-32-1.2.0.tgz";
sha1 = "cb2db6e29b88508e32d9dd0ec1693e7b41a18208";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "crc32_stream___crc32_stream_4.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "crc32_stream___crc32_stream_4.0.2.tgz";
url = "https://registry.yarnpkg.com/crc32-stream/-/crc32-stream-4.0.2.tgz";
sha1 = "c922ad22b38395abe9d3870f02fa8134ed709007";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "create_ecdh___create_ecdh_4.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "create_ecdh___create_ecdh_4.0.4.tgz";
url = "https://registry.yarnpkg.com/create-ecdh/-/create-ecdh-4.0.4.tgz";
sha1 = "d6e7f4bffa66736085a0762fd3a632684dabcc4e";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "create_hash___create_hash_1.2.0.tgz";
path = fetchurl {
name = "create_hash___create_hash_1.2.0.tgz";
url = "https://registry.yarnpkg.com/create-hash/-/create-hash-1.2.0.tgz";
sha1 = "889078af11a63756bcfb59bd221996be3a9ef196";
};
}
{
name = "create_hmac___create_hmac_1.1.7.tgz";
path = fetchurl {
name = "create_hmac___create_hmac_1.1.7.tgz";
url = "https://registry.yarnpkg.com/create-hmac/-/create-hmac-1.1.7.tgz";
sha1 = "69170c78b3ab957147b2b8b04572e47ead2243ff";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "cross_spawn___cross_spawn_7.0.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "cross_spawn___cross_spawn_7.0.3.tgz";
url = "https://registry.yarnpkg.com/cross-spawn/-/cross-spawn-7.0.3.tgz";
sha1 = "f73a85b9d5d41d045551c177e2882d4ac85728a6";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "crypto_browserify___crypto_browserify_3.12.0.tgz";
path = fetchurl {
name = "crypto_browserify___crypto_browserify_3.12.0.tgz";
url = "https://registry.yarnpkg.com/crypto-browserify/-/crypto-browserify-3.12.0.tgz";
sha1 = "396cf9f3137f03e4b8e532c58f698254e00f80ec";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "css_color_names___css_color_names_1.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "css_color_names___css_color_names_1.0.1.tgz";
url = "https://registry.yarnpkg.com/css-color-names/-/css-color-names-1.0.1.tgz";
sha1 = "6ff7ee81a823ad46e020fa2fd6ab40a887e2ba67";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "css_declaration_sorter___css_declaration_sorter_6.1.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "css_declaration_sorter___css_declaration_sorter_6.1.3.tgz";
url = "https://registry.yarnpkg.com/css-declaration-sorter/-/css-declaration-sorter-6.1.3.tgz";
sha1 = "e9852e4cf940ba79f509d9425b137d1f94438dc2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "css_loader___css_loader_5.2.7.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "css_loader___css_loader_5.2.7.tgz";
url = "https://registry.yarnpkg.com/css-loader/-/css-loader-5.2.7.tgz";
sha1 = "9b9f111edf6fb2be5dc62525644cbc9c232064ae";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "css_select___css_select_4.1.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "css_select___css_select_4.1.3.tgz";
url = "https://registry.yarnpkg.com/css-select/-/css-select-4.1.3.tgz";
sha1 = "a70440f70317f2669118ad74ff105e65849c7067";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
{
name = "css_select___css_select_1.2.0.tgz";
path = fetchurl {
name = "css_select___css_select_1.2.0.tgz";
url = "https://registry.yarnpkg.com/css-select/-/css-select-1.2.0.tgz";
sha1 = "2b3a110539c5355f1cd8d314623e870b121ec858";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "css_tree___css_tree_1.1.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "css_tree___css_tree_1.1.3.tgz";
url = "https://registry.yarnpkg.com/css-tree/-/css-tree-1.1.3.tgz";
sha1 = "eb4870fb6fd7707327ec95c2ff2ab09b5e8db91d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "css_what___css_what_2.1.3.tgz";
path = fetchurl {
name = "css_what___css_what_2.1.3.tgz";
url = "https://registry.yarnpkg.com/css-what/-/css-what-2.1.3.tgz";
sha1 = "a6d7604573365fe74686c3f311c56513d88285f2";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "css_what___css_what_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "css_what___css_what_5.0.1.tgz";
url = "https://registry.yarnpkg.com/css-what/-/css-what-5.0.1.tgz";
sha1 = "3efa820131f4669a8ac2408f9c32e7c7de9f4cad";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
name = "cssesc___cssesc_3.0.0.tgz";
path = fetchurl {
name = "cssesc___cssesc_3.0.0.tgz";
url = "https://registry.yarnpkg.com/cssesc/-/cssesc-3.0.0.tgz";
sha1 = "37741919903b868565e1c09ea747445cd18983ee";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "cssfilter___cssfilter_0.0.10.tgz";
path = fetchurl {
name = "cssfilter___cssfilter_0.0.10.tgz";
url = "https://registry.yarnpkg.com/cssfilter/-/cssfilter-0.0.10.tgz";
sha1 = "c6d2672632a2e5c83e013e6864a42ce8defd20ae";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "cssnano_preset_default___cssnano_preset_default_5.1.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "cssnano_preset_default___cssnano_preset_default_5.1.4.tgz";
url = "https://registry.yarnpkg.com/cssnano-preset-default/-/cssnano-preset-default-5.1.4.tgz";
sha1 = "359943bf00c5c8e05489f12dd25f3006f2c1cbd2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "cssnano_utils___cssnano_utils_2.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "cssnano_utils___cssnano_utils_2.0.1.tgz";
url = "https://registry.yarnpkg.com/cssnano-utils/-/cssnano-utils-2.0.1.tgz";
sha1 = "8660aa2b37ed869d2e2f22918196a9a8b6498ce2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "cssnano___cssnano_5.0.8.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "cssnano___cssnano_5.0.8.tgz";
url = "https://registry.yarnpkg.com/cssnano/-/cssnano-5.0.8.tgz";
sha1 = "39ad166256980fcc64faa08c9bb18bb5789ecfa9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "csso___csso_4.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "csso___csso_4.2.0.tgz";
url = "https://registry.yarnpkg.com/csso/-/csso-4.2.0.tgz";
sha1 = "ea3a561346e8dc9f546d6febedd50187cf389529";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "cssom___cssom_0.3.8.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "cssom___cssom_0.3.8.tgz";
url = "https://registry.yarnpkg.com/cssom/-/cssom-0.3.8.tgz";
sha1 = "9f1276f5b2b463f2114d3f2c75250af8c1a36f4a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "cssom___cssom_0.2.5.tgz";
path = fetchurl {
name = "cssom___cssom_0.2.5.tgz";
url = "https://registry.yarnpkg.com/cssom/-/cssom-0.2.5.tgz";
sha1 = "2682709b5902e7212df529116ff788cd5b254894";
};
}
{
name = "cssstyle___cssstyle_0.2.37.tgz";
path = fetchurl {
name = "cssstyle___cssstyle_0.2.37.tgz";
url = "https://registry.yarnpkg.com/cssstyle/-/cssstyle-0.2.37.tgz";
sha1 = "541097234cb2513c83ceed3acddc27ff27987d54";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "cyclist___cyclist_1.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "cyclist___cyclist_1.0.1.tgz";
url = "https://registry.yarnpkg.com/cyclist/-/cyclist-1.0.1.tgz";
sha1 = "596e9698fd0c80e12038c2b82d6eb1b35b6224d9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "d3_array___d3_array_1.2.4.tgz";
path = fetchurl {
name = "d3_array___d3_array_1.2.4.tgz";
url = "https://registry.yarnpkg.com/d3-array/-/d3-array-1.2.4.tgz";
sha1 = "635ce4d5eea759f6f605863dbcfc30edc737f71f";
};
}
{
name = "d3_axis___d3_axis_1.0.12.tgz";
path = fetchurl {
name = "d3_axis___d3_axis_1.0.12.tgz";
url = "https://registry.yarnpkg.com/d3-axis/-/d3-axis-1.0.12.tgz";
sha1 = "cdf20ba210cfbb43795af33756886fb3638daac9";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_brush___d3_brush_1.1.6.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_brush___d3_brush_1.1.6.tgz";
url = "https://registry.yarnpkg.com/d3-brush/-/d3-brush-1.1.6.tgz";
sha1 = "b0a22c7372cabec128bdddf9bddc058592f89e9b";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
name = "d3_chord___d3_chord_1.0.6.tgz";
path = fetchurl {
name = "d3_chord___d3_chord_1.0.6.tgz";
url = "https://registry.yarnpkg.com/d3-chord/-/d3-chord-1.0.6.tgz";
sha1 = "309157e3f2db2c752f0280fedd35f2067ccbb15f";
};
}
{
name = "d3_collection___d3_collection_1.0.7.tgz";
path = fetchurl {
name = "d3_collection___d3_collection_1.0.7.tgz";
url = "https://registry.yarnpkg.com/d3-collection/-/d3-collection-1.0.7.tgz";
sha1 = "349bd2aa9977db071091c13144d5e4f16b5b310e";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_color___d3_color_1.4.1.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_color___d3_color_1.4.1.tgz";
url = "https://registry.yarnpkg.com/d3-color/-/d3-color-1.4.1.tgz";
sha1 = "c52002bf8846ada4424d55d97982fef26eb3bc8a";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
name = "d3_contour___d3_contour_1.3.2.tgz";
path = fetchurl {
name = "d3_contour___d3_contour_1.3.2.tgz";
url = "https://registry.yarnpkg.com/d3-contour/-/d3-contour-1.3.2.tgz";
sha1 = "652aacd500d2264cb3423cee10db69f6f59bead3";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_dispatch___d3_dispatch_1.0.6.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_dispatch___d3_dispatch_1.0.6.tgz";
url = "https://registry.yarnpkg.com/d3-dispatch/-/d3-dispatch-1.0.6.tgz";
sha1 = "00d37bcee4dd8cd97729dd893a0ac29caaba5d58";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_drag___d3_drag_1.2.5.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_drag___d3_drag_1.2.5.tgz";
url = "https://registry.yarnpkg.com/d3-drag/-/d3-drag-1.2.5.tgz";
sha1 = "2537f451acd39d31406677b7dc77c82f7d988f70";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_dsv___d3_dsv_1.2.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_dsv___d3_dsv_1.2.0.tgz";
url = "https://registry.yarnpkg.com/d3-dsv/-/d3-dsv-1.2.0.tgz";
sha1 = "9d5f75c3a5f8abd611f74d3f5847b0d4338b885c";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_ease___d3_ease_1.0.7.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_ease___d3_ease_1.0.7.tgz";
url = "https://registry.yarnpkg.com/d3-ease/-/d3-ease-1.0.7.tgz";
sha1 = "9a834890ef8b8ae8c558b2fe55bd57f5993b85e2";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_fetch___d3_fetch_1.2.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_fetch___d3_fetch_1.2.0.tgz";
url = "https://registry.yarnpkg.com/d3-fetch/-/d3-fetch-1.2.0.tgz";
sha1 = "15ce2ecfc41b092b1db50abd2c552c2316cf7fc7";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
name = "d3_force___d3_force_1.2.1.tgz";
path = fetchurl {
name = "d3_force___d3_force_1.2.1.tgz";
url = "https://registry.yarnpkg.com/d3-force/-/d3-force-1.2.1.tgz";
sha1 = "fd29a5d1ff181c9e7f0669e4bd72bdb0e914ec0b";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_format___d3_format_1.4.5.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_format___d3_format_1.4.5.tgz";
url = "https://registry.yarnpkg.com/d3-format/-/d3-format-1.4.5.tgz";
sha1 = "374f2ba1320e3717eb74a9356c67daee17a7edb4";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_geo___d3_geo_1.12.1.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_geo___d3_geo_1.12.1.tgz";
url = "https://registry.yarnpkg.com/d3-geo/-/d3-geo-1.12.1.tgz";
sha1 = "7fc2ab7414b72e59fbcbd603e80d9adc029b035f";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_hierarchy___d3_hierarchy_1.1.9.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_hierarchy___d3_hierarchy_1.1.9.tgz";
url = "https://registry.yarnpkg.com/d3-hierarchy/-/d3-hierarchy-1.1.9.tgz";
sha1 = "2f6bee24caaea43f8dc37545fa01628559647a83";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_interpolate___d3_interpolate_1.4.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_interpolate___d3_interpolate_1.4.0.tgz";
url = "https://registry.yarnpkg.com/d3-interpolate/-/d3-interpolate-1.4.0.tgz";
sha1 = "526e79e2d80daa383f9e0c1c1c7dcc0f0583e987";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_path___d3_path_1.0.9.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_path___d3_path_1.0.9.tgz";
url = "https://registry.yarnpkg.com/d3-path/-/d3-path-1.0.9.tgz";
sha1 = "48c050bb1fe8c262493a8caf5524e3e9591701cf";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_polygon___d3_polygon_1.0.6.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_polygon___d3_polygon_1.0.6.tgz";
url = "https://registry.yarnpkg.com/d3-polygon/-/d3-polygon-1.0.6.tgz";
sha1 = "0bf8cb8180a6dc107f518ddf7975e12abbfbd38e";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_quadtree___d3_quadtree_1.0.7.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_quadtree___d3_quadtree_1.0.7.tgz";
url = "https://registry.yarnpkg.com/d3-quadtree/-/d3-quadtree-1.0.7.tgz";
sha1 = "ca8b84df7bb53763fe3c2f24bd435137f4e53135";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
name = "d3_random___d3_random_1.1.2.tgz";
path = fetchurl {
name = "d3_random___d3_random_1.1.2.tgz";
url = "https://registry.yarnpkg.com/d3-random/-/d3-random-1.1.2.tgz";
sha1 = "2833be7c124360bf9e2d3fd4f33847cfe6cab291";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_scale_chromatic___d3_scale_chromatic_1.5.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_scale_chromatic___d3_scale_chromatic_1.5.0.tgz";
url = "https://registry.yarnpkg.com/d3-scale-chromatic/-/d3-scale-chromatic-1.5.0.tgz";
sha1 = "54e333fc78212f439b14641fb55801dd81135a98";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
name = "d3_scale___d3_scale_2.2.2.tgz";
path = fetchurl {
name = "d3_scale___d3_scale_2.2.2.tgz";
url = "https://registry.yarnpkg.com/d3-scale/-/d3-scale-2.2.2.tgz";
sha1 = "4e880e0b2745acaaddd3ede26a9e908a9e17b81f";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_selection___d3_selection_1.4.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_selection___d3_selection_1.4.2.tgz";
url = "https://registry.yarnpkg.com/d3-selection/-/d3-selection-1.4.2.tgz";
sha1 = "dcaa49522c0dbf32d6c1858afc26b6094555bc5c";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_shape___d3_shape_1.3.7.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_shape___d3_shape_1.3.7.tgz";
url = "https://registry.yarnpkg.com/d3-shape/-/d3-shape-1.3.7.tgz";
sha1 = "df63801be07bc986bc54f63789b4fe502992b5d7";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_time_format___d3_time_format_2.3.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3_time_format___d3_time_format_2.3.0.tgz";
url = "https://registry.yarnpkg.com/d3-time-format/-/d3-time-format-2.3.0.tgz";
sha1 = "107bdc028667788a8924ba040faf1fbccd5a7850";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_time___d3_time_1.1.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_time___d3_time_1.1.0.tgz";
url = "https://registry.yarnpkg.com/d3-time/-/d3-time-1.1.0.tgz";
sha1 = "b1e19d307dae9c900b7e5b25ffc5dcc249a8a0f1";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_timer___d3_timer_1.0.10.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_timer___d3_timer_1.0.10.tgz";
url = "https://registry.yarnpkg.com/d3-timer/-/d3-timer-1.0.10.tgz";
sha1 = "dfe76b8a91748831b13b6d9c793ffbd508dd9de5";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_transition___d3_transition_1.3.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_transition___d3_transition_1.3.2.tgz";
url = "https://registry.yarnpkg.com/d3-transition/-/d3-transition-1.3.2.tgz";
sha1 = "a98ef2151be8d8600543434c1ca80140ae23b398";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
name = "d3_voronoi___d3_voronoi_1.1.4.tgz";
path = fetchurl {
name = "d3_voronoi___d3_voronoi_1.1.4.tgz";
url = "https://registry.yarnpkg.com/d3-voronoi/-/d3-voronoi-1.1.4.tgz";
sha1 = "dd3c78d7653d2bb359284ae478645d95944c8297";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_zoom___d3_zoom_1.8.3.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "d3_zoom___d3_zoom_1.8.3.tgz";
url = "https://registry.yarnpkg.com/d3-zoom/-/d3-zoom-1.8.3.tgz";
sha1 = "b6a3dbe738c7763121cd05b8a7795ffe17f4fc0a";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3___d3_5.16.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "d3___d3_5.16.0.tgz";
url = "https://registry.yarnpkg.com/d3/-/d3-5.16.0.tgz";
sha1 = "9c5e8d3b56403c79d4ed42fbd62f6113f199c877";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "dagre_d3___dagre_d3_0.6.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "dagre_d3___dagre_d3_0.6.4.tgz";
url = "https://registry.yarnpkg.com/dagre-d3/-/dagre-d3-0.6.4.tgz";
sha1 = "0728d5ce7f177ca2337df141ceb60fbe6eeb7b29";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "dagre___dagre_0.8.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "dagre___dagre_0.8.5.tgz";
url = "https://registry.yarnpkg.com/dagre/-/dagre-0.8.5.tgz";
sha1 = "ba30b0055dac12b6c1fcc247817442777d06afee";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "dashdash___dashdash_1.14.1.tgz";
path = fetchurl {
name = "dashdash___dashdash_1.14.1.tgz";
url = "https://registry.yarnpkg.com/dashdash/-/dashdash-1.14.1.tgz";
sha1 = "853cfa0f7cbe2fed5de20326b8dd581035f6e2f0";
};
}
{
name = "debug___debug_2.6.9.tgz";
path = fetchurl {
name = "debug___debug_2.6.9.tgz";
url = "https://registry.yarnpkg.com/debug/-/debug-2.6.9.tgz";
sha1 = "5d128515df134ff327e90a4c93f4e077a536341f";
};
}
{
name = "debug___debug_3.1.0.tgz";
path = fetchurl {
name = "debug___debug_3.1.0.tgz";
url = "https://registry.yarnpkg.com/debug/-/debug-3.1.0.tgz";
sha1 = "5bb5a0672628b64149566ba16819e61518c67261";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "debug___debug_4.3.1.tgz";
path = fetchurl {
name = "debug___debug_4.3.1.tgz";
url = "https://registry.yarnpkg.com/debug/-/debug-4.3.1.tgz";
sha1 = "f0d229c505e0c6d8c49ac553d1b13dc183f6b2ee";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "debug___debug_3.2.7.tgz";
path = fetchurl {
name = "debug___debug_3.2.7.tgz";
url = "https://registry.yarnpkg.com/debug/-/debug-3.2.7.tgz";
sha1 = "72580b7e9145fb39b6676f9c5e5fb100b934179a";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "debug___debug_4.3.2.tgz";
path = fetchurl {
name = "debug___debug_4.3.2.tgz";
url = "https://registry.yarnpkg.com/debug/-/debug-4.3.2.tgz";
sha1 = "f0a49c18ac8779e31d4a0c6029dfb76873c7428b";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "debug___debug_4.1.1.tgz";
path = fetchurl {
name = "debug___debug_4.1.1.tgz";
url = "https://registry.yarnpkg.com/debug/-/debug-4.1.1.tgz";
sha1 = "3b72260255109c6b589cee050f1d516139664791";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "decamelize___decamelize_4.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "decamelize___decamelize_4.0.0.tgz";
url = "https://registry.yarnpkg.com/decamelize/-/decamelize-4.0.0.tgz";
sha1 = "aa472d7bf660eb15f3494efd531cab7f2a709837";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "decode_uri_component___decode_uri_component_0.2.0.tgz";
path = fetchurl {
name = "decode_uri_component___decode_uri_component_0.2.0.tgz";
url = "https://registry.yarnpkg.com/decode-uri-component/-/decode-uri-component-0.2.0.tgz";
sha1 = "eb3913333458775cb84cd1a1fae062106bb87545";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "deep_equal___deep_equal_2.0.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "deep_equal___deep_equal_2.0.5.tgz";
url = "https://registry.yarnpkg.com/deep-equal/-/deep-equal-2.0.5.tgz";
sha1 = "55cd2fe326d83f9cbf7261ef0e060b3f724c5cb9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "deep_extend___deep_extend_0.6.0.tgz";
path = fetchurl {
name = "deep_extend___deep_extend_0.6.0.tgz";
url = "https://registry.yarnpkg.com/deep-extend/-/deep-extend-0.6.0.tgz";
sha1 = "c4fa7c95404a17a9c3e8ca7e1537312b736330ac";
};
}
{
name = "deep_freeze___deep_freeze_0.0.1.tgz";
path = fetchurl {
name = "deep_freeze___deep_freeze_0.0.1.tgz";
url = "https://registry.yarnpkg.com/deep-freeze/-/deep-freeze-0.0.1.tgz";
sha1 = "3a0b0005de18672819dfd38cd31f91179c893e84";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "deep_is___deep_is_0.1.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "deep_is___deep_is_0.1.4.tgz";
url = "https://registry.yarnpkg.com/deep-is/-/deep-is-0.1.4.tgz";
sha1 = "a6f2dce612fadd2ef1f519b73551f17e85199831";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "define_properties___define_properties_1.1.3.tgz";
path = fetchurl {
name = "define_properties___define_properties_1.1.3.tgz";
url = "https://registry.yarnpkg.com/define-properties/-/define-properties-1.1.3.tgz";
sha1 = "cf88da6cbee26fe6db7094f61d870cbd84cee9f1";
};
}
{
name = "define_property___define_property_0.2.5.tgz";
path = fetchurl {
name = "define_property___define_property_0.2.5.tgz";
url = "https://registry.yarnpkg.com/define-property/-/define-property-0.2.5.tgz";
sha1 = "c35b1ef918ec3c990f9a5bc57be04aacec5c8116";
};
}
{
name = "define_property___define_property_1.0.0.tgz";
path = fetchurl {
name = "define_property___define_property_1.0.0.tgz";
url = "https://registry.yarnpkg.com/define-property/-/define-property-1.0.0.tgz";
sha1 = "769ebaaf3f4a63aad3af9e8d304c9bbe79bfb0e6";
};
}
{
name = "define_property___define_property_2.0.2.tgz";
path = fetchurl {
name = "define_property___define_property_2.0.2.tgz";
url = "https://registry.yarnpkg.com/define-property/-/define-property-2.0.2.tgz";
sha1 = "d459689e8d654ba77e02a817f8710d702cb16e9d";
};
}
{
name = "delayed_stream___delayed_stream_1.0.0.tgz";
path = fetchurl {
name = "delayed_stream___delayed_stream_1.0.0.tgz";
url = "https://registry.yarnpkg.com/delayed-stream/-/delayed-stream-1.0.0.tgz";
sha1 = "df3ae199acadfb7d440aaae0b29e2272b24ec619";
};
}
{
name = "delegates___delegates_1.0.0.tgz";
path = fetchurl {
name = "delegates___delegates_1.0.0.tgz";
url = "https://registry.yarnpkg.com/delegates/-/delegates-1.0.0.tgz";
sha1 = "84c6e159b81904fdca59a0ef44cd870d31250f9a";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "denque___denque_1.5.1.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "denque___denque_1.5.1.tgz";
url = "https://registry.yarnpkg.com/denque/-/denque-1.5.1.tgz";
sha1 = "07f670e29c9a78f8faecb2566a1e2c11929c5cbf";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "depd___depd_1.1.2.tgz";
path = fetchurl {
name = "depd___depd_1.1.2.tgz";
url = "https://registry.yarnpkg.com/depd/-/depd-1.1.2.tgz";
sha1 = "9bcd52e14c097763e749b274c4346ed2e560b5a9";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "depd___depd_2.0.0.tgz";
path = fetchurl {
name = "depd___depd_2.0.0.tgz";
url = "https://registry.yarnpkg.com/depd/-/depd-2.0.0.tgz";
sha1 = "b696163cc757560d09cf22cc8fad1571b79e76df";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "des.js___des.js_1.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "des.js___des.js_1.0.1.tgz";
url = "https://registry.yarnpkg.com/des.js/-/des.js-1.0.1.tgz";
sha1 = "5382142e1bdc53f85d86d53e5f4aa7deb91e0843";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "destroy___destroy_1.0.4.tgz";
path = fetchurl {
name = "destroy___destroy_1.0.4.tgz";
url = "https://registry.yarnpkg.com/destroy/-/destroy-1.0.4.tgz";
sha1 = "978857442c44749e4206613e37946205826abd80";
};
}
{
name = "detect_indent___detect_indent_4.0.0.tgz";
path = fetchurl {
name = "detect_indent___detect_indent_4.0.0.tgz";
url = "https://registry.yarnpkg.com/detect-indent/-/detect-indent-4.0.0.tgz";
sha1 = "f76d064352cdf43a1cb6ce619c4ee3a9475de208";
};
}
{
name = "detect_libc___detect_libc_1.0.3.tgz";
path = fetchurl {
name = "detect_libc___detect_libc_1.0.3.tgz";
url = "https://registry.yarnpkg.com/detect-libc/-/detect-libc-1.0.3.tgz";
sha1 = "fa137c4bd698edf55cd5cd02ac559f91a4c4ba9b";
};
}
{
name = "diff-match-patch.git";
path =
let
repo = fetchgit {
url = "https://github.com/hackmdio/diff-match-patch.git";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
rev = "c2f8fb9d69aa9490b764850aa86ba442c93ccf78";
sha256 = "0hlv66cxrqih7spnissl44jd8f8x9dyvzc68fn0g2fwwrnpjjib7";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
in
hedgedoc: fix eval with `allowAliases = false`
2021-09-18 23:23:28 +01:00
runCommand "diff-match-patch.git" { buildInputs = [gnutar]; } ''
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
# Set u+w because tar-fs can't unpack archives with read-only dirs
# https://github.com/mafintosh/tar-fs/issues/79
tar cf $out --mode u+w -C ${repo} .
'';
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "diff___diff_5.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "diff___diff_5.0.0.tgz";
url = "https://registry.yarnpkg.com/diff/-/diff-5.0.0.tgz";
sha1 = "7ed6ad76d859d030787ec35855f5b1daf31d852b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "diffie_hellman___diffie_hellman_5.0.3.tgz";
path = fetchurl {
name = "diffie_hellman___diffie_hellman_5.0.3.tgz";
url = "https://registry.yarnpkg.com/diffie-hellman/-/diffie-hellman-5.0.3.tgz";
sha1 = "40e8ee98f55a2149607146921c63e1ae5f3d2875";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "dir_glob___dir_glob_3.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "dir_glob___dir_glob_3.0.1.tgz";
url = "https://registry.yarnpkg.com/dir-glob/-/dir-glob-3.0.1.tgz";
sha1 = "56dbf73d992a4a93ba1584f4534063fd2e41717f";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "doctrine___doctrine_2.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "doctrine___doctrine_2.1.0.tgz";
url = "https://registry.yarnpkg.com/doctrine/-/doctrine-2.1.0.tgz";
sha1 = "5cd01fc101621b42c4cd7f5d1a66243716d3f39d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "doctrine___doctrine_3.0.0.tgz";
path = fetchurl {
name = "doctrine___doctrine_3.0.0.tgz";
url = "https://registry.yarnpkg.com/doctrine/-/doctrine-3.0.0.tgz";
sha1 = "addebead72a6574db783639dc87a121773973961";
};
}
{
name = "dom_converter___dom_converter_0.2.0.tgz";
path = fetchurl {
name = "dom_converter___dom_converter_0.2.0.tgz";
url = "https://registry.yarnpkg.com/dom-converter/-/dom-converter-0.2.0.tgz";
sha1 = "6721a9daee2e293682955b6afe416771627bb768";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
name = "dom_serializer___dom_serializer_0.2.2.tgz";
path = fetchurl {
name = "dom_serializer___dom_serializer_0.2.2.tgz";
url = "https://registry.yarnpkg.com/dom-serializer/-/dom-serializer-0.2.2.tgz";
sha1 = "1afb81f533717175d478655debc5e332d9f9bb51";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "dom_serializer___dom_serializer_1.3.2.tgz";
path = fetchurl {
name = "dom_serializer___dom_serializer_1.3.2.tgz";
url = "https://registry.yarnpkg.com/dom-serializer/-/dom-serializer-1.3.2.tgz";
sha1 = "6206437d32ceefaec7161803230c7a20bc1b4d91";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "dom_serializer___dom_serializer_0.1.1.tgz";
path = fetchurl {
name = "dom_serializer___dom_serializer_0.1.1.tgz";
url = "https://registry.yarnpkg.com/dom-serializer/-/dom-serializer-0.1.1.tgz";
sha1 = "1ec4059e284babed36eec2941d4a970a189ce7c0";
};
}
{
name = "domain_browser___domain_browser_1.2.0.tgz";
path = fetchurl {
name = "domain_browser___domain_browser_1.2.0.tgz";
url = "https://registry.yarnpkg.com/domain-browser/-/domain-browser-1.2.0.tgz";
sha1 = "3d31f50191a6749dd1375a7f522e823d42e54eda";
};
}
{
name = "domelementtype___domelementtype_1.3.1.tgz";
path = fetchurl {
name = "domelementtype___domelementtype_1.3.1.tgz";
url = "https://registry.yarnpkg.com/domelementtype/-/domelementtype-1.3.1.tgz";
sha1 = "d048c44b37b0d10a7f2a3d5fee3f4333d790481f";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "domelementtype___domelementtype_2.2.0.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "domelementtype___domelementtype_2.2.0.tgz";
url = "https://registry.yarnpkg.com/domelementtype/-/domelementtype-2.2.0.tgz";
sha1 = "9a0b6c2782ed6a1c7323d42267183df9bd8b1d57";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "domhandler___domhandler_2.4.2.tgz";
path = fetchurl {
name = "domhandler___domhandler_2.4.2.tgz";
url = "https://registry.yarnpkg.com/domhandler/-/domhandler-2.4.2.tgz";
sha1 = "8805097e933d65e85546f726d60f5eb88b44f803";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "domhandler___domhandler_4.2.2.tgz";
path = fetchurl {
name = "domhandler___domhandler_4.2.2.tgz";
url = "https://registry.yarnpkg.com/domhandler/-/domhandler-4.2.2.tgz";
sha1 = "e825d721d19a86b8c201a35264e226c678ee755f";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "domino___domino_2.1.6.tgz";
path = fetchurl {
name = "domino___domino_2.1.6.tgz";
url = "https://registry.yarnpkg.com/domino/-/domino-2.1.6.tgz";
sha1 = "fe4ace4310526e5e7b9d12c7de01b7f485a57ffe";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "dompurify___dompurify_2.3.1.tgz";
path = fetchurl {
name = "dompurify___dompurify_2.3.1.tgz";
url = "https://registry.yarnpkg.com/dompurify/-/dompurify-2.3.1.tgz";
sha1 = "a47059ca21fd1212d3c8f71fdea6943b8bfbdf6a";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "domutils___domutils_1.5.1.tgz";
path = fetchurl {
name = "domutils___domutils_1.5.1.tgz";
url = "https://registry.yarnpkg.com/domutils/-/domutils-1.5.1.tgz";
sha1 = "dcd8488a26f563d61079e48c9f7b7e32373682cf";
};
}
{
name = "domutils___domutils_1.7.0.tgz";
path = fetchurl {
name = "domutils___domutils_1.7.0.tgz";
url = "https://registry.yarnpkg.com/domutils/-/domutils-1.7.0.tgz";
sha1 = "56ea341e834e06e6748af7a1cb25da67ea9f8c2a";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "domutils___domutils_2.8.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "domutils___domutils_2.8.0.tgz";
url = "https://registry.yarnpkg.com/domutils/-/domutils-2.8.0.tgz";
sha1 = "4437def5db6e2d1f5d6ee859bd95ca7d02048135";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "dot_case___dot_case_3.0.4.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "dot_case___dot_case_3.0.4.tgz";
url = "https://registry.yarnpkg.com/dot-case/-/dot-case-3.0.4.tgz";
sha1 = "9b2b670d00a431667a8a75ba29cd1b98809ce751";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "dottie___dottie_2.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "dottie___dottie_2.0.2.tgz";
url = "https://registry.yarnpkg.com/dottie/-/dottie-2.0.2.tgz";
sha1 = "cc91c0726ce3a054ebf11c55fbc92a7f266dd154";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "duplexify___duplexify_3.7.1.tgz";
path = fetchurl {
name = "duplexify___duplexify_3.7.1.tgz";
url = "https://registry.yarnpkg.com/duplexify/-/duplexify-3.7.1.tgz";
sha1 = "2a4df5317f6ccfd91f86d6fd25d8d8a103b88309";
};
}
{
name = "ecc_jsbn___ecc_jsbn_0.1.2.tgz";
path = fetchurl {
name = "ecc_jsbn___ecc_jsbn_0.1.2.tgz";
url = "https://registry.yarnpkg.com/ecc-jsbn/-/ecc-jsbn-0.1.2.tgz";
sha1 = "3a83a904e54353287874c564b7549386849a98c9";
};
}
{
name = "ee_first___ee_first_1.1.1.tgz";
path = fetchurl {
name = "ee_first___ee_first_1.1.1.tgz";
url = "https://registry.yarnpkg.com/ee-first/-/ee-first-1.1.1.tgz";
sha1 = "590c61156b0ae2f4f0255732a158b266bc56b21d";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "ejs___ejs_3.1.6.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "ejs___ejs_3.1.6.tgz";
url = "https://registry.yarnpkg.com/ejs/-/ejs-3.1.6.tgz";
sha1 = "5bfd0a0689743bb5268b3550cceeebbc1702822a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "electron_to_chromium___electron_to_chromium_1.3.836.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "electron_to_chromium___electron_to_chromium_1.3.836.tgz";
url = "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.3.836.tgz";
sha1 = "823cb9c98f28c64c673920f1c90ea3826596eaf9";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "elliptic___elliptic_6.5.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "elliptic___elliptic_6.5.4.tgz";
url = "https://registry.yarnpkg.com/elliptic/-/elliptic-6.5.4.tgz";
sha1 = "da37cebd31e79a1367e941b592ed1fbebd58abbb";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "emoji_regex___emoji_regex_8.0.0.tgz";
path = fetchurl {
name = "emoji_regex___emoji_regex_8.0.0.tgz";
url = "https://registry.yarnpkg.com/emoji-regex/-/emoji-regex-8.0.0.tgz";
sha1 = "e818fd69ce5ccfcb404594f842963bf53164cc37";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "emoji_regex___emoji_regex_9.2.2.tgz";
path = fetchurl {
name = "emoji_regex___emoji_regex_9.2.2.tgz";
url = "https://registry.yarnpkg.com/emoji-regex/-/emoji-regex-9.2.2.tgz";
sha1 = "840c8803b0d8047f4ff0cf963176b32d4ef3ed72";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "emojify.js___emojify.js_1.1.0.tgz";
path = fetchurl {
name = "emojify.js___emojify.js_1.1.0.tgz";
url = "https://registry.yarnpkg.com/emojify.js/-/emojify.js-1.1.0.tgz";
sha1 = "079fff223307c9007f570785e8e4935d5c398beb";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "emojis_list___emojis_list_3.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "emojis_list___emojis_list_3.0.0.tgz";
url = "https://registry.yarnpkg.com/emojis-list/-/emojis-list-3.0.0.tgz";
sha1 = "5570662046ad29e2e916e71aae260abdff4f6a78";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "enabled___enabled_2.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "enabled___enabled_2.0.0.tgz";
url = "https://registry.yarnpkg.com/enabled/-/enabled-2.0.0.tgz";
sha1 = "f9dd92ec2d6f4bbc0d5d1e64e21d61cd4665e7c2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "encodeurl___encodeurl_1.0.2.tgz";
path = fetchurl {
name = "encodeurl___encodeurl_1.0.2.tgz";
url = "https://registry.yarnpkg.com/encodeurl/-/encodeurl-1.0.2.tgz";
sha1 = "ad3ff4c86ec2d029322f5a02c3a9a606c95b3f59";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "end_of_stream___end_of_stream_1.4.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "end_of_stream___end_of_stream_1.4.4.tgz";
url = "https://registry.yarnpkg.com/end-of-stream/-/end-of-stream-1.4.4.tgz";
sha1 = "5ae64a5f45057baf3626ec14da0ca5e4b2431eb0";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "engine.io_client___engine.io_client_3.5.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "engine.io_client___engine.io_client_3.5.2.tgz";
url = "https://registry.yarnpkg.com/engine.io-client/-/engine.io-client-3.5.2.tgz";
sha1 = "0ef473621294004e9ceebe73cef0af9e36f2f5fa";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "engine.io_parser___engine.io_parser_2.2.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "engine.io_parser___engine.io_parser_2.2.1.tgz";
url = "https://registry.yarnpkg.com/engine.io-parser/-/engine.io-parser-2.2.1.tgz";
sha1 = "57ce5611d9370ee94f99641b589f94c97e4f5da7";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "engine.io___engine.io_3.5.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "engine.io___engine.io_3.5.0.tgz";
url = "https://registry.yarnpkg.com/engine.io/-/engine.io-3.5.0.tgz";
sha1 = "9d6b985c8a39b1fe87cd91eb014de0552259821b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "enhanced_resolve___enhanced_resolve_4.5.0.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "enhanced_resolve___enhanced_resolve_4.5.0.tgz";
url = "https://registry.yarnpkg.com/enhanced-resolve/-/enhanced-resolve-4.5.0.tgz";
sha1 = "2f3cfd84dbe3b487f18f2db2ef1e064a571ca5ec";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "enquirer___enquirer_2.3.6.tgz";
path = fetchurl {
name = "enquirer___enquirer_2.3.6.tgz";
url = "https://registry.yarnpkg.com/enquirer/-/enquirer-2.3.6.tgz";
sha1 = "2a7fe5dd634a1e4125a975ec994ff5456dc3734d";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "entities___entities_1.1.2.tgz";
path = fetchurl {
name = "entities___entities_1.1.2.tgz";
url = "https://registry.yarnpkg.com/entities/-/entities-1.1.2.tgz";
sha1 = "bdfa735299664dfafd34529ed4f8522a275fea56";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "entities___entities_2.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "entities___entities_2.2.0.tgz";
url = "https://registry.yarnpkg.com/entities/-/entities-2.2.0.tgz";
sha1 = "098dc90ebb83d8dffa089d55256b351d34c4da55";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "entities___entities_2.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "entities___entities_2.1.0.tgz";
url = "https://registry.yarnpkg.com/entities/-/entities-2.1.0.tgz";
sha1 = "992d3129cf7df6870b96c57858c249a120f8b8b5";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "envinfo___envinfo_7.8.1.tgz";
path = fetchurl {
name = "envinfo___envinfo_7.8.1.tgz";
url = "https://registry.yarnpkg.com/envinfo/-/envinfo-7.8.1.tgz";
sha1 = "06377e3e5f4d379fea7ac592d5ad8927e0c4d475";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "errno___errno_0.1.8.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "errno___errno_0.1.8.tgz";
url = "https://registry.yarnpkg.com/errno/-/errno-0.1.8.tgz";
sha1 = "8bb3e9c7d463be4976ff888f76b4809ebc2e811f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "error_ex___error_ex_1.3.2.tgz";
path = fetchurl {
name = "error_ex___error_ex_1.3.2.tgz";
url = "https://registry.yarnpkg.com/error-ex/-/error-ex-1.3.2.tgz";
sha1 = "b4ac40648107fdcdcfae242f428bea8a14d4f1bf";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "es_abstract___es_abstract_1.18.6.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "es_abstract___es_abstract_1.18.6.tgz";
url = "https://registry.yarnpkg.com/es-abstract/-/es-abstract-1.18.6.tgz";
sha1 = "2c44e3ea7a6255039164d26559777a6d978cb456";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "es_get_iterator___es_get_iterator_1.1.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "es_get_iterator___es_get_iterator_1.1.2.tgz";
url = "https://registry.yarnpkg.com/es-get-iterator/-/es-get-iterator-1.1.2.tgz";
sha1 = "9234c54aba713486d7ebde0220864af5e2b283f7";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "es_to_primitive___es_to_primitive_1.2.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "es_to_primitive___es_to_primitive_1.2.1.tgz";
url = "https://registry.yarnpkg.com/es-to-primitive/-/es-to-primitive-1.2.1.tgz";
sha1 = "e55cd4c9cdc188bcefb03b366c736323fc5c898a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "es6_error___es6_error_4.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "es6_error___es6_error_4.1.1.tgz";
url = "https://registry.yarnpkg.com/es6-error/-/es6-error-4.1.1.tgz";
sha1 = "9e3af407459deed47e9a91f9b885a84eb05c561d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "esbuild_loader___esbuild_loader_2.15.1.tgz";
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "esbuild_loader___esbuild_loader_2.15.1.tgz";
url = "https://registry.yarnpkg.com/esbuild-loader/-/esbuild-loader-2.15.1.tgz";
sha1 = "5a3940f5d20317f1a35720efa33e933f97c923e9";
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "esbuild___esbuild_0.12.27.tgz";
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "esbuild___esbuild_0.12.27.tgz";
url = "https://registry.yarnpkg.com/esbuild/-/esbuild-0.12.27.tgz";
sha1 = "9bcfb837111c5e89b189188dde339515b213a724";
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "escalade___escalade_3.1.1.tgz";
path = fetchurl {
name = "escalade___escalade_3.1.1.tgz";
url = "https://registry.yarnpkg.com/escalade/-/escalade-3.1.1.tgz";
sha1 = "d8cfdc7000965c5a0174b4a82eaa5c0552742e40";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "escape_html___escape_html_1.0.3.tgz";
path = fetchurl {
name = "escape_html___escape_html_1.0.3.tgz";
url = "https://registry.yarnpkg.com/escape-html/-/escape-html-1.0.3.tgz";
sha1 = "0258eae4d3d0c0974de1c169188ef0051d1d1988";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "escape_string_regexp___escape_string_regexp_4.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "escape_string_regexp___escape_string_regexp_4.0.0.tgz";
url = "https://registry.yarnpkg.com/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz";
sha1 = "14ba83a5d373e3d311e5afca29cf5bfad965bf34";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "escape_string_regexp___escape_string_regexp_1.0.5.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "escape_string_regexp___escape_string_regexp_1.0.5.tgz";
url = "https://registry.yarnpkg.com/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz";
sha1 = "1b61c0562190a8dff6ae3bb2cf0200ca130b86d4";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "eslint_config_standard___eslint_config_standard_16.0.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "eslint_config_standard___eslint_config_standard_16.0.3.tgz";
url = "https://registry.yarnpkg.com/eslint-config-standard/-/eslint-config-standard-16.0.3.tgz";
sha1 = "6c8761e544e96c531ff92642eeb87842b8488516";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "eslint_import_resolver_node___eslint_import_resolver_node_0.3.6.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "eslint_import_resolver_node___eslint_import_resolver_node_0.3.6.tgz";
url = "https://registry.yarnpkg.com/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.6.tgz";
sha1 = "4048b958395da89668252001dbd9eca6b83bacbd";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "eslint_module_utils___eslint_module_utils_2.6.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "eslint_module_utils___eslint_module_utils_2.6.2.tgz";
url = "https://registry.yarnpkg.com/eslint-module-utils/-/eslint-module-utils-2.6.2.tgz";
sha1 = "94e5540dd15fe1522e8ffa3ec8db3b7fa7e7a534";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "eslint_plugin_es___eslint_plugin_es_3.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "eslint_plugin_es___eslint_plugin_es_3.0.1.tgz";
url = "https://registry.yarnpkg.com/eslint-plugin-es/-/eslint-plugin-es-3.0.1.tgz";
sha1 = "75a7cdfdccddc0589934aeeb384175f221c57893";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "eslint_plugin_import___eslint_plugin_import_2.24.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "eslint_plugin_import___eslint_plugin_import_2.24.2.tgz";
url = "https://registry.yarnpkg.com/eslint-plugin-import/-/eslint-plugin-import-2.24.2.tgz";
sha1 = "2c8cd2e341f3885918ee27d18479910ade7bb4da";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "eslint_plugin_node___eslint_plugin_node_11.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "eslint_plugin_node___eslint_plugin_node_11.1.0.tgz";
url = "https://registry.yarnpkg.com/eslint-plugin-node/-/eslint-plugin-node-11.1.0.tgz";
sha1 = "c95544416ee4ada26740a30474eefc5402dc671d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "eslint_plugin_promise___eslint_plugin_promise_5.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "eslint_plugin_promise___eslint_plugin_promise_5.1.0.tgz";
url = "https://registry.yarnpkg.com/eslint-plugin-promise/-/eslint-plugin-promise-5.1.0.tgz";
sha1 = "fb2188fb734e4557993733b41aa1a688f46c6f24";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "eslint_plugin_standard___eslint_plugin_standard_4.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "eslint_plugin_standard___eslint_plugin_standard_4.1.0.tgz";
url = "https://registry.yarnpkg.com/eslint-plugin-standard/-/eslint-plugin-standard-4.1.0.tgz";
sha1 = "0c3bf3a67e853f8bbbc580fb4945fbf16f41b7c5";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "eslint_scope___eslint_scope_4.0.3.tgz";
path = fetchurl {
name = "eslint_scope___eslint_scope_4.0.3.tgz";
url = "https://registry.yarnpkg.com/eslint-scope/-/eslint-scope-4.0.3.tgz";
sha1 = "ca03833310f6889a3264781aa82e63eb9cfe7848";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "eslint_scope___eslint_scope_5.1.1.tgz";
path = fetchurl {
name = "eslint_scope___eslint_scope_5.1.1.tgz";
url = "https://registry.yarnpkg.com/eslint-scope/-/eslint-scope-5.1.1.tgz";
sha1 = "e786e59a66cb92b3f6c1fb0d508aab174848f48c";
};
}
{
name = "eslint_utils___eslint_utils_2.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "eslint_utils___eslint_utils_2.1.0.tgz";
url = "https://registry.yarnpkg.com/eslint-utils/-/eslint-utils-2.1.0.tgz";
sha1 = "d2de5e03424e707dc10c74068ddedae708741b27";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "eslint_visitor_keys___eslint_visitor_keys_1.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "eslint_visitor_keys___eslint_visitor_keys_1.3.0.tgz";
url = "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-1.3.0.tgz";
sha1 = "30ebd1ef7c2fdff01c3a4f151044af25fab0523e";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "eslint_visitor_keys___eslint_visitor_keys_2.1.0.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "eslint_visitor_keys___eslint_visitor_keys_2.1.0.tgz";
url = "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz";
sha1 = "f65328259305927392c938ed44eb0a5c9b2bd303";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "eslint___eslint_7.32.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "eslint___eslint_7.32.0.tgz";
url = "https://registry.yarnpkg.com/eslint/-/eslint-7.32.0.tgz";
sha1 = "c6d328a14be3fb08c8d1d21e12c02fdb7a2a812d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "espree___espree_7.3.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "espree___espree_7.3.1.tgz";
url = "https://registry.yarnpkg.com/espree/-/espree-7.3.1.tgz";
sha1 = "f2df330b752c6f55019f8bd89b7660039c1bbbb6";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "esprima___esprima_4.0.1.tgz";
path = fetchurl {
name = "esprima___esprima_4.0.1.tgz";
url = "https://registry.yarnpkg.com/esprima/-/esprima-4.0.1.tgz";
sha1 = "13b04cdb3e6c5d19df91ab6987a8695619b0aa71";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "esquery___esquery_1.4.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "esquery___esquery_1.4.0.tgz";
url = "https://registry.yarnpkg.com/esquery/-/esquery-1.4.0.tgz";
sha1 = "2148ffc38b82e8c7057dfed48425b3e61f0f24a5";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "esrecurse___esrecurse_4.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "esrecurse___esrecurse_4.3.0.tgz";
url = "https://registry.yarnpkg.com/esrecurse/-/esrecurse-4.3.0.tgz";
sha1 = "7ad7964d679abb28bee72cec63758b1c5d2c9921";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "estraverse___estraverse_4.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "estraverse___estraverse_4.3.0.tgz";
url = "https://registry.yarnpkg.com/estraverse/-/estraverse-4.3.0.tgz";
sha1 = "398ad3f3c5a24948be7725e83d11a7de28cdbd1d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "estraverse___estraverse_5.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "estraverse___estraverse_5.2.0.tgz";
url = "https://registry.yarnpkg.com/estraverse/-/estraverse-5.2.0.tgz";
sha1 = "307df42547e6cc7324d3cf03c155d5cdb8c53880";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
name = "esutils___esutils_2.0.3.tgz";
path = fetchurl {
name = "esutils___esutils_2.0.3.tgz";
url = "https://registry.yarnpkg.com/esutils/-/esutils-2.0.3.tgz";
sha1 = "74d2eb4de0b8da1293711910d50775b9b710ef64";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "etag___etag_1.8.1.tgz";
path = fetchurl {
name = "etag___etag_1.8.1.tgz";
url = "https://registry.yarnpkg.com/etag/-/etag-1.8.1.tgz";
sha1 = "41ae2eeb65efa62268aebfea83ac7d79299b0887";
};
}
{
name = "eve_raphael___eve_raphael_0.5.0.tgz";
path = fetchurl {
name = "eve_raphael___eve_raphael_0.5.0.tgz";
url = "https://registry.yarnpkg.com/eve-raphael/-/eve-raphael-0.5.0.tgz";
sha1 = "17c754b792beef3fa6684d79cf5a47c63c4cda30";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "eve___eve_0.5.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "eve___eve_0.5.4.tgz";
url = "https://registry.yarnpkg.com/eve/-/eve-0.5.4.tgz";
sha1 = "67d080b9725291d7e389e34c26860dd97f1debaa";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "events___events_1.1.1.tgz";
path = fetchurl {
name = "events___events_1.1.1.tgz";
url = "https://registry.yarnpkg.com/events/-/events-1.1.1.tgz";
sha1 = "9ebdb7635ad099c70dcc4c2a1f5004288e8bd924";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "events___events_3.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "events___events_3.3.0.tgz";
url = "https://registry.yarnpkg.com/events/-/events-3.3.0.tgz";
sha1 = "31a95ad0a924e2d2c419a813aeb2c4e878ea7400";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "evp_bytestokey___evp_bytestokey_1.0.3.tgz";
path = fetchurl {
name = "evp_bytestokey___evp_bytestokey_1.0.3.tgz";
url = "https://registry.yarnpkg.com/evp_bytestokey/-/evp_bytestokey-1.0.3.tgz";
sha1 = "7fcbdb198dc71959432efe13842684e0525acb02";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "execa___execa_5.1.1.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "execa___execa_5.1.1.tgz";
url = "https://registry.yarnpkg.com/execa/-/execa-5.1.1.tgz";
sha1 = "f80ad9cbf4298f7bd1d4c9555c21e93741c411dd";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "exit_on_epipe___exit_on_epipe_1.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "exit_on_epipe___exit_on_epipe_1.0.1.tgz";
url = "https://registry.yarnpkg.com/exit-on-epipe/-/exit-on-epipe-1.0.1.tgz";
sha1 = "0bdd92e87d5285d267daa8171d0eb06159689692";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "expand_brackets___expand_brackets_0.1.5.tgz";
path = fetchurl {
name = "expand_brackets___expand_brackets_0.1.5.tgz";
url = "https://registry.yarnpkg.com/expand-brackets/-/expand-brackets-0.1.5.tgz";
sha1 = "df07284e342a807cd733ac5af72411e581d1177b";
};
}
{
name = "expand_brackets___expand_brackets_2.1.4.tgz";
path = fetchurl {
name = "expand_brackets___expand_brackets_2.1.4.tgz";
url = "https://registry.yarnpkg.com/expand-brackets/-/expand-brackets-2.1.4.tgz";
sha1 = "b77735e315ce30f6b6eff0f83b04151a22449622";
};
}
{
name = "expand_range___expand_range_1.8.2.tgz";
path = fetchurl {
name = "expand_range___expand_range_1.8.2.tgz";
url = "https://registry.yarnpkg.com/expand-range/-/expand-range-1.8.2.tgz";
sha1 = "a299effd335fe2721ebae8e257ec79644fc85337";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "exports_loader___exports_loader_1.1.1.tgz";
path = fetchurl {
name = "exports_loader___exports_loader_1.1.1.tgz";
url = "https://registry.yarnpkg.com/exports-loader/-/exports-loader-1.1.1.tgz";
sha1 = "88c9a6877ee6a5519d7c41a016bdd99148421e69";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "expose_loader___expose_loader_1.0.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "expose_loader___expose_loader_1.0.3.tgz";
url = "https://registry.yarnpkg.com/expose-loader/-/expose-loader-1.0.3.tgz";
sha1 = "5686d3b78cac8831c4af11c3dc361563deb8a9c0";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "express_session___express_session_1.17.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "express_session___express_session_1.17.2.tgz";
url = "https://registry.yarnpkg.com/express-session/-/express-session-1.17.2.tgz";
sha1 = "397020374f9bf7997f891b85ea338767b30d0efd";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "express___express_4.17.1.tgz";
path = fetchurl {
name = "express___express_4.17.1.tgz";
url = "https://registry.yarnpkg.com/express/-/express-4.17.1.tgz";
sha1 = "4491fc38605cf51f8629d39c2b5d026f98a4c134";
};
}
{
name = "extend_shallow___extend_shallow_2.0.1.tgz";
path = fetchurl {
name = "extend_shallow___extend_shallow_2.0.1.tgz";
url = "https://registry.yarnpkg.com/extend-shallow/-/extend-shallow-2.0.1.tgz";
sha1 = "51af7d614ad9a9f610ea1bafbb989d6b1c56890f";
};
}
{
name = "extend_shallow___extend_shallow_3.0.2.tgz";
path = fetchurl {
name = "extend_shallow___extend_shallow_3.0.2.tgz";
url = "https://registry.yarnpkg.com/extend-shallow/-/extend-shallow-3.0.2.tgz";
sha1 = "26a71aaf073b39fb2127172746131c2704028db8";
};
}
{
name = "extend___extend_3.0.0.tgz";
path = fetchurl {
name = "extend___extend_3.0.0.tgz";
url = "https://registry.yarnpkg.com/extend/-/extend-3.0.0.tgz";
sha1 = "5a474353b9f3353ddd8176dfd37b91c83a46f1d4";
};
}
{
name = "extend___extend_3.0.2.tgz";
path = fetchurl {
name = "extend___extend_3.0.2.tgz";
url = "https://registry.yarnpkg.com/extend/-/extend-3.0.2.tgz";
sha1 = "f8b1136b4071fbd8eb140aff858b1019ec2915fa";
};
}
{
name = "extglob___extglob_0.3.2.tgz";
path = fetchurl {
name = "extglob___extglob_0.3.2.tgz";
url = "https://registry.yarnpkg.com/extglob/-/extglob-0.3.2.tgz";
sha1 = "2e18ff3d2f49ab2765cec9023f011daa8d8349a1";
};
}
{
name = "extglob___extglob_2.0.4.tgz";
path = fetchurl {
name = "extglob___extglob_2.0.4.tgz";
url = "https://registry.yarnpkg.com/extglob/-/extglob-2.0.4.tgz";
sha1 = "ad00fe4dc612a9232e8718711dc5cb5ab0285543";
};
}
{
name = "extsprintf___extsprintf_1.3.0.tgz";
path = fetchurl {
name = "extsprintf___extsprintf_1.3.0.tgz";
url = "https://registry.yarnpkg.com/extsprintf/-/extsprintf-1.3.0.tgz";
sha1 = "96918440e3041a7a414f8c52e3c574eb3c3e1e05";
};
}
{
name = "extsprintf___extsprintf_1.4.0.tgz";
path = fetchurl {
name = "extsprintf___extsprintf_1.4.0.tgz";
url = "https://registry.yarnpkg.com/extsprintf/-/extsprintf-1.4.0.tgz";
sha1 = "e2689f8f356fad62cca65a3a91c5df5f9551692f";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "fast_deep_equal___fast_deep_equal_3.1.3.tgz";
path = fetchurl {
name = "fast_deep_equal___fast_deep_equal_3.1.3.tgz";
url = "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz";
sha1 = "3a7d56b559d6cbc3eb512325244e619a65c6c525";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "fast_glob___fast_glob_3.2.7.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "fast_glob___fast_glob_3.2.7.tgz";
url = "https://registry.yarnpkg.com/fast-glob/-/fast-glob-3.2.7.tgz";
sha1 = "fd6cb7a2d7e9aa7a7846111e85a196d6b2f766a1";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "fast_json_stable_stringify___fast_json_stable_stringify_2.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "fast_json_stable_stringify___fast_json_stable_stringify_2.1.0.tgz";
url = "https://registry.yarnpkg.com/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz";
sha1 = "874bf69c6f404c2b5d99c481341399fd55892633";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "fast_levenshtein___fast_levenshtein_2.0.6.tgz";
path = fetchurl {
name = "fast_levenshtein___fast_levenshtein_2.0.6.tgz";
url = "https://registry.yarnpkg.com/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz";
sha1 = "3d8a5c66883a16a30ca8643e851f19baa7797917";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "fast_safe_stringify___fast_safe_stringify_2.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "fast_safe_stringify___fast_safe_stringify_2.1.1.tgz";
url = "https://registry.yarnpkg.com/fast-safe-stringify/-/fast-safe-stringify-2.1.1.tgz";
sha1 = "c406a83b6e70d9e35ce3b30a81141df30aeba884";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "fast_xml_parser___fast_xml_parser_3.20.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "fast_xml_parser___fast_xml_parser_3.20.0.tgz";
url = "https://registry.yarnpkg.com/fast-xml-parser/-/fast-xml-parser-3.20.0.tgz";
sha1 = "b9ce9ddbc44d2cb7e38f846c5929c667bbf0936d";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "fastest_levenshtein___fastest_levenshtein_1.0.12.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "fastest_levenshtein___fastest_levenshtein_1.0.12.tgz";
url = "https://registry.yarnpkg.com/fastest-levenshtein/-/fastest-levenshtein-1.0.12.tgz";
sha1 = "9990f7d3a88cc5a9ffd1f1745745251700d497e2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "fastq___fastq_1.13.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "fastq___fastq_1.13.0.tgz";
url = "https://registry.yarnpkg.com/fastq/-/fastq-1.13.0.tgz";
sha1 = "616760f88a7526bdfc596b7cab8c18938c36b98c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "fault___fault_2.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "fault___fault_2.0.0.tgz";
url = "https://registry.yarnpkg.com/fault/-/fault-2.0.0.tgz";
sha1 = "ad2198a6e28e344dcda76a7b32406b1039f0b707";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "fecha___fecha_4.2.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "fecha___fecha_4.2.1.tgz";
url = "https://registry.yarnpkg.com/fecha/-/fecha-4.2.1.tgz";
sha1 = "0a83ad8f86ef62a091e22bb5a039cd03d23eecce";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "figgy_pudding___figgy_pudding_3.5.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "figgy_pudding___figgy_pudding_3.5.2.tgz";
url = "https://registry.yarnpkg.com/figgy-pudding/-/figgy-pudding-3.5.2.tgz";
sha1 = "b4eee8148abb01dcf1d1ac34367d59e12fa61d6e";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "file_entry_cache___file_entry_cache_6.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "file_entry_cache___file_entry_cache_6.0.1.tgz";
url = "https://registry.yarnpkg.com/file-entry-cache/-/file-entry-cache-6.0.1.tgz";
sha1 = "211b2dd9659cb0394b073e7323ac3c933d522027";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "file_loader___file_loader_6.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "file_loader___file_loader_6.2.0.tgz";
url = "https://registry.yarnpkg.com/file-loader/-/file-loader-6.2.0.tgz";
sha1 = "baef7cf8e1840df325e4390b4484879480eebe4d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "file_saver___file_saver_2.0.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "file_saver___file_saver_2.0.5.tgz";
url = "https://registry.yarnpkg.com/file-saver/-/file-saver-2.0.5.tgz";
sha1 = "d61cfe2ce059f414d899e9dd6d4107ee25670c38";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "file_type___file_type_16.5.3.tgz";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "file_type___file_type_16.5.3.tgz";
url = "https://registry.yarnpkg.com/file-type/-/file-type-16.5.3.tgz";
sha1 = "474b7e88c74724046abb505e9b8ed4db30c4fc06";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
name = "file_uri_to_path___file_uri_to_path_1.0.0.tgz";
path = fetchurl {
name = "file_uri_to_path___file_uri_to_path_1.0.0.tgz";
url = "https://registry.yarnpkg.com/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz";
sha1 = "553a7b8446ff6f684359c445f1e37a05dacc33dd";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "filelist___filelist_1.0.2.tgz";
path = fetchurl {
name = "filelist___filelist_1.0.2.tgz";
url = "https://registry.yarnpkg.com/filelist/-/filelist-1.0.2.tgz";
sha1 = "80202f21462d4d1c2e214119b1807c1bc0380e5b";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "filename_regex___filename_regex_2.0.1.tgz";
path = fetchurl {
name = "filename_regex___filename_regex_2.0.1.tgz";
url = "https://registry.yarnpkg.com/filename-regex/-/filename-regex-2.0.1.tgz";
sha1 = "c1c4b9bee3e09725ddb106b75c1e301fe2f18b26";
};
}
{
name = "fill_range___fill_range_2.2.4.tgz";
path = fetchurl {
name = "fill_range___fill_range_2.2.4.tgz";
url = "https://registry.yarnpkg.com/fill-range/-/fill-range-2.2.4.tgz";
sha1 = "eb1e773abb056dcd8df2bfdf6af59b8b3a936565";
};
}
{
name = "fill_range___fill_range_4.0.0.tgz";
path = fetchurl {
name = "fill_range___fill_range_4.0.0.tgz";
url = "https://registry.yarnpkg.com/fill-range/-/fill-range-4.0.0.tgz";
sha1 = "d544811d428f98eb06a63dc402d2403c328c38f7";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "fill_range___fill_range_7.0.1.tgz";
path = fetchurl {
name = "fill_range___fill_range_7.0.1.tgz";
url = "https://registry.yarnpkg.com/fill-range/-/fill-range-7.0.1.tgz";
sha1 = "1919a6a7c75fe38b2c7c77e5198535da9acdda40";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "finalhandler___finalhandler_1.1.2.tgz";
path = fetchurl {
name = "finalhandler___finalhandler_1.1.2.tgz";
url = "https://registry.yarnpkg.com/finalhandler/-/finalhandler-1.1.2.tgz";
sha1 = "b7e7d000ffd11938d0fdb053506f6ebabe9f587d";
};
}
{
name = "find_cache_dir___find_cache_dir_1.0.0.tgz";
path = fetchurl {
name = "find_cache_dir___find_cache_dir_1.0.0.tgz";
url = "https://registry.yarnpkg.com/find-cache-dir/-/find-cache-dir-1.0.0.tgz";
sha1 = "9288e3e9e3cc3748717d39eade17cf71fc30ee6f";
};
}
{
name = "find_cache_dir___find_cache_dir_2.1.0.tgz";
path = fetchurl {
name = "find_cache_dir___find_cache_dir_2.1.0.tgz";
url = "https://registry.yarnpkg.com/find-cache-dir/-/find-cache-dir-2.1.0.tgz";
sha1 = "8d0f94cd13fe43c6c7c261a0d86115ca918c05f7";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "find_cache_dir___find_cache_dir_3.3.2.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "find_cache_dir___find_cache_dir_3.3.2.tgz";
url = "https://registry.yarnpkg.com/find-cache-dir/-/find-cache-dir-3.3.2.tgz";
sha1 = "b30c5b6eff0730731aea9bbd9dbecbd80256d64b";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "find_up___find_up_5.0.0.tgz";
path = fetchurl {
name = "find_up___find_up_5.0.0.tgz";
url = "https://registry.yarnpkg.com/find-up/-/find-up-5.0.0.tgz";
sha1 = "4c92819ecb7083561e4f4a240a86be5198f536fc";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "find_up___find_up_2.1.0.tgz";
path = fetchurl {
name = "find_up___find_up_2.1.0.tgz";
url = "https://registry.yarnpkg.com/find-up/-/find-up-2.1.0.tgz";
sha1 = "45d1b7e506c717ddd482775a2b77920a3c0c57a7";
};
}
{
name = "find_up___find_up_3.0.0.tgz";
path = fetchurl {
name = "find_up___find_up_3.0.0.tgz";
url = "https://registry.yarnpkg.com/find-up/-/find-up-3.0.0.tgz";
sha1 = "49169f1d7993430646da61ecc5ae355c21c97b73";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "find_up___find_up_4.1.0.tgz";
path = fetchurl {
name = "find_up___find_up_4.1.0.tgz";
url = "https://registry.yarnpkg.com/find-up/-/find-up-4.1.0.tgz";
sha1 = "97afe7d6cdc0bc5928584b7c8d7b16e8a9aa5d19";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "flat_cache___flat_cache_3.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "flat_cache___flat_cache_3.0.4.tgz";
url = "https://registry.yarnpkg.com/flat-cache/-/flat-cache-3.0.4.tgz";
sha1 = "61b0338302b2fe9f957dcc32fc2a87f1c3048b11";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "flat___flat_5.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "flat___flat_5.0.2.tgz";
url = "https://registry.yarnpkg.com/flat/-/flat-5.0.2.tgz";
sha1 = "8ca6fe332069ffa9d324c327198c598259ceb241";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "flatted___flatted_3.2.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "flatted___flatted_3.2.2.tgz";
url = "https://registry.yarnpkg.com/flatted/-/flatted-3.2.2.tgz";
sha1 = "64bfed5cb68fe3ca78b3eb214ad97b63bedce561";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "flowchart.js___flowchart.js_1.15.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "flowchart.js___flowchart.js_1.15.0.tgz";
url = "https://registry.yarnpkg.com/flowchart.js/-/flowchart.js-1.15.0.tgz";
sha1 = "132ba2df14af0a65e67280026ef05a1ffd16569f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "flush_write_stream___flush_write_stream_1.1.1.tgz";
path = fetchurl {
name = "flush_write_stream___flush_write_stream_1.1.1.tgz";
url = "https://registry.yarnpkg.com/flush-write-stream/-/flush-write-stream-1.1.1.tgz";
sha1 = "8dd7d873a1babc207d94ead0c2e0e44276ebf2e8";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "fn.name___fn.name_1.1.0.tgz";
path = fetchurl {
name = "fn.name___fn.name_1.1.0.tgz";
url = "https://registry.yarnpkg.com/fn.name/-/fn.name-1.1.0.tgz";
sha1 = "26cad8017967aea8731bc42961d04a3d5988accc";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "follow_redirects___follow_redirects_1.14.3.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "follow_redirects___follow_redirects_1.14.3.tgz";
url = "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.14.3.tgz";
sha1 = "6ada78118d8d24caee595595accdc0ac6abd022e";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "for_in___for_in_1.0.2.tgz";
path = fetchurl {
name = "for_in___for_in_1.0.2.tgz";
url = "https://registry.yarnpkg.com/for-in/-/for-in-1.0.2.tgz";
sha1 = "81068d295a8142ec0ac726c6e2200c30fb6d5e80";
};
}
{
name = "for_own___for_own_0.1.5.tgz";
path = fetchurl {
name = "for_own___for_own_0.1.5.tgz";
url = "https://registry.yarnpkg.com/for-own/-/for-own-0.1.5.tgz";
sha1 = "5265c681a4f294dabbf17c9509b6763aa84510ce";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "foreach___foreach_2.0.5.tgz";
path = fetchurl {
name = "foreach___foreach_2.0.5.tgz";
url = "https://registry.yarnpkg.com/foreach/-/foreach-2.0.5.tgz";
sha1 = "0bee005018aeb260d0a3af3ae658dd0136ec1b99";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "forever_agent___forever_agent_0.6.1.tgz";
path = fetchurl {
name = "forever_agent___forever_agent_0.6.1.tgz";
url = "https://registry.yarnpkg.com/forever-agent/-/forever-agent-0.6.1.tgz";
sha1 = "fbc71f0c41adeb37f96c577ad1ed42d8fdacca91";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "fork_awesome___fork_awesome_1.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "fork_awesome___fork_awesome_1.2.0.tgz";
url = "https://registry.yarnpkg.com/fork-awesome/-/fork-awesome-1.2.0.tgz";
sha1 = "acd43f1e1f54510fa45209c31385b4fde3a95003";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "form_data___form_data_1.0.0_rc3.tgz";
path = fetchurl {
name = "form_data___form_data_1.0.0_rc3.tgz";
url = "https://registry.yarnpkg.com/form-data/-/form-data-1.0.0-rc3.tgz";
sha1 = "d35bc62e7fbc2937ae78f948aaa0d38d90607577";
};
}
{
name = "form_data___form_data_2.3.3.tgz";
path = fetchurl {
name = "form_data___form_data_2.3.3.tgz";
url = "https://registry.yarnpkg.com/form-data/-/form-data-2.3.3.tgz";
sha1 = "dcce52c05f644f298c6a7ab936bd724ceffbf3a6";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "format___format_0.2.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "format___format_0.2.2.tgz";
url = "https://registry.yarnpkg.com/format/-/format-0.2.2.tgz";
sha1 = "d6170107e9efdc4ed30c9dc39016df942b5cb58b";
};
}
{
name = "formidable___formidable_1.2.2.tgz";
path = fetchurl {
name = "formidable___formidable_1.2.2.tgz";
url = "https://registry.yarnpkg.com/formidable/-/formidable-1.2.2.tgz";
sha1 = "bf69aea2972982675f00865342b982986f6b8dd9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "formidable___formidable_1.0.17.tgz";
path = fetchurl {
name = "formidable___formidable_1.0.17.tgz";
url = "https://registry.yarnpkg.com/formidable/-/formidable-1.0.17.tgz";
sha1 = "ef5491490f9433b705faa77249c99029ae348559";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "forwarded___forwarded_0.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "forwarded___forwarded_0.2.0.tgz";
url = "https://registry.yarnpkg.com/forwarded/-/forwarded-0.2.0.tgz";
sha1 = "2269936428aad4c15c7ebe9779a84bf0b2a81811";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "fragment_cache___fragment_cache_0.2.1.tgz";
path = fetchurl {
name = "fragment_cache___fragment_cache_0.2.1.tgz";
url = "https://registry.yarnpkg.com/fragment-cache/-/fragment-cache-0.2.1.tgz";
sha1 = "4290fad27f13e89be7f33799c6bc5a0abfff0d19";
};
}
{
name = "fresh___fresh_0.5.2.tgz";
path = fetchurl {
name = "fresh___fresh_0.5.2.tgz";
url = "https://registry.yarnpkg.com/fresh/-/fresh-0.5.2.tgz";
sha1 = "3d8cadd90d976569fa835ab1f8e4b23a105605a7";
};
}
{
name = "from2___from2_2.3.0.tgz";
path = fetchurl {
name = "from2___from2_2.3.0.tgz";
url = "https://registry.yarnpkg.com/from2/-/from2-2.3.0.tgz";
sha1 = "8bfb5502bde4a4d36cfdeea007fcca21d7e382af";
};
}
{
name = "fs_constants___fs_constants_1.0.0.tgz";
path = fetchurl {
name = "fs_constants___fs_constants_1.0.0.tgz";
url = "https://registry.yarnpkg.com/fs-constants/-/fs-constants-1.0.0.tgz";
sha1 = "6be0de9be998ce16af8afc24497b9ee9b7ccd9ad";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "fs_minipass___fs_minipass_1.2.7.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "fs_minipass___fs_minipass_1.2.7.tgz";
url = "https://registry.yarnpkg.com/fs-minipass/-/fs-minipass-1.2.7.tgz";
sha1 = "ccff8570841e7fe4265693da88936c55aed7f7c7";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "fs_minipass___fs_minipass_2.1.0.tgz";
path = fetchurl {
name = "fs_minipass___fs_minipass_2.1.0.tgz";
url = "https://registry.yarnpkg.com/fs-minipass/-/fs-minipass-2.1.0.tgz";
sha1 = "7f5036fdbf12c63c169190cbe4199c852271f9fb";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "fs_readdir_recursive___fs_readdir_recursive_1.1.0.tgz";
path = fetchurl {
name = "fs_readdir_recursive___fs_readdir_recursive_1.1.0.tgz";
url = "https://registry.yarnpkg.com/fs-readdir-recursive/-/fs-readdir-recursive-1.1.0.tgz";
sha1 = "e32fc030a2ccee44a6b5371308da54be0b397d27";
};
}
{
name = "fs_write_stream_atomic___fs_write_stream_atomic_1.0.10.tgz";
path = fetchurl {
name = "fs_write_stream_atomic___fs_write_stream_atomic_1.0.10.tgz";
url = "https://registry.yarnpkg.com/fs-write-stream-atomic/-/fs-write-stream-atomic-1.0.10.tgz";
sha1 = "b47df53493ef911df75731e70a9ded0189db40c9";
};
}
{
name = "fs.realpath___fs.realpath_1.0.0.tgz";
path = fetchurl {
name = "fs.realpath___fs.realpath_1.0.0.tgz";
url = "https://registry.yarnpkg.com/fs.realpath/-/fs.realpath-1.0.0.tgz";
sha1 = "1504ad2523158caa40db4a2787cb01411994ea4f";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "fsevents___fsevents_1.2.13.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "fsevents___fsevents_1.2.13.tgz";
url = "https://registry.yarnpkg.com/fsevents/-/fsevents-1.2.13.tgz";
sha1 = "f325cb0455592428bcf11b383370ef70e3bfcc38";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "fsevents___fsevents_2.3.2.tgz";
path = fetchurl {
name = "fsevents___fsevents_2.3.2.tgz";
url = "https://registry.yarnpkg.com/fsevents/-/fsevents-2.3.2.tgz";
sha1 = "8a526f78b8fdf4623b709e0b975c52c24c02fd1a";
};
}
{
name = "fstream___fstream_1.0.12.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "fstream___fstream_1.0.12.tgz";
url = "https://registry.yarnpkg.com/fstream/-/fstream-1.0.12.tgz";
sha1 = "4e8ba8ee2d48be4f7d0de505455548eae5932045";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "function_bind___function_bind_1.1.1.tgz";
path = fetchurl {
name = "function_bind___function_bind_1.1.1.tgz";
url = "https://registry.yarnpkg.com/function-bind/-/function-bind-1.1.1.tgz";
sha1 = "a56899d3ea3c9bab874bb9773b7c5ede92f4895d";
};
}
{
name = "functional_red_black_tree___functional_red_black_tree_1.0.1.tgz";
path = fetchurl {
name = "functional_red_black_tree___functional_red_black_tree_1.0.1.tgz";
url = "https://registry.yarnpkg.com/functional-red-black-tree/-/functional-red-black-tree-1.0.1.tgz";
sha1 = "1b0ab3bd553b2a0d6399d29c0e3ea0b252078327";
};
}
{
name = "gauge___gauge_2.7.4.tgz";
path = fetchurl {
name = "gauge___gauge_2.7.4.tgz";
url = "https://registry.yarnpkg.com/gauge/-/gauge-2.7.4.tgz";
sha1 = "2c03405c7538c39d7eb37b317022e325fb018bf7";
};
}
{
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "generate_function___generate_function_2.3.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "generate_function___generate_function_2.3.1.tgz";
url = "https://registry.yarnpkg.com/generate-function/-/generate-function-2.3.1.tgz";
sha1 = "f069617690c10c868e73b8465746764f97c3479f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "get_caller_file___get_caller_file_1.0.3.tgz";
path = fetchurl {
name = "get_caller_file___get_caller_file_1.0.3.tgz";
url = "https://registry.yarnpkg.com/get-caller-file/-/get-caller-file-1.0.3.tgz";
sha1 = "f978fa4c90d1dfe7ff2d6beda2a515e713bdcf4a";
};
}
{
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "get_caller_file___get_caller_file_2.0.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "get_caller_file___get_caller_file_2.0.5.tgz";
url = "https://registry.yarnpkg.com/get-caller-file/-/get-caller-file-2.0.5.tgz";
sha1 = "4f94412a82db32f36e3b0b9741f8a97feb031f7e";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "get_intrinsic___get_intrinsic_1.1.1.tgz";
path = fetchurl {
name = "get_intrinsic___get_intrinsic_1.1.1.tgz";
url = "https://registry.yarnpkg.com/get-intrinsic/-/get-intrinsic-1.1.1.tgz";
sha1 = "15f59f376f855c446963948f0d24cd3637b4abc6";
};
}
{
name = "get_stream___get_stream_6.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "get_stream___get_stream_6.0.1.tgz";
url = "https://registry.yarnpkg.com/get-stream/-/get-stream-6.0.1.tgz";
sha1 = "a262d8eef67aced57c2852ad6167526a43cbf7b7";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "get_symbol_description___get_symbol_description_1.0.0.tgz";
path = fetchurl {
name = "get_symbol_description___get_symbol_description_1.0.0.tgz";
url = "https://registry.yarnpkg.com/get-symbol-description/-/get-symbol-description-1.0.0.tgz";
sha1 = "7fdb81c900101fbd564dd5f1a30af5aadc1e58d6";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "get_value___get_value_2.0.6.tgz";
path = fetchurl {
name = "get_value___get_value_2.0.6.tgz";
url = "https://registry.yarnpkg.com/get-value/-/get-value-2.0.6.tgz";
sha1 = "dc15ca1c672387ca76bd37ac0a395ba2042a2c28";
};
}
{
name = "getpass___getpass_0.1.7.tgz";
path = fetchurl {
name = "getpass___getpass_0.1.7.tgz";
url = "https://registry.yarnpkg.com/getpass/-/getpass-0.1.7.tgz";
sha1 = "5eff8e3e684d569ae4cb2b1282604e8ba62149fa";
};
}
{
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "gist_embed___gist_embed_2.6.0.tgz";
path = fetchurl {
name = "gist_embed___gist_embed_2.6.0.tgz";
url = "https://registry.yarnpkg.com/gist-embed/-/gist-embed-2.6.0.tgz";
sha1 = "1ea95703fa1fc2a1255419f6f06c67e9920649ab";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "glob_base___glob_base_0.3.0.tgz";
path = fetchurl {
name = "glob_base___glob_base_0.3.0.tgz";
url = "https://registry.yarnpkg.com/glob-base/-/glob-base-0.3.0.tgz";
sha1 = "dbb164f6221b1c0b1ccf82aea328b497df0ea3c4";
};
}
{
name = "glob_parent___glob_parent_2.0.0.tgz";
path = fetchurl {
name = "glob_parent___glob_parent_2.0.0.tgz";
url = "https://registry.yarnpkg.com/glob-parent/-/glob-parent-2.0.0.tgz";
sha1 = "81383d72db054fcccf5336daa902f182f6edbb28";
};
}
{
name = "glob_parent___glob_parent_3.1.0.tgz";
path = fetchurl {
name = "glob_parent___glob_parent_3.1.0.tgz";
url = "https://registry.yarnpkg.com/glob-parent/-/glob-parent-3.1.0.tgz";
sha1 = "9e6af6299d8d3bd2bd40430832bd113df906c5ae";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "glob_parent___glob_parent_5.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "glob_parent___glob_parent_5.1.2.tgz";
url = "https://registry.yarnpkg.com/glob-parent/-/glob-parent-5.1.2.tgz";
sha1 = "869832c58034fe68a4093c17dc15e8340d8401c4";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
{
name = "glob___glob_7.1.7.tgz";
path = fetchurl {
name = "glob___glob_7.1.7.tgz";
url = "https://registry.yarnpkg.com/glob/-/glob-7.1.7.tgz";
sha1 = "3b193e9233f01d42d0b3f78294bbeeb418f94a90";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "globals___globals_13.11.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "globals___globals_13.11.0.tgz";
url = "https://registry.yarnpkg.com/globals/-/globals-13.11.0.tgz";
sha1 = "40ef678da117fe7bd2e28f1fab24951bd0255be7";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "globals___globals_9.18.0.tgz";
path = fetchurl {
name = "globals___globals_9.18.0.tgz";
url = "https://registry.yarnpkg.com/globals/-/globals-9.18.0.tgz";
sha1 = "aa3896b3e69b487f17e31ed2143d69a8e30c2d8a";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "globby___globby_11.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "globby___globby_11.0.4.tgz";
url = "https://registry.yarnpkg.com/globby/-/globby-11.0.4.tgz";
sha1 = "2cbaff77c2f2a62e71e9b2813a67b97a3a3001a5";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "graceful_fs___graceful_fs_4.2.8.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "graceful_fs___graceful_fs_4.2.8.tgz";
url = "https://registry.yarnpkg.com/graceful-fs/-/graceful-fs-4.2.8.tgz";
sha1 = "e412b8d33f5e006593cbd3cee6df9f2cebbe802a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "graphlib___graphlib_2.1.8.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "graphlib___graphlib_2.1.8.tgz";
url = "https://registry.yarnpkg.com/graphlib/-/graphlib-2.1.8.tgz";
sha1 = "5761d414737870084c92ec7b5dbcb0592c9d35da";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "growl___growl_1.10.5.tgz";
path = fetchurl {
name = "growl___growl_1.10.5.tgz";
url = "https://registry.yarnpkg.com/growl/-/growl-1.10.5.tgz";
sha1 = "f2735dc2283674fa67478b10181059355c369e5e";
};
}
{
name = "har_schema___har_schema_2.0.0.tgz";
path = fetchurl {
name = "har_schema___har_schema_2.0.0.tgz";
url = "https://registry.yarnpkg.com/har-schema/-/har-schema-2.0.0.tgz";
sha1 = "a94c2224ebcac04782a0d9035521f24735b7ec92";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "har_validator___har_validator_5.1.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "har_validator___har_validator_5.1.5.tgz";
url = "https://registry.yarnpkg.com/har-validator/-/har-validator-5.1.5.tgz";
sha1 = "1f0803b9f8cb20c0fa13822df1ecddb36bde1efd";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "has_ansi___has_ansi_2.0.0.tgz";
path = fetchurl {
name = "has_ansi___has_ansi_2.0.0.tgz";
url = "https://registry.yarnpkg.com/has-ansi/-/has-ansi-2.0.0.tgz";
sha1 = "34f5049ce1ecdf2b0649af3ef24e45ed35416d91";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "has_bigints___has_bigints_1.0.1.tgz";
path = fetchurl {
name = "has_bigints___has_bigints_1.0.1.tgz";
url = "https://registry.yarnpkg.com/has-bigints/-/has-bigints-1.0.1.tgz";
sha1 = "64fe6acb020673e3b78db035a5af69aa9d07b113";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "has_binary2___has_binary2_1.0.3.tgz";
path = fetchurl {
name = "has_binary2___has_binary2_1.0.3.tgz";
url = "https://registry.yarnpkg.com/has-binary2/-/has-binary2-1.0.3.tgz";
sha1 = "7776ac627f3ea77250cfc332dab7ddf5e4f5d11d";
};
}
{
name = "has_color___has_color_0.1.7.tgz";
path = fetchurl {
name = "has_color___has_color_0.1.7.tgz";
url = "https://registry.yarnpkg.com/has-color/-/has-color-0.1.7.tgz";
sha1 = "67144a5260c34fc3cca677d041daf52fe7b78b2f";
};
}
{
name = "has_cors___has_cors_1.1.0.tgz";
path = fetchurl {
name = "has_cors___has_cors_1.1.0.tgz";
url = "https://registry.yarnpkg.com/has-cors/-/has-cors-1.1.0.tgz";
sha1 = "5e474793f7ea9843d1bb99c23eef49ff126fff39";
};
}
{
name = "has_flag___has_flag_3.0.0.tgz";
path = fetchurl {
name = "has_flag___has_flag_3.0.0.tgz";
url = "https://registry.yarnpkg.com/has-flag/-/has-flag-3.0.0.tgz";
sha1 = "b5d454dc2199ae225699f3467e5a07f3b955bafd";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "has_flag___has_flag_4.0.0.tgz";
path = fetchurl {
name = "has_flag___has_flag_4.0.0.tgz";
url = "https://registry.yarnpkg.com/has-flag/-/has-flag-4.0.0.tgz";
sha1 = "944771fd9c81c81265c4d6941860da06bb59479b";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "has_flag___has_flag_5.0.1.tgz";
path = fetchurl {
name = "has_flag___has_flag_5.0.1.tgz";
url = "https://registry.yarnpkg.com/has-flag/-/has-flag-5.0.1.tgz";
sha1 = "5483db2ae02a472d1d0691462fc587d1843cd940";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "has_symbols___has_symbols_1.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "has_symbols___has_symbols_1.0.2.tgz";
url = "https://registry.yarnpkg.com/has-symbols/-/has-symbols-1.0.2.tgz";
sha1 = "165d3070c00309752a1236a479331e3ac56f1423";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "has_tostringtag___has_tostringtag_1.0.0.tgz";
path = fetchurl {
name = "has_tostringtag___has_tostringtag_1.0.0.tgz";
url = "https://registry.yarnpkg.com/has-tostringtag/-/has-tostringtag-1.0.0.tgz";
sha1 = "7e133818a7d394734f941e73c3d3f9291e658b25";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "has_unicode___has_unicode_2.0.1.tgz";
path = fetchurl {
name = "has_unicode___has_unicode_2.0.1.tgz";
url = "https://registry.yarnpkg.com/has-unicode/-/has-unicode-2.0.1.tgz";
sha1 = "e0e6fe6a28cf51138855e086d1691e771de2a8b9";
};
}
{
name = "has_value___has_value_0.3.1.tgz";
path = fetchurl {
name = "has_value___has_value_0.3.1.tgz";
url = "https://registry.yarnpkg.com/has-value/-/has-value-0.3.1.tgz";
sha1 = "7b1f58bada62ca827ec0a2078025654845995e1f";
};
}
{
name = "has_value___has_value_1.0.0.tgz";
path = fetchurl {
name = "has_value___has_value_1.0.0.tgz";
url = "https://registry.yarnpkg.com/has-value/-/has-value-1.0.0.tgz";
sha1 = "18b281da585b1c5c51def24c930ed29a0be6b177";
};
}
{
name = "has_values___has_values_0.1.4.tgz";
path = fetchurl {
name = "has_values___has_values_0.1.4.tgz";
url = "https://registry.yarnpkg.com/has-values/-/has-values-0.1.4.tgz";
sha1 = "6d61de95d91dfca9b9a02089ad384bff8f62b771";
};
}
{
name = "has_values___has_values_1.0.0.tgz";
path = fetchurl {
name = "has_values___has_values_1.0.0.tgz";
url = "https://registry.yarnpkg.com/has-values/-/has-values-1.0.0.tgz";
sha1 = "95b0b63fec2146619a6fe57fe75628d5a39efe4f";
};
}
{
name = "has___has_1.0.3.tgz";
path = fetchurl {
name = "has___has_1.0.3.tgz";
url = "https://registry.yarnpkg.com/has/-/has-1.0.3.tgz";
sha1 = "722d7cbfc1f6aa8241f16dd814e011e1f41e8796";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "hash_base___hash_base_3.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "hash_base___hash_base_3.1.0.tgz";
url = "https://registry.yarnpkg.com/hash-base/-/hash-base-3.1.0.tgz";
sha1 = "55c381d9e06e1d2997a883b4a3fddfe7f0d3af33";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "hash.js___hash.js_1.1.7.tgz";
path = fetchurl {
name = "hash.js___hash.js_1.1.7.tgz";
url = "https://registry.yarnpkg.com/hash.js/-/hash.js-1.1.7.tgz";
sha1 = "0babca538e8d4ee4a0f8988d68866537a003cf42";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "hast_util_from_parse5___hast_util_from_parse5_7.1.0.tgz";
path = fetchurl {
name = "hast_util_from_parse5___hast_util_from_parse5_7.1.0.tgz";
url = "https://registry.yarnpkg.com/hast-util-from-parse5/-/hast-util-from-parse5-7.1.0.tgz";
sha1 = "c129dd3a24dd8a867ab8a029ca47e27aa54864b7";
};
}
{
name = "hast_util_is_element___hast_util_is_element_2.1.1.tgz";
path = fetchurl {
name = "hast_util_is_element___hast_util_is_element_2.1.1.tgz";
url = "https://registry.yarnpkg.com/hast-util-is-element/-/hast-util-is-element-2.1.1.tgz";
sha1 = "863019a27400dc4f1aedfa4900627f42fd75c2b7";
};
}
{
name = "hast_util_parse_selector___hast_util_parse_selector_3.1.0.tgz";
path = fetchurl {
name = "hast_util_parse_selector___hast_util_parse_selector_3.1.0.tgz";
url = "https://registry.yarnpkg.com/hast-util-parse-selector/-/hast-util-parse-selector-3.1.0.tgz";
sha1 = "a519e27e8b61bd5a98fad494ed06131ce68d9c3f";
};
}
{
name = "hast_util_to_html___hast_util_to_html_8.0.2.tgz";
path = fetchurl {
name = "hast_util_to_html___hast_util_to_html_8.0.2.tgz";
url = "https://registry.yarnpkg.com/hast-util-to-html/-/hast-util-to-html-8.0.2.tgz";
sha1 = "3445497508e2157a3169864eb43fb6ee929d3cbe";
};
}
{
name = "hast_util_whitespace___hast_util_whitespace_2.0.0.tgz";
path = fetchurl {
name = "hast_util_whitespace___hast_util_whitespace_2.0.0.tgz";
url = "https://registry.yarnpkg.com/hast-util-whitespace/-/hast-util-whitespace-2.0.0.tgz";
sha1 = "4fc1086467cc1ef5ba20673cb6b03cec3a970f1c";
};
}
{
name = "hastscript___hastscript_7.0.2.tgz";
path = fetchurl {
name = "hastscript___hastscript_7.0.2.tgz";
url = "https://registry.yarnpkg.com/hastscript/-/hastscript-7.0.2.tgz";
sha1 = "d811fc040817d91923448a28156463b2e40d590a";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "he___he_1.2.0.tgz";
path = fetchurl {
name = "he___he_1.2.0.tgz";
url = "https://registry.yarnpkg.com/he/-/he-1.2.0.tgz";
sha1 = "84ae65fa7eafb165fddb61566ae14baf05664f0f";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "helmet___helmet_4.6.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "helmet___helmet_4.6.0.tgz";
url = "https://registry.yarnpkg.com/helmet/-/helmet-4.6.0.tgz";
sha1 = "579971196ba93c5978eb019e4e8ec0e50076b4df";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "highlight.js___highlight.js_10.7.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "highlight.js___highlight.js_10.7.3.tgz";
url = "https://registry.yarnpkg.com/highlight.js/-/highlight.js-10.7.3.tgz";
sha1 = "697272e3991356e40c3cac566a74eef681756531";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "hmac_drbg___hmac_drbg_1.0.1.tgz";
path = fetchurl {
name = "hmac_drbg___hmac_drbg_1.0.1.tgz";
url = "https://registry.yarnpkg.com/hmac-drbg/-/hmac-drbg-1.0.1.tgz";
sha1 = "d2745701025a6c775a6c545793ed502fc0c649a1";
};
}
{
name = "home_or_tmp___home_or_tmp_2.0.0.tgz";
path = fetchurl {
name = "home_or_tmp___home_or_tmp_2.0.0.tgz";
url = "https://registry.yarnpkg.com/home-or-tmp/-/home-or-tmp-2.0.0.tgz";
sha1 = "e36c3f2d2cae7d746a857e38d18d5f32a7882db8";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "hosted_git_info___hosted_git_info_2.8.9.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "hosted_git_info___hosted_git_info_2.8.9.tgz";
url = "https://registry.yarnpkg.com/hosted-git-info/-/hosted-git-info-2.8.9.tgz";
sha1 = "dffc0bf9a21c02209090f2aa69429e1414daf3f9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "html_minifier_terser___html_minifier_terser_5.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "html_minifier_terser___html_minifier_terser_5.1.1.tgz";
url = "https://registry.yarnpkg.com/html-minifier-terser/-/html-minifier-terser-5.1.1.tgz";
sha1 = "922e96f1f3bb60832c2634b79884096389b1f054";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "html_void_elements___html_void_elements_2.0.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "html_void_elements___html_void_elements_2.0.0.tgz";
url = "https://registry.yarnpkg.com/html-void-elements/-/html-void-elements-2.0.0.tgz";
sha1 = "ea71bae0dd33de675cdda3c4ace1bc7584bb1071";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "html_webpack_plugin___html_webpack_plugin_4.5.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "html_webpack_plugin___html_webpack_plugin_4.5.2.tgz";
url = "https://registry.yarnpkg.com/html-webpack-plugin/-/html-webpack-plugin-4.5.2.tgz";
sha1 = "76fc83fa1a0f12dd5f7da0404a54e2699666bc12";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "htmlparser2___htmlparser2_3.10.1.tgz";
path = fetchurl {
name = "htmlparser2___htmlparser2_3.10.1.tgz";
url = "https://registry.yarnpkg.com/htmlparser2/-/htmlparser2-3.10.1.tgz";
sha1 = "bd679dc3f59897b6a34bb10749c855bb53a9392f";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "htmlparser2___htmlparser2_6.1.0.tgz";
path = fetchurl {
name = "htmlparser2___htmlparser2_6.1.0.tgz";
url = "https://registry.yarnpkg.com/htmlparser2/-/htmlparser2-6.1.0.tgz";
sha1 = "c4d762b6c3371a05dbe65e94ae43a9f845fb8fb7";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "http_errors___http_errors_1.7.2.tgz";
path = fetchurl {
name = "http_errors___http_errors_1.7.2.tgz";
url = "https://registry.yarnpkg.com/http-errors/-/http-errors-1.7.2.tgz";
sha1 = "4f5029cf13239f31036e5b2e55292bcfbcc85c8f";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "http_errors___http_errors_1.7.3.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "http_errors___http_errors_1.7.3.tgz";
url = "https://registry.yarnpkg.com/http-errors/-/http-errors-1.7.3.tgz";
sha1 = "6c619e4f9c60308c38519498c14fbb10aacebb06";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "http_signature___http_signature_1.2.0.tgz";
path = fetchurl {
name = "http_signature___http_signature_1.2.0.tgz";
url = "https://registry.yarnpkg.com/http-signature/-/http-signature-1.2.0.tgz";
sha1 = "9aecd925114772f3d95b65a60abb8f7c18fbace1";
};
}
{
name = "https_browserify___https_browserify_1.0.0.tgz";
path = fetchurl {
name = "https_browserify___https_browserify_1.0.0.tgz";
url = "https://registry.yarnpkg.com/https-browserify/-/https-browserify-1.0.0.tgz";
sha1 = "ec06c10e0a34c0f2faf199f7fd7fc78fffd03c73";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "human_signals___human_signals_2.1.0.tgz";
path = fetchurl {
name = "human_signals___human_signals_2.1.0.tgz";
url = "https://registry.yarnpkg.com/human-signals/-/human-signals-2.1.0.tgz";
sha1 = "dc91fcba42e4d06e4abaed33b3e7a3c02f514ea0";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "i18n___i18n_0.13.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "i18n___i18n_0.13.3.tgz";
url = "https://registry.yarnpkg.com/i18n/-/i18n-0.13.3.tgz";
sha1 = "5820f48d87a77cf14e064719bee9bc682ed550eb";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "iconv_lite___iconv_lite_0.4.24.tgz";
path = fetchurl {
name = "iconv_lite___iconv_lite_0.4.24.tgz";
url = "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.4.24.tgz";
sha1 = "2022b4b25fbddc21d2f524974a474aafe733908b";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "iconv_lite___iconv_lite_0.6.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "iconv_lite___iconv_lite_0.6.3.tgz";
url = "https://registry.yarnpkg.com/iconv-lite/-/iconv-lite-0.6.3.tgz";
sha1 = "a52f80bf38da1952eb5c681790719871a1a72501";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "icss_utils___icss_utils_5.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "icss_utils___icss_utils_5.1.0.tgz";
url = "https://registry.yarnpkg.com/icss-utils/-/icss-utils-5.1.0.tgz";
sha1 = "c6be6858abd013d768e98366ae47e25d5887b1ae";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "ieee754___ieee754_1.1.13.tgz";
path = fetchurl {
name = "ieee754___ieee754_1.1.13.tgz";
url = "https://registry.yarnpkg.com/ieee754/-/ieee754-1.1.13.tgz";
sha1 = "ec168558e95aa181fd87d37f55c32bbcb6708b84";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ieee754___ieee754_1.2.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ieee754___ieee754_1.2.1.tgz";
url = "https://registry.yarnpkg.com/ieee754/-/ieee754-1.2.1.tgz";
sha1 = "8eb7a10a63fff25d15a57b001586d177d1b0d352";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "iferr___iferr_0.1.5.tgz";
path = fetchurl {
name = "iferr___iferr_0.1.5.tgz";
url = "https://registry.yarnpkg.com/iferr/-/iferr-0.1.5.tgz";
sha1 = "c60eed69e6d8fdb6b3104a1fcbca1c192dc5b501";
};
}
{
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "ignore_walk___ignore_walk_3.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "ignore_walk___ignore_walk_3.0.4.tgz";
url = "https://registry.yarnpkg.com/ignore-walk/-/ignore-walk-3.0.4.tgz";
sha1 = "c9a09f69b7c7b479a5d74ac1a3c0d4236d2a6335";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "ignore___ignore_4.0.6.tgz";
path = fetchurl {
name = "ignore___ignore_4.0.6.tgz";
url = "https://registry.yarnpkg.com/ignore/-/ignore-4.0.6.tgz";
sha1 = "750e3db5862087b4737ebac8207ffd1ef27b25fc";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ignore___ignore_5.1.8.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ignore___ignore_5.1.8.tgz";
url = "https://registry.yarnpkg.com/ignore/-/ignore-5.1.8.tgz";
sha1 = "f150a8b50a34289b33e22f5889abd4d8016f0e57";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "image_size___image_size_0.5.5.tgz";
path = fetchurl {
name = "image_size___image_size_0.5.5.tgz";
url = "https://registry.yarnpkg.com/image-size/-/image-size-0.5.5.tgz";
sha1 = "09dfd4ab9d20e29eb1c3e80b8990378df9e3cb9c";
};
}
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "import_fresh___import_fresh_3.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "import_fresh___import_fresh_3.3.0.tgz";
url = "https://registry.yarnpkg.com/import-fresh/-/import-fresh-3.3.0.tgz";
sha1 = "37162c25fcb9ebaa2e6e53d5b4d88ce17d9e0c2b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "import_local___import_local_3.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "import_local___import_local_3.0.2.tgz";
url = "https://registry.yarnpkg.com/import-local/-/import-local-3.0.2.tgz";
sha1 = "a8cfd0431d1de4a2199703d003e3e62364fa6db6";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "import_meta_resolve___import_meta_resolve_1.1.1.tgz";
path = fetchurl {
name = "import_meta_resolve___import_meta_resolve_1.1.1.tgz";
url = "https://registry.yarnpkg.com/import-meta-resolve/-/import-meta-resolve-1.1.1.tgz";
sha1 = "244fd542fd1fae73550d4f8b3cde3bba1d7b2b18";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "imports_loader___imports_loader_1.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "imports_loader___imports_loader_1.2.0.tgz";
url = "https://registry.yarnpkg.com/imports-loader/-/imports-loader-1.2.0.tgz";
sha1 = "b06823d0bb42e6f5ff89bc893829000eda46693f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "imurmurhash___imurmurhash_0.1.4.tgz";
path = fetchurl {
name = "imurmurhash___imurmurhash_0.1.4.tgz";
url = "https://registry.yarnpkg.com/imurmurhash/-/imurmurhash-0.1.4.tgz";
sha1 = "9218b9b2b928a238b13dc4fb6b6d576f231453ea";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "indent_string___indent_string_4.0.0.tgz";
path = fetchurl {
name = "indent_string___indent_string_4.0.0.tgz";
url = "https://registry.yarnpkg.com/indent-string/-/indent-string-4.0.0.tgz";
sha1 = "624f8f4497d619b2d9768531d58f4122854d7251";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "indexof___indexof_0.0.1.tgz";
path = fetchurl {
name = "indexof___indexof_0.0.1.tgz";
url = "https://registry.yarnpkg.com/indexof/-/indexof-0.0.1.tgz";
sha1 = "82dc336d232b9062179d05ab3293a66059fd435d";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
name = "infer_owner___infer_owner_1.0.4.tgz";
path = fetchurl {
name = "infer_owner___infer_owner_1.0.4.tgz";
url = "https://registry.yarnpkg.com/infer-owner/-/infer-owner-1.0.4.tgz";
sha1 = "c4cefcaa8e51051c2a40ba2ce8a3d27295af9467";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "inflection___inflection_1.12.0.tgz";
path = fetchurl {
name = "inflection___inflection_1.12.0.tgz";
url = "https://registry.yarnpkg.com/inflection/-/inflection-1.12.0.tgz";
sha1 = "a200935656d6f5f6bc4dc7502e1aecb703228416";
};
}
{
name = "inflight___inflight_1.0.6.tgz";
path = fetchurl {
name = "inflight___inflight_1.0.6.tgz";
url = "https://registry.yarnpkg.com/inflight/-/inflight-1.0.6.tgz";
sha1 = "49bd6331d7d02d0c09bc910a1075ba8165b56df9";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "inherits___inherits_2.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "inherits___inherits_2.0.4.tgz";
url = "https://registry.yarnpkg.com/inherits/-/inherits-2.0.4.tgz";
sha1 = "0fa2c64f932917c3433a0ded55363aae37416b7c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "inherits___inherits_2.0.1.tgz";
path = fetchurl {
name = "inherits___inherits_2.0.1.tgz";
url = "https://registry.yarnpkg.com/inherits/-/inherits-2.0.1.tgz";
sha1 = "b17d08d326b4423e568eff719f91b0b1cbdf69f1";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
name = "inherits___inherits_2.0.3.tgz";
path = fetchurl {
name = "inherits___inherits_2.0.3.tgz";
url = "https://registry.yarnpkg.com/inherits/-/inherits-2.0.3.tgz";
sha1 = "633c2c83e3da42a502f52466022480f4208261de";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "ini___ini_1.3.8.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "ini___ini_1.3.8.tgz";
url = "https://registry.yarnpkg.com/ini/-/ini-1.3.8.tgz";
sha1 = "a29da425b48806f34767a4efce397269af28432c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "internal_slot___internal_slot_1.0.3.tgz";
path = fetchurl {
name = "internal_slot___internal_slot_1.0.3.tgz";
url = "https://registry.yarnpkg.com/internal-slot/-/internal-slot-1.0.3.tgz";
sha1 = "7347e307deeea2faac2ac6205d4bc7d34967f59c";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "interpret___interpret_2.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "interpret___interpret_2.2.0.tgz";
url = "https://registry.yarnpkg.com/interpret/-/interpret-2.2.0.tgz";
sha1 = "1a78a0b5965c40a5416d007ad6f50ad27c417df9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "invariant___invariant_2.2.4.tgz";
path = fetchurl {
name = "invariant___invariant_2.2.4.tgz";
url = "https://registry.yarnpkg.com/invariant/-/invariant-2.2.4.tgz";
sha1 = "610f3c92c9359ce1db616e538008d23ff35158e6";
};
}
{
name = "ionicons___ionicons_2.0.1.tgz";
path = fetchurl {
name = "ionicons___ionicons_2.0.1.tgz";
url = "https://registry.yarnpkg.com/ionicons/-/ionicons-2.0.1.tgz";
sha1 = "ca398113293ea870244f538f0aabbd4b5b209a3e";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ipaddr.js___ipaddr.js_1.9.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "ipaddr.js___ipaddr.js_1.9.1.tgz";
url = "https://registry.yarnpkg.com/ipaddr.js/-/ipaddr.js-1.9.1.tgz";
sha1 = "bff38543eeb8984825079ff3a2a8e6cbd46781b3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_absolute_url___is_absolute_url_3.0.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_absolute_url___is_absolute_url_3.0.3.tgz";
url = "https://registry.yarnpkg.com/is-absolute-url/-/is-absolute-url-3.0.3.tgz";
sha1 = "96c6a22b6a23929b11ea0afb1836c36ad4a5d698";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "is_accessor_descriptor___is_accessor_descriptor_0.1.6.tgz";
path = fetchurl {
name = "is_accessor_descriptor___is_accessor_descriptor_0.1.6.tgz";
url = "https://registry.yarnpkg.com/is-accessor-descriptor/-/is-accessor-descriptor-0.1.6.tgz";
sha1 = "a9e12cb3ae8d876727eeef3843f8a0897b5c98d6";
};
}
{
name = "is_accessor_descriptor___is_accessor_descriptor_1.0.0.tgz";
path = fetchurl {
name = "is_accessor_descriptor___is_accessor_descriptor_1.0.0.tgz";
url = "https://registry.yarnpkg.com/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz";
sha1 = "169c2f6d3df1f992618072365c9b0ea1f6878656";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_alphabetical___is_alphabetical_2.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_alphabetical___is_alphabetical_2.0.0.tgz";
url = "https://registry.yarnpkg.com/is-alphabetical/-/is-alphabetical-2.0.0.tgz";
sha1 = "ef6e2caea57c63450fffc7abb6cbdafc5eb96e96";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_alphanumerical___is_alphanumerical_2.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_alphanumerical___is_alphanumerical_2.0.0.tgz";
url = "https://registry.yarnpkg.com/is-alphanumerical/-/is-alphanumerical-2.0.0.tgz";
sha1 = "0fbfeb6a72d21d91143b3d182bf6cf5909ee66f6";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_arguments___is_arguments_1.1.1.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_arguments___is_arguments_1.1.1.tgz";
url = "https://registry.yarnpkg.com/is-arguments/-/is-arguments-1.1.1.tgz";
sha1 = "15b3f88fda01f2a97fec84ca761a560f123efa9b";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "is_arrayish___is_arrayish_0.2.1.tgz";
path = fetchurl {
name = "is_arrayish___is_arrayish_0.2.1.tgz";
url = "https://registry.yarnpkg.com/is-arrayish/-/is-arrayish-0.2.1.tgz";
sha1 = "77c99840527aa8ecb1a8ba697b80645a7a926a9d";
};
}
{
name = "is_arrayish___is_arrayish_0.3.2.tgz";
path = fetchurl {
name = "is_arrayish___is_arrayish_0.3.2.tgz";
url = "https://registry.yarnpkg.com/is-arrayish/-/is-arrayish-0.3.2.tgz";
sha1 = "4574a2ae56f7ab206896fb431eaeed066fdf8f03";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_bigint___is_bigint_1.0.4.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_bigint___is_bigint_1.0.4.tgz";
url = "https://registry.yarnpkg.com/is-bigint/-/is-bigint-1.0.4.tgz";
sha1 = "08147a1875bc2b32005d41ccd8291dffc6691df3";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "is_binary_path___is_binary_path_1.0.1.tgz";
path = fetchurl {
name = "is_binary_path___is_binary_path_1.0.1.tgz";
url = "https://registry.yarnpkg.com/is-binary-path/-/is-binary-path-1.0.1.tgz";
sha1 = "75f16642b480f187a711c814161fd3a4a7655898";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "is_binary_path___is_binary_path_2.1.0.tgz";
path = fetchurl {
name = "is_binary_path___is_binary_path_2.1.0.tgz";
url = "https://registry.yarnpkg.com/is-binary-path/-/is-binary-path-2.1.0.tgz";
sha1 = "ea1f7f3b80f064236e83470f86c09c254fb45b09";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
name = "is_bluebird___is_bluebird_1.0.2.tgz";
path = fetchurl {
name = "is_bluebird___is_bluebird_1.0.2.tgz";
url = "https://registry.yarnpkg.com/is-bluebird/-/is-bluebird-1.0.2.tgz";
sha1 = "096439060f4aa411abee19143a84d6a55346d6e2";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_boolean_object___is_boolean_object_1.1.2.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_boolean_object___is_boolean_object_1.1.2.tgz";
url = "https://registry.yarnpkg.com/is-boolean-object/-/is-boolean-object-1.1.2.tgz";
sha1 = "5c6dc200246dd9321ae4b885a114bb1f75f63719";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "is_buffer___is_buffer_1.1.6.tgz";
path = fetchurl {
name = "is_buffer___is_buffer_1.1.6.tgz";
url = "https://registry.yarnpkg.com/is-buffer/-/is-buffer-1.1.6.tgz";
sha1 = "efaa2ea9daa0d7ab2ea13a97b2b8ad51fefbe8be";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "is_buffer___is_buffer_2.0.5.tgz";
path = fetchurl {
name = "is_buffer___is_buffer_2.0.5.tgz";
url = "https://registry.yarnpkg.com/is-buffer/-/is-buffer-2.0.5.tgz";
sha1 = "ebc252e400d22ff8d77fa09888821a24a658c191";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_callable___is_callable_1.2.4.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_callable___is_callable_1.2.4.tgz";
url = "https://registry.yarnpkg.com/is-callable/-/is-callable-1.2.4.tgz";
sha1 = "47301d58dd0259407865547853df6d61fe471945";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_core_module___is_core_module_2.6.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_core_module___is_core_module_2.6.0.tgz";
url = "https://registry.yarnpkg.com/is-core-module/-/is-core-module-2.6.0.tgz";
sha1 = "d7553b2526fe59b92ba3e40c8df757ec8a709e19";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "is_data_descriptor___is_data_descriptor_0.1.4.tgz";
path = fetchurl {
name = "is_data_descriptor___is_data_descriptor_0.1.4.tgz";
url = "https://registry.yarnpkg.com/is-data-descriptor/-/is-data-descriptor-0.1.4.tgz";
sha1 = "0b5ee648388e2c860282e793f1856fec3f301b56";
};
}
{
name = "is_data_descriptor___is_data_descriptor_1.0.0.tgz";
path = fetchurl {
name = "is_data_descriptor___is_data_descriptor_1.0.0.tgz";
url = "https://registry.yarnpkg.com/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz";
sha1 = "d84876321d0e7add03990406abbbbd36ba9268c7";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_date_object___is_date_object_1.0.5.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_date_object___is_date_object_1.0.5.tgz";
url = "https://registry.yarnpkg.com/is-date-object/-/is-date-object-1.0.5.tgz";
sha1 = "0841d5536e724c25597bf6ea62e1bd38298df31f";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_decimal___is_decimal_2.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_decimal___is_decimal_2.0.0.tgz";
url = "https://registry.yarnpkg.com/is-decimal/-/is-decimal-2.0.0.tgz";
sha1 = "db1140337809fd043a056ae40a9bd1cdc563034c";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "is_descriptor___is_descriptor_0.1.6.tgz";
path = fetchurl {
name = "is_descriptor___is_descriptor_0.1.6.tgz";
url = "https://registry.yarnpkg.com/is-descriptor/-/is-descriptor-0.1.6.tgz";
sha1 = "366d8240dde487ca51823b1ab9f07a10a78251ca";
};
}
{
name = "is_descriptor___is_descriptor_1.0.2.tgz";
path = fetchurl {
name = "is_descriptor___is_descriptor_1.0.2.tgz";
url = "https://registry.yarnpkg.com/is-descriptor/-/is-descriptor-1.0.2.tgz";
sha1 = "3b159746a66604b04f8c81524ba365c5f14d86ec";
};
}
{
name = "is_dotfile___is_dotfile_1.0.3.tgz";
path = fetchurl {
name = "is_dotfile___is_dotfile_1.0.3.tgz";
url = "https://registry.yarnpkg.com/is-dotfile/-/is-dotfile-1.0.3.tgz";
sha1 = "a6a2f32ffd2dfb04f5ca25ecd0f6b83cf798a1e1";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "is_empty___is_empty_1.2.0.tgz";
path = fetchurl {
name = "is_empty___is_empty_1.2.0.tgz";
url = "https://registry.yarnpkg.com/is-empty/-/is-empty-1.2.0.tgz";
sha1 = "de9bb5b278738a05a0b09a57e1fb4d4a341a9f6b";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "is_equal_shallow___is_equal_shallow_0.1.3.tgz";
path = fetchurl {
name = "is_equal_shallow___is_equal_shallow_0.1.3.tgz";
url = "https://registry.yarnpkg.com/is-equal-shallow/-/is-equal-shallow-0.1.3.tgz";
sha1 = "2238098fc221de0bcfa5d9eac4c45d638aa1c534";
};
}
{
name = "is_extendable___is_extendable_0.1.1.tgz";
path = fetchurl {
name = "is_extendable___is_extendable_0.1.1.tgz";
url = "https://registry.yarnpkg.com/is-extendable/-/is-extendable-0.1.1.tgz";
sha1 = "62b110e289a471418e3ec36a617d472e301dfc89";
};
}
{
name = "is_extendable___is_extendable_1.0.1.tgz";
path = fetchurl {
name = "is_extendable___is_extendable_1.0.1.tgz";
url = "https://registry.yarnpkg.com/is-extendable/-/is-extendable-1.0.1.tgz";
sha1 = "a7470f9e426733d81bd81e1155264e3a3507cab4";
};
}
{
name = "is_extglob___is_extglob_1.0.0.tgz";
path = fetchurl {
name = "is_extglob___is_extglob_1.0.0.tgz";
url = "https://registry.yarnpkg.com/is-extglob/-/is-extglob-1.0.0.tgz";
sha1 = "ac468177c4943405a092fc8f29760c6ffc6206c0";
};
}
{
name = "is_extglob___is_extglob_2.1.1.tgz";
path = fetchurl {
name = "is_extglob___is_extglob_2.1.1.tgz";
url = "https://registry.yarnpkg.com/is-extglob/-/is-extglob-2.1.1.tgz";
sha1 = "a88c02535791f02ed37c76a1b9ea9773c833f8c2";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "is_finite___is_finite_1.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "is_finite___is_finite_1.1.0.tgz";
url = "https://registry.yarnpkg.com/is-finite/-/is-finite-1.1.0.tgz";
sha1 = "904135c77fb42c0641d6aa1bcdbc4daa8da082f3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "is_fullwidth_code_point___is_fullwidth_code_point_1.0.0.tgz";
path = fetchurl {
name = "is_fullwidth_code_point___is_fullwidth_code_point_1.0.0.tgz";
url = "https://registry.yarnpkg.com/is-fullwidth-code-point/-/is-fullwidth-code-point-1.0.0.tgz";
sha1 = "ef9e31386f031a7f0d643af82fde50c457ef00cb";
};
}
{
name = "is_fullwidth_code_point___is_fullwidth_code_point_2.0.0.tgz";
path = fetchurl {
name = "is_fullwidth_code_point___is_fullwidth_code_point_2.0.0.tgz";
url = "https://registry.yarnpkg.com/is-fullwidth-code-point/-/is-fullwidth-code-point-2.0.0.tgz";
sha1 = "a3b30a5c4f199183167aaab93beefae3ddfb654f";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "is_fullwidth_code_point___is_fullwidth_code_point_3.0.0.tgz";
path = fetchurl {
name = "is_fullwidth_code_point___is_fullwidth_code_point_3.0.0.tgz";
url = "https://registry.yarnpkg.com/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz";
sha1 = "f116f8064fe90b3f7844a38997c0b75051269f1d";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "is_fullwidth_code_point___is_fullwidth_code_point_4.0.0.tgz";
path = fetchurl {
name = "is_fullwidth_code_point___is_fullwidth_code_point_4.0.0.tgz";
url = "https://registry.yarnpkg.com/is-fullwidth-code-point/-/is-fullwidth-code-point-4.0.0.tgz";
sha1 = "fae3167c729e7463f8461ce512b080a49268aa88";
};
}
{
name = "is_generator_function___is_generator_function_1.0.10.tgz";
path = fetchurl {
name = "is_generator_function___is_generator_function_1.0.10.tgz";
url = "https://registry.yarnpkg.com/is-generator-function/-/is-generator-function-1.0.10.tgz";
sha1 = "f1558baf1ac17e0deea7c0415c438351ff2b3c72";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "is_glob___is_glob_2.0.1.tgz";
path = fetchurl {
name = "is_glob___is_glob_2.0.1.tgz";
url = "https://registry.yarnpkg.com/is-glob/-/is-glob-2.0.1.tgz";
sha1 = "d096f926a3ded5600f3fdfd91198cb0888c2d863";
};
}
{
name = "is_glob___is_glob_3.1.0.tgz";
path = fetchurl {
name = "is_glob___is_glob_3.1.0.tgz";
url = "https://registry.yarnpkg.com/is-glob/-/is-glob-3.1.0.tgz";
sha1 = "7ba5ae24217804ac70707b96922567486cc3e84a";
};
}
{
name = "is_glob___is_glob_4.0.1.tgz";
path = fetchurl {
name = "is_glob___is_glob_4.0.1.tgz";
url = "https://registry.yarnpkg.com/is-glob/-/is-glob-4.0.1.tgz";
sha1 = "7567dbe9f2f5e2467bc77ab83c4a29482407a5dc";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_hexadecimal___is_hexadecimal_2.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_hexadecimal___is_hexadecimal_2.0.0.tgz";
url = "https://registry.yarnpkg.com/is-hexadecimal/-/is-hexadecimal-2.0.0.tgz";
sha1 = "8e1ec9f48fe3eabd90161109856a23e0907a65d5";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "is_map___is_map_2.0.2.tgz";
path = fetchurl {
name = "is_map___is_map_2.0.2.tgz";
url = "https://registry.yarnpkg.com/is-map/-/is-map-2.0.2.tgz";
sha1 = "00922db8c9bf73e81b7a335827bc2a43f2b91127";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "is_negative_zero___is_negative_zero_2.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "is_negative_zero___is_negative_zero_2.0.1.tgz";
url = "https://registry.yarnpkg.com/is-negative-zero/-/is-negative-zero-2.0.1.tgz";
sha1 = "3de746c18dda2319241a53675908d8f766f11c24";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_number_object___is_number_object_1.0.6.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_number_object___is_number_object_1.0.6.tgz";
url = "https://registry.yarnpkg.com/is-number-object/-/is-number-object-1.0.6.tgz";
sha1 = "6a7aaf838c7f0686a50b4553f7e54a96494e89f0";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "is_number___is_number_2.1.0.tgz";
path = fetchurl {
name = "is_number___is_number_2.1.0.tgz";
url = "https://registry.yarnpkg.com/is-number/-/is-number-2.1.0.tgz";
sha1 = "01fcbbb393463a548f2f466cce16dece49db908f";
};
}
{
name = "is_number___is_number_3.0.0.tgz";
path = fetchurl {
name = "is_number___is_number_3.0.0.tgz";
url = "https://registry.yarnpkg.com/is-number/-/is-number-3.0.0.tgz";
sha1 = "24fd6201a4782cf50561c810276afc7d12d71195";
};
}
{
name = "is_number___is_number_4.0.0.tgz";
path = fetchurl {
name = "is_number___is_number_4.0.0.tgz";
url = "https://registry.yarnpkg.com/is-number/-/is-number-4.0.0.tgz";
sha1 = "0026e37f5454d73e356dfe6564699867c6a7f0ff";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "is_number___is_number_7.0.0.tgz";
path = fetchurl {
name = "is_number___is_number_7.0.0.tgz";
url = "https://registry.yarnpkg.com/is-number/-/is-number-7.0.0.tgz";
sha1 = "7535345b896734d5f80c4d06c50955527a14f12b";
};
}
{
name = "is_plain_obj___is_plain_obj_2.1.0.tgz";
path = fetchurl {
name = "is_plain_obj___is_plain_obj_2.1.0.tgz";
url = "https://registry.yarnpkg.com/is-plain-obj/-/is-plain-obj-2.1.0.tgz";
sha1 = "45e42e37fccf1f40da8e5f76ee21515840c09287";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "is_plain_obj___is_plain_obj_4.0.0.tgz";
path = fetchurl {
name = "is_plain_obj___is_plain_obj_4.0.0.tgz";
url = "https://registry.yarnpkg.com/is-plain-obj/-/is-plain-obj-4.0.0.tgz";
sha1 = "06c0999fd7574edf5a906ba5644ad0feb3a84d22";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "is_plain_object___is_plain_object_2.0.4.tgz";
path = fetchurl {
name = "is_plain_object___is_plain_object_2.0.4.tgz";
url = "https://registry.yarnpkg.com/is-plain-object/-/is-plain-object-2.0.4.tgz";
sha1 = "2c163b3fafb1b606d9d17928f05c2a1c38e07677";
};
}
{
name = "is_posix_bracket___is_posix_bracket_0.1.1.tgz";
path = fetchurl {
name = "is_posix_bracket___is_posix_bracket_0.1.1.tgz";
url = "https://registry.yarnpkg.com/is-posix-bracket/-/is-posix-bracket-0.1.1.tgz";
sha1 = "3334dc79774368e92f016e6fbc0a88f5cd6e6bc4";
};
}
{
name = "is_primitive___is_primitive_2.0.0.tgz";
path = fetchurl {
name = "is_primitive___is_primitive_2.0.0.tgz";
url = "https://registry.yarnpkg.com/is-primitive/-/is-primitive-2.0.0.tgz";
sha1 = "207bab91638499c07b2adf240a41a87210034575";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
name = "is_property___is_property_1.0.2.tgz";
path = fetchurl {
name = "is_property___is_property_1.0.2.tgz";
url = "https://registry.yarnpkg.com/is-property/-/is-property-1.0.2.tgz";
sha1 = "57fe1c4e48474edd65b09911f26b1cd4095dda84";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_regex___is_regex_1.1.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_regex___is_regex_1.1.4.tgz";
url = "https://registry.yarnpkg.com/is-regex/-/is-regex-1.1.4.tgz";
sha1 = "eef5663cd59fa4c0ae339505323df6854bb15958";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "is_resolvable___is_resolvable_1.1.0.tgz";
path = fetchurl {
name = "is_resolvable___is_resolvable_1.1.0.tgz";
url = "https://registry.yarnpkg.com/is-resolvable/-/is-resolvable-1.1.0.tgz";
sha1 = "fb18f87ce1feb925169c9a407c19318a3206ed88";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "is_set___is_set_2.0.2.tgz";
path = fetchurl {
name = "is_set___is_set_2.0.2.tgz";
url = "https://registry.yarnpkg.com/is-set/-/is-set-2.0.2.tgz";
sha1 = "90755fa4c2562dc1c5d4024760d6119b94ca18ec";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_stream___is_stream_2.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_stream___is_stream_2.0.1.tgz";
url = "https://registry.yarnpkg.com/is-stream/-/is-stream-2.0.1.tgz";
sha1 = "fac1e3d53b97ad5a9d0ae9cef2389f5810a5c077";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_string___is_string_1.0.7.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_string___is_string_1.0.7.tgz";
url = "https://registry.yarnpkg.com/is-string/-/is-string-1.0.7.tgz";
sha1 = "0dd12bf2006f255bb58f695110eff7491eebc0fd";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "is_svg___is_svg_4.3.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "is_svg___is_svg_4.3.1.tgz";
url = "https://registry.yarnpkg.com/is-svg/-/is-svg-4.3.1.tgz";
sha1 = "8c63ec8c67c8c7f0a8de0a71c8c7d58eccf4406b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "is_symbol___is_symbol_1.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "is_symbol___is_symbol_1.0.4.tgz";
url = "https://registry.yarnpkg.com/is-symbol/-/is-symbol-1.0.4.tgz";
sha1 = "a6dac93b635b063ca6872236de88910a57af139c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_typed_array___is_typed_array_1.1.8.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "is_typed_array___is_typed_array_1.1.8.tgz";
url = "https://registry.yarnpkg.com/is-typed-array/-/is-typed-array-1.1.8.tgz";
sha1 = "cbaa6585dc7db43318bc5b89523ea384a6f65e79";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "is_typedarray___is_typedarray_1.0.0.tgz";
path = fetchurl {
name = "is_typedarray___is_typedarray_1.0.0.tgz";
url = "https://registry.yarnpkg.com/is-typedarray/-/is-typedarray-1.0.0.tgz";
sha1 = "e479c80858df0c1b11ddda6940f96011fcda4a9a";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "is_unicode_supported___is_unicode_supported_0.1.0.tgz";
path = fetchurl {
name = "is_unicode_supported___is_unicode_supported_0.1.0.tgz";
url = "https://registry.yarnpkg.com/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz";
sha1 = "3f26c76a809593b52bfa2ecb5710ed2779b522a7";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "is_weakmap___is_weakmap_2.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "is_weakmap___is_weakmap_2.0.1.tgz";
url = "https://registry.yarnpkg.com/is-weakmap/-/is-weakmap-2.0.1.tgz";
sha1 = "5008b59bdc43b698201d18f62b37b2ca243e8cf2";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "is_weakset___is_weakset_2.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "is_weakset___is_weakset_2.0.1.tgz";
url = "https://registry.yarnpkg.com/is-weakset/-/is-weakset-2.0.1.tgz";
sha1 = "e9a0af88dbd751589f5e50d80f4c98b780884f83";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "is_what___is_what_3.14.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "is_what___is_what_3.14.1.tgz";
url = "https://registry.yarnpkg.com/is-what/-/is-what-3.14.1.tgz";
sha1 = "e1222f46ddda85dead0fd1c9df131760e77755c1";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "is_windows___is_windows_1.0.2.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "is_windows___is_windows_1.0.2.tgz";
url = "https://registry.yarnpkg.com/is-windows/-/is-windows-1.0.2.tgz";
sha1 = "d1850eb9791ecd18e6182ce12a30f396634bb19d";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "is_wsl___is_wsl_1.1.0.tgz";
path = fetchurl {
name = "is_wsl___is_wsl_1.1.0.tgz";
url = "https://registry.yarnpkg.com/is-wsl/-/is-wsl-1.1.0.tgz";
sha1 = "1f16e4aa22b04d1336b66188a66af3c600c3a66d";
};
}
{
name = "isarray___isarray_0.0.1.tgz";
path = fetchurl {
name = "isarray___isarray_0.0.1.tgz";
url = "https://registry.yarnpkg.com/isarray/-/isarray-0.0.1.tgz";
sha1 = "8a18acfca9a8f4177e09abfc6038939b05d1eedf";
};
}
{
name = "isarray___isarray_1.0.0.tgz";
path = fetchurl {
name = "isarray___isarray_1.0.0.tgz";
url = "https://registry.yarnpkg.com/isarray/-/isarray-1.0.0.tgz";
sha1 = "bb935d48582cba168c06834957a54a3e07124f11";
};
}
{
name = "isarray___isarray_2.0.1.tgz";
path = fetchurl {
name = "isarray___isarray_2.0.1.tgz";
url = "https://registry.yarnpkg.com/isarray/-/isarray-2.0.1.tgz";
sha1 = "a37d94ed9cda2d59865c9f76fe596ee1f338741e";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "isarray___isarray_2.0.5.tgz";
path = fetchurl {
name = "isarray___isarray_2.0.5.tgz";
url = "https://registry.yarnpkg.com/isarray/-/isarray-2.0.5.tgz";
sha1 = "8af1e4c1221244cc62459faf38940d4e644a5723";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "isexe___isexe_2.0.0.tgz";
path = fetchurl {
name = "isexe___isexe_2.0.0.tgz";
url = "https://registry.yarnpkg.com/isexe/-/isexe-2.0.0.tgz";
sha1 = "e8fbf374dc556ff8947a10dcb0572d633f2cfa10";
};
}
{
name = "isobject___isobject_2.1.0.tgz";
path = fetchurl {
name = "isobject___isobject_2.1.0.tgz";
url = "https://registry.yarnpkg.com/isobject/-/isobject-2.1.0.tgz";
sha1 = "f065561096a3f1da2ef46272f815c840d87e0c89";
};
}
{
name = "isobject___isobject_3.0.1.tgz";
path = fetchurl {
name = "isobject___isobject_3.0.1.tgz";
url = "https://registry.yarnpkg.com/isobject/-/isobject-3.0.1.tgz";
sha1 = "4e431e92b11a9731636aa1f9c8d1ccbcfdab78df";
};
}
{
name = "isstream___isstream_0.1.2.tgz";
path = fetchurl {
name = "isstream___isstream_0.1.2.tgz";
url = "https://registry.yarnpkg.com/isstream/-/isstream-0.1.2.tgz";
sha1 = "47e63f7af55afa6f92e1500e690eb8b8529c099a";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "jake___jake_10.8.2.tgz";
path = fetchurl {
name = "jake___jake_10.8.2.tgz";
url = "https://registry.yarnpkg.com/jake/-/jake-10.8.2.tgz";
sha1 = "ebc9de8558160a66d82d0eadc6a2e58fbc500a7b";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "jmespath___jmespath_0.15.0.tgz";
path = fetchurl {
name = "jmespath___jmespath_0.15.0.tgz";
url = "https://registry.yarnpkg.com/jmespath/-/jmespath-0.15.0.tgz";
sha1 = "a3f222a9aae9f966f5d27c796510e28091764217";
};
}
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
{
name = "joycon___joycon_3.0.1.tgz";
path = fetchurl {
name = "joycon___joycon_3.0.1.tgz";
url = "https://registry.yarnpkg.com/joycon/-/joycon-3.0.1.tgz";
sha1 = "9074c9b08ccf37a6726ff74a18485f85efcaddaf";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "jquery_mousewheel___jquery_mousewheel_3.1.13.tgz";
path = fetchurl {
name = "jquery_mousewheel___jquery_mousewheel_3.1.13.tgz";
url = "https://registry.yarnpkg.com/jquery-mousewheel/-/jquery-mousewheel-3.1.13.tgz";
sha1 = "06f0335f16e353a695e7206bf50503cb523a6ee5";
};
}
{
name = "jquery_ui___jquery_ui_1.12.1.tgz";
path = fetchurl {
name = "jquery_ui___jquery_ui_1.12.1.tgz";
url = "https://registry.yarnpkg.com/jquery-ui/-/jquery-ui-1.12.1.tgz";
sha1 = "bcb4045c8dd0539c134bc1488cdd3e768a7a9e51";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "jquery___jquery_3.6.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "jquery___jquery_3.6.0.tgz";
url = "https://registry.yarnpkg.com/jquery/-/jquery-3.6.0.tgz";
sha1 = "c72a09f15c1bdce142f49dbf1170bdf8adac2470";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "js_cookie___js_cookie_3.0.1.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "js_cookie___js_cookie_3.0.1.tgz";
url = "https://registry.yarnpkg.com/js-cookie/-/js-cookie-3.0.1.tgz";
sha1 = "9e39b4c6c2f56563708d7d31f6f5f21873a92414";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "js-sequence-diagrams.git";
path =
let
repo = fetchgit {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
url = "https://github.com/hedgedoc/js-sequence-diagrams.git";
rev = "bda0e49b6c2754f3c7158b1dfb9ccf26efc24b39";
hedgedoc: fix build by re-running `yarn2nix` Failing Hydra build: https://hydra.nixos.org/build/154209534
2021-09-26 00:01:37 +01:00
sha256 = "0d2zf62fmad760rg9hrkyhp03k5apms3fm0mf64yy8q6p3iw7jvw";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
in
hedgedoc: fix eval with `allowAliases = false`
2021-09-18 23:23:28 +01:00
runCommand "js-sequence-diagrams.git" { buildInputs = [gnutar]; } ''
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
# Set u+w because tar-fs can't unpack archives with read-only dirs
# https://github.com/mafintosh/tar-fs/issues/79
tar cf $out --mode u+w -C ${repo} .
'';
}
{
name = "js_tokens___js_tokens_4.0.0.tgz";
path = fetchurl {
name = "js_tokens___js_tokens_4.0.0.tgz";
url = "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz";
sha1 = "19203fb59991df98e3a287050d4647cdeaf32499";
};
}
{
name = "js_tokens___js_tokens_3.0.2.tgz";
path = fetchurl {
name = "js_tokens___js_tokens_3.0.2.tgz";
url = "https://registry.yarnpkg.com/js-tokens/-/js-tokens-3.0.2.tgz";
sha1 = "9866df395102130e38f7f996bceb65443209c25b";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "js_yaml___js_yaml_3.14.1.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "js_yaml___js_yaml_3.14.1.tgz";
url = "https://registry.yarnpkg.com/js-yaml/-/js-yaml-3.14.1.tgz";
sha1 = "dae812fdb3825fa306609a8717383c50c36a0537";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "js_yaml___js_yaml_4.1.0.tgz";
path = fetchurl {
name = "js_yaml___js_yaml_4.1.0.tgz";
url = "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.1.0.tgz";
sha1 = "c1fb65f8f5017901cdd2c951864ba18458a10602";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "jsbn___jsbn_0.1.1.tgz";
path = fetchurl {
name = "jsbn___jsbn_0.1.1.tgz";
url = "https://registry.yarnpkg.com/jsbn/-/jsbn-0.1.1.tgz";
sha1 = "a5e654c2e5a2deb5f201d96cefbca80c0ef2f513";
};
}
{
name = "jsdom_nogyp___jsdom_nogyp_0.8.3.tgz";
path = fetchurl {
name = "jsdom_nogyp___jsdom_nogyp_0.8.3.tgz";
url = "https://registry.yarnpkg.com/jsdom-nogyp/-/jsdom-nogyp-0.8.3.tgz";
sha1 = "924b3f03cfe487dfcdf6375e6324252ceb80d0cc";
};
}
{
name = "jsesc___jsesc_1.3.0.tgz";
path = fetchurl {
name = "jsesc___jsesc_1.3.0.tgz";
url = "https://registry.yarnpkg.com/jsesc/-/jsesc-1.3.0.tgz";
sha1 = "46c3fec8c1892b12b0833db9bc7622176dbab34b";
};
}
{
name = "jsesc___jsesc_0.5.0.tgz";
path = fetchurl {
name = "jsesc___jsesc_0.5.0.tgz";
url = "https://registry.yarnpkg.com/jsesc/-/jsesc-0.5.0.tgz";
sha1 = "e7dee66e35d6fc16f710fe91d5cf69f70f08911d";
};
}
{
name = "json_edm_parser___json_edm_parser_0.1.2.tgz";
path = fetchurl {
name = "json_edm_parser___json_edm_parser_0.1.2.tgz";
url = "https://registry.yarnpkg.com/json-edm-parser/-/json-edm-parser-0.1.2.tgz";
sha1 = "1e60b0fef1bc0af67bc0d146dfdde5486cd615b4";
};
}
{
name = "json_parse_better_errors___json_parse_better_errors_1.0.2.tgz";
path = fetchurl {
name = "json_parse_better_errors___json_parse_better_errors_1.0.2.tgz";
url = "https://registry.yarnpkg.com/json-parse-better-errors/-/json-parse-better-errors-1.0.2.tgz";
sha1 = "bb867cfb3450e69107c131d1c514bab3dc8bcaa9";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "json_parse_even_better_errors___json_parse_even_better_errors_2.3.1.tgz";
path = fetchurl {
name = "json_parse_even_better_errors___json_parse_even_better_errors_2.3.1.tgz";
url = "https://registry.yarnpkg.com/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz";
sha1 = "7c47805a94319928e05777405dc12e1f7a4ee02d";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "json_schema_traverse___json_schema_traverse_0.4.1.tgz";
path = fetchurl {
name = "json_schema_traverse___json_schema_traverse_0.4.1.tgz";
url = "https://registry.yarnpkg.com/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz";
sha1 = "69f6a87d9513ab8bb8fe63bdb0979c448e684660";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "json_schema_traverse___json_schema_traverse_1.0.0.tgz";
path = fetchurl {
name = "json_schema_traverse___json_schema_traverse_1.0.0.tgz";
url = "https://registry.yarnpkg.com/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz";
sha1 = "ae7bcb3656ab77a73ba5c49bf654f38e6b6860e2";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "json_schema___json_schema_0.2.3.tgz";
path = fetchurl {
name = "json_schema___json_schema_0.2.3.tgz";
url = "https://registry.yarnpkg.com/json-schema/-/json-schema-0.2.3.tgz";
sha1 = "b480c892e59a2f05954ce727bd3f2a4e882f9e13";
};
}
{
name = "json_stable_stringify_without_jsonify___json_stable_stringify_without_jsonify_1.0.1.tgz";
path = fetchurl {
name = "json_stable_stringify_without_jsonify___json_stable_stringify_without_jsonify_1.0.1.tgz";
url = "https://registry.yarnpkg.com/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz";
sha1 = "9db7b59496ad3f3cfef30a75142d2d930ad72651";
};
}
{
name = "json_stream___json_stream_1.0.0.tgz";
path = fetchurl {
name = "json_stream___json_stream_1.0.0.tgz";
url = "https://registry.yarnpkg.com/json-stream/-/json-stream-1.0.0.tgz";
sha1 = "1a3854e28d2bbeeab31cc7ddf683d2ddc5652708";
};
}
{
name = "json_stringify_safe___json_stringify_safe_5.0.1.tgz";
path = fetchurl {
name = "json_stringify_safe___json_stringify_safe_5.0.1.tgz";
url = "https://registry.yarnpkg.com/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz";
sha1 = "1296a2d58fd45f19a0f6ce01d65701e2c735b6eb";
};
}
{
name = "json5___json5_0.5.1.tgz";
path = fetchurl {
name = "json5___json5_0.5.1.tgz";
url = "https://registry.yarnpkg.com/json5/-/json5-0.5.1.tgz";
sha1 = "1eade7acc012034ad84e2396767ead9fa5495821";
};
}
{
name = "json5___json5_1.0.1.tgz";
path = fetchurl {
name = "json5___json5_1.0.1.tgz";
url = "https://registry.yarnpkg.com/json5/-/json5-1.0.1.tgz";
sha1 = "779fb0018604fa854eacbf6252180d83543e3dbe";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "json5___json5_2.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "json5___json5_2.2.0.tgz";
url = "https://registry.yarnpkg.com/json5/-/json5-2.2.0.tgz";
sha1 = "2dfefe720c6ba525d9ebd909950f0515316c89a3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "jsonlint___jsonlint_1.6.3.tgz";
path = fetchurl {
name = "jsonlint___jsonlint_1.6.3.tgz";
url = "https://registry.yarnpkg.com/jsonlint/-/jsonlint-1.6.3.tgz";
sha1 = "cb5e31efc0b78291d0d862fbef05900adf212988";
};
}
{
name = "jsonparse___jsonparse_1.2.0.tgz";
path = fetchurl {
name = "jsonparse___jsonparse_1.2.0.tgz";
url = "https://registry.yarnpkg.com/jsonparse/-/jsonparse-1.2.0.tgz";
sha1 = "5c0c5685107160e72fe7489bddea0b44c2bc67bd";
};
}
{
name = "jsprim___jsprim_1.4.1.tgz";
path = fetchurl {
name = "jsprim___jsprim_1.4.1.tgz";
url = "https://registry.yarnpkg.com/jsprim/-/jsprim-1.4.1.tgz";
sha1 = "313e66bc1e5cc06e438bc1b7499c2e5c56acb6a2";
};
}
{
name = "keymaster___keymaster_1.6.2.tgz";
path = fetchurl {
name = "keymaster___keymaster_1.6.2.tgz";
url = "https://registry.yarnpkg.com/keymaster/-/keymaster-1.6.2.tgz";
sha1 = "e1ae54d0ea9488f9f60b66b668f02e9a1946c6eb";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "khroma___khroma_1.4.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "khroma___khroma_1.4.1.tgz";
url = "https://registry.yarnpkg.com/khroma/-/khroma-1.4.1.tgz";
sha1 = "ad6a5b6a972befc5112ce5129887a1a83af2c003";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "kind_of___kind_of_3.2.2.tgz";
path = fetchurl {
name = "kind_of___kind_of_3.2.2.tgz";
url = "https://registry.yarnpkg.com/kind-of/-/kind-of-3.2.2.tgz";
sha1 = "31ea21a734bab9bbb0f32466d893aea51e4a3c64";
};
}
{
name = "kind_of___kind_of_4.0.0.tgz";
path = fetchurl {
name = "kind_of___kind_of_4.0.0.tgz";
url = "https://registry.yarnpkg.com/kind-of/-/kind-of-4.0.0.tgz";
sha1 = "20813df3d712928b207378691a45066fae72dd57";
};
}
{
name = "kind_of___kind_of_5.1.0.tgz";
path = fetchurl {
name = "kind_of___kind_of_5.1.0.tgz";
url = "https://registry.yarnpkg.com/kind-of/-/kind-of-5.1.0.tgz";
sha1 = "729c91e2d857b7a419a1f9aa65685c4c33f5845d";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "kind_of___kind_of_6.0.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "kind_of___kind_of_6.0.3.tgz";
url = "https://registry.yarnpkg.com/kind-of/-/kind-of-6.0.3.tgz";
sha1 = "07c05034a6c349fa06e24fa35aa76db4580ce4dd";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "klona___klona_2.0.4.tgz";
path = fetchurl {
name = "klona___klona_2.0.4.tgz";
url = "https://registry.yarnpkg.com/klona/-/klona-2.0.4.tgz";
sha1 = "7bb1e3affb0cb8624547ef7e8f6708ea2e39dfc0";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "kuler___kuler_2.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "kuler___kuler_2.0.0.tgz";
url = "https://registry.yarnpkg.com/kuler/-/kuler-2.0.0.tgz";
sha1 = "e2c570a3800388fb44407e851531c1d670b061b3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "last_call_webpack_plugin___last_call_webpack_plugin_3.0.0.tgz";
path = fetchurl {
name = "last_call_webpack_plugin___last_call_webpack_plugin_3.0.0.tgz";
url = "https://registry.yarnpkg.com/last-call-webpack-plugin/-/last-call-webpack-plugin-3.0.0.tgz";
sha1 = "9742df0e10e3cf46e5c0381c2de90d3a7a2d7555";
};
}
{
name = "lazystream___lazystream_1.0.0.tgz";
path = fetchurl {
name = "lazystream___lazystream_1.0.0.tgz";
url = "https://registry.yarnpkg.com/lazystream/-/lazystream-1.0.0.tgz";
sha1 = "f6995fe0f820392f61396be89462407bb77168e4";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "ldap_filter___ldap_filter_0.3.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "ldap_filter___ldap_filter_0.3.3.tgz";
url = "https://registry.yarnpkg.com/ldap-filter/-/ldap-filter-0.3.3.tgz";
sha1 = "2b14c68a2a9d4104dbdbc910a1ca85fd189e9797";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "ldapauth_fork___ldapauth_fork_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "ldapauth_fork___ldapauth_fork_5.0.1.tgz";
url = "https://registry.yarnpkg.com/ldapauth-fork/-/ldapauth-fork-5.0.1.tgz";
sha1 = "18779a9c30371c5bbea02e3b6aaadb60819ad29c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "ldapjs___ldapjs_2.3.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "ldapjs___ldapjs_2.3.1.tgz";
url = "https://registry.yarnpkg.com/ldapjs/-/ldapjs-2.3.1.tgz";
sha1 = "04136815fb1f21d692ac87fab5961a04d86e8b04";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "less_loader___less_loader_7.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "less_loader___less_loader_7.3.0.tgz";
url = "https://registry.yarnpkg.com/less-loader/-/less-loader-7.3.0.tgz";
sha1 = "f9d6d36d18739d642067a05fb5bd70c8c61317e5";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "less___less_4.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "less___less_4.1.1.tgz";
url = "https://registry.yarnpkg.com/less/-/less-4.1.1.tgz";
sha1 = "15bf253a9939791dc690888c3ff424f3e6c7edba";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "levn___levn_0.4.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "levn___levn_0.4.1.tgz";
url = "https://registry.yarnpkg.com/levn/-/levn-0.4.1.tgz";
sha1 = "ae4562c007473b932a6200d403268dd2fffc6ade";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "libnpmconfig___libnpmconfig_1.2.1.tgz";
path = fetchurl {
name = "libnpmconfig___libnpmconfig_1.2.1.tgz";
url = "https://registry.yarnpkg.com/libnpmconfig/-/libnpmconfig-1.2.1.tgz";
sha1 = "c0c2f793a74e67d4825e5039e7a02a0044dfcbc0";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "lilconfig___lilconfig_2.0.3.tgz";
path = fetchurl {
name = "lilconfig___lilconfig_2.0.3.tgz";
url = "https://registry.yarnpkg.com/lilconfig/-/lilconfig-2.0.3.tgz";
sha1 = "68f3005e921dafbd2a2afb48379986aa6d2579fd";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "lines_and_columns___lines_and_columns_1.1.6.tgz";
path = fetchurl {
name = "lines_and_columns___lines_and_columns_1.1.6.tgz";
url = "https://registry.yarnpkg.com/lines-and-columns/-/lines-and-columns-1.1.6.tgz";
sha1 = "1c00c743b433cd0a4e80758f7b64a57440d9ff00";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "linkify_it___linkify_it_3.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "linkify_it___linkify_it_3.0.2.tgz";
url = "https://registry.yarnpkg.com/linkify-it/-/linkify-it-3.0.2.tgz";
sha1 = "f55eeb8bc1d3ae754049e124ab3bb56d97797fb8";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "list.js___list.js_2.3.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "list.js___list.js_2.3.1.tgz";
url = "https://registry.yarnpkg.com/list.js/-/list.js-2.3.1.tgz";
sha1 = "48961989ffe52b0505e352f7a521f819f51df7e7";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "load_json_file___load_json_file_4.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "load_json_file___load_json_file_4.0.0.tgz";
url = "https://registry.yarnpkg.com/load-json-file/-/load-json-file-4.0.0.tgz";
sha1 = "2f5f45ab91e33216234fd53adab668eb4ec0993b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "load_plugin___load_plugin_4.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "load_plugin___load_plugin_4.0.1.tgz";
url = "https://registry.yarnpkg.com/load-plugin/-/load-plugin-4.0.1.tgz";
sha1 = "9a239b0337064c9b8aac82b0c9f89b067db487c5";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "loader_runner___loader_runner_2.4.0.tgz";
path = fetchurl {
name = "loader_runner___loader_runner_2.4.0.tgz";
url = "https://registry.yarnpkg.com/loader-runner/-/loader-runner-2.4.0.tgz";
sha1 = "ed47066bfe534d7e84c4c7b9998c2a75607d9357";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "loader_utils___loader_utils_1.4.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "loader_utils___loader_utils_1.4.0.tgz";
url = "https://registry.yarnpkg.com/loader-utils/-/loader-utils-1.4.0.tgz";
sha1 = "c579b5e34cb34b1a74edc6c1fb36bfa371d5a613";
};
}
{
name = "loader_utils___loader_utils_2.0.0.tgz";
path = fetchurl {
name = "loader_utils___loader_utils_2.0.0.tgz";
url = "https://registry.yarnpkg.com/loader-utils/-/loader-utils-2.0.0.tgz";
sha1 = "e4cace5b816d425a166b5f097e10cd12b36064b0";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "locate_path___locate_path_2.0.0.tgz";
path = fetchurl {
name = "locate_path___locate_path_2.0.0.tgz";
url = "https://registry.yarnpkg.com/locate-path/-/locate-path-2.0.0.tgz";
sha1 = "2b568b265eec944c6d9c0de9c3dbbbca0354cd8e";
};
}
{
name = "locate_path___locate_path_3.0.0.tgz";
path = fetchurl {
name = "locate_path___locate_path_3.0.0.tgz";
url = "https://registry.yarnpkg.com/locate-path/-/locate-path-3.0.0.tgz";
sha1 = "dbec3b3ab759758071b58fe59fc41871af21400e";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "locate_path___locate_path_5.0.0.tgz";
path = fetchurl {
name = "locate_path___locate_path_5.0.0.tgz";
url = "https://registry.yarnpkg.com/locate-path/-/locate-path-5.0.0.tgz";
sha1 = "1afba396afd676a6d42504d0a67a3a7eb9f62aa0";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "locate_path___locate_path_6.0.0.tgz";
path = fetchurl {
name = "locate_path___locate_path_6.0.0.tgz";
url = "https://registry.yarnpkg.com/locate-path/-/locate-path-6.0.0.tgz";
sha1 = "55321eb309febbc59c4801d931a72452a681d286";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "lodash.assignin___lodash.assignin_4.2.0.tgz";
path = fetchurl {
name = "lodash.assignin___lodash.assignin_4.2.0.tgz";
url = "https://registry.yarnpkg.com/lodash.assignin/-/lodash.assignin-4.2.0.tgz";
sha1 = "ba8df5fb841eb0a3e8044232b0e263a8dc6a28a2";
};
}
{
name = "lodash.bind___lodash.bind_4.2.1.tgz";
path = fetchurl {
name = "lodash.bind___lodash.bind_4.2.1.tgz";
url = "https://registry.yarnpkg.com/lodash.bind/-/lodash.bind-4.2.1.tgz";
sha1 = "7ae3017e939622ac31b7d7d7dcb1b34db1690d35";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "lodash.clonedeep___lodash.clonedeep_4.5.0.tgz";
path = fetchurl {
name = "lodash.clonedeep___lodash.clonedeep_4.5.0.tgz";
url = "https://registry.yarnpkg.com/lodash.clonedeep/-/lodash.clonedeep-4.5.0.tgz";
sha1 = "e23f3f9c4f8fbdde872529c1071857a086e5ccef";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "lodash.defaults___lodash.defaults_4.2.0.tgz";
path = fetchurl {
name = "lodash.defaults___lodash.defaults_4.2.0.tgz";
url = "https://registry.yarnpkg.com/lodash.defaults/-/lodash.defaults-4.2.0.tgz";
sha1 = "d09178716ffea4dde9e5fb7b37f6f0802274580c";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "lodash.difference___lodash.difference_4.5.0.tgz";
path = fetchurl {
name = "lodash.difference___lodash.difference_4.5.0.tgz";
url = "https://registry.yarnpkg.com/lodash.difference/-/lodash.difference-4.5.0.tgz";
sha1 = "9ccb4e505d486b91651345772885a2df27fd017c";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "lodash.filter___lodash.filter_4.6.0.tgz";
path = fetchurl {
name = "lodash.filter___lodash.filter_4.6.0.tgz";
url = "https://registry.yarnpkg.com/lodash.filter/-/lodash.filter-4.6.0.tgz";
sha1 = "668b1d4981603ae1cc5a6fa760143e480b4c4ace";
};
}
{
name = "lodash.flatten___lodash.flatten_4.4.0.tgz";
path = fetchurl {
name = "lodash.flatten___lodash.flatten_4.4.0.tgz";
url = "https://registry.yarnpkg.com/lodash.flatten/-/lodash.flatten-4.4.0.tgz";
sha1 = "f31c22225a9632d2bbf8e4addbef240aa765a61f";
};
}
{
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "lodash.foreach___lodash.foreach_4.5.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "lodash.foreach___lodash.foreach_4.5.0.tgz";
url = "https://registry.yarnpkg.com/lodash.foreach/-/lodash.foreach-4.5.0.tgz";
sha1 = "1a6a35eace401280c7f06dddec35165ab27e3e53";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "lodash.get___lodash.get_4.4.2.tgz";
path = fetchurl {
name = "lodash.get___lodash.get_4.4.2.tgz";
url = "https://registry.yarnpkg.com/lodash.get/-/lodash.get-4.4.2.tgz";
sha1 = "2d177f652fa31e939b4438d5341499dfa3825e99";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "lodash.isplainobject___lodash.isplainobject_4.0.6.tgz";
path = fetchurl {
name = "lodash.isplainobject___lodash.isplainobject_4.0.6.tgz";
url = "https://registry.yarnpkg.com/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz";
sha1 = "7c526a52d89b45c45cc690b88163be0497f550cb";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "lodash.map___lodash.map_4.6.0.tgz";
path = fetchurl {
name = "lodash.map___lodash.map_4.6.0.tgz";
url = "https://registry.yarnpkg.com/lodash.map/-/lodash.map-4.6.0.tgz";
sha1 = "771ec7839e3473d9c4cde28b19394c3562f4f6d3";
};
}
{
name = "lodash.memoize___lodash.memoize_4.1.2.tgz";
path = fetchurl {
name = "lodash.memoize___lodash.memoize_4.1.2.tgz";
url = "https://registry.yarnpkg.com/lodash.memoize/-/lodash.memoize-4.1.2.tgz";
sha1 = "bcc6c49a42a2840ed997f323eada5ecd182e0bfe";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "lodash.merge___lodash.merge_4.6.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "lodash.merge___lodash.merge_4.6.2.tgz";
url = "https://registry.yarnpkg.com/lodash.merge/-/lodash.merge-4.6.2.tgz";
sha1 = "558aa53b43b661e1925a0afdfa36a9a1085fe57a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "lodash.pick___lodash.pick_4.4.0.tgz";
path = fetchurl {
name = "lodash.pick___lodash.pick_4.4.0.tgz";
url = "https://registry.yarnpkg.com/lodash.pick/-/lodash.pick-4.4.0.tgz";
sha1 = "52f05610fff9ded422611441ed1fc123a03001b3";
};
}
{
name = "lodash.reduce___lodash.reduce_4.6.0.tgz";
path = fetchurl {
name = "lodash.reduce___lodash.reduce_4.6.0.tgz";
url = "https://registry.yarnpkg.com/lodash.reduce/-/lodash.reduce-4.6.0.tgz";
sha1 = "f1ab6b839299ad48f784abbf476596f03b914d3b";
};
}
{
name = "lodash.reject___lodash.reject_4.6.0.tgz";
path = fetchurl {
name = "lodash.reject___lodash.reject_4.6.0.tgz";
url = "https://registry.yarnpkg.com/lodash.reject/-/lodash.reject-4.6.0.tgz";
sha1 = "80d6492dc1470864bbf583533b651f42a9f52415";
};
}
{
name = "lodash.some___lodash.some_4.6.0.tgz";
path = fetchurl {
name = "lodash.some___lodash.some_4.6.0.tgz";
url = "https://registry.yarnpkg.com/lodash.some/-/lodash.some-4.6.0.tgz";
sha1 = "1bb9f314ef6b8baded13b549169b2a945eb68e4d";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "lodash.truncate___lodash.truncate_4.4.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "lodash.truncate___lodash.truncate_4.4.2.tgz";
url = "https://registry.yarnpkg.com/lodash.truncate/-/lodash.truncate-4.4.2.tgz";
sha1 = "5a350da0b1113b837ecfffd5812cbe58d6eae193";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "lodash.union___lodash.union_4.6.0.tgz";
path = fetchurl {
name = "lodash.union___lodash.union_4.6.0.tgz";
url = "https://registry.yarnpkg.com/lodash.union/-/lodash.union-4.6.0.tgz";
sha1 = "48bb5088409f16f1821666641c44dd1aaae3cd88";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "lodash.uniq___lodash.uniq_4.5.0.tgz";
path = fetchurl {
name = "lodash.uniq___lodash.uniq_4.5.0.tgz";
url = "https://registry.yarnpkg.com/lodash.uniq/-/lodash.uniq-4.5.0.tgz";
sha1 = "d0225373aeb652adc1bc82e4945339a842754773";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "lodash___lodash_4.17.21.tgz";
path = fetchurl {
name = "lodash___lodash_4.17.21.tgz";
url = "https://registry.yarnpkg.com/lodash/-/lodash-4.17.21.tgz";
sha1 = "679591c564c3bffaae8454cf0b3df370c3d6911c";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "log_symbols___log_symbols_4.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "log_symbols___log_symbols_4.1.0.tgz";
url = "https://registry.yarnpkg.com/log-symbols/-/log-symbols-4.1.0.tgz";
sha1 = "3fbdbb95b4683ac9fc785111e792e558d4abd503";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "logform___logform_2.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "logform___logform_2.2.0.tgz";
url = "https://registry.yarnpkg.com/logform/-/logform-2.2.0.tgz";
sha1 = "40f036d19161fc76b68ab50fdc7fe495544492f2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
name = "long___long_4.0.0.tgz";
path = fetchurl {
name = "long___long_4.0.0.tgz";
url = "https://registry.yarnpkg.com/long/-/long-4.0.0.tgz";
sha1 = "9a7b71cfb7d361a194ea555241c92f7468d5bf28";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "longest_streak___longest_streak_3.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "longest_streak___longest_streak_3.0.0.tgz";
url = "https://registry.yarnpkg.com/longest-streak/-/longest-streak-3.0.0.tgz";
sha1 = "f127e2bded83caa6a35ac5f7a2f2b2f94b36f3dc";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "loose_envify___loose_envify_1.4.0.tgz";
path = fetchurl {
name = "loose_envify___loose_envify_1.4.0.tgz";
url = "https://registry.yarnpkg.com/loose-envify/-/loose-envify-1.4.0.tgz";
sha1 = "71ee51fa7be4caec1a63839f7e682d8132d30caf";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "lower_case___lower_case_2.0.2.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "lower_case___lower_case_2.0.2.tgz";
url = "https://registry.yarnpkg.com/lower-case/-/lower-case-2.0.2.tgz";
sha1 = "6fa237c63dbdc4a82ca0fd882e4722dc5e634e28";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "lru_cache___lru_cache_4.1.5.tgz";
path = fetchurl {
name = "lru_cache___lru_cache_4.1.5.tgz";
url = "https://registry.yarnpkg.com/lru-cache/-/lru-cache-4.1.5.tgz";
sha1 = "8bbe50ea85bed59bc9e33dcab8235ee9bcf443cd";
};
}
{
name = "lru_cache___lru_cache_5.1.1.tgz";
path = fetchurl {
name = "lru_cache___lru_cache_5.1.1.tgz";
url = "https://registry.yarnpkg.com/lru-cache/-/lru-cache-5.1.1.tgz";
sha1 = "1da27e6710271947695daf6848e847f01d84b920";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "lru_cache___lru_cache_6.0.0.tgz";
path = fetchurl {
name = "lru_cache___lru_cache_6.0.0.tgz";
url = "https://registry.yarnpkg.com/lru-cache/-/lru-cache-6.0.0.tgz";
sha1 = "6d6fe6570ebd96aaf90fcad1dafa3b2566db3a94";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "lutim___lutim_1.0.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "lutim___lutim_1.0.3.tgz";
url = "https://registry.yarnpkg.com/lutim/-/lutim-1.0.3.tgz";
sha1 = "3a29d0f2731eed7097f2d7367defeaa2ae45d820";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "lz-string.git";
path =
let
repo = fetchgit {
url = "https://github.com/hackmdio/lz-string.git";
rev = "efd1f64676264d6d8871b01f4f375fc6ef4f9022";
sha256 = "036v1a9z79mc961xxx0rw8p6n2w1z8bnqpapgfg2kbw8f87jfxyi";
};
in
hedgedoc: fix eval with `allowAliases = false`
2021-09-18 23:23:28 +01:00
runCommand "lz-string.git" { buildInputs = [gnutar]; } ''
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
# Set u+w because tar-fs can't unpack archives with read-only dirs
# https://github.com/mafintosh/tar-fs/issues/79
tar cf $out --mode u+w -C ${repo} .
'';
}
{
name = "make_dir___make_dir_1.3.0.tgz";
path = fetchurl {
name = "make_dir___make_dir_1.3.0.tgz";
url = "https://registry.yarnpkg.com/make-dir/-/make-dir-1.3.0.tgz";
sha1 = "79c1033b80515bd6d24ec9933e860ca75ee27f0c";
};
}
{
name = "make_dir___make_dir_2.1.0.tgz";
path = fetchurl {
name = "make_dir___make_dir_2.1.0.tgz";
url = "https://registry.yarnpkg.com/make-dir/-/make-dir-2.1.0.tgz";
sha1 = "5f0310e18b8be898cc07009295a30ae41e91e6f5";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "make_dir___make_dir_3.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "make_dir___make_dir_3.1.0.tgz";
url = "https://registry.yarnpkg.com/make-dir/-/make-dir-3.1.0.tgz";
sha1 = "415e967046b3a7f1d185277d84aa58203726a13f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "make_plural___make_plural_4.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "make_plural___make_plural_4.3.0.tgz";
url = "https://registry.yarnpkg.com/make-plural/-/make-plural-4.3.0.tgz";
sha1 = "f23de08efdb0cac2e0c9ba9f315b0dff6b4c2735";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "make_plural___make_plural_6.2.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "make_plural___make_plural_6.2.2.tgz";
url = "https://registry.yarnpkg.com/make-plural/-/make-plural-6.2.2.tgz";
sha1 = "beb5fd751355e72660eeb2218bb98eec92853c6c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "map_cache___map_cache_0.2.2.tgz";
path = fetchurl {
name = "map_cache___map_cache_0.2.2.tgz";
url = "https://registry.yarnpkg.com/map-cache/-/map-cache-0.2.2.tgz";
sha1 = "c32abd0bd6525d9b051645bb4f26ac5dc98a0dbf";
};
}
{
name = "map_visit___map_visit_1.0.0.tgz";
path = fetchurl {
name = "map_visit___map_visit_1.0.0.tgz";
url = "https://registry.yarnpkg.com/map-visit/-/map-visit-1.0.0.tgz";
sha1 = "ecdca8f13144e660f1b5bd41f12f3479d98dfb8f";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mariadb___mariadb_2.5.4.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mariadb___mariadb_2.5.4.tgz";
url = "https://registry.yarnpkg.com/mariadb/-/mariadb-2.5.4.tgz";
sha1 = "c66daa35e2768b8c714c758453531c06ae4927f4";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "markdown_it_abbr___markdown_it_abbr_1.0.4.tgz";
path = fetchurl {
name = "markdown_it_abbr___markdown_it_abbr_1.0.4.tgz";
url = "https://registry.yarnpkg.com/markdown-it-abbr/-/markdown-it-abbr-1.0.4.tgz";
sha1 = "d66b5364521cbb3dd8aa59dadfba2fb6865c8fd8";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "markdown_it_container___markdown_it_container_3.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "markdown_it_container___markdown_it_container_3.0.0.tgz";
url = "https://registry.yarnpkg.com/markdown-it-container/-/markdown-it-container-3.0.0.tgz";
sha1 = "1d19b06040a020f9a827577bb7dbf67aa5de9a5b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "markdown_it_deflist___markdown_it_deflist_2.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "markdown_it_deflist___markdown_it_deflist_2.1.0.tgz";
url = "https://registry.yarnpkg.com/markdown-it-deflist/-/markdown-it-deflist-2.1.0.tgz";
sha1 = "50d7a56b9544cd81252f7623bd785e28a8dcef5c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "markdown_it_emoji___markdown_it_emoji_2.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "markdown_it_emoji___markdown_it_emoji_2.0.0.tgz";
url = "https://registry.yarnpkg.com/markdown-it-emoji/-/markdown-it-emoji-2.0.0.tgz";
sha1 = "3164ad4c009efd946e98274f7562ad611089a231";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "markdown_it_footnote___markdown_it_footnote_3.0.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "markdown_it_footnote___markdown_it_footnote_3.0.3.tgz";
url = "https://registry.yarnpkg.com/markdown-it-footnote/-/markdown-it-footnote-3.0.3.tgz";
sha1 = "e0e4c0d67390a4c5f0c75f73be605c7c190ca4d8";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "markdown_it_imsize___markdown_it_imsize_2.0.1.tgz";
path = fetchurl {
name = "markdown_it_imsize___markdown_it_imsize_2.0.1.tgz";
url = "https://registry.yarnpkg.com/markdown-it-imsize/-/markdown-it-imsize-2.0.1.tgz";
sha1 = "cca0427905d05338a247cb9ca9d968c5cddd5170";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "markdown_it_ins___markdown_it_ins_3.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "markdown_it_ins___markdown_it_ins_3.0.1.tgz";
url = "https://registry.yarnpkg.com/markdown-it-ins/-/markdown-it-ins-3.0.1.tgz";
sha1 = "c09356b917cf1dbf73add0b275d67ab8c73d4b4d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "markdown_it_mark___markdown_it_mark_3.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "markdown_it_mark___markdown_it_mark_3.0.1.tgz";
url = "https://registry.yarnpkg.com/markdown-it-mark/-/markdown-it-mark-3.0.1.tgz";
sha1 = "51257db58787d78aaf46dc13418d99a9f3f0ebd3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "markdown_it_mathjax___markdown_it_mathjax_2.0.0.tgz";
path = fetchurl {
name = "markdown_it_mathjax___markdown_it_mathjax_2.0.0.tgz";
url = "https://registry.yarnpkg.com/markdown-it-mathjax/-/markdown-it-mathjax-2.0.0.tgz";
sha1 = "ae2b4f4c5c719a03f9e475c664f7b2685231d9e9";
};
}
{
name = "markdown_it_regexp___markdown_it_regexp_0.4.0.tgz";
path = fetchurl {
name = "markdown_it_regexp___markdown_it_regexp_0.4.0.tgz";
url = "https://registry.yarnpkg.com/markdown-it-regexp/-/markdown-it-regexp-0.4.0.tgz";
sha1 = "d64d713eecec55ce4cfdeb321750ecc099e2c2dc";
};
}
{
name = "markdown_it_sub___markdown_it_sub_1.0.0.tgz";
path = fetchurl {
name = "markdown_it_sub___markdown_it_sub_1.0.0.tgz";
url = "https://registry.yarnpkg.com/markdown-it-sub/-/markdown-it-sub-1.0.0.tgz";
sha1 = "375fd6026eae7ddcb012497f6411195ea1e3afe8";
};
}
{
name = "markdown_it_sup___markdown_it_sup_1.0.0.tgz";
path = fetchurl {
name = "markdown_it_sup___markdown_it_sup_1.0.0.tgz";
url = "https://registry.yarnpkg.com/markdown-it-sup/-/markdown-it-sup-1.0.0.tgz";
sha1 = "cb9c9ff91a5255ac08f3fd3d63286e15df0a1fc3";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "markdown_it___markdown_it_12.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "markdown_it___markdown_it_12.2.0.tgz";
url = "https://registry.yarnpkg.com/markdown-it/-/markdown-it-12.2.0.tgz";
sha1 = "091f720fd5db206f80de7a8d1f1a7035fd0d38db";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "marked___marked_2.1.3.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "marked___marked_2.1.3.tgz";
url = "https://registry.yarnpkg.com/marked/-/marked-2.1.3.tgz";
sha1 = "bd017cef6431724fd4b27e0657f5ceb14bff3753";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "math_interval_parser___math_interval_parser_2.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "math_interval_parser___math_interval_parser_2.0.1.tgz";
url = "https://registry.yarnpkg.com/math-interval-parser/-/math-interval-parser-2.0.1.tgz";
sha1 = "e22cd6d15a0a7f4c03aec560db76513da615bed4";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "math_random___math_random_1.0.4.tgz";
path = fetchurl {
name = "math_random___math_random_1.0.4.tgz";
url = "https://registry.yarnpkg.com/math-random/-/math-random-1.0.4.tgz";
sha1 = "5dd6943c938548267016d4e34f057583080c514c";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "mathjax___mathjax_2.7.9.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "mathjax___mathjax_2.7.9.tgz";
url = "https://registry.yarnpkg.com/mathjax/-/mathjax-2.7.9.tgz";
sha1 = "d6b67955c173e7d719fcb2fc0288662884eb7d3d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "mattermost___mattermost_3.4.0.tgz";
path = fetchurl {
name = "mattermost___mattermost_3.4.0.tgz";
url = "https://registry.yarnpkg.com/mattermost/-/mattermost-3.4.0.tgz";
sha1 = "7e4958e1bc96c7da7bc5f179dd2c6ae5035a8857";
};
}
{
name = "md5.js___md5.js_1.3.4.tgz";
path = fetchurl {
name = "md5.js___md5.js_1.3.4.tgz";
url = "https://registry.yarnpkg.com/md5.js/-/md5.js-1.3.4.tgz";
sha1 = "e9bdbde94a20a5ac18b04340fc5764d5b09d901d";
};
}
{
name = "md5.js___md5.js_1.3.5.tgz";
path = fetchurl {
name = "md5.js___md5.js_1.3.5.tgz";
url = "https://registry.yarnpkg.com/md5.js/-/md5.js-1.3.5.tgz";
sha1 = "b5d07b8e3216e3e27cd728d72f70d1e6a342005f";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mdast_comment_marker___mdast_comment_marker_2.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mdast_comment_marker___mdast_comment_marker_2.0.0.tgz";
url = "https://registry.yarnpkg.com/mdast-comment-marker/-/mdast-comment-marker-2.0.0.tgz";
sha1 = "1b97b8c01fc1ad0a213940e9dc50e787db349907";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mdast_util_from_markdown___mdast_util_from_markdown_1.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mdast_util_from_markdown___mdast_util_from_markdown_1.0.0.tgz";
url = "https://registry.yarnpkg.com/mdast-util-from-markdown/-/mdast-util-from-markdown-1.0.0.tgz";
sha1 = "c517313cd999ec2b8f6d447b438c5a9d500b89c9";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mdast_util_heading_style___mdast_util_heading_style_2.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mdast_util_heading_style___mdast_util_heading_style_2.0.0.tgz";
url = "https://registry.yarnpkg.com/mdast-util-heading-style/-/mdast-util-heading-style-2.0.0.tgz";
sha1 = "19bcc14d96b4a6f24efbe1318409bd34af64bb7f";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mdast_util_to_markdown___mdast_util_to_markdown_1.2.1.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mdast_util_to_markdown___mdast_util_to_markdown_1.2.1.tgz";
url = "https://registry.yarnpkg.com/mdast-util-to-markdown/-/mdast-util-to-markdown-1.2.1.tgz";
sha1 = "33e93c2409f8c1be17b832f90978e29830af5435";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mdast_util_to_string___mdast_util_to_string_3.1.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mdast_util_to_string___mdast_util_to_string_3.1.0.tgz";
url = "https://registry.yarnpkg.com/mdast-util-to-string/-/mdast-util-to-string-3.1.0.tgz";
sha1 = "56c506d065fbf769515235e577b5a261552d56e9";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "mdn_data___mdn_data_2.0.14.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "mdn_data___mdn_data_2.0.14.tgz";
url = "https://registry.yarnpkg.com/mdn-data/-/mdn-data-2.0.14.tgz";
sha1 = "7113fc4281917d63ce29b43446f701e68c25ba50";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "mdurl___mdurl_1.0.1.tgz";
path = fetchurl {
name = "mdurl___mdurl_1.0.1.tgz";
url = "https://registry.yarnpkg.com/mdurl/-/mdurl-1.0.1.tgz";
sha1 = "fe85b2ec75a59037f2adfec100fd6c601761152e";
};
}
{
name = "media_typer___media_typer_0.3.0.tgz";
path = fetchurl {
name = "media_typer___media_typer_0.3.0.tgz";
url = "https://registry.yarnpkg.com/media-typer/-/media-typer-0.3.0.tgz";
sha1 = "8710d7af0aa626f8fffa1ce00168545263255748";
};
}
{
name = "memory_fs___memory_fs_0.4.1.tgz";
path = fetchurl {
name = "memory_fs___memory_fs_0.4.1.tgz";
url = "https://registry.yarnpkg.com/memory-fs/-/memory-fs-0.4.1.tgz";
sha1 = "3a9a20b8462523e447cfbc7e8bb80ed667bfc552";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
name = "memory_fs___memory_fs_0.5.0.tgz";
path = fetchurl {
name = "memory_fs___memory_fs_0.5.0.tgz";
url = "https://registry.yarnpkg.com/memory-fs/-/memory-fs-0.5.0.tgz";
sha1 = "324c01288b88652966d161db77838720845a8e3c";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "merge_descriptors___merge_descriptors_1.0.1.tgz";
path = fetchurl {
name = "merge_descriptors___merge_descriptors_1.0.1.tgz";
url = "https://registry.yarnpkg.com/merge-descriptors/-/merge-descriptors-1.0.1.tgz";
sha1 = "b00aaa556dd8b44568150ec9d1b953f3f90cbb61";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "merge_stream___merge_stream_2.0.0.tgz";
path = fetchurl {
name = "merge_stream___merge_stream_2.0.0.tgz";
url = "https://registry.yarnpkg.com/merge-stream/-/merge-stream-2.0.0.tgz";
sha1 = "52823629a14dd00c9770fb6ad47dc6310f2c1f60";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "merge2___merge2_1.4.1.tgz";
path = fetchurl {
name = "merge2___merge2_1.4.1.tgz";
url = "https://registry.yarnpkg.com/merge2/-/merge2-1.4.1.tgz";
sha1 = "4368892f885e907455a6fd7dc55c0c9d404990ae";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mermaid___mermaid_8.12.1.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mermaid___mermaid_8.12.1.tgz";
url = "https://registry.yarnpkg.com/mermaid/-/mermaid-8.12.1.tgz";
sha1 = "6b55617bcfc970a7bf724e027368b281feb62539";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
{
name = "messageformat_formatters___messageformat_formatters_2.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "messageformat_formatters___messageformat_formatters_2.0.1.tgz";
url = "https://registry.yarnpkg.com/messageformat-formatters/-/messageformat-formatters-2.0.1.tgz";
sha1 = "0492c1402a48775f751c9b17c0354e92be012b08";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "messageformat_parser___messageformat_parser_4.1.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "messageformat_parser___messageformat_parser_4.1.3.tgz";
url = "https://registry.yarnpkg.com/messageformat-parser/-/messageformat-parser-4.1.3.tgz";
sha1 = "b824787f57fcda7d50769f5b63e8d4fda68f5b9e";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
{
name = "messageformat___messageformat_2.3.0.tgz";
path = fetchurl {
name = "messageformat___messageformat_2.3.0.tgz";
url = "https://registry.yarnpkg.com/messageformat/-/messageformat-2.3.0.tgz";
sha1 = "de263c49029d5eae65d7ee25e0754f57f425ad91";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "meta-marked";
path =
let
repo = fetchgit {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
url = "https://github.com/hedgedoc/meta-marked";
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
rev = "6b3653c53a1727f697d0719626c55037b2f03753";
sha256 = "0yh3hyx2h57lnfs2wcyj90qw0vrm57adf2fks9q5hjr5zgqy9sfw";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
in
hedgedoc: fix eval with `allowAliases = false`
2021-09-18 23:23:28 +01:00
runCommand "meta-marked" { buildInputs = [gnutar]; } ''
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
# Set u+w because tar-fs can't unpack archives with read-only dirs
# https://github.com/mafintosh/tar-fs/issues/79
tar cf $out --mode u+w -C ${repo} .
'';
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "method_override___method_override_3.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "method_override___method_override_3.0.0.tgz";
url = "https://registry.yarnpkg.com/method-override/-/method-override-3.0.0.tgz";
sha1 = "6ab0d5d574e3208f15b0c9cf45ab52000468d7a2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "methods___methods_1.1.2.tgz";
path = fetchurl {
name = "methods___methods_1.1.2.tgz";
url = "https://registry.yarnpkg.com/methods/-/methods-1.1.2.tgz";
sha1 = "5529a4d67654134edcc5266656835b0f851afcee";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "micromark_core_commonmark___micromark_core_commonmark_1.0.1.tgz";
path = fetchurl {
name = "micromark_core_commonmark___micromark_core_commonmark_1.0.1.tgz";
url = "https://registry.yarnpkg.com/micromark-core-commonmark/-/micromark-core-commonmark-1.0.1.tgz";
sha1 = "a64987cafe872e8b80bc8f2352a5d988586ac4f1";
};
}
{
name = "micromark_factory_destination___micromark_factory_destination_1.0.0.tgz";
path = fetchurl {
name = "micromark_factory_destination___micromark_factory_destination_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-factory-destination/-/micromark-factory-destination-1.0.0.tgz";
sha1 = "fef1cb59ad4997c496f887b6977aa3034a5a277e";
};
}
{
name = "micromark_factory_label___micromark_factory_label_1.0.0.tgz";
path = fetchurl {
name = "micromark_factory_label___micromark_factory_label_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-factory-label/-/micromark-factory-label-1.0.0.tgz";
sha1 = "b316ec479b474232973ff13b49b576f84a6f2cbb";
};
}
{
name = "micromark_factory_space___micromark_factory_space_1.0.0.tgz";
path = fetchurl {
name = "micromark_factory_space___micromark_factory_space_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-factory-space/-/micromark-factory-space-1.0.0.tgz";
sha1 = "cebff49968f2b9616c0fcb239e96685cb9497633";
};
}
{
name = "micromark_factory_title___micromark_factory_title_1.0.0.tgz";
path = fetchurl {
name = "micromark_factory_title___micromark_factory_title_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-factory-title/-/micromark-factory-title-1.0.0.tgz";
sha1 = "708f7a8044f34a898c0efdb4f55e4da66b537273";
};
}
{
name = "micromark_factory_whitespace___micromark_factory_whitespace_1.0.0.tgz";
path = fetchurl {
name = "micromark_factory_whitespace___micromark_factory_whitespace_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-factory-whitespace/-/micromark-factory-whitespace-1.0.0.tgz";
sha1 = "e991e043ad376c1ba52f4e49858ce0794678621c";
};
}
{
name = "micromark_util_character___micromark_util_character_1.1.0.tgz";
path = fetchurl {
name = "micromark_util_character___micromark_util_character_1.1.0.tgz";
url = "https://registry.yarnpkg.com/micromark-util-character/-/micromark-util-character-1.1.0.tgz";
sha1 = "d97c54d5742a0d9611a68ca0cd4124331f264d86";
};
}
{
name = "micromark_util_chunked___micromark_util_chunked_1.0.0.tgz";
path = fetchurl {
name = "micromark_util_chunked___micromark_util_chunked_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-util-chunked/-/micromark-util-chunked-1.0.0.tgz";
sha1 = "5b40d83f3d53b84c4c6bce30ed4257e9a4c79d06";
};
}
{
name = "micromark_util_classify_character___micromark_util_classify_character_1.0.0.tgz";
path = fetchurl {
name = "micromark_util_classify_character___micromark_util_classify_character_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-util-classify-character/-/micromark-util-classify-character-1.0.0.tgz";
sha1 = "cbd7b447cb79ee6997dd274a46fc4eb806460a20";
};
}
{
name = "micromark_util_combine_extensions___micromark_util_combine_extensions_1.0.0.tgz";
path = fetchurl {
name = "micromark_util_combine_extensions___micromark_util_combine_extensions_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-util-combine-extensions/-/micromark-util-combine-extensions-1.0.0.tgz";
sha1 = "91418e1e74fb893e3628b8d496085639124ff3d5";
};
}
{
name = "micromark_util_decode_numeric_character_reference___micromark_util_decode_numeric_character_reference_1.0.0.tgz";
path = fetchurl {
name = "micromark_util_decode_numeric_character_reference___micromark_util_decode_numeric_character_reference_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-1.0.0.tgz";
sha1 = "dcc85f13b5bd93ff8d2868c3dba28039d490b946";
};
}
{
name = "micromark_util_encode___micromark_util_encode_1.0.0.tgz";
path = fetchurl {
name = "micromark_util_encode___micromark_util_encode_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-util-encode/-/micromark-util-encode-1.0.0.tgz";
sha1 = "c409ecf751a28aa9564b599db35640fccec4c068";
};
}
{
name = "micromark_util_html_tag_name___micromark_util_html_tag_name_1.0.0.tgz";
path = fetchurl {
name = "micromark_util_html_tag_name___micromark_util_html_tag_name_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-util-html-tag-name/-/micromark-util-html-tag-name-1.0.0.tgz";
sha1 = "75737e92fef50af0c6212bd309bc5cb8dbd489ed";
};
}
{
name = "micromark_util_normalize_identifier___micromark_util_normalize_identifier_1.0.0.tgz";
path = fetchurl {
name = "micromark_util_normalize_identifier___micromark_util_normalize_identifier_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-1.0.0.tgz";
sha1 = "4a3539cb8db954bbec5203952bfe8cedadae7828";
};
}
{
name = "micromark_util_resolve_all___micromark_util_resolve_all_1.0.0.tgz";
path = fetchurl {
name = "micromark_util_resolve_all___micromark_util_resolve_all_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-util-resolve-all/-/micromark-util-resolve-all-1.0.0.tgz";
sha1 = "a7c363f49a0162e931960c44f3127ab58f031d88";
};
}
{
name = "micromark_util_sanitize_uri___micromark_util_sanitize_uri_1.0.0.tgz";
path = fetchurl {
name = "micromark_util_sanitize_uri___micromark_util_sanitize_uri_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-1.0.0.tgz";
sha1 = "27dc875397cd15102274c6c6da5585d34d4f12b2";
};
}
{
name = "micromark_util_subtokenize___micromark_util_subtokenize_1.0.0.tgz";
path = fetchurl {
name = "micromark_util_subtokenize___micromark_util_subtokenize_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-util-subtokenize/-/micromark-util-subtokenize-1.0.0.tgz";
sha1 = "6f006fa719af92776c75a264daaede0fb3943c6a";
};
}
{
name = "micromark_util_symbol___micromark_util_symbol_1.0.0.tgz";
path = fetchurl {
name = "micromark_util_symbol___micromark_util_symbol_1.0.0.tgz";
url = "https://registry.yarnpkg.com/micromark-util-symbol/-/micromark-util-symbol-1.0.0.tgz";
sha1 = "91cdbcc9b2a827c0129a177d36241bcd3ccaa34d";
};
}
{
name = "micromark_util_types___micromark_util_types_1.0.1.tgz";
path = fetchurl {
name = "micromark_util_types___micromark_util_types_1.0.1.tgz";
url = "https://registry.yarnpkg.com/micromark-util-types/-/micromark-util-types-1.0.1.tgz";
sha1 = "8bb8a092d93d326bd29fe29602799f2d0d922fd4";
};
}
{
name = "micromark___micromark_3.0.5.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "micromark___micromark_3.0.5.tgz";
url = "https://registry.yarnpkg.com/micromark/-/micromark-3.0.5.tgz";
sha1 = "d24792c8a06f201d5608c106dbfadef34c299684";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "micromatch___micromatch_2.3.11.tgz";
path = fetchurl {
name = "micromatch___micromatch_2.3.11.tgz";
url = "https://registry.yarnpkg.com/micromatch/-/micromatch-2.3.11.tgz";
sha1 = "86677c97d1720b363431d04d0d15293bd38c1565";
};
}
{
name = "micromatch___micromatch_3.1.10.tgz";
path = fetchurl {
name = "micromatch___micromatch_3.1.10.tgz";
url = "https://registry.yarnpkg.com/micromatch/-/micromatch-3.1.10.tgz";
sha1 = "70859bc95c9840952f359a068a3fc49f9ecfac23";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "micromatch___micromatch_4.0.4.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "micromatch___micromatch_4.0.4.tgz";
url = "https://registry.yarnpkg.com/micromatch/-/micromatch-4.0.4.tgz";
sha1 = "896d519dfe9db25fce94ceb7a500919bf881ebf9";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "MIDI.js.git";
path =
let
repo = fetchgit {
url = "https://github.com/paulrosen/MIDI.js.git";
rev = "e593ffef81a0350f99448e3ab8111957145ff6b2";
sha256 = "0vhb1harjvr6vzbqwqdhrfc9r3nk3lpl2srm895r977fq3ngkc2a";
};
in
hedgedoc: fix eval with `allowAliases = false`
2021-09-18 23:23:28 +01:00
runCommand "MIDI.js.git" { buildInputs = [gnutar]; } ''
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
# Set u+w because tar-fs can't unpack archives with read-only dirs
# https://github.com/mafintosh/tar-fs/issues/79
tar cf $out --mode u+w -C ${repo} .
'';
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "miller_rabin___miller_rabin_4.0.1.tgz";
path = fetchurl {
name = "miller_rabin___miller_rabin_4.0.1.tgz";
url = "https://registry.yarnpkg.com/miller-rabin/-/miller-rabin-4.0.1.tgz";
sha1 = "f080351c865b0dc562a8462966daa53543c78a4d";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mime_db___mime_db_1.49.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mime_db___mime_db_1.49.0.tgz";
url = "https://registry.yarnpkg.com/mime-db/-/mime-db-1.49.0.tgz";
sha1 = "f3dfde60c99e9cf3bc9701d687778f537001cbed";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mime_types___mime_types_2.1.32.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mime_types___mime_types_2.1.32.tgz";
url = "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.32.tgz";
sha1 = "1d00e89e7de7fe02008db61001d9e02852670fd5";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "mime___mime_1.3.4.tgz";
path = fetchurl {
name = "mime___mime_1.3.4.tgz";
url = "https://registry.yarnpkg.com/mime/-/mime-1.3.4.tgz";
sha1 = "115f9e3b6b3daf2959983cb38f149a2d40eb5d53";
};
}
{
name = "mime___mime_1.6.0.tgz";
path = fetchurl {
name = "mime___mime_1.6.0.tgz";
url = "https://registry.yarnpkg.com/mime/-/mime-1.6.0.tgz";
sha1 = "32cd9e5c64553bd58d19a568af452acff04981b1";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "mimic_fn___mimic_fn_2.1.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "mimic_fn___mimic_fn_2.1.0.tgz";
url = "https://registry.yarnpkg.com/mimic-fn/-/mimic-fn-2.1.0.tgz";
sha1 = "7ed2c2ccccaf84d3ffcb7a69b57711fc2083401b";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mini_css_extract_plugin___mini_css_extract_plugin_1.6.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mini_css_extract_plugin___mini_css_extract_plugin_1.6.2.tgz";
url = "https://registry.yarnpkg.com/mini-css-extract-plugin/-/mini-css-extract-plugin-1.6.2.tgz";
sha1 = "83172b4fd812f8fc4a09d6f6d16f924f53990ca8";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "minimalistic_assert___minimalistic_assert_1.0.1.tgz";
path = fetchurl {
name = "minimalistic_assert___minimalistic_assert_1.0.1.tgz";
url = "https://registry.yarnpkg.com/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz";
sha1 = "2e194de044626d4a10e7f7fbc00ce73e83e4d5c7";
};
}
{
name = "minimalistic_crypto_utils___minimalistic_crypto_utils_1.0.1.tgz";
path = fetchurl {
name = "minimalistic_crypto_utils___minimalistic_crypto_utils_1.0.1.tgz";
url = "https://registry.yarnpkg.com/minimalistic-crypto-utils/-/minimalistic-crypto-utils-1.0.1.tgz";
sha1 = "f6c00c1c0b082246e5c4d99dfb8c7c083b2b582a";
};
}
{
name = "minimatch___minimatch_3.0.4.tgz";
path = fetchurl {
name = "minimatch___minimatch_3.0.4.tgz";
url = "https://registry.yarnpkg.com/minimatch/-/minimatch-3.0.4.tgz";
sha1 = "5166e286457f03306064be5497e8dbb0c3d32083";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "minimist___minimist_1.2.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "minimist___minimist_1.2.5.tgz";
url = "https://registry.yarnpkg.com/minimist/-/minimist-1.2.5.tgz";
sha1 = "67d66014b66a6a8aaa0c083c5fd58df4e4e97602";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "minio___minio_7.0.19.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "minio___minio_7.0.19.tgz";
url = "https://registry.yarnpkg.com/minio/-/minio-7.0.19.tgz";
sha1 = "ca47b68669e45237286709a8c06ecf89f992aa61";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "minipass_collect___minipass_collect_1.0.2.tgz";
path = fetchurl {
name = "minipass_collect___minipass_collect_1.0.2.tgz";
url = "https://registry.yarnpkg.com/minipass-collect/-/minipass-collect-1.0.2.tgz";
sha1 = "22b813bf745dc6edba2576b940022ad6edc8c617";
};
}
{
name = "minipass_flush___minipass_flush_1.0.5.tgz";
path = fetchurl {
name = "minipass_flush___minipass_flush_1.0.5.tgz";
url = "https://registry.yarnpkg.com/minipass-flush/-/minipass-flush-1.0.5.tgz";
sha1 = "82e7135d7e89a50ffe64610a787953c4c4cbb373";
};
}
{
name = "minipass_pipeline___minipass_pipeline_1.2.4.tgz";
path = fetchurl {
name = "minipass_pipeline___minipass_pipeline_1.2.4.tgz";
url = "https://registry.yarnpkg.com/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz";
sha1 = "68472f79711c084657c067c5c6ad93cddea8214c";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "minipass___minipass_2.9.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "minipass___minipass_2.9.0.tgz";
url = "https://registry.yarnpkg.com/minipass/-/minipass-2.9.0.tgz";
sha1 = "e713762e7d3e32fed803115cf93e04bca9fcc9a6";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "minipass___minipass_3.1.3.tgz";
path = fetchurl {
name = "minipass___minipass_3.1.3.tgz";
url = "https://registry.yarnpkg.com/minipass/-/minipass-3.1.3.tgz";
sha1 = "7d42ff1f39635482e15f9cdb53184deebd5815fd";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "minizlib___minizlib_1.3.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "minizlib___minizlib_1.3.3.tgz";
url = "https://registry.yarnpkg.com/minizlib/-/minizlib-1.3.3.tgz";
sha1 = "2290de96818a34c29551c8a8d301216bd65a861d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "minizlib___minizlib_2.1.2.tgz";
path = fetchurl {
name = "minizlib___minizlib_2.1.2.tgz";
url = "https://registry.yarnpkg.com/minizlib/-/minizlib-2.1.2.tgz";
sha1 = "e90d3466ba209b932451508a11ce3d3632145931";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "mississippi___mississippi_3.0.0.tgz";
path = fetchurl {
name = "mississippi___mississippi_3.0.0.tgz";
url = "https://registry.yarnpkg.com/mississippi/-/mississippi-3.0.0.tgz";
sha1 = "ea0a3291f97e0b5e8776b363d5f0a12d94c67022";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "mixin_deep___mixin_deep_1.3.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "mixin_deep___mixin_deep_1.3.2.tgz";
url = "https://registry.yarnpkg.com/mixin-deep/-/mixin-deep-1.3.2.tgz";
sha1 = "1120b43dc359a785dce65b55b82e257ccf479566";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "mkdirp___mkdirp_0.5.5.tgz";
path = fetchurl {
name = "mkdirp___mkdirp_0.5.5.tgz";
url = "https://registry.yarnpkg.com/mkdirp/-/mkdirp-0.5.5.tgz";
sha1 = "d91cefd62d1436ca0f41620e251288d420099def";
};
}
{
name = "mkdirp___mkdirp_1.0.4.tgz";
path = fetchurl {
name = "mkdirp___mkdirp_1.0.4.tgz";
url = "https://registry.yarnpkg.com/mkdirp/-/mkdirp-1.0.4.tgz";
sha1 = "3eb5ed62622756d79a5f0e2a221dfebad75c2f7e";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mocha___mocha_9.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mocha___mocha_9.1.1.tgz";
url = "https://registry.yarnpkg.com/mocha/-/mocha-9.1.1.tgz";
sha1 = "33df2eb9c6262434630510c5f4283b36efda9b61";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "mock_require___mock_require_3.0.3.tgz";
path = fetchurl {
name = "mock_require___mock_require_3.0.3.tgz";
url = "https://registry.yarnpkg.com/mock-require/-/mock-require-3.0.3.tgz";
sha1 = "ccd544d9eae81dd576b3f219f69ec867318a1946";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "moment_mini___moment_mini_2.24.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "moment_mini___moment_mini_2.24.0.tgz";
url = "https://registry.yarnpkg.com/moment-mini/-/moment-mini-2.24.0.tgz";
sha1 = "fa68d98f7fe93ae65bf1262f6abb5fb6983d8d18";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "moment_timezone___moment_timezone_0.5.33.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "moment_timezone___moment_timezone_0.5.33.tgz";
url = "https://registry.yarnpkg.com/moment-timezone/-/moment-timezone-0.5.33.tgz";
sha1 = "b252fd6bb57f341c9b59a5ab61a8e51a73bbd22c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "moment___moment_2.29.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "moment___moment_2.29.1.tgz";
url = "https://registry.yarnpkg.com/moment/-/moment-2.29.1.tgz";
sha1 = "b2be769fa31940be9eeea6469c075e35006fa3d3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "morgan___morgan_1.10.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "morgan___morgan_1.10.0.tgz";
url = "https://registry.yarnpkg.com/morgan/-/morgan-1.10.0.tgz";
sha1 = "091778abc1fc47cd3509824653dae1faab6b17d7";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "move_concurrently___move_concurrently_1.0.1.tgz";
path = fetchurl {
name = "move_concurrently___move_concurrently_1.0.1.tgz";
url = "https://registry.yarnpkg.com/move-concurrently/-/move-concurrently-1.0.1.tgz";
sha1 = "be2c005fda32e0b29af1f05d7c4b33214c701f92";
};
}
{
name = "ms___ms_2.0.0.tgz";
path = fetchurl {
name = "ms___ms_2.0.0.tgz";
url = "https://registry.yarnpkg.com/ms/-/ms-2.0.0.tgz";
sha1 = "5608aeadfc00be6c2901df5f9861788de0d597c8";
};
}
{
name = "ms___ms_2.1.1.tgz";
path = fetchurl {
name = "ms___ms_2.1.1.tgz";
url = "https://registry.yarnpkg.com/ms/-/ms-2.1.1.tgz";
sha1 = "30a5864eb3ebb0a66f2ebe6d727af06a09d86e0a";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "ms___ms_2.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "ms___ms_2.1.2.tgz";
url = "https://registry.yarnpkg.com/ms/-/ms-2.1.2.tgz";
sha1 = "d09d1f357b443f493382a8eb3ccd183872ae6009";
};
}
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "ms___ms_2.1.3.tgz";
path = fetchurl {
name = "ms___ms_2.1.3.tgz";
url = "https://registry.yarnpkg.com/ms/-/ms-2.1.3.tgz";
sha1 = "574c8138ce1d2b5861f0b44579dbadd60c6615b2";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "mustache___mustache_4.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "mustache___mustache_4.2.0.tgz";
url = "https://registry.yarnpkg.com/mustache/-/mustache-4.2.0.tgz";
sha1 = "e5892324d60a12ec9c2a73359edca52972bf6f64";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mysql2___mysql2_2.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "mysql2___mysql2_2.3.0.tgz";
url = "https://registry.yarnpkg.com/mysql2/-/mysql2-2.3.0.tgz";
sha1 = "600f5cc27e397dfb77b59eac93666434f88e8079";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
name = "named_placeholders___named_placeholders_1.1.2.tgz";
path = fetchurl {
name = "named_placeholders___named_placeholders_1.1.2.tgz";
url = "https://registry.yarnpkg.com/named-placeholders/-/named-placeholders-1.1.2.tgz";
sha1 = "ceb1fbff50b6b33492b5cf214ccf5e39cef3d0e8";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "nan___nan_2.15.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "nan___nan_2.15.0.tgz";
url = "https://registry.yarnpkg.com/nan/-/nan-2.15.0.tgz";
sha1 = "3f34a473ff18e15c1b5626b62903b5ad6e665fee";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "nanoid___nanoid_3.1.23.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "nanoid___nanoid_3.1.23.tgz";
url = "https://registry.yarnpkg.com/nanoid/-/nanoid-3.1.23.tgz";
sha1 = "f744086ce7c2bc47ee0a8472574d5c78e4183a81";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "nanoid___nanoid_2.1.11.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "nanoid___nanoid_2.1.11.tgz";
url = "https://registry.yarnpkg.com/nanoid/-/nanoid-2.1.11.tgz";
sha1 = "ec24b8a758d591561531b4176a01e3ab4f0f0280";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "nanoid___nanoid_3.1.25.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "nanoid___nanoid_3.1.25.tgz";
url = "https://registry.yarnpkg.com/nanoid/-/nanoid-3.1.25.tgz";
sha1 = "09ca32747c0e543f0e1814b7d3793477f9c8e152";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "nanomatch___nanomatch_1.2.13.tgz";
path = fetchurl {
name = "nanomatch___nanomatch_1.2.13.tgz";
url = "https://registry.yarnpkg.com/nanomatch/-/nanomatch-1.2.13.tgz";
sha1 = "b87a8aa4fc0de8fe6be88895b38983ff265bd119";
};
}
{
name = "natural_compare___natural_compare_1.4.0.tgz";
path = fetchurl {
name = "natural_compare___natural_compare_1.4.0.tgz";
url = "https://registry.yarnpkg.com/natural-compare/-/natural-compare-1.4.0.tgz";
sha1 = "4abebfeed7541f2c27acfb29bdbbd15c8d5ba4f7";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "needle___needle_2.9.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "needle___needle_2.9.1.tgz";
url = "https://registry.yarnpkg.com/needle/-/needle-2.9.1.tgz";
sha1 = "22d1dffbe3490c2b83e301f7709b6736cd8f2684";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "negotiator___negotiator_0.6.2.tgz";
path = fetchurl {
name = "negotiator___negotiator_0.6.2.tgz";
url = "https://registry.yarnpkg.com/negotiator/-/negotiator-0.6.2.tgz";
sha1 = "feacf7ccf525a77ae9634436a64883ffeca346fb";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "neo_async___neo_async_2.6.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "neo_async___neo_async_2.6.2.tgz";
url = "https://registry.yarnpkg.com/neo-async/-/neo-async-2.6.2.tgz";
sha1 = "b4aafb93e3aeb2d8174ca53cf163ab7d7308305f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "no_case___no_case_3.0.4.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "no_case___no_case_3.0.4.tgz";
url = "https://registry.yarnpkg.com/no-case/-/no-case-3.0.4.tgz";
sha1 = "d361fd5c9800f558551a8369fc0dcd4662b6124d";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "node_addon_api___node_addon_api_3.2.1.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "node_addon_api___node_addon_api_3.2.1.tgz";
url = "https://registry.yarnpkg.com/node-addon-api/-/node-addon-api-3.2.1.tgz";
sha1 = "81325e0a2117789c0128dab65e7e38f07ceba161";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "node_fetch___node_fetch_2.6.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "node_fetch___node_fetch_2.6.2.tgz";
url = "https://registry.yarnpkg.com/node-fetch/-/node-fetch-2.6.2.tgz";
sha1 = "986996818b73785e47b1965cc34eb093a1d464d0";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "node_forge___node_forge_0.10.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "node_forge___node_forge_0.10.0.tgz";
url = "https://registry.yarnpkg.com/node-forge/-/node-forge-0.10.0.tgz";
sha1 = "32dea2afb3e9926f02ee5ce8794902691a676bf3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "node_gyp_build___node_gyp_build_4.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "node_gyp_build___node_gyp_build_4.3.0.tgz";
url = "https://registry.yarnpkg.com/node-gyp-build/-/node-gyp-build-4.3.0.tgz";
sha1 = "9f256b03e5826150be39c764bf51e993946d71a3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "node_gyp___node_gyp_3.8.0.tgz";
path = fetchurl {
name = "node_gyp___node_gyp_3.8.0.tgz";
url = "https://registry.yarnpkg.com/node-gyp/-/node-gyp-3.8.0.tgz";
sha1 = "540304261c330e80d0d5edce253a68cb3964218c";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "node_libs_browser___node_libs_browser_2.2.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "node_libs_browser___node_libs_browser_2.2.1.tgz";
url = "https://registry.yarnpkg.com/node-libs-browser/-/node-libs-browser-2.2.1.tgz";
sha1 = "b64f513d18338625f90346d27b0d235e631f6425";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "node_pre_gyp___node_pre_gyp_0.11.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "node_pre_gyp___node_pre_gyp_0.11.0.tgz";
url = "https://registry.yarnpkg.com/node-pre-gyp/-/node-pre-gyp-0.11.0.tgz";
sha1 = "db1f33215272f692cd38f03238e3e9b47c5dd054";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "node_releases___node_releases_1.1.75.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "node_releases___node_releases_1.1.75.tgz";
url = "https://registry.yarnpkg.com/node-releases/-/node-releases-1.1.75.tgz";
sha1 = "6dd8c876b9897a1b8e5a02de26afa79bb54ebbfe";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "nomnom___nomnom_1.8.1.tgz";
path = fetchurl {
name = "nomnom___nomnom_1.8.1.tgz";
url = "https://registry.yarnpkg.com/nomnom/-/nomnom-1.8.1.tgz";
sha1 = "2151f722472ba79e50a76fc125bb8c8f2e4dc2a7";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "nopt___nopt_3.0.6.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "nopt___nopt_3.0.6.tgz";
url = "https://registry.yarnpkg.com/nopt/-/nopt-3.0.6.tgz";
sha1 = "c6465dbf08abcd4db359317f79ac68a646b28ff9";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "nopt___nopt_4.0.3.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "nopt___nopt_4.0.3.tgz";
url = "https://registry.yarnpkg.com/nopt/-/nopt-4.0.3.tgz";
sha1 = "a375cad9d02fd921278d954c2254d5aa57e15e48";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "normalize_package_data___normalize_package_data_2.5.0.tgz";
path = fetchurl {
name = "normalize_package_data___normalize_package_data_2.5.0.tgz";
url = "https://registry.yarnpkg.com/normalize-package-data/-/normalize-package-data-2.5.0.tgz";
sha1 = "e66db1838b200c1dfc233225d12cb36520e234a8";
};
}
{
name = "normalize_path___normalize_path_2.1.1.tgz";
path = fetchurl {
name = "normalize_path___normalize_path_2.1.1.tgz";
url = "https://registry.yarnpkg.com/normalize-path/-/normalize-path-2.1.1.tgz";
sha1 = "1ab28b556e198363a8c1a6f7e6fa20137fe6aed9";
};
}
{
name = "normalize_path___normalize_path_3.0.0.tgz";
path = fetchurl {
name = "normalize_path___normalize_path_3.0.0.tgz";
url = "https://registry.yarnpkg.com/normalize-path/-/normalize-path-3.0.0.tgz";
sha1 = "0dcd69ff23a1c9b11fd0978316644a0388216a65";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "normalize_url___normalize_url_6.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "normalize_url___normalize_url_6.1.0.tgz";
url = "https://registry.yarnpkg.com/normalize-url/-/normalize-url-6.1.0.tgz";
sha1 = "40d0885b535deffe3f3147bec877d05fe4c5668a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "npm_bundled___npm_bundled_1.1.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "npm_bundled___npm_bundled_1.1.2.tgz";
url = "https://registry.yarnpkg.com/npm-bundled/-/npm-bundled-1.1.2.tgz";
sha1 = "944c78789bd739035b70baa2ca5cc32b8d860bc1";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "npm_normalize_package_bin___npm_normalize_package_bin_1.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "npm_normalize_package_bin___npm_normalize_package_bin_1.0.1.tgz";
url = "https://registry.yarnpkg.com/npm-normalize-package-bin/-/npm-normalize-package-bin-1.0.1.tgz";
sha1 = "6e79a41f23fd235c0623218228da7d9c23b8f6e2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "npm_packlist___npm_packlist_1.4.8.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "npm_packlist___npm_packlist_1.4.8.tgz";
url = "https://registry.yarnpkg.com/npm-packlist/-/npm-packlist-1.4.8.tgz";
sha1 = "56ee6cc135b9f98ad3d51c1c95da22bbb9b2ef3e";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "npm_run_path___npm_run_path_4.0.1.tgz";
path = fetchurl {
name = "npm_run_path___npm_run_path_4.0.1.tgz";
url = "https://registry.yarnpkg.com/npm-run-path/-/npm-run-path-4.0.1.tgz";
sha1 = "b7ecd1e5ed53da8e37a55e1c2269e0b97ed748ea";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "npmlog___npmlog_4.1.2.tgz";
path = fetchurl {
name = "npmlog___npmlog_4.1.2.tgz";
url = "https://registry.yarnpkg.com/npmlog/-/npmlog-4.1.2.tgz";
sha1 = "08a7f2a8bf734604779a9efa4ad5cc717abb954b";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "nth_check___nth_check_2.0.0.tgz";
path = fetchurl {
name = "nth_check___nth_check_2.0.0.tgz";
url = "https://registry.yarnpkg.com/nth-check/-/nth-check-2.0.0.tgz";
sha1 = "1bb4f6dac70072fc313e8c9cd1417b5074c0a125";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "nth_check___nth_check_1.0.2.tgz";
path = fetchurl {
name = "nth_check___nth_check_1.0.2.tgz";
url = "https://registry.yarnpkg.com/nth-check/-/nth-check-1.0.2.tgz";
sha1 = "b2bd295c37e3dd58a3bf0700376663ba4d9cf05c";
};
}
{
name = "number_is_nan___number_is_nan_1.0.1.tgz";
path = fetchurl {
name = "number_is_nan___number_is_nan_1.0.1.tgz";
url = "https://registry.yarnpkg.com/number-is-nan/-/number-is-nan-1.0.1.tgz";
sha1 = "097b602b53422a522c1afb8790318336941a011d";
};
}
{
name = "nwmatcher___nwmatcher_1.3.9.tgz";
path = fetchurl {
name = "nwmatcher___nwmatcher_1.3.9.tgz";
url = "https://registry.yarnpkg.com/nwmatcher/-/nwmatcher-1.3.9.tgz";
sha1 = "8bab486ff7fa3dfd086656bbe8b17116d3692d2a";
};
}
{
name = "oauth_sign___oauth_sign_0.9.0.tgz";
path = fetchurl {
name = "oauth_sign___oauth_sign_0.9.0.tgz";
url = "https://registry.yarnpkg.com/oauth-sign/-/oauth-sign-0.9.0.tgz";
sha1 = "47a7b016baa68b5fa0ecf3dee08a85c679ac6455";
};
}
{
name = "oauth___oauth_0.9.15.tgz";
path = fetchurl {
name = "oauth___oauth_0.9.15.tgz";
url = "https://registry.yarnpkg.com/oauth/-/oauth-0.9.15.tgz";
sha1 = "bd1fefaf686c96b75475aed5196412ff60cfb9c1";
};
}
{
name = "object_assign___object_assign_4.1.1.tgz";
path = fetchurl {
name = "object_assign___object_assign_4.1.1.tgz";
url = "https://registry.yarnpkg.com/object-assign/-/object-assign-4.1.1.tgz";
sha1 = "2109adc7965887cfc05cbbd442cac8bfbb360863";
};
}
{
name = "object_copy___object_copy_0.1.0.tgz";
path = fetchurl {
name = "object_copy___object_copy_0.1.0.tgz";
url = "https://registry.yarnpkg.com/object-copy/-/object-copy-0.1.0.tgz";
sha1 = "7e7d858b781bd7c991a41ba975ed3812754e998c";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "object_inspect___object_inspect_1.11.0.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "object_inspect___object_inspect_1.11.0.tgz";
url = "https://registry.yarnpkg.com/object-inspect/-/object-inspect-1.11.0.tgz";
sha1 = "9dceb146cedd4148a0d9e51ab88d34cf509922b1";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "object_is___object_is_1.1.5.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "object_is___object_is_1.1.5.tgz";
url = "https://registry.yarnpkg.com/object-is/-/object-is-1.1.5.tgz";
sha1 = "b9deeaa5fc7f1846a0faecdceec138e5778f53ac";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "object_keys___object_keys_1.1.1.tgz";
path = fetchurl {
name = "object_keys___object_keys_1.1.1.tgz";
url = "https://registry.yarnpkg.com/object-keys/-/object-keys-1.1.1.tgz";
sha1 = "1c47f272df277f3b1daf061677d9c82e2322c60e";
};
}
{
name = "object_visit___object_visit_1.0.1.tgz";
path = fetchurl {
name = "object_visit___object_visit_1.0.1.tgz";
url = "https://registry.yarnpkg.com/object-visit/-/object-visit-1.0.1.tgz";
sha1 = "f79c4493af0c5377b59fe39d395e41042dd045bb";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "object.assign___object.assign_4.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "object.assign___object.assign_4.1.2.tgz";
url = "https://registry.yarnpkg.com/object.assign/-/object.assign-4.1.2.tgz";
sha1 = "0ed54a342eceb37b38ff76eb831a0e788cb63940";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "object.getownpropertydescriptors___object.getownpropertydescriptors_2.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "object.getownpropertydescriptors___object.getownpropertydescriptors_2.1.2.tgz";
url = "https://registry.yarnpkg.com/object.getownpropertydescriptors/-/object.getownpropertydescriptors-2.1.2.tgz";
sha1 = "1bd63aeacf0d5d2d2f31b5e393b03a7c601a23f7";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "object.omit___object.omit_2.0.1.tgz";
path = fetchurl {
name = "object.omit___object.omit_2.0.1.tgz";
url = "https://registry.yarnpkg.com/object.omit/-/object.omit-2.0.1.tgz";
sha1 = "1a9c744829f39dbb858c76ca3579ae2a54ebd1fa";
};
}
{
name = "object.pick___object.pick_1.3.0.tgz";
path = fetchurl {
name = "object.pick___object.pick_1.3.0.tgz";
url = "https://registry.yarnpkg.com/object.pick/-/object.pick-1.3.0.tgz";
sha1 = "87a10ac4c1694bd2e1cbf53591a66141fb5dd747";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "object.values___object.values_1.1.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "object.values___object.values_1.1.4.tgz";
url = "https://registry.yarnpkg.com/object.values/-/object.values-1.1.4.tgz";
sha1 = "0d273762833e816b693a637d30073e7051535b30";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "on_finished___on_finished_2.3.0.tgz";
path = fetchurl {
name = "on_finished___on_finished_2.3.0.tgz";
url = "https://registry.yarnpkg.com/on-finished/-/on-finished-2.3.0.tgz";
sha1 = "20f1336481b083cd75337992a16971aa2d906947";
};
}
{
name = "on_headers___on_headers_1.0.2.tgz";
path = fetchurl {
name = "on_headers___on_headers_1.0.2.tgz";
url = "https://registry.yarnpkg.com/on-headers/-/on-headers-1.0.2.tgz";
sha1 = "772b0ae6aaa525c399e489adfad90c403eb3c28f";
};
}
{
name = "once___once_1.4.0.tgz";
path = fetchurl {
name = "once___once_1.4.0.tgz";
url = "https://registry.yarnpkg.com/once/-/once-1.4.0.tgz";
sha1 = "583b1aa775961d4b113ac17d9c50baef9dd76bd1";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "one_time___one_time_1.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "one_time___one_time_1.0.0.tgz";
url = "https://registry.yarnpkg.com/one-time/-/one-time-1.0.0.tgz";
sha1 = "e06bc174aed214ed58edede573b433bbf827cb45";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "onetime___onetime_5.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "onetime___onetime_5.1.2.tgz";
url = "https://registry.yarnpkg.com/onetime/-/onetime-5.1.2.tgz";
sha1 = "d0e96ebb56b07476df1dd9c4806e5237985ca45e";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "openid___openid_2.0.9.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "openid___openid_2.0.9.tgz";
url = "https://registry.yarnpkg.com/openid/-/openid-2.0.9.tgz";
sha1 = "7d2bc03ed4c6bf4ccd05b128e3b0b33b6680205f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "optimize_css_assets_webpack_plugin___optimize_css_assets_webpack_plugin_6.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "optimize_css_assets_webpack_plugin___optimize_css_assets_webpack_plugin_6.0.1.tgz";
url = "https://registry.yarnpkg.com/optimize-css-assets-webpack-plugin/-/optimize-css-assets-webpack-plugin-6.0.1.tgz";
sha1 = "7719bceabba1f3891ec3ae04efb81a1cc99cd793";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "optionator___optionator_0.9.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "optionator___optionator_0.9.1.tgz";
url = "https://registry.yarnpkg.com/optionator/-/optionator-0.9.1.tgz";
sha1 = "4f236a6373dae0566a6d43e1326674f50c291499";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "os_browserify___os_browserify_0.3.0.tgz";
path = fetchurl {
name = "os_browserify___os_browserify_0.3.0.tgz";
url = "https://registry.yarnpkg.com/os-browserify/-/os-browserify-0.3.0.tgz";
sha1 = "854373c7f5c2315914fc9bfc6bd8238fdda1ec27";
};
}
{
name = "os_homedir___os_homedir_1.0.2.tgz";
path = fetchurl {
name = "os_homedir___os_homedir_1.0.2.tgz";
url = "https://registry.yarnpkg.com/os-homedir/-/os-homedir-1.0.2.tgz";
sha1 = "ffbc4988336e0e833de0c168c7ef152121aa7fb3";
};
}
{
name = "os_tmpdir___os_tmpdir_1.0.2.tgz";
path = fetchurl {
name = "os_tmpdir___os_tmpdir_1.0.2.tgz";
url = "https://registry.yarnpkg.com/os-tmpdir/-/os-tmpdir-1.0.2.tgz";
sha1 = "bbe67406c79aa85c5cfec766fe5734555dfa1274";
};
}
{
name = "osenv___osenv_0.1.5.tgz";
path = fetchurl {
name = "osenv___osenv_0.1.5.tgz";
url = "https://registry.yarnpkg.com/osenv/-/osenv-0.1.5.tgz";
sha1 = "85cdfafaeb28e8677f416e287592b5f3f49ea410";
};
}
{
name = "output_file_sync___output_file_sync_1.1.2.tgz";
path = fetchurl {
name = "output_file_sync___output_file_sync_1.1.2.tgz";
url = "https://registry.yarnpkg.com/output-file-sync/-/output-file-sync-1.1.2.tgz";
sha1 = "d0a33eefe61a205facb90092e826598d5245ce76";
};
}
{
name = "p_limit___p_limit_1.3.0.tgz";
path = fetchurl {
name = "p_limit___p_limit_1.3.0.tgz";
url = "https://registry.yarnpkg.com/p-limit/-/p-limit-1.3.0.tgz";
sha1 = "b86bd5f0c25690911c7590fcbfc2010d54b3ccb8";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "p_limit___p_limit_2.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "p_limit___p_limit_2.3.0.tgz";
url = "https://registry.yarnpkg.com/p-limit/-/p-limit-2.3.0.tgz";
sha1 = "3dd33c647a214fdfffd835933eb086da0dc21db1";
};
}
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "p_limit___p_limit_3.1.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "p_limit___p_limit_3.1.0.tgz";
url = "https://registry.yarnpkg.com/p-limit/-/p-limit-3.1.0.tgz";
sha1 = "e1daccbe78d0d1388ca18c64fea38e3e57e3706b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "p_locate___p_locate_2.0.0.tgz";
path = fetchurl {
name = "p_locate___p_locate_2.0.0.tgz";
url = "https://registry.yarnpkg.com/p-locate/-/p-locate-2.0.0.tgz";
sha1 = "20a0103b222a70c8fd39cc2e580680f3dde5ec43";
};
}
{
name = "p_locate___p_locate_3.0.0.tgz";
path = fetchurl {
name = "p_locate___p_locate_3.0.0.tgz";
url = "https://registry.yarnpkg.com/p-locate/-/p-locate-3.0.0.tgz";
sha1 = "322d69a05c0264b25997d9f40cd8a891ab0064a4";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "p_locate___p_locate_4.1.0.tgz";
path = fetchurl {
name = "p_locate___p_locate_4.1.0.tgz";
url = "https://registry.yarnpkg.com/p-locate/-/p-locate-4.1.0.tgz";
sha1 = "a3428bb7088b3a60292f66919278b7c297ad4f07";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "p_locate___p_locate_5.0.0.tgz";
path = fetchurl {
name = "p_locate___p_locate_5.0.0.tgz";
url = "https://registry.yarnpkg.com/p-locate/-/p-locate-5.0.0.tgz";
sha1 = "83c8315c6785005e3bd021839411c9e110e6d834";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "p_map___p_map_4.0.0.tgz";
path = fetchurl {
name = "p_map___p_map_4.0.0.tgz";
url = "https://registry.yarnpkg.com/p-map/-/p-map-4.0.0.tgz";
sha1 = "bb2f95a5eda2ec168ec9274e06a747c3e2904d2b";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "p_try___p_try_1.0.0.tgz";
path = fetchurl {
name = "p_try___p_try_1.0.0.tgz";
url = "https://registry.yarnpkg.com/p-try/-/p-try-1.0.0.tgz";
sha1 = "cbc79cdbaf8fd4228e13f621f2b1a237c1b207b3";
};
}
{
name = "p_try___p_try_2.2.0.tgz";
path = fetchurl {
name = "p_try___p_try_2.2.0.tgz";
url = "https://registry.yarnpkg.com/p-try/-/p-try-2.2.0.tgz";
sha1 = "cb2868540e313d61de58fafbe35ce9004d5540e6";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "packet_reader___packet_reader_1.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "packet_reader___packet_reader_1.0.0.tgz";
url = "https://registry.yarnpkg.com/packet-reader/-/packet-reader-1.0.0.tgz";
sha1 = "9238e5480dedabacfe1fe3f2771063f164157d74";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "pako___pako_1.0.11.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "pako___pako_1.0.11.tgz";
url = "https://registry.yarnpkg.com/pako/-/pako-1.0.11.tgz";
sha1 = "6c9599d340d54dfd3946380252a35705a6b992bf";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "parallel_transform___parallel_transform_1.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "parallel_transform___parallel_transform_1.2.0.tgz";
url = "https://registry.yarnpkg.com/parallel-transform/-/parallel-transform-1.2.0.tgz";
sha1 = "9049ca37d6cb2182c3b1d2c720be94d14a5814fc";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "param_case___param_case_3.0.4.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "param_case___param_case_3.0.4.tgz";
url = "https://registry.yarnpkg.com/param-case/-/param-case-3.0.4.tgz";
sha1 = "7d17fe4aa12bde34d4a77d91acfb6219caad01c5";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "parent_module___parent_module_1.0.1.tgz";
path = fetchurl {
name = "parent_module___parent_module_1.0.1.tgz";
url = "https://registry.yarnpkg.com/parent-module/-/parent-module-1.0.1.tgz";
sha1 = "691d2709e78c79fae3a156622452d00762caaaa2";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "parse_asn1___parse_asn1_5.1.6.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "parse_asn1___parse_asn1_5.1.6.tgz";
url = "https://registry.yarnpkg.com/parse-asn1/-/parse-asn1-5.1.6.tgz";
sha1 = "385080a3ec13cb62a62d39409cb3e88844cdaed4";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "parse_entities___parse_entities_3.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "parse_entities___parse_entities_3.0.0.tgz";
url = "https://registry.yarnpkg.com/parse-entities/-/parse-entities-3.0.0.tgz";
sha1 = "9ed6d6569b6cfc95ade058d683ddef239dad60dc";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "parse_glob___parse_glob_3.0.4.tgz";
path = fetchurl {
name = "parse_glob___parse_glob_3.0.4.tgz";
url = "https://registry.yarnpkg.com/parse-glob/-/parse-glob-3.0.4.tgz";
sha1 = "b2c376cfb11f35513badd173ef0bb6e3a388391c";
};
}
{
name = "parse_json___parse_json_4.0.0.tgz";
path = fetchurl {
name = "parse_json___parse_json_4.0.0.tgz";
url = "https://registry.yarnpkg.com/parse-json/-/parse-json-4.0.0.tgz";
sha1 = "be35f5425be1f7f6c747184f98a788cb99477ee0";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "parse_json___parse_json_5.2.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "parse_json___parse_json_5.2.0.tgz";
url = "https://registry.yarnpkg.com/parse-json/-/parse-json-5.2.0.tgz";
sha1 = "c76fc66dee54231c962b22bcc8a72cf2f99753cd";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "parse_node_version___parse_node_version_1.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "parse_node_version___parse_node_version_1.0.1.tgz";
url = "https://registry.yarnpkg.com/parse-node-version/-/parse-node-version-1.0.1.tgz";
sha1 = "e2b5dbede00e7fa9bc363607f53327e8b073189b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "parse5___parse5_6.0.1.tgz";
path = fetchurl {
name = "parse5___parse5_6.0.1.tgz";
url = "https://registry.yarnpkg.com/parse5/-/parse5-6.0.1.tgz";
sha1 = "e1a1c085c569b3dc08321184f19a39cc27f7c30b";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "parseqs___parseqs_0.0.6.tgz";
path = fetchurl {
name = "parseqs___parseqs_0.0.6.tgz";
url = "https://registry.yarnpkg.com/parseqs/-/parseqs-0.0.6.tgz";
sha1 = "8e4bb5a19d1cdc844a08ac974d34e273afa670d5";
};
}
{
name = "parseuri___parseuri_0.0.6.tgz";
path = fetchurl {
name = "parseuri___parseuri_0.0.6.tgz";
url = "https://registry.yarnpkg.com/parseuri/-/parseuri-0.0.6.tgz";
sha1 = "e1496e829e3ac2ff47f39a4dd044b32823c4a25a";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "parseurl___parseurl_1.3.3.tgz";
path = fetchurl {
name = "parseurl___parseurl_1.3.3.tgz";
url = "https://registry.yarnpkg.com/parseurl/-/parseurl-1.3.3.tgz";
sha1 = "9da19e7bee8d12dff0513ed5b76957793bc2e8d4";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "pascal_case___pascal_case_3.1.2.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "pascal_case___pascal_case_3.1.2.tgz";
url = "https://registry.yarnpkg.com/pascal-case/-/pascal-case-3.1.2.tgz";
sha1 = "b48e0ef2b98e205e7c1dae747d0b1508237660eb";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "pascalcase___pascalcase_0.1.1.tgz";
path = fetchurl {
name = "pascalcase___pascalcase_0.1.1.tgz";
url = "https://registry.yarnpkg.com/pascalcase/-/pascalcase-0.1.1.tgz";
sha1 = "b363e55e8006ca6fe21784d2db22bd15d7917f14";
};
}
{
name = "passport_dropbox_oauth2___passport_dropbox_oauth2_1.1.0.tgz";
path = fetchurl {
name = "passport_dropbox_oauth2___passport_dropbox_oauth2_1.1.0.tgz";
url = "https://registry.yarnpkg.com/passport-dropbox-oauth2/-/passport-dropbox-oauth2-1.1.0.tgz";
sha1 = "77c737636e4841944dfb82dfc42c3d8ab782c10e";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "passport_facebook___passport_facebook_3.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "passport_facebook___passport_facebook_3.0.0.tgz";
url = "https://registry.yarnpkg.com/passport-facebook/-/passport-facebook-3.0.0.tgz";
sha1 = "b16f7314128be55d020a2b75f574c194bd6d9805";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "passport_github___passport_github_1.1.0.tgz";
path = fetchurl {
name = "passport_github___passport_github_1.1.0.tgz";
url = "https://registry.yarnpkg.com/passport-github/-/passport-github-1.1.0.tgz";
sha1 = "8ce1e3fcd61ad7578eb1df595839e4aea12355d4";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "passport_gitlab2___passport_gitlab2_5.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "passport_gitlab2___passport_gitlab2_5.0.0.tgz";
url = "https://registry.yarnpkg.com/passport-gitlab2/-/passport-gitlab2-5.0.0.tgz";
sha1 = "ea37e5285321c026a02671e87469cac28cce9b69";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "passport_google_oauth20___passport_google_oauth20_2.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "passport_google_oauth20___passport_google_oauth20_2.0.0.tgz";
url = "https://registry.yarnpkg.com/passport-google-oauth20/-/passport-google-oauth20-2.0.0.tgz";
sha1 = "0d241b2d21ebd3dc7f2b60669ec4d587e3a674ef";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "passport_ldapauth___passport_ldapauth_3.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "passport_ldapauth___passport_ldapauth_3.0.1.tgz";
url = "https://registry.yarnpkg.com/passport-ldapauth/-/passport-ldapauth-3.0.1.tgz";
sha1 = "1432e8469de18bd46b5b39a46a866b416c1ddded";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "passport_local___passport_local_1.0.0.tgz";
path = fetchurl {
name = "passport_local___passport_local_1.0.0.tgz";
url = "https://registry.yarnpkg.com/passport-local/-/passport-local-1.0.0.tgz";
sha1 = "1fe63268c92e75606626437e3b906662c15ba6ee";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "passport_oauth1___passport_oauth1_1.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "passport_oauth1___passport_oauth1_1.2.0.tgz";
url = "https://registry.yarnpkg.com/passport-oauth1/-/passport-oauth1-1.2.0.tgz";
sha1 = "5229d431781bf5b265bec86ce9a9cce58a756cf9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "passport_oauth2___passport_oauth2_1.6.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "passport_oauth2___passport_oauth2_1.6.0.tgz";
url = "https://registry.yarnpkg.com/passport-oauth2/-/passport-oauth2-1.6.0.tgz";
sha1 = "5f599735e0ea40ea3027643785f81a3a9b4feb50";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "passport_oauth___passport_oauth_1.0.0.tgz";
path = fetchurl {
name = "passport_oauth___passport_oauth_1.0.0.tgz";
url = "https://registry.yarnpkg.com/passport-oauth/-/passport-oauth-1.0.0.tgz";
sha1 = "90aff63387540f02089af28cdad39ea7f80d77df";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "passport_saml___passport_saml_3.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "passport_saml___passport_saml_3.1.2.tgz";
url = "https://registry.yarnpkg.com/passport-saml/-/passport-saml-3.1.2.tgz";
sha1 = "34a0c2c423d729ce102e69fea9c22040910e6d43";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "passport_strategy___passport_strategy_1.0.0.tgz";
path = fetchurl {
name = "passport_strategy___passport_strategy_1.0.0.tgz";
url = "https://registry.yarnpkg.com/passport-strategy/-/passport-strategy-1.0.0.tgz";
sha1 = "b5539aa8fc225a3d1ad179476ddf236b440f52e4";
};
}
{
name = "passport_twitter___passport_twitter_1.0.4.tgz";
path = fetchurl {
name = "passport_twitter___passport_twitter_1.0.4.tgz";
url = "https://registry.yarnpkg.com/passport-twitter/-/passport-twitter-1.0.4.tgz";
sha1 = "01a799e1f760bf2de49f2ba5fba32282f18932d7";
};
}
{
name = "passport.socketio___passport.socketio_3.7.0.tgz";
path = fetchurl {
name = "passport.socketio___passport.socketio_3.7.0.tgz";
url = "https://registry.yarnpkg.com/passport.socketio/-/passport.socketio-3.7.0.tgz";
sha1 = "2ee5fafe9695d4281c8cddd3fe975ecd18e6726e";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "passport___passport_0.4.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "passport___passport_0.4.1.tgz";
url = "https://registry.yarnpkg.com/passport/-/passport-0.4.1.tgz";
sha1 = "941446a21cb92fc688d97a0861c38ce9f738f270";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "path_browserify___path_browserify_0.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "path_browserify___path_browserify_0.0.1.tgz";
url = "https://registry.yarnpkg.com/path-browserify/-/path-browserify-0.0.1.tgz";
sha1 = "e6c4ddd7ed3aa27c68a20cc4e50e1a4ee83bbc4a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "path_dirname___path_dirname_1.0.2.tgz";
path = fetchurl {
name = "path_dirname___path_dirname_1.0.2.tgz";
url = "https://registry.yarnpkg.com/path-dirname/-/path-dirname-1.0.2.tgz";
sha1 = "cc33d24d525e099a5388c0336c6e32b9160609e0";
};
}
{
name = "path_exists___path_exists_3.0.0.tgz";
path = fetchurl {
name = "path_exists___path_exists_3.0.0.tgz";
url = "https://registry.yarnpkg.com/path-exists/-/path-exists-3.0.0.tgz";
sha1 = "ce0ebeaa5f78cb18925ea7d810d7b59b010fd515";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "path_exists___path_exists_4.0.0.tgz";
path = fetchurl {
name = "path_exists___path_exists_4.0.0.tgz";
url = "https://registry.yarnpkg.com/path-exists/-/path-exists-4.0.0.tgz";
sha1 = "513bdbe2d3b95d7762e8c1137efa195c6c61b5b3";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "path_is_absolute___path_is_absolute_1.0.1.tgz";
path = fetchurl {
name = "path_is_absolute___path_is_absolute_1.0.1.tgz";
url = "https://registry.yarnpkg.com/path-is-absolute/-/path-is-absolute-1.0.1.tgz";
sha1 = "174b9268735534ffbc7ace6bf53a5a9e1b5c5f5f";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "path_key___path_key_3.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "path_key___path_key_3.1.1.tgz";
url = "https://registry.yarnpkg.com/path-key/-/path-key-3.1.1.tgz";
sha1 = "581f6ade658cbba65a0d3380de7753295054f375";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "path_parse___path_parse_1.0.7.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "path_parse___path_parse_1.0.7.tgz";
url = "https://registry.yarnpkg.com/path-parse/-/path-parse-1.0.7.tgz";
sha1 = "fbc114b60ca42b30d9daf5858e4bd68bbedb6735";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "path_to_regexp___path_to_regexp_0.1.7.tgz";
path = fetchurl {
name = "path_to_regexp___path_to_regexp_0.1.7.tgz";
url = "https://registry.yarnpkg.com/path-to-regexp/-/path-to-regexp-0.1.7.tgz";
sha1 = "df604178005f522f15eb4490e7247a1bfaa67f8c";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "path_type___path_type_3.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "path_type___path_type_3.0.0.tgz";
url = "https://registry.yarnpkg.com/path-type/-/path-type-3.0.0.tgz";
sha1 = "cef31dc8e0a1a3bb0d105c0cd97cf3bf47f4e36f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "path_type___path_type_4.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "path_type___path_type_4.0.0.tgz";
url = "https://registry.yarnpkg.com/path-type/-/path-type-4.0.0.tgz";
sha1 = "84ed01c0a7ba380afe09d90a8c180dcd9d03043b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "pause___pause_0.0.1.tgz";
path = fetchurl {
name = "pause___pause_0.0.1.tgz";
url = "https://registry.yarnpkg.com/pause/-/pause-0.0.1.tgz";
sha1 = "1d408b3fdb76923b9543d96fb4c9dfd535d9cb5d";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "pbkdf2___pbkdf2_3.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "pbkdf2___pbkdf2_3.1.2.tgz";
url = "https://registry.yarnpkg.com/pbkdf2/-/pbkdf2-3.1.2.tgz";
sha1 = "dd822aa0887580e52f1a039dc3eda108efae3075";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "pdfobject___pdfobject_2.2.6.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "pdfobject___pdfobject_2.2.6.tgz";
url = "https://registry.yarnpkg.com/pdfobject/-/pdfobject-2.2.6.tgz";
sha1 = "cb8a0b7697af88df8af017b5fd4a7a42abb6e031";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "peek_readable___peek_readable_4.0.1.tgz";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "peek_readable___peek_readable_4.0.1.tgz";
url = "https://registry.yarnpkg.com/peek-readable/-/peek-readable-4.0.1.tgz";
sha1 = "9a045f291db254111c3412c1ce4fec27ddd4d202";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "performance_now___performance_now_2.1.0.tgz";
path = fetchurl {
name = "performance_now___performance_now_2.1.0.tgz";
url = "https://registry.yarnpkg.com/performance-now/-/performance-now-2.1.0.tgz";
sha1 = "6309f4e0e5fa913ec1c69307ae364b4b377c9e7b";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "pg_connection_string___pg_connection_string_2.5.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "pg_connection_string___pg_connection_string_2.5.0.tgz";
url = "https://registry.yarnpkg.com/pg-connection-string/-/pg-connection-string-2.5.0.tgz";
sha1 = "538cadd0f7e603fc09a12590f3b8a452c2c0cf34";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "pg_hstore___pg_hstore_2.3.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "pg_hstore___pg_hstore_2.3.4.tgz";
url = "https://registry.yarnpkg.com/pg-hstore/-/pg-hstore-2.3.4.tgz";
sha1 = "4425e3e2a3e15d2a334c35581186c27cf2e9b8dd";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "pg_int8___pg_int8_1.0.1.tgz";
path = fetchurl {
name = "pg_int8___pg_int8_1.0.1.tgz";
url = "https://registry.yarnpkg.com/pg-int8/-/pg-int8-1.0.1.tgz";
sha1 = "943bd463bf5b71b4170115f80f8efc9a0c0eb78c";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "pg_pool___pg_pool_3.4.1.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "pg_pool___pg_pool_3.4.1.tgz";
url = "https://registry.yarnpkg.com/pg-pool/-/pg-pool-3.4.1.tgz";
sha1 = "0e71ce2c67b442a5e862a9c182172c37eda71e9c";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "pg_protocol___pg_protocol_1.5.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "pg_protocol___pg_protocol_1.5.0.tgz";
url = "https://registry.yarnpkg.com/pg-protocol/-/pg-protocol-1.5.0.tgz";
sha1 = "b5dd452257314565e2d54ab3c132adc46565a6a0";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "pg_types___pg_types_2.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "pg_types___pg_types_2.2.0.tgz";
url = "https://registry.yarnpkg.com/pg-types/-/pg-types-2.2.0.tgz";
sha1 = "2d0250d636454f7cfa3b6ae0382fdfa8063254a3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "pg___pg_8.7.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "pg___pg_8.7.1.tgz";
url = "https://registry.yarnpkg.com/pg/-/pg-8.7.1.tgz";
sha1 = "9ea9d1ec225980c36f94e181d009ab9f4ce4c471";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "pgpass___pgpass_1.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "pgpass___pgpass_1.0.4.tgz";
url = "https://registry.yarnpkg.com/pgpass/-/pgpass-1.0.4.tgz";
sha1 = "85eb93a83800b20f8057a2b029bf05abaf94ea9c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "picomatch___picomatch_2.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "picomatch___picomatch_2.3.0.tgz";
url = "https://registry.yarnpkg.com/picomatch/-/picomatch-2.3.0.tgz";
sha1 = "f1f061de8f6a4bf022892e2d128234fb98302972";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "pify___pify_3.0.0.tgz";
path = fetchurl {
name = "pify___pify_3.0.0.tgz";
url = "https://registry.yarnpkg.com/pify/-/pify-3.0.0.tgz";
sha1 = "e5a4acd2c101fdf3d9a4d07f0dbc4db49dd28176";
};
}
{
name = "pify___pify_4.0.1.tgz";
path = fetchurl {
name = "pify___pify_4.0.1.tgz";
url = "https://registry.yarnpkg.com/pify/-/pify-4.0.1.tgz";
sha1 = "4b2cd25c50d598735c50292224fd8c6df41e3231";
};
}
{
name = "pkg_dir___pkg_dir_2.0.0.tgz";
path = fetchurl {
name = "pkg_dir___pkg_dir_2.0.0.tgz";
url = "https://registry.yarnpkg.com/pkg-dir/-/pkg-dir-2.0.0.tgz";
sha1 = "f6d5d1109e19d63edf428e0bd57e12777615334b";
};
}
{
name = "pkg_dir___pkg_dir_3.0.0.tgz";
path = fetchurl {
name = "pkg_dir___pkg_dir_3.0.0.tgz";
url = "https://registry.yarnpkg.com/pkg-dir/-/pkg-dir-3.0.0.tgz";
sha1 = "2749020f239ed990881b1f71210d51eb6523bea3";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "pkg_dir___pkg_dir_4.2.0.tgz";
path = fetchurl {
name = "pkg_dir___pkg_dir_4.2.0.tgz";
url = "https://registry.yarnpkg.com/pkg-dir/-/pkg-dir-4.2.0.tgz";
sha1 = "f099133df7ede422e81d1d8448270eeb3e4261f3";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "pkg_up___pkg_up_2.0.0.tgz";
path = fetchurl {
name = "pkg_up___pkg_up_2.0.0.tgz";
url = "https://registry.yarnpkg.com/pkg-up/-/pkg-up-2.0.0.tgz";
sha1 = "c819ac728059a461cab1c3889a2be3c49a004d7f";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "pkginfo___pkginfo_0.2.3.tgz";
path = fetchurl {
name = "pkginfo___pkginfo_0.2.3.tgz";
url = "https://registry.yarnpkg.com/pkginfo/-/pkginfo-0.2.3.tgz";
sha1 = "7239c42a5ef6c30b8f328439d9b9ff71042490f8";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "pkginfo___pkginfo_0.4.1.tgz";
path = fetchurl {
name = "pkginfo___pkginfo_0.4.1.tgz";
url = "https://registry.yarnpkg.com/pkginfo/-/pkginfo-0.4.1.tgz";
sha1 = "b5418ef0439de5425fc4995042dced14fb2a84ff";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "please_upgrade_node___please_upgrade_node_3.2.0.tgz";
path = fetchurl {
name = "please_upgrade_node___please_upgrade_node_3.2.0.tgz";
url = "https://registry.yarnpkg.com/please-upgrade-node/-/please-upgrade-node-3.2.0.tgz";
sha1 = "aeddd3f994c933e4ad98b99d9a556efa0e2fe942";
};
}
{
name = "pluralize___pluralize_8.0.0.tgz";
path = fetchurl {
name = "pluralize___pluralize_8.0.0.tgz";
url = "https://registry.yarnpkg.com/pluralize/-/pluralize-8.0.0.tgz";
sha1 = "1a6fa16a38d12a1901e0320fa017051c539ce3b1";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "posix_character_classes___posix_character_classes_0.1.1.tgz";
path = fetchurl {
name = "posix_character_classes___posix_character_classes_0.1.1.tgz";
url = "https://registry.yarnpkg.com/posix-character-classes/-/posix-character-classes-0.1.1.tgz";
sha1 = "01eac0fe3b5af71a2a6c02feabb8c1fef7e00eab";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_calc___postcss_calc_8.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_calc___postcss_calc_8.0.0.tgz";
url = "https://registry.yarnpkg.com/postcss-calc/-/postcss-calc-8.0.0.tgz";
sha1 = "a05b87aacd132740a5db09462a3612453e5df90a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_colormin___postcss_colormin_5.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_colormin___postcss_colormin_5.2.0.tgz";
url = "https://registry.yarnpkg.com/postcss-colormin/-/postcss-colormin-5.2.0.tgz";
sha1 = "2b620b88c0ff19683f3349f4cf9e24ebdafb2c88";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_convert_values___postcss_convert_values_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_convert_values___postcss_convert_values_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-convert-values/-/postcss-convert-values-5.0.1.tgz";
sha1 = "4ec19d6016534e30e3102fdf414e753398645232";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_discard_comments___postcss_discard_comments_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_discard_comments___postcss_discard_comments_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-discard-comments/-/postcss-discard-comments-5.0.1.tgz";
sha1 = "9eae4b747cf760d31f2447c27f0619d5718901fe";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_discard_duplicates___postcss_discard_duplicates_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_discard_duplicates___postcss_discard_duplicates_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-discard-duplicates/-/postcss-discard-duplicates-5.0.1.tgz";
sha1 = "68f7cc6458fe6bab2e46c9f55ae52869f680e66d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_discard_empty___postcss_discard_empty_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_discard_empty___postcss_discard_empty_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-discard-empty/-/postcss-discard-empty-5.0.1.tgz";
sha1 = "ee136c39e27d5d2ed4da0ee5ed02bc8a9f8bf6d8";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_discard_overridden___postcss_discard_overridden_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_discard_overridden___postcss_discard_overridden_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-discard-overridden/-/postcss-discard-overridden-5.0.1.tgz";
sha1 = "454b41f707300b98109a75005ca4ab0ff2743ac6";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_merge_longhand___postcss_merge_longhand_5.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_merge_longhand___postcss_merge_longhand_5.0.2.tgz";
url = "https://registry.yarnpkg.com/postcss-merge-longhand/-/postcss-merge-longhand-5.0.2.tgz";
sha1 = "277ada51d9a7958e8ef8cf263103c9384b322a41";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_merge_rules___postcss_merge_rules_5.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_merge_rules___postcss_merge_rules_5.0.2.tgz";
url = "https://registry.yarnpkg.com/postcss-merge-rules/-/postcss-merge-rules-5.0.2.tgz";
sha1 = "d6e4d65018badbdb7dcc789c4f39b941305d410a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_minify_font_values___postcss_minify_font_values_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_minify_font_values___postcss_minify_font_values_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-minify-font-values/-/postcss-minify-font-values-5.0.1.tgz";
sha1 = "a90cefbfdaa075bd3dbaa1b33588bb4dc268addf";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_minify_gradients___postcss_minify_gradients_5.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_minify_gradients___postcss_minify_gradients_5.0.2.tgz";
url = "https://registry.yarnpkg.com/postcss-minify-gradients/-/postcss-minify-gradients-5.0.2.tgz";
sha1 = "7c175c108f06a5629925d698b3c4cf7bd3864ee5";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_minify_params___postcss_minify_params_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_minify_params___postcss_minify_params_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-minify-params/-/postcss-minify-params-5.0.1.tgz";
sha1 = "371153ba164b9d8562842fdcd929c98abd9e5b6c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_minify_selectors___postcss_minify_selectors_5.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_minify_selectors___postcss_minify_selectors_5.1.0.tgz";
url = "https://registry.yarnpkg.com/postcss-minify-selectors/-/postcss-minify-selectors-5.1.0.tgz";
sha1 = "4385c845d3979ff160291774523ffa54eafd5a54";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "postcss_modules_extract_imports___postcss_modules_extract_imports_3.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "postcss_modules_extract_imports___postcss_modules_extract_imports_3.0.0.tgz";
url = "https://registry.yarnpkg.com/postcss-modules-extract-imports/-/postcss-modules-extract-imports-3.0.0.tgz";
sha1 = "cda1f047c0ae80c97dbe28c3e76a43b88025741d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "postcss_modules_local_by_default___postcss_modules_local_by_default_4.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "postcss_modules_local_by_default___postcss_modules_local_by_default_4.0.0.tgz";
url = "https://registry.yarnpkg.com/postcss-modules-local-by-default/-/postcss-modules-local-by-default-4.0.0.tgz";
sha1 = "ebbb54fae1598eecfdf691a02b3ff3b390a5a51c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "postcss_modules_scope___postcss_modules_scope_3.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "postcss_modules_scope___postcss_modules_scope_3.0.0.tgz";
url = "https://registry.yarnpkg.com/postcss-modules-scope/-/postcss-modules-scope-3.0.0.tgz";
sha1 = "9ef3151456d3bbfa120ca44898dfca6f2fa01f06";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "postcss_modules_values___postcss_modules_values_4.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "postcss_modules_values___postcss_modules_values_4.0.0.tgz";
url = "https://registry.yarnpkg.com/postcss-modules-values/-/postcss-modules-values-4.0.0.tgz";
sha1 = "d7c5e7e68c3bb3c9b27cbf48ca0bb3ffb4602c9c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_charset___postcss_normalize_charset_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_charset___postcss_normalize_charset_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-normalize-charset/-/postcss-normalize-charset-5.0.1.tgz";
sha1 = "121559d1bebc55ac8d24af37f67bd4da9efd91d0";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_display_values___postcss_normalize_display_values_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_display_values___postcss_normalize_display_values_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-normalize-display-values/-/postcss-normalize-display-values-5.0.1.tgz";
sha1 = "62650b965981a955dffee83363453db82f6ad1fd";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_positions___postcss_normalize_positions_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_positions___postcss_normalize_positions_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-normalize-positions/-/postcss-normalize-positions-5.0.1.tgz";
sha1 = "868f6af1795fdfa86fbbe960dceb47e5f9492fe5";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_repeat_style___postcss_normalize_repeat_style_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_repeat_style___postcss_normalize_repeat_style_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-normalize-repeat-style/-/postcss-normalize-repeat-style-5.0.1.tgz";
sha1 = "cbc0de1383b57f5bb61ddd6a84653b5e8665b2b5";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_string___postcss_normalize_string_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_string___postcss_normalize_string_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-normalize-string/-/postcss-normalize-string-5.0.1.tgz";
sha1 = "d9eafaa4df78c7a3b973ae346ef0e47c554985b0";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_timing_functions___postcss_normalize_timing_functions_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_timing_functions___postcss_normalize_timing_functions_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-normalize-timing-functions/-/postcss-normalize-timing-functions-5.0.1.tgz";
sha1 = "8ee41103b9130429c6cbba736932b75c5e2cb08c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_unicode___postcss_normalize_unicode_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_unicode___postcss_normalize_unicode_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-normalize-unicode/-/postcss-normalize-unicode-5.0.1.tgz";
sha1 = "82d672d648a411814aa5bf3ae565379ccd9f5e37";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_url___postcss_normalize_url_5.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_url___postcss_normalize_url_5.0.2.tgz";
url = "https://registry.yarnpkg.com/postcss-normalize-url/-/postcss-normalize-url-5.0.2.tgz";
sha1 = "ddcdfb7cede1270740cf3e4dfc6008bd96abc763";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_whitespace___postcss_normalize_whitespace_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_normalize_whitespace___postcss_normalize_whitespace_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-normalize-whitespace/-/postcss-normalize-whitespace-5.0.1.tgz";
sha1 = "b0b40b5bcac83585ff07ead2daf2dcfbeeef8e9a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_ordered_values___postcss_ordered_values_5.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_ordered_values___postcss_ordered_values_5.0.2.tgz";
url = "https://registry.yarnpkg.com/postcss-ordered-values/-/postcss-ordered-values-5.0.2.tgz";
sha1 = "1f351426977be00e0f765b3164ad753dac8ed044";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_reduce_initial___postcss_reduce_initial_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_reduce_initial___postcss_reduce_initial_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-reduce-initial/-/postcss-reduce-initial-5.0.1.tgz";
sha1 = "9d6369865b0f6f6f6b165a0ef5dc1a4856c7e946";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_reduce_transforms___postcss_reduce_transforms_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_reduce_transforms___postcss_reduce_transforms_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-reduce-transforms/-/postcss-reduce-transforms-5.0.1.tgz";
sha1 = "93c12f6a159474aa711d5269923e2383cedcf640";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "postcss_selector_parser___postcss_selector_parser_6.0.6.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "postcss_selector_parser___postcss_selector_parser_6.0.6.tgz";
url = "https://registry.yarnpkg.com/postcss-selector-parser/-/postcss-selector-parser-6.0.6.tgz";
sha1 = "2c5bba8174ac2f6981ab631a42ab0ee54af332ea";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_svgo___postcss_svgo_5.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_svgo___postcss_svgo_5.0.2.tgz";
url = "https://registry.yarnpkg.com/postcss-svgo/-/postcss-svgo-5.0.2.tgz";
sha1 = "bc73c4ea4c5a80fbd4b45e29042c34ceffb9257f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_unique_selectors___postcss_unique_selectors_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss_unique_selectors___postcss_unique_selectors_5.0.1.tgz";
url = "https://registry.yarnpkg.com/postcss-unique-selectors/-/postcss-unique-selectors-5.0.1.tgz";
sha1 = "3be5c1d7363352eff838bd62b0b07a0abad43bfc";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "postcss_value_parser___postcss_value_parser_4.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "postcss_value_parser___postcss_value_parser_4.1.0.tgz";
url = "https://registry.yarnpkg.com/postcss-value-parser/-/postcss-value-parser-4.1.0.tgz";
sha1 = "443f6a20ced6481a2bda4fa8532a6e55d789a2cb";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss___postcss_8.3.6.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "postcss___postcss_8.3.6.tgz";
url = "https://registry.yarnpkg.com/postcss/-/postcss-8.3.6.tgz";
sha1 = "2730dd76a97969f37f53b9a6096197be311cc4ea";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "postgres_array___postgres_array_2.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "postgres_array___postgres_array_2.0.0.tgz";
url = "https://registry.yarnpkg.com/postgres-array/-/postgres-array-2.0.0.tgz";
sha1 = "48f8fce054fbc69671999329b8834b772652d82e";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "postgres_bytea___postgres_bytea_1.0.0.tgz";
path = fetchurl {
name = "postgres_bytea___postgres_bytea_1.0.0.tgz";
url = "https://registry.yarnpkg.com/postgres-bytea/-/postgres-bytea-1.0.0.tgz";
sha1 = "027b533c0aa890e26d172d47cf9ccecc521acd35";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "postgres_date___postgres_date_1.0.7.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "postgres_date___postgres_date_1.0.7.tgz";
url = "https://registry.yarnpkg.com/postgres-date/-/postgres-date-1.0.7.tgz";
sha1 = "51bc086006005e5061c591cee727f2531bf641a8";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "postgres_interval___postgres_interval_1.2.0.tgz";
path = fetchurl {
name = "postgres_interval___postgres_interval_1.2.0.tgz";
url = "https://registry.yarnpkg.com/postgres-interval/-/postgres-interval-1.2.0.tgz";
sha1 = "b460c82cb1587507788819a06aa0fffdb3544695";
};
}
{
name = "precond___precond_0.2.3.tgz";
path = fetchurl {
name = "precond___precond_0.2.3.tgz";
url = "https://registry.yarnpkg.com/precond/-/precond-0.2.3.tgz";
sha1 = "aa9591bcaa24923f1e0f4849d240f47efc1075ac";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "prelude_ls___prelude_ls_1.2.1.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "prelude_ls___prelude_ls_1.2.1.tgz";
url = "https://registry.yarnpkg.com/prelude-ls/-/prelude-ls-1.2.1.tgz";
sha1 = "debc6489d7a6e6b0e7611888cec880337d316396";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "preserve___preserve_0.2.0.tgz";
path = fetchurl {
name = "preserve___preserve_0.2.0.tgz";
url = "https://registry.yarnpkg.com/preserve/-/preserve-0.2.0.tgz";
sha1 = "815ed1f6ebc65926f865b310c0713bcb3315ce4b";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "pretty_error___pretty_error_2.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "pretty_error___pretty_error_2.1.2.tgz";
url = "https://registry.yarnpkg.com/pretty-error/-/pretty-error-2.1.2.tgz";
sha1 = "be89f82d81b1c86ec8fdfbc385045882727f93b6";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "printj___printj_1.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "printj___printj_1.1.2.tgz";
url = "https://registry.yarnpkg.com/printj/-/printj-1.1.2.tgz";
sha1 = "d90deb2975a8b9f600fb3a1c94e3f4c53c78a222";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "prismjs___prismjs_1.24.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "prismjs___prismjs_1.24.1.tgz";
url = "https://registry.yarnpkg.com/prismjs/-/prismjs-1.24.1.tgz";
sha1 = "c4d7895c4d6500289482fa8936d9cdd192684036";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "private___private_0.1.8.tgz";
path = fetchurl {
name = "private___private_0.1.8.tgz";
url = "https://registry.yarnpkg.com/private/-/private-0.1.8.tgz";
sha1 = "2381edb3689f7a53d653190060fcf822d2f368ff";
};
}
{
name = "process_nextick_args___process_nextick_args_1.0.7.tgz";
path = fetchurl {
name = "process_nextick_args___process_nextick_args_1.0.7.tgz";
url = "https://registry.yarnpkg.com/process-nextick-args/-/process-nextick-args-1.0.7.tgz";
sha1 = "150e20b756590ad3f91093f25a4f2ad8bff30ba3";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "process_nextick_args___process_nextick_args_2.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "process_nextick_args___process_nextick_args_2.0.1.tgz";
url = "https://registry.yarnpkg.com/process-nextick-args/-/process-nextick-args-2.0.1.tgz";
sha1 = "7820d9b16120cc55ca9ae7792680ae7dba6d7fe2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "process___process_0.11.10.tgz";
path = fetchurl {
name = "process___process_0.11.10.tgz";
url = "https://registry.yarnpkg.com/process/-/process-0.11.10.tgz";
sha1 = "7332300e840161bda3e69a1d1d91a7d4bc16f182";
};
}
{
name = "progress___progress_2.0.3.tgz";
path = fetchurl {
name = "progress___progress_2.0.3.tgz";
url = "https://registry.yarnpkg.com/progress/-/progress-2.0.3.tgz";
sha1 = "7e8cf8d8f5b8f239c1bc68beb4eb78567d572ef8";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "prom_client___prom_client_13.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "prom_client___prom_client_13.2.0.tgz";
url = "https://registry.yarnpkg.com/prom-client/-/prom-client-13.2.0.tgz";
sha1 = "99d13357912dd400f8911b77df19f7b328a93e92";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "prometheus_api_metrics___prometheus_api_metrics_3.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "prometheus_api_metrics___prometheus_api_metrics_3.2.0.tgz";
url = "https://registry.yarnpkg.com/prometheus-api-metrics/-/prometheus-api-metrics-3.2.0.tgz";
sha1 = "3af90989271abb55b7e0405bdfcb161f403a361c";
};
}
{
name = "promise_inflight___promise_inflight_1.0.1.tgz";
path = fetchurl {
name = "promise_inflight___promise_inflight_1.0.1.tgz";
url = "https://registry.yarnpkg.com/promise-inflight/-/promise-inflight-1.0.1.tgz";
sha1 = "98472870bf228132fcbdd868129bad12c3c029e3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "property_information___property_information_6.0.1.tgz";
path = fetchurl {
name = "property_information___property_information_6.0.1.tgz";
url = "https://registry.yarnpkg.com/property-information/-/property-information-6.0.1.tgz";
sha1 = "7c668d9f2b9cb63bc3e105d8b8dfee7221a17800";
};
}
{
name = "proxy_addr___proxy_addr_2.0.7.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "proxy_addr___proxy_addr_2.0.7.tgz";
url = "https://registry.yarnpkg.com/proxy-addr/-/proxy-addr-2.0.7.tgz";
sha1 = "f19fe69ceab311eeb94b42e70e8c2070f9ba1025";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "prr___prr_1.0.1.tgz";
path = fetchurl {
name = "prr___prr_1.0.1.tgz";
url = "https://registry.yarnpkg.com/prr/-/prr-1.0.1.tgz";
sha1 = "d3fc114ba06995a45ec6893f484ceb1d78f5f476";
};
}
{
name = "pseudomap___pseudomap_1.0.2.tgz";
path = fetchurl {
name = "pseudomap___pseudomap_1.0.2.tgz";
url = "https://registry.yarnpkg.com/pseudomap/-/pseudomap-1.0.2.tgz";
sha1 = "f052a28da70e618917ef0a8ac34c1ae5a68286b3";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "psl___psl_1.8.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "psl___psl_1.8.0.tgz";
url = "https://registry.yarnpkg.com/psl/-/psl-1.8.0.tgz";
sha1 = "9326f8bcfb013adcc005fdff056acce020e51c24";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "public_encrypt___public_encrypt_4.0.3.tgz";
path = fetchurl {
name = "public_encrypt___public_encrypt_4.0.3.tgz";
url = "https://registry.yarnpkg.com/public-encrypt/-/public-encrypt-4.0.3.tgz";
sha1 = "4fcc9d77a07e48ba7527e7cbe0de33d0701331e0";
};
}
{
name = "pump___pump_2.0.1.tgz";
path = fetchurl {
name = "pump___pump_2.0.1.tgz";
url = "https://registry.yarnpkg.com/pump/-/pump-2.0.1.tgz";
sha1 = "12399add6e4cf7526d973cbc8b5ce2e2908b3909";
};
}
{
name = "pump___pump_3.0.0.tgz";
path = fetchurl {
name = "pump___pump_3.0.0.tgz";
url = "https://registry.yarnpkg.com/pump/-/pump-3.0.0.tgz";
sha1 = "b4a2116815bde2f4e1ea602354e8c75565107a64";
};
}
{
name = "pumpify___pumpify_1.5.1.tgz";
path = fetchurl {
name = "pumpify___pumpify_1.5.1.tgz";
url = "https://registry.yarnpkg.com/pumpify/-/pumpify-1.5.1.tgz";
sha1 = "36513be246ab27570b1a374a5ce278bfd74370ce";
};
}
{
name = "punycode___punycode_1.3.2.tgz";
path = fetchurl {
name = "punycode___punycode_1.3.2.tgz";
url = "https://registry.yarnpkg.com/punycode/-/punycode-1.3.2.tgz";
sha1 = "9653a036fb7c1ee42342f2325cceefea3926c48d";
};
}
{
name = "punycode___punycode_1.4.1.tgz";
path = fetchurl {
name = "punycode___punycode_1.4.1.tgz";
url = "https://registry.yarnpkg.com/punycode/-/punycode-1.4.1.tgz";
sha1 = "c0d5a63b2718800ad8e1eb0fa5269c84dd41845e";
};
}
{
name = "punycode___punycode_2.1.1.tgz";
path = fetchurl {
name = "punycode___punycode_2.1.1.tgz";
url = "https://registry.yarnpkg.com/punycode/-/punycode-2.1.1.tgz";
sha1 = "b58b010ac40c22c5657616c8d2c2c02c7bf479ec";
};
}
{
name = "q___q_1.5.1.tgz";
path = fetchurl {
name = "q___q_1.5.1.tgz";
url = "https://registry.yarnpkg.com/q/-/q-1.5.1.tgz";
sha1 = "7e32f75b41381291d04611f1bf14109ac00651d7";
};
}
{
name = "qs___qs_2.3.3.tgz";
path = fetchurl {
name = "qs___qs_2.3.3.tgz";
url = "https://registry.yarnpkg.com/qs/-/qs-2.3.3.tgz";
sha1 = "e9e85adbe75da0bbe4c8e0476a086290f863b404";
};
}
{
name = "qs___qs_6.7.0.tgz";
path = fetchurl {
name = "qs___qs_6.7.0.tgz";
url = "https://registry.yarnpkg.com/qs/-/qs-6.7.0.tgz";
sha1 = "41dc1a015e3d581f1621776be31afb2876a9b1bc";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "qs___qs_6.10.1.tgz";
path = fetchurl {
name = "qs___qs_6.10.1.tgz";
url = "https://registry.yarnpkg.com/qs/-/qs-6.10.1.tgz";
sha1 = "4931482fa8d647a5aab799c5271d2133b981fb6a";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "qs___qs_6.5.2.tgz";
path = fetchurl {
name = "qs___qs_6.5.2.tgz";
url = "https://registry.yarnpkg.com/qs/-/qs-6.5.2.tgz";
sha1 = "cb3ae806e8740444584ef154ce8ee98d403f3e36";
};
}
{
name = "querystring_es3___querystring_es3_0.2.1.tgz";
path = fetchurl {
name = "querystring_es3___querystring_es3_0.2.1.tgz";
url = "https://registry.yarnpkg.com/querystring-es3/-/querystring-es3-0.2.1.tgz";
sha1 = "9ec61f79049875707d69414596fd907a4d711e73";
};
}
{
name = "querystring___querystring_0.2.0.tgz";
path = fetchurl {
name = "querystring___querystring_0.2.0.tgz";
url = "https://registry.yarnpkg.com/querystring/-/querystring-0.2.0.tgz";
sha1 = "b209849203bb25df820da756e747005878521620";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "queue_microtask___queue_microtask_1.2.3.tgz";
path = fetchurl {
name = "queue_microtask___queue_microtask_1.2.3.tgz";
url = "https://registry.yarnpkg.com/queue-microtask/-/queue-microtask-1.2.3.tgz";
sha1 = "4929228bbc724dfac43e0efb058caf7b6cfb6243";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "random_bytes___random_bytes_1.0.0.tgz";
path = fetchurl {
name = "random_bytes___random_bytes_1.0.0.tgz";
url = "https://registry.yarnpkg.com/random-bytes/-/random-bytes-1.0.0.tgz";
sha1 = "4f68a1dc0ae58bd3fb95848c30324db75d64360b";
};
}
{
name = "randomatic___randomatic_3.1.1.tgz";
path = fetchurl {
name = "randomatic___randomatic_3.1.1.tgz";
url = "https://registry.yarnpkg.com/randomatic/-/randomatic-3.1.1.tgz";
sha1 = "b776efc59375984e36c537b2f51a1f0aff0da1ed";
};
}
{
name = "randombytes___randombytes_2.1.0.tgz";
path = fetchurl {
name = "randombytes___randombytes_2.1.0.tgz";
url = "https://registry.yarnpkg.com/randombytes/-/randombytes-2.1.0.tgz";
sha1 = "df6f84372f0270dc65cdf6291349ab7a473d4f2a";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "randomcolor___randomcolor_0.6.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "randomcolor___randomcolor_0.6.2.tgz";
url = "https://registry.yarnpkg.com/randomcolor/-/randomcolor-0.6.2.tgz";
sha1 = "7a57362ae1a1278439aeed2c15e5deb8ea33f56d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "randomfill___randomfill_1.0.4.tgz";
path = fetchurl {
name = "randomfill___randomfill_1.0.4.tgz";
url = "https://registry.yarnpkg.com/randomfill/-/randomfill-1.0.4.tgz";
sha1 = "c92196fc86ab42be983f1bf31778224931d61458";
};
}
{
name = "range_parser___range_parser_1.2.1.tgz";
path = fetchurl {
name = "range_parser___range_parser_1.2.1.tgz";
url = "https://registry.yarnpkg.com/range-parser/-/range-parser-1.2.1.tgz";
sha1 = "3cf37023d199e1c24d1a55b84800c2f3e6468031";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
name = "raphael___raphael_2.3.0.tgz";
path = fetchurl {
name = "raphael___raphael_2.3.0.tgz";
url = "https://registry.yarnpkg.com/raphael/-/raphael-2.3.0.tgz";
sha1 = "eabeb09dba861a1d4cee077eaafb8c53f3131f89";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "raw_body___raw_body_2.4.0.tgz";
path = fetchurl {
name = "raw_body___raw_body_2.4.0.tgz";
url = "https://registry.yarnpkg.com/raw-body/-/raw-body-2.4.0.tgz";
sha1 = "a1ce6fb9c9bc356ca52e89256ab59059e13d0332";
};
}
{
name = "rc___rc_1.2.8.tgz";
path = fetchurl {
name = "rc___rc_1.2.8.tgz";
url = "https://registry.yarnpkg.com/rc/-/rc-1.2.8.tgz";
sha1 = "cd924bf5200a075b83c188cd6b9e211b7fc0d3ed";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "read_pkg_up___read_pkg_up_3.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "read_pkg_up___read_pkg_up_3.0.0.tgz";
url = "https://registry.yarnpkg.com/read-pkg-up/-/read-pkg-up-3.0.0.tgz";
sha1 = "3ed496685dba0f8fe118d0691dc51f4a1ff96f07";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "read_pkg___read_pkg_3.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "read_pkg___read_pkg_3.0.0.tgz";
url = "https://registry.yarnpkg.com/read-pkg/-/read-pkg-3.0.0.tgz";
sha1 = "9cbc686978fee65d16c00e2b19c237fcf6e38389";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "readable_stream___readable_stream_2.3.7.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "readable_stream___readable_stream_2.3.7.tgz";
url = "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.3.7.tgz";
sha1 = "1eca1cf711aef814c04f62252a36a62f6cb23b57";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "readable_stream___readable_stream_1.0.27_1.tgz";
path = fetchurl {
name = "readable_stream___readable_stream_1.0.27_1.tgz";
url = "https://registry.yarnpkg.com/readable-stream/-/readable-stream-1.0.27-1.tgz";
sha1 = "6b67983c20357cefd07f0165001a16d710d91078";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "readable_stream___readable_stream_3.6.0.tgz";
path = fetchurl {
name = "readable_stream___readable_stream_3.6.0.tgz";
url = "https://registry.yarnpkg.com/readable-stream/-/readable-stream-3.6.0.tgz";
sha1 = "337bbda3adc0706bd3e024426a286d4b4b2c9198";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "readable_stream___readable_stream_2.0.6.tgz";
path = fetchurl {
name = "readable_stream___readable_stream_2.0.6.tgz";
url = "https://registry.yarnpkg.com/readable-stream/-/readable-stream-2.0.6.tgz";
sha1 = "8f90341e68a53ccc928788dacfcd11b36eb9b78e";
};
}
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "readable_web_to_node_stream___readable_web_to_node_stream_3.0.2.tgz";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "readable_web_to_node_stream___readable_web_to_node_stream_3.0.2.tgz";
url = "https://registry.yarnpkg.com/readable-web-to-node-stream/-/readable-web-to-node-stream-3.0.2.tgz";
sha1 = "5d52bb5df7b54861fd48d015e93a2cb87b3ee0bb";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "readdir_glob___readdir_glob_1.1.1.tgz";
path = fetchurl {
name = "readdir_glob___readdir_glob_1.1.1.tgz";
url = "https://registry.yarnpkg.com/readdir-glob/-/readdir-glob-1.1.1.tgz";
sha1 = "f0e10bb7bf7bfa7e0add8baffdc54c3f7dbee6c4";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "readdirp___readdirp_2.2.1.tgz";
path = fetchurl {
name = "readdirp___readdirp_2.2.1.tgz";
url = "https://registry.yarnpkg.com/readdirp/-/readdirp-2.2.1.tgz";
sha1 = "0e87622a3325aa33e892285caf8b4e846529a525";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "readdirp___readdirp_3.6.0.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "readdirp___readdirp_3.6.0.tgz";
url = "https://registry.yarnpkg.com/readdirp/-/readdirp-3.6.0.tgz";
sha1 = "74a370bd857116e245b29cc97340cd431a02a6c7";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "readline_sync___readline_sync_1.4.10.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "readline_sync___readline_sync_1.4.10.tgz";
url = "https://registry.yarnpkg.com/readline-sync/-/readline-sync-1.4.10.tgz";
sha1 = "41df7fbb4b6312d673011594145705bf56d8873b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "rechoir___rechoir_0.7.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "rechoir___rechoir_0.7.1.tgz";
url = "https://registry.yarnpkg.com/rechoir/-/rechoir-0.7.1.tgz";
sha1 = "9478a96a1ca135b5e88fc027f03ee92d6c645686";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "reduce_component___reduce_component_1.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "reduce_component___reduce_component_1.0.1.tgz";
url = "https://registry.yarnpkg.com/reduce-component/-/reduce-component-1.0.1.tgz";
sha1 = "e0c93542c574521bea13df0f9488ed82ab77c5da";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "regenerate___regenerate_1.4.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "regenerate___regenerate_1.4.2.tgz";
url = "https://registry.yarnpkg.com/regenerate/-/regenerate-1.4.2.tgz";
sha1 = "b9346d8827e8f5a32f7ba29637d398b69014848a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "regenerator_runtime___regenerator_runtime_0.10.5.tgz";
path = fetchurl {
name = "regenerator_runtime___regenerator_runtime_0.10.5.tgz";
url = "https://registry.yarnpkg.com/regenerator-runtime/-/regenerator-runtime-0.10.5.tgz";
sha1 = "336c3efc1220adcedda2c9fab67b5a7955a33658";
};
}
{
name = "regenerator_runtime___regenerator_runtime_0.11.1.tgz";
path = fetchurl {
name = "regenerator_runtime___regenerator_runtime_0.11.1.tgz";
url = "https://registry.yarnpkg.com/regenerator-runtime/-/regenerator-runtime-0.11.1.tgz";
sha1 = "be05ad7f9bf7d22e056f9726cee5017fbf19e2e9";
};
}
{
name = "regenerator_transform___regenerator_transform_0.10.1.tgz";
path = fetchurl {
name = "regenerator_transform___regenerator_transform_0.10.1.tgz";
url = "https://registry.yarnpkg.com/regenerator-transform/-/regenerator-transform-0.10.1.tgz";
sha1 = "1e4996837231da8b7f3cf4114d71b5691a0680dd";
};
}
{
name = "regex_cache___regex_cache_0.4.4.tgz";
path = fetchurl {
name = "regex_cache___regex_cache_0.4.4.tgz";
url = "https://registry.yarnpkg.com/regex-cache/-/regex-cache-0.4.4.tgz";
sha1 = "75bdc58a2a1496cec48a12835bc54c8d562336dd";
};
}
{
name = "regex_not___regex_not_1.0.2.tgz";
path = fetchurl {
name = "regex_not___regex_not_1.0.2.tgz";
url = "https://registry.yarnpkg.com/regex-not/-/regex-not-1.0.2.tgz";
sha1 = "1f4ece27e00b0b65e0247a6810e6a85d83a5752c";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "regexp.prototype.flags___regexp.prototype.flags_1.3.1.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "regexp.prototype.flags___regexp.prototype.flags_1.3.1.tgz";
url = "https://registry.yarnpkg.com/regexp.prototype.flags/-/regexp.prototype.flags-1.3.1.tgz";
sha1 = "7ef352ae8d159e758c0eadca6f8fcb4eef07be26";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "regexpp___regexpp_3.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "regexpp___regexpp_3.2.0.tgz";
url = "https://registry.yarnpkg.com/regexpp/-/regexpp-3.2.0.tgz";
sha1 = "0425a2768d8f23bad70ca4b90461fa2f1213e1b2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "regexpu_core___regexpu_core_2.0.0.tgz";
path = fetchurl {
name = "regexpu_core___regexpu_core_2.0.0.tgz";
url = "https://registry.yarnpkg.com/regexpu-core/-/regexpu-core-2.0.0.tgz";
sha1 = "49d038837b8dcf8bfa5b9a42139938e6ea2ae240";
};
}
{
name = "regjsgen___regjsgen_0.2.0.tgz";
path = fetchurl {
name = "regjsgen___regjsgen_0.2.0.tgz";
url = "https://registry.yarnpkg.com/regjsgen/-/regjsgen-0.2.0.tgz";
sha1 = "6c016adeac554f75823fe37ac05b92d5a4edb1f7";
};
}
{
name = "regjsparser___regjsparser_0.1.5.tgz";
path = fetchurl {
name = "regjsparser___regjsparser_0.1.5.tgz";
url = "https://registry.yarnpkg.com/regjsparser/-/regjsparser-0.1.5.tgz";
sha1 = "7ee8f84dc6fa792d3fd0ae228d24bd949ead205c";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "rehype_parse___rehype_parse_8.0.3.tgz";
path = fetchurl {
name = "rehype_parse___rehype_parse_8.0.3.tgz";
url = "https://registry.yarnpkg.com/rehype-parse/-/rehype-parse-8.0.3.tgz";
sha1 = "a1947132a08a930d0c2b6fd2b3dbcc137457c07a";
};
}
{
name = "rehype_stringify___rehype_stringify_9.0.2.tgz";
path = fetchurl {
name = "rehype_stringify___rehype_stringify_9.0.2.tgz";
url = "https://registry.yarnpkg.com/rehype-stringify/-/rehype-stringify-9.0.2.tgz";
sha1 = "2d95e06e246abbee504cf2f54c8d12f27d7bfd8e";
};
}
{
name = "rehype___rehype_12.0.0.tgz";
path = fetchurl {
name = "rehype___rehype_12.0.0.tgz";
url = "https://registry.yarnpkg.com/rehype/-/rehype-12.0.0.tgz";
sha1 = "d5e80a206da2479b3564722bc2ba882e0f4240ec";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "relateurl___relateurl_0.2.7.tgz";
path = fetchurl {
name = "relateurl___relateurl_0.2.7.tgz";
url = "https://registry.yarnpkg.com/relateurl/-/relateurl-0.2.7.tgz";
sha1 = "54dbf377e51440aca90a4cd274600d3ff2d888a9";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_cli___remark_cli_10.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_cli___remark_cli_10.0.0.tgz";
url = "https://registry.yarnpkg.com/remark-cli/-/remark-cli-10.0.0.tgz";
sha1 = "3b0e20f2ad3909f35c7a6fb3f721c82f6ff5beac";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_blockquote_indentation___remark_lint_blockquote_indentation_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_blockquote_indentation___remark_lint_blockquote_indentation_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-blockquote-indentation/-/remark-lint-blockquote-indentation-3.0.1.tgz";
sha1 = "74591e6029c4c8c92bf0c1665e001b29a71522bd";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_code_block_style___remark_lint_code_block_style_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_code_block_style___remark_lint_code_block_style_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-code-block-style/-/remark-lint-code-block-style-3.0.1.tgz";
sha1 = "be4434e3e8007bd3324227da876d3c59e2e960d6";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_definition_case___remark_lint_definition_case_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_definition_case___remark_lint_definition_case_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-definition-case/-/remark-lint-definition-case-3.0.1.tgz";
sha1 = "15b2260ed0281398944c09f460ec48cb31a12fdc";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_definition_spacing___remark_lint_definition_spacing_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_definition_spacing___remark_lint_definition_spacing_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-definition-spacing/-/remark-lint-definition-spacing-3.0.1.tgz";
sha1 = "2599dc8cef6eb555b116a9634a226d812795fd87";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_emphasis_marker___remark_lint_emphasis_marker_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_emphasis_marker___remark_lint_emphasis_marker_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-emphasis-marker/-/remark-lint-emphasis-marker-3.0.1.tgz";
sha1 = "612d0126d99649484ad9a42ad854f3110ddc7536";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_fenced_code_flag___remark_lint_fenced_code_flag_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_fenced_code_flag___remark_lint_fenced_code_flag_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-fenced-code-flag/-/remark-lint-fenced-code-flag-3.0.1.tgz";
sha1 = "5282ece321f9e3e86dd7e1b30dbd50f0cdbb40e0";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_fenced_code_marker___remark_lint_fenced_code_marker_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_fenced_code_marker___remark_lint_fenced_code_marker_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-fenced-code-marker/-/remark-lint-fenced-code-marker-3.0.1.tgz";
sha1 = "3b09baa8305f86f27c81e1f4eaffd4ac4e51e7b0";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_file_extension___remark_lint_file_extension_2.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_file_extension___remark_lint_file_extension_2.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-file-extension/-/remark-lint-file-extension-2.0.1.tgz";
sha1 = "e6777c2a322270066aa3c249d2836d326ba3f91d";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_final_definition___remark_lint_final_definition_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_final_definition___remark_lint_final_definition_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-final-definition/-/remark-lint-final-definition-3.0.1.tgz";
sha1 = "9439d9531369b6a8bbbb25e2d550d5fe19a9202b";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_hard_break_spaces___remark_lint_hard_break_spaces_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_hard_break_spaces___remark_lint_hard_break_spaces_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-hard-break-spaces/-/remark-lint-hard-break-spaces-3.0.1.tgz";
sha1 = "aa5a968a6ecb609fddc0b3c73e578f4eb3fdf75a";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_heading_increment___remark_lint_heading_increment_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_heading_increment___remark_lint_heading_increment_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-heading-increment/-/remark-lint-heading-increment-3.0.1.tgz";
sha1 = "12d264ea48b6db979433bf22b4145d116789361d";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_heading_style___remark_lint_heading_style_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_heading_style___remark_lint_heading_style_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-heading-style/-/remark-lint-heading-style-3.0.1.tgz";
sha1 = "8727db87ceab53d33c7016750acf3358b321d15f";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_link_title_style___remark_lint_link_title_style_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_link_title_style___remark_lint_link_title_style_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-link-title-style/-/remark-lint-link-title-style-3.0.1.tgz";
sha1 = "9fbbc8329cf7c693d307764662cc644415b143fe";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_list_item_content_indent___remark_lint_list_item_content_indent_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_list_item_content_indent___remark_lint_list_item_content_indent_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-list-item-content-indent/-/remark-lint-list-item-content-indent-3.0.1.tgz";
sha1 = "1357e559e69163386f9666b20efd2951e6222416";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_list_item_indent___remark_lint_list_item_indent_3.0.1.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_list_item_indent___remark_lint_list_item_indent_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-list-item-indent/-/remark-lint-list-item-indent-3.0.1.tgz";
sha1 = "719ee34dec3f7b34cfd3fd2600806dc561fc748b";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_list_item_spacing___remark_lint_list_item_spacing_4.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_list_item_spacing___remark_lint_list_item_spacing_4.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-list-item-spacing/-/remark-lint-list-item-spacing-4.0.1.tgz";
sha1 = "41add9734076d23671d043db09e2cd9154cd7dd5";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_maximum_heading_length___remark_lint_maximum_heading_length_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_maximum_heading_length___remark_lint_maximum_heading_length_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-maximum-heading-length/-/remark-lint-maximum-heading-length-3.0.1.tgz";
sha1 = "0ab8071f5c2fbdf8a28d23022f74c59bfdfaac75";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_maximum_line_length___remark_lint_maximum_line_length_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_maximum_line_length___remark_lint_maximum_line_length_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-maximum-line-length/-/remark-lint-maximum-line-length-3.0.1.tgz";
sha1 = "685871fd6581148a32ca38719f9f1eb16d78c30f";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_auto_link_without_protocol___remark_lint_no_auto_link_without_protocol_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_auto_link_without_protocol___remark_lint_no_auto_link_without_protocol_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-auto-link-without-protocol/-/remark-lint-no-auto-link-without-protocol-3.0.1.tgz";
sha1 = "8a70874368521bb40689b5421d8279796199c493";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_blockquote_without_marker___remark_lint_no_blockquote_without_marker_5.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_blockquote_without_marker___remark_lint_no_blockquote_without_marker_5.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-blockquote-without-marker/-/remark-lint-no-blockquote-without-marker-5.0.1.tgz";
sha1 = "31cb4264088b6db8c5a2824ab0a16f0ce37d5065";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_consecutive_blank_lines___remark_lint_no_consecutive_blank_lines_4.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_consecutive_blank_lines___remark_lint_no_consecutive_blank_lines_4.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-consecutive-blank-lines/-/remark-lint-no-consecutive-blank-lines-4.0.1.tgz";
sha1 = "e9ff3613e25d42bd004e8ab065609a0393f16f2b";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_duplicate_headings___remark_lint_no_duplicate_headings_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_duplicate_headings___remark_lint_no_duplicate_headings_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-duplicate-headings/-/remark-lint-no-duplicate-headings-3.0.1.tgz";
sha1 = "9db2ba686606226178d6563a0213e83ac7a22c15";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_emphasis_as_heading___remark_lint_no_emphasis_as_heading_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_emphasis_as_heading___remark_lint_no_emphasis_as_heading_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-emphasis-as-heading/-/remark-lint-no-emphasis-as-heading-3.0.1.tgz";
sha1 = "0290da33cbce79b72ddf28f9878fccad64d3a0f2";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_file_name_articles___remark_lint_no_file_name_articles_2.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_file_name_articles___remark_lint_no_file_name_articles_2.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-file-name-articles/-/remark-lint-no-file-name-articles-2.0.1.tgz";
sha1 = "1265a3dab489f5c07a1c3e8a2167124ef5bd030f";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_file_name_consecutive_dashes___remark_lint_no_file_name_consecutive_dashes_2.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_file_name_consecutive_dashes___remark_lint_no_file_name_consecutive_dashes_2.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-file-name-consecutive-dashes/-/remark-lint-no-file-name-consecutive-dashes-2.0.1.tgz";
sha1 = "cab34dce03381b15dac50188198c24303bde4e71";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_file_name_irregular_characters___remark_lint_no_file_name_irregular_characters_2.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_file_name_irregular_characters___remark_lint_no_file_name_irregular_characters_2.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-file-name-irregular-characters/-/remark-lint-no-file-name-irregular-characters-2.0.1.tgz";
sha1 = "7188d6bca6618d667237ceb553bf7a19fb421dd1";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_file_name_mixed_case___remark_lint_no_file_name_mixed_case_2.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_file_name_mixed_case___remark_lint_no_file_name_mixed_case_2.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-file-name-mixed-case/-/remark-lint-no-file-name-mixed-case-2.0.1.tgz";
sha1 = "2e200fdb19d8b3249ba3cddbddf35c52590b7c1a";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_file_name_outer_dashes___remark_lint_no_file_name_outer_dashes_2.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_file_name_outer_dashes___remark_lint_no_file_name_outer_dashes_2.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-file-name-outer-dashes/-/remark-lint-no-file-name-outer-dashes-2.0.1.tgz";
sha1 = "536344895ab351d8712180dd63ade2f59849fcef";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_heading_punctuation___remark_lint_no_heading_punctuation_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_heading_punctuation___remark_lint_no_heading_punctuation_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-heading-punctuation/-/remark-lint-no-heading-punctuation-3.0.1.tgz";
sha1 = "e21744d80e7f06cb9c984c0bd4e3f3a284b51afd";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_inline_padding___remark_lint_no_inline_padding_4.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_inline_padding___remark_lint_no_inline_padding_4.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-inline-padding/-/remark-lint-no-inline-padding-4.0.1.tgz";
sha1 = "a89d4fd639e888ee97cac811b9c950f1787a08a5";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_literal_urls___remark_lint_no_literal_urls_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_literal_urls___remark_lint_no_literal_urls_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-literal-urls/-/remark-lint-no-literal-urls-3.0.1.tgz";
sha1 = "af87cc111f942a43edf2d2cc27d199b7785be141";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_multiple_toplevel_headings___remark_lint_no_multiple_toplevel_headings_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_multiple_toplevel_headings___remark_lint_no_multiple_toplevel_headings_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-multiple-toplevel-headings/-/remark-lint-no-multiple-toplevel-headings-3.0.1.tgz";
sha1 = "08e03c3b102748835bc7077fbec9b0543c8feff4";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_shell_dollars___remark_lint_no_shell_dollars_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_shell_dollars___remark_lint_no_shell_dollars_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-shell-dollars/-/remark-lint-no-shell-dollars-3.0.1.tgz";
sha1 = "e9c092e07be2e308abd49b54c253010efb3e654c";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_shortcut_reference_image___remark_lint_no_shortcut_reference_image_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_shortcut_reference_image___remark_lint_no_shortcut_reference_image_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-shortcut-reference-image/-/remark-lint-no-shortcut-reference-image-3.0.1.tgz";
sha1 = "3cef27ef939debd385d9d3ba21bfb8afd3e011b4";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_shortcut_reference_link___remark_lint_no_shortcut_reference_link_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_shortcut_reference_link___remark_lint_no_shortcut_reference_link_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-shortcut-reference-link/-/remark-lint-no-shortcut-reference-link-3.0.1.tgz";
sha1 = "3104ed6b82c6234eb6187481243f1b3890a1d506";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_table_indentation___remark_lint_no_table_indentation_4.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_no_table_indentation___remark_lint_no_table_indentation_4.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-no-table-indentation/-/remark-lint-no-table-indentation-4.0.1.tgz";
sha1 = "13a41252021b245ca60bfbe5a578755421316e65";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_ordered_list_marker_style___remark_lint_ordered_list_marker_style_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_ordered_list_marker_style___remark_lint_ordered_list_marker_style_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-ordered-list-marker-style/-/remark-lint-ordered-list-marker-style-3.0.1.tgz";
sha1 = "56f6a94d88dd8c74b8e444cd970bb3be6a575606";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_ordered_list_marker_value___remark_lint_ordered_list_marker_value_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_ordered_list_marker_value___remark_lint_ordered_list_marker_value_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-ordered-list-marker-value/-/remark-lint-ordered-list-marker-value-3.0.1.tgz";
sha1 = "1296c0a758df6ea2e918769f013bff10ff5bd0d9";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_rule_style___remark_lint_rule_style_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_rule_style___remark_lint_rule_style_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-rule-style/-/remark-lint-rule-style-3.0.1.tgz";
sha1 = "2473b4d8d866e6f27ef968d7071d2ed719ce999c";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_strong_marker___remark_lint_strong_marker_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_strong_marker___remark_lint_strong_marker_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-strong-marker/-/remark-lint-strong-marker-3.0.1.tgz";
sha1 = "54119b529d152ea7294ac761e866a3a6244c4405";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_table_cell_padding___remark_lint_table_cell_padding_4.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_table_cell_padding___remark_lint_table_cell_padding_4.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-table-cell-padding/-/remark-lint-table-cell-padding-4.0.1.tgz";
sha1 = "0cfc515af12f4c2f123e8b5895a9ae635142f7e3";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_table_pipe_alignment___remark_lint_table_pipe_alignment_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_table_pipe_alignment___remark_lint_table_pipe_alignment_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-table-pipe-alignment/-/remark-lint-table-pipe-alignment-3.0.1.tgz";
sha1 = "70517c20ca24e4da830f71e09c39aabab1e5382e";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_table_pipes___remark_lint_table_pipes_4.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_table_pipes___remark_lint_table_pipes_4.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-table-pipes/-/remark-lint-table-pipes-4.0.1.tgz";
sha1 = "529d6d5569eed1129b912df3c748005cc2f82046";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_unordered_list_marker_style___remark_lint_unordered_list_marker_style_3.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint_unordered_list_marker_style___remark_lint_unordered_list_marker_style_3.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint-unordered-list-marker-style/-/remark-lint-unordered-list-marker-style-3.0.1.tgz";
sha1 = "f50b3359444d32363541bd26e30e091eb9b4d866";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint___remark_lint_9.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_lint___remark_lint_9.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-lint/-/remark-lint-9.0.1.tgz";
sha1 = "85ede987d24b7def9a6cea4a4d40c2035723eaec";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_message_control___remark_message_control_7.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_message_control___remark_message_control_7.0.0.tgz";
url = "https://registry.yarnpkg.com/remark-message-control/-/remark-message-control-7.0.0.tgz";
sha1 = "ba83d212fbde3e5e2adabd30697bf80b0b709ef7";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_parse___remark_parse_10.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_parse___remark_parse_10.0.0.tgz";
url = "https://registry.yarnpkg.com/remark-parse/-/remark-parse-10.0.0.tgz";
sha1 = "65e2b2b34d8581d36b97f12a2926bb2126961cb4";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_preset_lint_markdown_style_guide___remark_preset_lint_markdown_style_guide_5.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_preset_lint_markdown_style_guide___remark_preset_lint_markdown_style_guide_5.0.1.tgz";
url = "https://registry.yarnpkg.com/remark-preset-lint-markdown-style-guide/-/remark-preset-lint-markdown-style-guide-5.0.1.tgz";
sha1 = "a53018e4e44f4417b911968ee1ecc49aa3cff6a7";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_stringify___remark_stringify_10.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark_stringify___remark_stringify_10.0.0.tgz";
url = "https://registry.yarnpkg.com/remark-stringify/-/remark-stringify-10.0.0.tgz";
sha1 = "7f23659d92b2d5da489e3c858656d7bbe045f161";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark___remark_14.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "remark___remark_14.0.1.tgz";
url = "https://registry.yarnpkg.com/remark/-/remark-14.0.1.tgz";
sha1 = "a97280d4f2a3010a7d81e6c292a310dcd5554d80";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "remove_trailing_separator___remove_trailing_separator_1.1.0.tgz";
path = fetchurl {
name = "remove_trailing_separator___remove_trailing_separator_1.1.0.tgz";
url = "https://registry.yarnpkg.com/remove-trailing-separator/-/remove-trailing-separator-1.1.0.tgz";
sha1 = "c24bce2a283adad5bc3f58e0d48249b92379d8ef";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "renderkid___renderkid_2.0.7.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "renderkid___renderkid_2.0.7.tgz";
url = "https://registry.yarnpkg.com/renderkid/-/renderkid-2.0.7.tgz";
sha1 = "464f276a6bdcee606f4a15993f9b29fc74ca8609";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "repeat_element___repeat_element_1.1.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "repeat_element___repeat_element_1.1.4.tgz";
url = "https://registry.yarnpkg.com/repeat-element/-/repeat-element-1.1.4.tgz";
sha1 = "be681520847ab58c7568ac75fbfad28ed42d39e9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "repeat_string___repeat_string_1.6.1.tgz";
path = fetchurl {
name = "repeat_string___repeat_string_1.6.1.tgz";
url = "https://registry.yarnpkg.com/repeat-string/-/repeat-string-1.6.1.tgz";
sha1 = "8dcae470e1c88abc2d600fff4a776286da75e637";
};
}
{
name = "repeating___repeating_2.0.1.tgz";
path = fetchurl {
name = "repeating___repeating_2.0.1.tgz";
url = "https://registry.yarnpkg.com/repeating/-/repeating-2.0.1.tgz";
sha1 = "5214c53a926d3552707527fbab415dbc08d06dda";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "request___request_2.88.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "request___request_2.88.2.tgz";
url = "https://registry.yarnpkg.com/request/-/request-2.88.2.tgz";
sha1 = "d73c918731cb5a87da047e207234146f664d12b3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "require_directory___require_directory_2.1.1.tgz";
path = fetchurl {
name = "require_directory___require_directory_2.1.1.tgz";
url = "https://registry.yarnpkg.com/require-directory/-/require-directory-2.1.1.tgz";
sha1 = "8c64ad5fd30dab1c976e2344ffe7f792a6a6df42";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "require_from_string___require_from_string_2.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "require_from_string___require_from_string_2.0.2.tgz";
url = "https://registry.yarnpkg.com/require-from-string/-/require-from-string-2.0.2.tgz";
sha1 = "89a7fdd938261267318eafe14f9c32e598c36909";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "resolve_cwd___resolve_cwd_3.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "resolve_cwd___resolve_cwd_3.0.0.tgz";
url = "https://registry.yarnpkg.com/resolve-cwd/-/resolve-cwd-3.0.0.tgz";
sha1 = "0f0075f1bb2544766cf73ba6a6e2adfebcb13f2d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "resolve_from___resolve_from_4.0.0.tgz";
path = fetchurl {
name = "resolve_from___resolve_from_4.0.0.tgz";
url = "https://registry.yarnpkg.com/resolve-from/-/resolve-from-4.0.0.tgz";
sha1 = "4abcd852ad32dd7baabfe9b40e00a36db5f392e6";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "resolve_from___resolve_from_5.0.0.tgz";
path = fetchurl {
name = "resolve_from___resolve_from_5.0.0.tgz";
url = "https://registry.yarnpkg.com/resolve-from/-/resolve-from-5.0.0.tgz";
sha1 = "c35225843df8f776df21c57557bc087e9dfdfc69";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "resolve_url___resolve_url_0.2.1.tgz";
path = fetchurl {
name = "resolve_url___resolve_url_0.2.1.tgz";
url = "https://registry.yarnpkg.com/resolve-url/-/resolve-url-0.2.1.tgz";
sha1 = "2c637fe77c893afd2a663fe21aa9080068e2052a";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "resolve___resolve_1.20.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "resolve___resolve_1.20.0.tgz";
url = "https://registry.yarnpkg.com/resolve/-/resolve-1.20.0.tgz";
sha1 = "629a013fb3f70755d6f0b7935cc1c2c5378b1975";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "ret___ret_0.1.15.tgz";
path = fetchurl {
name = "ret___ret_0.1.15.tgz";
url = "https://registry.yarnpkg.com/ret/-/ret-0.1.15.tgz";
sha1 = "b8a4825d5bdb1fc3f6f53c2bc33f81388681c7bc";
};
}
{
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "retry_as_promised___retry_as_promised_3.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "retry_as_promised___retry_as_promised_3.2.0.tgz";
url = "https://registry.yarnpkg.com/retry-as-promised/-/retry-as-promised-3.2.0.tgz";
sha1 = "769f63d536bec4783549db0777cb56dadd9d8543";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "reusify___reusify_1.0.4.tgz";
path = fetchurl {
name = "reusify___reusify_1.0.4.tgz";
url = "https://registry.yarnpkg.com/reusify/-/reusify-1.0.4.tgz";
sha1 = "90da382b1e126efc02146e90845a88db12925d76";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "reveal.js___reveal.js_3.9.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "reveal.js___reveal.js_3.9.2.tgz";
url = "https://registry.yarnpkg.com/reveal.js/-/reveal.js-3.9.2.tgz";
sha1 = "7f63d3dfec338b6c313dcabdf006e8cf80e0b358";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
name = "rimraf___rimraf_2.7.1.tgz";
path = fetchurl {
name = "rimraf___rimraf_2.7.1.tgz";
url = "https://registry.yarnpkg.com/rimraf/-/rimraf-2.7.1.tgz";
sha1 = "35797f13a7fdadc566142c29d4f07ccad483e3ec";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "rimraf___rimraf_3.0.2.tgz";
path = fetchurl {
name = "rimraf___rimraf_3.0.2.tgz";
url = "https://registry.yarnpkg.com/rimraf/-/rimraf-3.0.2.tgz";
sha1 = "f1a5402ba6220ad52cc1282bac1ae3aa49fd061a";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "ripemd160___ripemd160_2.0.2.tgz";
path = fetchurl {
name = "ripemd160___ripemd160_2.0.2.tgz";
url = "https://registry.yarnpkg.com/ripemd160/-/ripemd160-2.0.2.tgz";
sha1 = "a1c1a6f624751577ba5d07914cbc92850585890c";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "run_parallel___run_parallel_1.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "run_parallel___run_parallel_1.2.0.tgz";
url = "https://registry.yarnpkg.com/run-parallel/-/run-parallel-1.2.0.tgz";
sha1 = "66d1368da7bdf921eb9d95bd1a9229e7f21a43ee";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "run_queue___run_queue_1.0.3.tgz";
path = fetchurl {
name = "run_queue___run_queue_1.0.3.tgz";
url = "https://registry.yarnpkg.com/run-queue/-/run-queue-1.0.3.tgz";
sha1 = "e848396f057d223f24386924618e25694161ec47";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
name = "rw___rw_1.3.3.tgz";
path = fetchurl {
name = "rw___rw_1.3.3.tgz";
url = "https://registry.yarnpkg.com/rw/-/rw-1.3.3.tgz";
sha1 = "3f862dfa91ab766b14885ef4d01124bfda074fb4";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "safe_buffer___safe_buffer_5.1.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "safe_buffer___safe_buffer_5.1.2.tgz";
url = "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.1.2.tgz";
sha1 = "991ec69d296e0313747d59bdfd2b745c35f8828d";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "safe_buffer___safe_buffer_5.2.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "safe_buffer___safe_buffer_5.2.1.tgz";
url = "https://registry.yarnpkg.com/safe-buffer/-/safe-buffer-5.2.1.tgz";
sha1 = "1eaf9fa9bdb1fdd4ec75f58f9cdb4e6b7827eec6";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "safe_regex___safe_regex_1.1.0.tgz";
path = fetchurl {
name = "safe_regex___safe_regex_1.1.0.tgz";
url = "https://registry.yarnpkg.com/safe-regex/-/safe-regex-1.1.0.tgz";
sha1 = "40a3669f3b077d1e943d44629e157dd48023bf2e";
};
}
{
name = "safer_buffer___safer_buffer_2.1.2.tgz";
path = fetchurl {
name = "safer_buffer___safer_buffer_2.1.2.tgz";
url = "https://registry.yarnpkg.com/safer-buffer/-/safer-buffer-2.1.2.tgz";
sha1 = "44fa161b0187b9549dd84bb91802f9bd8385cd6a";
};
}
{
name = "sax___sax_0.5.8.tgz";
path = fetchurl {
name = "sax___sax_0.5.8.tgz";
url = "https://registry.yarnpkg.com/sax/-/sax-0.5.8.tgz";
sha1 = "d472db228eb331c2506b0e8c15524adb939d12c1";
};
}
{
name = "sax___sax_1.2.1.tgz";
path = fetchurl {
name = "sax___sax_1.2.1.tgz";
url = "https://registry.yarnpkg.com/sax/-/sax-1.2.1.tgz";
sha1 = "7b8e656190b228e81a66aea748480d828cd2d37a";
};
}
{
name = "sax___sax_1.2.4.tgz";
path = fetchurl {
name = "sax___sax_1.2.4.tgz";
url = "https://registry.yarnpkg.com/sax/-/sax-1.2.4.tgz";
sha1 = "2816234e2378bddc4e5354fab5caa895df7100d9";
};
}
{
name = "schema_utils___schema_utils_1.0.0.tgz";
path = fetchurl {
name = "schema_utils___schema_utils_1.0.0.tgz";
url = "https://registry.yarnpkg.com/schema-utils/-/schema-utils-1.0.0.tgz";
sha1 = "0b79a93204d7b600d4b2850d1f66c2a34951c770";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "schema_utils___schema_utils_3.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "schema_utils___schema_utils_3.1.1.tgz";
url = "https://registry.yarnpkg.com/schema-utils/-/schema-utils-3.1.1.tgz";
sha1 = "bc74c4b6b6995c1d88f76a8b77bea7219e0c8281";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "scrypt_kdf___scrypt_kdf_2.0.1.tgz";
path = fetchurl {
name = "scrypt_kdf___scrypt_kdf_2.0.1.tgz";
url = "https://registry.yarnpkg.com/scrypt-kdf/-/scrypt-kdf-2.0.1.tgz";
sha1 = "3355224c52d398331b2cbf2b70a7be26b52c53e6";
};
}
{
name = "select2___select2_3.5.2_browserify.tgz";
path = fetchurl {
name = "select2___select2_3.5.2_browserify.tgz";
url = "https://registry.yarnpkg.com/select2/-/select2-3.5.2-browserify.tgz";
sha1 = "dc4dafda38d67a734e8a97a46f0d3529ae05391d";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "semver_compare___semver_compare_1.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "semver_compare___semver_compare_1.0.0.tgz";
url = "https://registry.yarnpkg.com/semver-compare/-/semver-compare-1.0.0.tgz";
sha1 = "0dee216a1c941ab37e9efb1788f6afc5ff5537fc";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "semver___semver_5.7.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "semver___semver_5.7.1.tgz";
url = "https://registry.yarnpkg.com/semver/-/semver-5.7.1.tgz";
sha1 = "a954f931aeba508d307bbf069eff0c01c96116f7";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "semver___semver_6.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "semver___semver_6.3.0.tgz";
url = "https://registry.yarnpkg.com/semver/-/semver-6.3.0.tgz";
sha1 = "ee0a64c8af5e8ceea67687b133761e1becbd1d3d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "semver___semver_7.3.5.tgz";
path = fetchurl {
name = "semver___semver_7.3.5.tgz";
url = "https://registry.yarnpkg.com/semver/-/semver-7.3.5.tgz";
sha1 = "0b621c879348d8998e4b0e4be94b3f12e6018ef7";
};
}
{
name = "semver___semver_5.3.0.tgz";
path = fetchurl {
name = "semver___semver_5.3.0.tgz";
url = "https://registry.yarnpkg.com/semver/-/semver-5.3.0.tgz";
sha1 = "9b2ce5d3de02d17c6012ad326aa6b4d0cf54f94f";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "send___send_0.17.1.tgz";
path = fetchurl {
name = "send___send_0.17.1.tgz";
url = "https://registry.yarnpkg.com/send/-/send-0.17.1.tgz";
sha1 = "c1d8b059f7900f7466dd4938bdc44e11ddb376c8";
};
}
{
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "seq_queue___seq_queue_0.0.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "seq_queue___seq_queue_0.0.5.tgz";
url = "https://registry.yarnpkg.com/seq-queue/-/seq-queue-0.0.5.tgz";
sha1 = "d56812e1c017a6e4e7c3e3a37a1da6d78dd3c93e";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "sequelize_pool___sequelize_pool_2.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "sequelize_pool___sequelize_pool_2.3.0.tgz";
url = "https://registry.yarnpkg.com/sequelize-pool/-/sequelize-pool-2.3.0.tgz";
sha1 = "64f1fe8744228172c474f530604b6133be64993d";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "sequelize___sequelize_5.22.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "sequelize___sequelize_5.22.4.tgz";
url = "https://registry.yarnpkg.com/sequelize/-/sequelize-5.22.4.tgz";
sha1 = "4dbd8a1a735e98150880d43a95d45e9f46d151fa";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "serialize_javascript___serialize_javascript_6.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "serialize_javascript___serialize_javascript_6.0.0.tgz";
url = "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-6.0.0.tgz";
sha1 = "efae5d88f45d7924141da8b5c3a7a7e663fefeb8";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "serialize_javascript___serialize_javascript_4.0.0.tgz";
path = fetchurl {
name = "serialize_javascript___serialize_javascript_4.0.0.tgz";
url = "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-4.0.0.tgz";
sha1 = "b525e1238489a5ecfc42afacc3fe99e666f4b1aa";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "serialize_javascript___serialize_javascript_5.0.1.tgz";
path = fetchurl {
name = "serialize_javascript___serialize_javascript_5.0.1.tgz";
url = "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-5.0.1.tgz";
sha1 = "7886ec848049a462467a97d3d918ebb2aaf934f4";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "serve_static___serve_static_1.14.1.tgz";
path = fetchurl {
name = "serve_static___serve_static_1.14.1.tgz";
url = "https://registry.yarnpkg.com/serve-static/-/serve-static-1.14.1.tgz";
sha1 = "666e636dc4f010f7ef29970a88a674320898b2f9";
};
}
{
name = "set_blocking___set_blocking_2.0.0.tgz";
path = fetchurl {
name = "set_blocking___set_blocking_2.0.0.tgz";
url = "https://registry.yarnpkg.com/set-blocking/-/set-blocking-2.0.0.tgz";
sha1 = "045f9782d011ae9a6803ddd382b24392b3d890f7";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "set_value___set_value_2.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "set_value___set_value_2.0.1.tgz";
url = "https://registry.yarnpkg.com/set-value/-/set-value-2.0.1.tgz";
sha1 = "a18d40530e6f07de4228c7defe4227af8cad005b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "setimmediate___setimmediate_1.0.5.tgz";
path = fetchurl {
name = "setimmediate___setimmediate_1.0.5.tgz";
url = "https://registry.yarnpkg.com/setimmediate/-/setimmediate-1.0.5.tgz";
sha1 = "290cbb232e306942d7d7ea9b83732ab7856f8285";
};
}
{
name = "setprototypeof___setprototypeof_1.1.1.tgz";
path = fetchurl {
name = "setprototypeof___setprototypeof_1.1.1.tgz";
url = "https://registry.yarnpkg.com/setprototypeof/-/setprototypeof-1.1.1.tgz";
sha1 = "7e95acb24aa92f5885e0abef5ba131330d4ae683";
};
}
{
name = "sha.js___sha.js_2.4.11.tgz";
path = fetchurl {
name = "sha.js___sha.js_2.4.11.tgz";
url = "https://registry.yarnpkg.com/sha.js/-/sha.js-2.4.11.tgz";
sha1 = "37a5cf0b81ecbc6943de109ba2960d1b26584ae7";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "shallow_clone___shallow_clone_3.0.1.tgz";
path = fetchurl {
name = "shallow_clone___shallow_clone_3.0.1.tgz";
url = "https://registry.yarnpkg.com/shallow-clone/-/shallow-clone-3.0.1.tgz";
sha1 = "8f2981ad92531f55035b01fb230769a40e02efa3";
};
}
{
name = "shebang_command___shebang_command_2.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "shebang_command___shebang_command_2.0.0.tgz";
url = "https://registry.yarnpkg.com/shebang-command/-/shebang-command-2.0.0.tgz";
sha1 = "ccd0af4f8835fbdc265b82461aaf0c36663f34ea";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "shebang_regex___shebang_regex_3.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "shebang_regex___shebang_regex_3.0.0.tgz";
url = "https://registry.yarnpkg.com/shebang-regex/-/shebang-regex-3.0.0.tgz";
sha1 = "ae16f1644d873ecad843b0307b143362d4c42172";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "shimmer___shimmer_1.2.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "shimmer___shimmer_1.2.1.tgz";
url = "https://registry.yarnpkg.com/shimmer/-/shimmer-1.2.1.tgz";
sha1 = "610859f7de327b587efebf501fb43117f9aff337";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "shortid___shortid_2.2.16.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "shortid___shortid_2.2.16.tgz";
url = "https://registry.yarnpkg.com/shortid/-/shortid-2.2.16.tgz";
sha1 = "b742b8f0cb96406fd391c76bfc18a67a57fe5608";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "side_channel___side_channel_1.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "side_channel___side_channel_1.0.4.tgz";
url = "https://registry.yarnpkg.com/side-channel/-/side-channel-1.0.4.tgz";
sha1 = "efce5c8fdc104ee751b25c58d4290011fa5ea2cf";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "signal_exit___signal_exit_3.0.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "signal_exit___signal_exit_3.0.3.tgz";
url = "https://registry.yarnpkg.com/signal-exit/-/signal-exit-3.0.3.tgz";
sha1 = "a1410c2edd8f077b08b4e253c8eacfcaf057461c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "simple_swizzle___simple_swizzle_0.2.2.tgz";
path = fetchurl {
name = "simple_swizzle___simple_swizzle_0.2.2.tgz";
url = "https://registry.yarnpkg.com/simple-swizzle/-/simple-swizzle-0.2.2.tgz";
sha1 = "a4da6b635ffcccca33f70d17cb92592de95e557a";
};
}
{
name = "slash___slash_1.0.0.tgz";
path = fetchurl {
name = "slash___slash_1.0.0.tgz";
url = "https://registry.yarnpkg.com/slash/-/slash-1.0.0.tgz";
sha1 = "c41f2f6c39fc16d1cd17ad4b5d896114ae470d55";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "slash___slash_3.0.0.tgz";
path = fetchurl {
name = "slash___slash_3.0.0.tgz";
url = "https://registry.yarnpkg.com/slash/-/slash-3.0.0.tgz";
sha1 = "6539be870c165adbd5240220dbe361f1bc4d4634";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "slice_ansi___slice_ansi_4.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "slice_ansi___slice_ansi_4.0.0.tgz";
url = "https://registry.yarnpkg.com/slice-ansi/-/slice-ansi-4.0.0.tgz";
sha1 = "500e8dd0fd55b05815086255b3195adf2a45fe6b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "snapdragon_node___snapdragon_node_2.1.1.tgz";
path = fetchurl {
name = "snapdragon_node___snapdragon_node_2.1.1.tgz";
url = "https://registry.yarnpkg.com/snapdragon-node/-/snapdragon-node-2.1.1.tgz";
sha1 = "6c175f86ff14bdb0724563e8f3c1b021a286853b";
};
}
{
name = "snapdragon_util___snapdragon_util_3.0.1.tgz";
path = fetchurl {
name = "snapdragon_util___snapdragon_util_3.0.1.tgz";
url = "https://registry.yarnpkg.com/snapdragon-util/-/snapdragon-util-3.0.1.tgz";
sha1 = "f956479486f2acd79700693f6f7b805e45ab56e2";
};
}
{
name = "snapdragon___snapdragon_0.8.2.tgz";
path = fetchurl {
name = "snapdragon___snapdragon_0.8.2.tgz";
url = "https://registry.yarnpkg.com/snapdragon/-/snapdragon-0.8.2.tgz";
sha1 = "64922e7c565b0e14204ba1aa7d6964278d25182d";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "snapsvg___snapsvg_0.5.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "snapsvg___snapsvg_0.5.1.tgz";
url = "https://registry.yarnpkg.com/snapsvg/-/snapsvg-0.5.1.tgz";
sha1 = "0caf52c79189a290746fc446cc5e863f6bdddfe3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "socket.io_adapter___socket.io_adapter_1.1.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "socket.io_adapter___socket.io_adapter_1.1.2.tgz";
url = "https://registry.yarnpkg.com/socket.io-adapter/-/socket.io-adapter-1.1.2.tgz";
sha1 = "ab3f0d6f66b8fc7fca3959ab5991f82221789be9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "socket.io_client___socket.io_client_2.4.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "socket.io_client___socket.io_client_2.4.0.tgz";
url = "https://registry.yarnpkg.com/socket.io-client/-/socket.io-client-2.4.0.tgz";
sha1 = "aafb5d594a3c55a34355562fc8aea22ed9119a35";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "socket.io_parser___socket.io_parser_3.3.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "socket.io_parser___socket.io_parser_3.3.2.tgz";
url = "https://registry.yarnpkg.com/socket.io-parser/-/socket.io-parser-3.3.2.tgz";
sha1 = "ef872009d0adcf704f2fbe830191a14752ad50b6";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "socket.io_parser___socket.io_parser_3.4.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "socket.io_parser___socket.io_parser_3.4.1.tgz";
url = "https://registry.yarnpkg.com/socket.io-parser/-/socket.io-parser-3.4.1.tgz";
sha1 = "b06af838302975837eab2dc980037da24054d64a";
};
}
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "socket.io___socket.io_2.4.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "socket.io___socket.io_2.4.1.tgz";
url = "https://registry.yarnpkg.com/socket.io/-/socket.io-2.4.1.tgz";
sha1 = "95ad861c9a52369d7f1a68acf0d4a1b16da451d2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "source_list_map___source_list_map_2.0.1.tgz";
path = fetchurl {
name = "source_list_map___source_list_map_2.0.1.tgz";
url = "https://registry.yarnpkg.com/source-list-map/-/source-list-map-2.0.1.tgz";
sha1 = "3993bd873bfc48479cca9ea3a547835c7c154b34";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "source_map_js___source_map_js_0.6.2.tgz";
path = fetchurl {
name = "source_map_js___source_map_js_0.6.2.tgz";
url = "https://registry.yarnpkg.com/source-map-js/-/source-map-js-0.6.2.tgz";
sha1 = "0bb5de631b41cfbda6cfba8bd05a80efdfd2385e";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "source_map_resolve___source_map_resolve_0.5.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "source_map_resolve___source_map_resolve_0.5.3.tgz";
url = "https://registry.yarnpkg.com/source-map-resolve/-/source-map-resolve-0.5.3.tgz";
sha1 = "190866bece7553e1f8f267a2ee82c606b5509a1a";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "source_map_support___source_map_support_0.4.18.tgz";
path = fetchurl {
name = "source_map_support___source_map_support_0.4.18.tgz";
url = "https://registry.yarnpkg.com/source-map-support/-/source-map-support-0.4.18.tgz";
sha1 = "0286a6de8be42641338594e97ccea75f0a2c585f";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "source_map_support___source_map_support_0.5.20.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "source_map_support___source_map_support_0.5.20.tgz";
url = "https://registry.yarnpkg.com/source-map-support/-/source-map-support-0.5.20.tgz";
sha1 = "12166089f8f5e5e8c56926b377633392dd2cb6c9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "source_map_url___source_map_url_0.4.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "source_map_url___source_map_url_0.4.1.tgz";
url = "https://registry.yarnpkg.com/source-map-url/-/source-map-url-0.4.1.tgz";
sha1 = "0af66605a745a5a2f91cf1bbf8a7afbc283dec56";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "source_map___source_map_0.5.7.tgz";
path = fetchurl {
name = "source_map___source_map_0.5.7.tgz";
url = "https://registry.yarnpkg.com/source-map/-/source-map-0.5.7.tgz";
sha1 = "8a039d2d1021d22d1ea14c80d8ea468ba2ef3fcc";
};
}
{
name = "source_map___source_map_0.6.1.tgz";
path = fetchurl {
name = "source_map___source_map_0.6.1.tgz";
url = "https://registry.yarnpkg.com/source-map/-/source-map-0.6.1.tgz";
sha1 = "74722af32e9614e9c287a8d0bbde48b5e2f1a263";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "source_map___source_map_0.7.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "source_map___source_map_0.7.3.tgz";
url = "https://registry.yarnpkg.com/source-map/-/source-map-0.7.3.tgz";
sha1 = "5302f8169031735226544092e64981f751750383";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "space_separated_tokens___space_separated_tokens_2.0.1.tgz";
path = fetchurl {
name = "space_separated_tokens___space_separated_tokens_2.0.1.tgz";
url = "https://registry.yarnpkg.com/space-separated-tokens/-/space-separated-tokens-2.0.1.tgz";
sha1 = "43193cec4fb858a2ce934b7f98b7f2c18107098b";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "spdx_correct___spdx_correct_3.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "spdx_correct___spdx_correct_3.1.1.tgz";
url = "https://registry.yarnpkg.com/spdx-correct/-/spdx-correct-3.1.1.tgz";
sha1 = "dece81ac9c1e6713e5f7d1b6f17d468fa53d89a9";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "spdx_exceptions___spdx_exceptions_2.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "spdx_exceptions___spdx_exceptions_2.3.0.tgz";
url = "https://registry.yarnpkg.com/spdx-exceptions/-/spdx-exceptions-2.3.0.tgz";
sha1 = "3f28ce1a77a00372683eade4a433183527a2163d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "spdx_expression_parse___spdx_expression_parse_3.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "spdx_expression_parse___spdx_expression_parse_3.0.1.tgz";
url = "https://registry.yarnpkg.com/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz";
sha1 = "cf70f50482eefdc98e3ce0a6833e4a53ceeba679";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "spdx_license_ids___spdx_license_ids_3.0.10.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "spdx_license_ids___spdx_license_ids_3.0.10.tgz";
url = "https://registry.yarnpkg.com/spdx-license-ids/-/spdx-license-ids-3.0.10.tgz";
sha1 = "0d9becccde7003d6c658d487dd48a32f0bf3014b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "spin.js___spin.js_4.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "spin.js___spin.js_4.1.1.tgz";
url = "https://registry.yarnpkg.com/spin.js/-/spin.js-4.1.1.tgz";
sha1 = "567464a08620541e523da856cb5f67af2d0f48ad";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "split_string___split_string_3.1.0.tgz";
path = fetchurl {
name = "split_string___split_string_3.1.0.tgz";
url = "https://registry.yarnpkg.com/split-string/-/split-string-3.1.0.tgz";
sha1 = "7cb09dda3a86585705c64b39a6466038682e8fe2";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "split2___split2_3.2.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "split2___split2_3.2.2.tgz";
url = "https://registry.yarnpkg.com/split2/-/split2-3.2.2.tgz";
sha1 = "bf2cf2a37d838312c249c89206fd7a17dd12365f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "sprintf_js___sprintf_js_1.1.2.tgz";
path = fetchurl {
name = "sprintf_js___sprintf_js_1.1.2.tgz";
url = "https://registry.yarnpkg.com/sprintf-js/-/sprintf-js-1.1.2.tgz";
sha1 = "da1765262bf8c0f571749f2ad6c26300207ae673";
};
}
{
name = "sprintf_js___sprintf_js_1.0.3.tgz";
path = fetchurl {
name = "sprintf_js___sprintf_js_1.0.3.tgz";
url = "https://registry.yarnpkg.com/sprintf-js/-/sprintf-js-1.0.3.tgz";
sha1 = "04e6926f662895354f3dd015203633b857297e2c";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "sqlite3___sqlite3_5.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "sqlite3___sqlite3_5.0.2.tgz";
url = "https://registry.yarnpkg.com/sqlite3/-/sqlite3-5.0.2.tgz";
sha1 = "00924adcc001c17686e0a6643b6cbbc2d3965083";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "sqlstring___sqlstring_2.3.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "sqlstring___sqlstring_2.3.2.tgz";
url = "https://registry.yarnpkg.com/sqlstring/-/sqlstring-2.3.2.tgz";
sha1 = "cdae7169389a1375b18e885f2e60b3e460809514";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "sshpk___sshpk_1.16.1.tgz";
path = fetchurl {
name = "sshpk___sshpk_1.16.1.tgz";
url = "https://registry.yarnpkg.com/sshpk/-/sshpk-1.16.1.tgz";
sha1 = "fb661c0bef29b39db40769ee39fa70093d6f6877";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "ssri___ssri_6.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "ssri___ssri_6.0.2.tgz";
url = "https://registry.yarnpkg.com/ssri/-/ssri-6.0.2.tgz";
sha1 = "157939134f20464e7301ddba3e90ffa8f7728ac5";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "ssri___ssri_8.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "ssri___ssri_8.0.1.tgz";
url = "https://registry.yarnpkg.com/ssri/-/ssri-8.0.1.tgz";
sha1 = "638e4e439e2ffbd2cd289776d5ca457c4f51a2af";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "stable___stable_0.1.8.tgz";
path = fetchurl {
name = "stable___stable_0.1.8.tgz";
url = "https://registry.yarnpkg.com/stable/-/stable-0.1.8.tgz";
sha1 = "836eb3c8382fe2936feaf544631017ce7d47a3cf";
};
}
{
name = "stack_trace___stack_trace_0.0.10.tgz";
path = fetchurl {
name = "stack_trace___stack_trace_0.0.10.tgz";
url = "https://registry.yarnpkg.com/stack-trace/-/stack-trace-0.0.10.tgz";
sha1 = "547c70b347e8d32b4e108ea1a2a159e5fdde19c0";
};
}
{
name = "static_extend___static_extend_0.1.2.tgz";
path = fetchurl {
name = "static_extend___static_extend_0.1.2.tgz";
url = "https://registry.yarnpkg.com/static-extend/-/static-extend-0.1.2.tgz";
sha1 = "60809c39cbff55337226fd5e0b520f341f1fb5c6";
};
}
{
name = "statuses___statuses_1.5.0.tgz";
path = fetchurl {
name = "statuses___statuses_1.5.0.tgz";
url = "https://registry.yarnpkg.com/statuses/-/statuses-1.5.0.tgz";
sha1 = "161c7dac177659fd9811f43771fa99381478628c";
};
}
{
name = "store___store_2.0.12.tgz";
path = fetchurl {
name = "store___store_2.0.12.tgz";
url = "https://registry.yarnpkg.com/store/-/store-2.0.12.tgz";
sha1 = "8c534e2a0b831f72b75fc5f1119857c44ef5d593";
};
}
{
name = "stream_browserify___stream_browserify_2.0.2.tgz";
path = fetchurl {
name = "stream_browserify___stream_browserify_2.0.2.tgz";
url = "https://registry.yarnpkg.com/stream-browserify/-/stream-browserify-2.0.2.tgz";
sha1 = "87521d38a44aa7ee91ce1cd2a47df0cb49dd660b";
};
}
{
name = "stream_each___stream_each_1.2.3.tgz";
path = fetchurl {
name = "stream_each___stream_each_1.2.3.tgz";
url = "https://registry.yarnpkg.com/stream-each/-/stream-each-1.2.3.tgz";
sha1 = "ebe27a0c389b04fbcc233642952e10731afa9bae";
};
}
{
name = "stream_http___stream_http_2.8.3.tgz";
path = fetchurl {
name = "stream_http___stream_http_2.8.3.tgz";
url = "https://registry.yarnpkg.com/stream-http/-/stream-http-2.8.3.tgz";
sha1 = "b2d242469288a5a27ec4fe8933acf623de6514fc";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "stream_shift___stream_shift_1.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "stream_shift___stream_shift_1.0.1.tgz";
url = "https://registry.yarnpkg.com/stream-shift/-/stream-shift-1.0.1.tgz";
sha1 = "d7088281559ab2778424279b0877da3c392d5a3d";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "string_loader___string_loader_0.0.1.tgz";
path = fetchurl {
name = "string_loader___string_loader_0.0.1.tgz";
url = "https://registry.yarnpkg.com/string-loader/-/string-loader-0.0.1.tgz";
sha1 = "496f3cccc990213e0dd5411499f9ac6a6a6f2ff8";
};
}
{
name = "string_natural_compare___string_natural_compare_2.0.3.tgz";
path = fetchurl {
name = "string_natural_compare___string_natural_compare_2.0.3.tgz";
url = "https://registry.yarnpkg.com/string-natural-compare/-/string-natural-compare-2.0.3.tgz";
sha1 = "9dbe1dd65490a5fe14f7a5c9bc686fc67cb9c6e4";
};
}
{
name = "string_width___string_width_1.0.2.tgz";
path = fetchurl {
name = "string_width___string_width_1.0.2.tgz";
url = "https://registry.yarnpkg.com/string-width/-/string-width-1.0.2.tgz";
sha1 = "118bdf5b8cdc51a2a7e70d211e07e2b0b9b107d3";
};
}
{
name = "string_width___string_width_2.1.1.tgz";
path = fetchurl {
name = "string_width___string_width_2.1.1.tgz";
url = "https://registry.yarnpkg.com/string-width/-/string-width-2.1.1.tgz";
sha1 = "ab93f27a8dc13d28cac815c462143a6d9012ae9e";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "string_width___string_width_4.2.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "string_width___string_width_4.2.2.tgz";
url = "https://registry.yarnpkg.com/string-width/-/string-width-4.2.2.tgz";
sha1 = "dafd4f9559a7585cfba529c6a0a4f73488ebd4c5";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "string_width___string_width_5.0.1.tgz";
path = fetchurl {
name = "string_width___string_width_5.0.1.tgz";
url = "https://registry.yarnpkg.com/string-width/-/string-width-5.0.1.tgz";
sha1 = "0d8158335a6cfd8eb95da9b6b262ce314a036ffd";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "string.prototype.trimend___string.prototype.trimend_1.0.4.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "string.prototype.trimend___string.prototype.trimend_1.0.4.tgz";
url = "https://registry.yarnpkg.com/string.prototype.trimend/-/string.prototype.trimend-1.0.4.tgz";
sha1 = "e75ae90c2942c63504686c18b287b4a0b1a45f80";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "string.prototype.trimstart___string.prototype.trimstart_1.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "string.prototype.trimstart___string.prototype.trimstart_1.0.4.tgz";
url = "https://registry.yarnpkg.com/string.prototype.trimstart/-/string.prototype.trimstart-1.0.4.tgz";
sha1 = "b36399af4ab2999b4c9c648bd7a3fb2bb26feeed";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "string___string_3.3.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "string___string_3.3.3.tgz";
url = "https://registry.yarnpkg.com/string/-/string-3.3.3.tgz";
sha1 = "5ea211cd92d228e184294990a6cc97b366a77cb0";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "string_decoder___string_decoder_1.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "string_decoder___string_decoder_1.3.0.tgz";
url = "https://registry.yarnpkg.com/string_decoder/-/string_decoder-1.3.0.tgz";
sha1 = "42f114594a46cf1a8e30b0a84f56c78c3edac21e";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "string_decoder___string_decoder_0.10.31.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "string_decoder___string_decoder_0.10.31.tgz";
url = "https://registry.yarnpkg.com/string_decoder/-/string_decoder-0.10.31.tgz";
sha1 = "62e203bc41766c6c28c9fc84301dab1c5310fa94";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "string_decoder___string_decoder_1.1.1.tgz";
path = fetchurl {
name = "string_decoder___string_decoder_1.1.1.tgz";
url = "https://registry.yarnpkg.com/string_decoder/-/string_decoder-1.1.1.tgz";
sha1 = "9cf1611ba62685d7030ae9e4ba34149c3af03fc8";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "stringify_entities___stringify_entities_4.0.1.tgz";
path = fetchurl {
name = "stringify_entities___stringify_entities_4.0.1.tgz";
url = "https://registry.yarnpkg.com/stringify-entities/-/stringify-entities-4.0.1.tgz";
sha1 = "f483c9ca8d7e029edec9863c5a37c1f1e7702c8d";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "strip_ansi___strip_ansi_3.0.1.tgz";
path = fetchurl {
name = "strip_ansi___strip_ansi_3.0.1.tgz";
url = "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-3.0.1.tgz";
sha1 = "6a385fb8853d952d5ff05d0e8aaf94278dc63dcf";
};
}
{
name = "strip_ansi___strip_ansi_4.0.0.tgz";
path = fetchurl {
name = "strip_ansi___strip_ansi_4.0.0.tgz";
url = "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-4.0.0.tgz";
sha1 = "a8479022eb1ac368a871389b635262c505ee368f";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "strip_ansi___strip_ansi_6.0.0.tgz";
path = fetchurl {
name = "strip_ansi___strip_ansi_6.0.0.tgz";
url = "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-6.0.0.tgz";
sha1 = "0b1571dd7669ccd4f3e06e14ef1eed26225ae532";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "strip_ansi___strip_ansi_7.0.1.tgz";
path = fetchurl {
name = "strip_ansi___strip_ansi_7.0.1.tgz";
url = "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-7.0.1.tgz";
sha1 = "61740a08ce36b61e50e65653f07060d000975fb2";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "strip_ansi___strip_ansi_0.1.1.tgz";
path = fetchurl {
name = "strip_ansi___strip_ansi_0.1.1.tgz";
url = "https://registry.yarnpkg.com/strip-ansi/-/strip-ansi-0.1.1.tgz";
sha1 = "39e8a98d044d150660abe4a6808acf70bb7bc991";
};
}
{
name = "strip_bom___strip_bom_3.0.0.tgz";
path = fetchurl {
name = "strip_bom___strip_bom_3.0.0.tgz";
url = "https://registry.yarnpkg.com/strip-bom/-/strip-bom-3.0.0.tgz";
sha1 = "2334c18e9c759f7bdd56fdef7e9ae3d588e68ed3";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "strip_comments___strip_comments_2.0.1.tgz";
path = fetchurl {
name = "strip_comments___strip_comments_2.0.1.tgz";
url = "https://registry.yarnpkg.com/strip-comments/-/strip-comments-2.0.1.tgz";
sha1 = "4ad11c3fbcac177a67a40ac224ca339ca1c1ba9b";
};
}
{
name = "strip_final_newline___strip_final_newline_2.0.0.tgz";
path = fetchurl {
name = "strip_final_newline___strip_final_newline_2.0.0.tgz";
url = "https://registry.yarnpkg.com/strip-final-newline/-/strip-final-newline-2.0.0.tgz";
sha1 = "89b852fb2fcbe936f6f4b3187afb0a12c1ab58ad";
};
}
{
name = "strip_json_comments___strip_json_comments_3.1.1.tgz";
path = fetchurl {
name = "strip_json_comments___strip_json_comments_3.1.1.tgz";
url = "https://registry.yarnpkg.com/strip-json-comments/-/strip-json-comments-3.1.1.tgz";
sha1 = "31f1281b3832630434831c310c01cccda8cbe006";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "strip_json_comments___strip_json_comments_2.0.1.tgz";
path = fetchurl {
name = "strip_json_comments___strip_json_comments_2.0.1.tgz";
url = "https://registry.yarnpkg.com/strip-json-comments/-/strip-json-comments-2.0.1.tgz";
sha1 = "3c531942e908c2697c0ec344858c286c7ca0a60a";
};
}
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "strnum___strnum_1.0.3.tgz";
path = fetchurl {
name = "strnum___strnum_1.0.3.tgz";
url = "https://registry.yarnpkg.com/strnum/-/strnum-1.0.3.tgz";
sha1 = "bbc438bcb35fbbfc9c1e82f73097665b6ec6959e";
};
}
{
name = "strtok3___strtok3_6.2.4.tgz";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "strtok3___strtok3_6.2.4.tgz";
url = "https://registry.yarnpkg.com/strtok3/-/strtok3-6.2.4.tgz";
sha1 = "302aea64c0fa25d12a0385069ba66253fdc38a81";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "stylehacks___stylehacks_5.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "stylehacks___stylehacks_5.0.1.tgz";
url = "https://registry.yarnpkg.com/stylehacks/-/stylehacks-5.0.1.tgz";
sha1 = "323ec554198520986806388c7fdaebc38d2c06fb";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "stylis___stylis_4.0.10.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "stylis___stylis_4.0.10.tgz";
url = "https://registry.yarnpkg.com/stylis/-/stylis-4.0.10.tgz";
sha1 = "446512d1097197ab3f02fb3c258358c3f7a14240";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "superagent___superagent_1.8.3.tgz";
path = fetchurl {
name = "superagent___superagent_1.8.3.tgz";
url = "https://registry.yarnpkg.com/superagent/-/superagent-1.8.3.tgz";
sha1 = "2b7d70fcc870eda4f2a61e619dd54009b86547c3";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "supports_color___supports_color_8.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "supports_color___supports_color_8.1.1.tgz";
url = "https://registry.yarnpkg.com/supports-color/-/supports-color-8.1.1.tgz";
sha1 = "cd6fc17e28500cff56c1b86c0a7fd4a54a73005c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "supports_color___supports_color_2.0.0.tgz";
path = fetchurl {
name = "supports_color___supports_color_2.0.0.tgz";
url = "https://registry.yarnpkg.com/supports-color/-/supports-color-2.0.0.tgz";
sha1 = "535d045ce6b6363fa40117084629995e9df324c7";
};
}
{
name = "supports_color___supports_color_5.5.0.tgz";
path = fetchurl {
name = "supports_color___supports_color_5.5.0.tgz";
url = "https://registry.yarnpkg.com/supports-color/-/supports-color-5.5.0.tgz";
sha1 = "e2e69a44ac8772f78a1ec0b35b689df6530efc8f";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "supports_color___supports_color_7.2.0.tgz";
path = fetchurl {
name = "supports_color___supports_color_7.2.0.tgz";
url = "https://registry.yarnpkg.com/supports-color/-/supports-color-7.2.0.tgz";
sha1 = "1b7dcdcb32b8138801b3e478ba6a51caa89648da";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "supports_color___supports_color_9.0.2.tgz";
path = fetchurl {
name = "supports_color___supports_color_9.0.2.tgz";
url = "https://registry.yarnpkg.com/supports-color/-/supports-color-9.0.2.tgz";
sha1 = "50f082888e4b0a4e2ccd2d0b4f9ef4efcd332485";
};
}
{
name = "svgo___svgo_2.6.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "svgo___svgo_2.6.0.tgz";
url = "https://registry.yarnpkg.com/svgo/-/svgo-2.6.0.tgz";
sha1 = "f7d3064a91b0804ea28a9dbfc3b36ba2ed4dd8d4";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "table___table_6.7.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "table___table_6.7.1.tgz";
url = "https://registry.yarnpkg.com/table/-/table-6.7.1.tgz";
sha1 = "ee05592b7143831a8c94f3cee6aae4c1ccef33e2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "tapable___tapable_1.1.3.tgz";
path = fetchurl {
name = "tapable___tapable_1.1.3.tgz";
url = "https://registry.yarnpkg.com/tapable/-/tapable-1.1.3.tgz";
sha1 = "a1fccc06b58db61fd7a45da2da44f5f3a3e67ba2";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "tapable___tapable_2.2.1.tgz";
path = fetchurl {
name = "tapable___tapable_2.2.1.tgz";
url = "https://registry.yarnpkg.com/tapable/-/tapable-2.2.1.tgz";
sha1 = "1967a73ef4060a82f12ab96af86d52fdb76eeca0";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "tar_stream___tar_stream_2.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "tar_stream___tar_stream_2.2.0.tgz";
url = "https://registry.yarnpkg.com/tar-stream/-/tar-stream-2.2.0.tgz";
sha1 = "acad84c284136b060dc3faa64474aa9aebd77287";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "tar___tar_2.2.2.tgz";
path = fetchurl {
name = "tar___tar_2.2.2.tgz";
url = "https://registry.yarnpkg.com/tar/-/tar-2.2.2.tgz";
sha1 = "0ca8848562c7299b8b446ff6a4d60cdbb23edc40";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "tar___tar_4.4.19.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "tar___tar_4.4.19.tgz";
url = "https://registry.yarnpkg.com/tar/-/tar-4.4.19.tgz";
sha1 = "2e4d7263df26f2b914dee10c825ab132123742f3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "tar___tar_6.1.11.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "tar___tar_6.1.11.tgz";
url = "https://registry.yarnpkg.com/tar/-/tar-6.1.11.tgz";
sha1 = "6760a38f003afa1b2ffd0ffe9e9abbd0eab3d621";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "tdigest___tdigest_0.1.1.tgz";
path = fetchurl {
name = "tdigest___tdigest_0.1.1.tgz";
url = "https://registry.yarnpkg.com/tdigest/-/tdigest-0.1.1.tgz";
sha1 = "2e3cb2c39ea449e55d1e6cd91117accca4588021";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "terser_webpack_plugin___terser_webpack_plugin_1.4.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "terser_webpack_plugin___terser_webpack_plugin_1.4.5.tgz";
url = "https://registry.yarnpkg.com/terser-webpack-plugin/-/terser-webpack-plugin-1.4.5.tgz";
sha1 = "a217aefaea330e734ffacb6120ec1fa312d6040b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "terser___terser_4.8.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "terser___terser_4.8.0.tgz";
url = "https://registry.yarnpkg.com/terser/-/terser-4.8.0.tgz";
sha1 = "63056343d7c70bb29f3af665865a46fe03a0df17";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "text_hex___text_hex_1.0.0.tgz";
path = fetchurl {
name = "text_hex___text_hex_1.0.0.tgz";
url = "https://registry.yarnpkg.com/text-hex/-/text-hex-1.0.0.tgz";
sha1 = "69dc9c1b17446ee79a92bf5b884bb4b9127506f5";
};
}
{
name = "text_table___text_table_0.2.0.tgz";
path = fetchurl {
name = "text_table___text_table_0.2.0.tgz";
url = "https://registry.yarnpkg.com/text-table/-/text-table-0.2.0.tgz";
sha1 = "7f5ee823ae805207c00af2df4a84ec3fcfa570b4";
};
}
{
name = "through2___through2_2.0.5.tgz";
path = fetchurl {
name = "through2___through2_2.0.5.tgz";
url = "https://registry.yarnpkg.com/through2/-/through2-2.0.5.tgz";
sha1 = "01c1e39eb31d07cb7d03a96a70823260b23132cd";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "through2___through2_3.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "through2___through2_3.0.2.tgz";
url = "https://registry.yarnpkg.com/through2/-/through2-3.0.2.tgz";
sha1 = "99f88931cfc761ec7678b41d5d7336b5b6a07bf4";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "timers_browserify___timers_browserify_2.0.12.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "timers_browserify___timers_browserify_2.0.12.tgz";
url = "https://registry.yarnpkg.com/timers-browserify/-/timers-browserify-2.0.12.tgz";
sha1 = "44a45c11fbf407f34f97bccd1577c652361b00ee";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "timsort___timsort_0.3.0.tgz";
path = fetchurl {
name = "timsort___timsort_0.3.0.tgz";
url = "https://registry.yarnpkg.com/timsort/-/timsort-0.3.0.tgz";
sha1 = "405411a8e7e6339fe64db9a234de11dc31e02bd4";
};
}
{
name = "to_array___to_array_0.1.4.tgz";
path = fetchurl {
name = "to_array___to_array_0.1.4.tgz";
url = "https://registry.yarnpkg.com/to-array/-/to-array-0.1.4.tgz";
sha1 = "17e6c11f73dd4f3d74cda7a4ff3238e9ad9bf890";
};
}
{
name = "to_arraybuffer___to_arraybuffer_1.0.1.tgz";
path = fetchurl {
name = "to_arraybuffer___to_arraybuffer_1.0.1.tgz";
url = "https://registry.yarnpkg.com/to-arraybuffer/-/to-arraybuffer-1.0.1.tgz";
sha1 = "7d229b1fcc637e466ca081180836a7aabff83f43";
};
}
{
name = "to_fast_properties___to_fast_properties_1.0.3.tgz";
path = fetchurl {
name = "to_fast_properties___to_fast_properties_1.0.3.tgz";
url = "https://registry.yarnpkg.com/to-fast-properties/-/to-fast-properties-1.0.3.tgz";
sha1 = "b83571fa4d8c25b82e231b06e3a3055de4ca1a47";
};
}
{
name = "to_object_path___to_object_path_0.3.0.tgz";
path = fetchurl {
name = "to_object_path___to_object_path_0.3.0.tgz";
url = "https://registry.yarnpkg.com/to-object-path/-/to-object-path-0.3.0.tgz";
sha1 = "297588b7b0e7e0ac08e04e672f85c1f4999e17af";
};
}
{
name = "to_regex_range___to_regex_range_2.1.1.tgz";
path = fetchurl {
name = "to_regex_range___to_regex_range_2.1.1.tgz";
url = "https://registry.yarnpkg.com/to-regex-range/-/to-regex-range-2.1.1.tgz";
sha1 = "7c80c17b9dfebe599e27367e0d4dd5590141db38";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "to_regex_range___to_regex_range_5.0.1.tgz";
path = fetchurl {
name = "to_regex_range___to_regex_range_5.0.1.tgz";
url = "https://registry.yarnpkg.com/to-regex-range/-/to-regex-range-5.0.1.tgz";
sha1 = "1648c44aae7c8d988a326018ed72f5b4dd0392e4";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "to_regex___to_regex_3.0.2.tgz";
path = fetchurl {
name = "to_regex___to_regex_3.0.2.tgz";
url = "https://registry.yarnpkg.com/to-regex/-/to-regex-3.0.2.tgz";
sha1 = "13cfdd9b336552f30b51f33a8ae1b42a7a7599ce";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "to_vfile___to_vfile_7.2.2.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "to_vfile___to_vfile_7.2.2.tgz";
url = "https://registry.yarnpkg.com/to-vfile/-/to-vfile-7.2.2.tgz";
sha1 = "5976568397ef664bc8df210676d082478822afbf";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "toidentifier___toidentifier_1.0.0.tgz";
path = fetchurl {
name = "toidentifier___toidentifier_1.0.0.tgz";
url = "https://registry.yarnpkg.com/toidentifier/-/toidentifier-1.0.0.tgz";
sha1 = "7e1be3470f1e77948bc43d94a3c8f4d7752ba553";
};
}
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "token_types___token_types_4.1.1.tgz";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "token_types___token_types_4.1.1.tgz";
url = "https://registry.yarnpkg.com/token-types/-/token-types-4.1.1.tgz";
sha1 = "ef9e8c8e2e0ded9f1b3f8dbaa46a3228b113ba1a";
hedgedoc: 1.7.0 -> 1.7.1 (fixes CVE-2020-26286 and CVE-2020-26287) https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-g6w6-7xf9-m95p
2020-12-27 21:36:47 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "toobusy_js___toobusy_js_0.5.1.tgz";
path = fetchurl {
name = "toobusy_js___toobusy_js_0.5.1.tgz";
url = "https://registry.yarnpkg.com/toobusy-js/-/toobusy-js-0.5.1.tgz";
sha1 = "5511f78f6a87a6a512d44fdb0efa13672217f659";
};
}
{
name = "toposort_class___toposort_class_1.0.1.tgz";
path = fetchurl {
name = "toposort_class___toposort_class_1.0.1.tgz";
url = "https://registry.yarnpkg.com/toposort-class/-/toposort-class-1.0.1.tgz";
sha1 = "7ffd1f78c8be28c3ba45cd4e1a3f5ee193bd9988";
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "tough_cookie___tough_cookie_2.5.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "tough_cookie___tough_cookie_2.5.0.tgz";
url = "https://registry.yarnpkg.com/tough-cookie/-/tough-cookie-2.5.0.tgz";
sha1 = "cd9fb2a0aa1d5a12b473bd9fb96fa3dcff65ade2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "trim_right___trim_right_1.0.1.tgz";
path = fetchurl {
name = "trim_right___trim_right_1.0.1.tgz";
url = "https://registry.yarnpkg.com/trim-right/-/trim-right-1.0.1.tgz";
sha1 = "cb2e1203067e0c8de1f614094b9fe45704ea6003";
};
}
{
name = "triple_beam___triple_beam_1.3.0.tgz";
path = fetchurl {
name = "triple_beam___triple_beam_1.3.0.tgz";
url = "https://registry.yarnpkg.com/triple-beam/-/triple-beam-1.3.0.tgz";
sha1 = "a595214c7298db8339eeeee083e4d10bd8cb8dd9";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "trough___trough_2.0.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "trough___trough_2.0.2.tgz";
url = "https://registry.yarnpkg.com/trough/-/trough-2.0.2.tgz";
sha1 = "94a3aa9d5ce379fc561f6244905b3f36b7458d96";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "tsconfig_paths___tsconfig_paths_3.11.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "tsconfig_paths___tsconfig_paths_3.11.0.tgz";
url = "https://registry.yarnpkg.com/tsconfig-paths/-/tsconfig-paths-3.11.0.tgz";
sha1 = "954c1fe973da6339c78e06b03ce2e48810b65f36";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
name = "tslib___tslib_1.14.1.tgz";
path = fetchurl {
name = "tslib___tslib_1.14.1.tgz";
url = "https://registry.yarnpkg.com/tslib/-/tslib-1.14.1.tgz";
sha1 = "cf2d38bdc34a134bcaf1091c41f6619e2f672d00";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "tslib___tslib_2.3.1.tgz";
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "tslib___tslib_2.3.1.tgz";
url = "https://registry.yarnpkg.com/tslib/-/tslib-2.3.1.tgz";
sha1 = "e8a335add5ceae51aa261d32a490158ef042ef01";
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "tty_browserify___tty_browserify_0.0.0.tgz";
path = fetchurl {
name = "tty_browserify___tty_browserify_0.0.0.tgz";
url = "https://registry.yarnpkg.com/tty-browserify/-/tty-browserify-0.0.0.tgz";
sha1 = "a157ba402da24e9bf957f9aa69d524eed42901a6";
};
}
{
name = "tunnel_agent___tunnel_agent_0.6.0.tgz";
path = fetchurl {
name = "tunnel_agent___tunnel_agent_0.6.0.tgz";
url = "https://registry.yarnpkg.com/tunnel-agent/-/tunnel-agent-0.6.0.tgz";
sha1 = "27a5dea06b36b04a0a9966774b290868f0fc40fd";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "turndown___turndown_7.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "turndown___turndown_7.1.1.tgz";
url = "https://registry.yarnpkg.com/turndown/-/turndown-7.1.1.tgz";
sha1 = "96992f2d9b40a1a03d3ea61ad31b5a5c751ef77f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "tweetnacl___tweetnacl_0.14.5.tgz";
path = fetchurl {
name = "tweetnacl___tweetnacl_0.14.5.tgz";
url = "https://registry.yarnpkg.com/tweetnacl/-/tweetnacl-0.14.5.tgz";
sha1 = "5ae68177f192d4456269d108afa93ff8743f4f64";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "type_check___type_check_0.4.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "type_check___type_check_0.4.0.tgz";
url = "https://registry.yarnpkg.com/type-check/-/type-check-0.4.0.tgz";
sha1 = "07b8203bfa7056c0657050e3ccd2c37730bab8f1";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "type_fest___type_fest_0.20.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "type_fest___type_fest_0.20.2.tgz";
url = "https://registry.yarnpkg.com/type-fest/-/type-fest-0.20.2.tgz";
sha1 = "1bf207f4b28f91583666cb5fbd327887301cd5f4";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "type_fest___type_fest_1.4.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "type_fest___type_fest_1.4.0.tgz";
url = "https://registry.yarnpkg.com/type-fest/-/type-fest-1.4.0.tgz";
sha1 = "e9fb813fe3bf1744ec359d55d1affefa76f14be1";
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "type_is___type_is_1.6.18.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "type_is___type_is_1.6.18.tgz";
url = "https://registry.yarnpkg.com/type-is/-/type-is-1.6.18.tgz";
sha1 = "4e552cd05df09467dcbc4ef739de89f2cf37c131";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "typedarray___typedarray_0.0.6.tgz";
path = fetchurl {
name = "typedarray___typedarray_0.0.6.tgz";
url = "https://registry.yarnpkg.com/typedarray/-/typedarray-0.0.6.tgz";
sha1 = "867ac74e3864187b1d3d47d996a78ec5c8830777";
};
}
{
name = "uc.micro___uc.micro_1.0.6.tgz";
path = fetchurl {
name = "uc.micro___uc.micro_1.0.6.tgz";
url = "https://registry.yarnpkg.com/uc.micro/-/uc.micro-1.0.6.tgz";
sha1 = "9c411a802a409a91fc6cf74081baba34b24499ac";
};
}
{
name = "uid_safe___uid_safe_2.1.5.tgz";
path = fetchurl {
name = "uid_safe___uid_safe_2.1.5.tgz";
url = "https://registry.yarnpkg.com/uid-safe/-/uid-safe-2.1.5.tgz";
sha1 = "2b3d5c7240e8fc2e58f8aa269e5ee49c0857bd3a";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "uid2___uid2_0.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "uid2___uid2_0.0.4.tgz";
url = "https://registry.yarnpkg.com/uid2/-/uid2-0.0.4.tgz";
sha1 = "033f3b1d5d32505f5ce5f888b9f3b667123c0a44";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "umzug___umzug_2.3.0.tgz";
path = fetchurl {
name = "umzug___umzug_2.3.0.tgz";
url = "https://registry.yarnpkg.com/umzug/-/umzug-2.3.0.tgz";
sha1 = "0ef42b62df54e216b05dcaf627830a6a8b84a184";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "unbox_primitive___unbox_primitive_1.0.1.tgz";
path = fetchurl {
name = "unbox_primitive___unbox_primitive_1.0.1.tgz";
url = "https://registry.yarnpkg.com/unbox-primitive/-/unbox-primitive-1.0.1.tgz";
sha1 = "085e215625ec3162574dc8859abee78a59b14471";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
name = "underscore___underscore_1.11.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "underscore___underscore_1.11.0.tgz";
url = "https://registry.yarnpkg.com/underscore/-/underscore-1.11.0.tgz";
sha1 = "dd7c23a195db34267186044649870ff1bab5929e";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "underscore___underscore_1.13.1.tgz";
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "underscore___underscore_1.13.1.tgz";
url = "https://registry.yarnpkg.com/underscore/-/underscore-1.13.1.tgz";
sha1 = "0c1c6bd2df54b6b69f2314066d65b6cde6fcf9d1";
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "underscore___underscore_1.6.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "underscore___underscore_1.6.0.tgz";
url = "https://registry.yarnpkg.com/underscore/-/underscore-1.6.0.tgz";
sha1 = "8b38b10cacdef63337b8b24e4ff86d45aea529a8";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unified_args___unified_args_9.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unified_args___unified_args_9.0.2.tgz";
url = "https://registry.yarnpkg.com/unified-args/-/unified-args-9.0.2.tgz";
sha1 = "0c14f555e73ee29c23f9a567942e29069f56e5a2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unified_engine___unified_engine_9.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unified_engine___unified_engine_9.0.4.tgz";
url = "https://registry.yarnpkg.com/unified-engine/-/unified-engine-9.0.4.tgz";
sha1 = "ee02b6a7f11e69a56f79cb8595065b8c3f02bda8";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unified_lint_rule___unified_lint_rule_2.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unified_lint_rule___unified_lint_rule_2.0.1.tgz";
url = "https://registry.yarnpkg.com/unified-lint-rule/-/unified-lint-rule-2.0.1.tgz";
sha1 = "85276c0d443dce7b76d65e4b8bcdc987323ec9e4";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unified_message_control___unified_message_control_4.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unified_message_control___unified_message_control_4.0.0.tgz";
url = "https://registry.yarnpkg.com/unified-message-control/-/unified-message-control-4.0.0.tgz";
sha1 = "7cd313df526fc660f218b19a56377bb6957019a8";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unified___unified_10.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unified___unified_10.1.0.tgz";
url = "https://registry.yarnpkg.com/unified/-/unified-10.1.0.tgz";
sha1 = "4e65eb38fc2448b1c5ee573a472340f52b9346fe";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "union_value___union_value_1.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "union_value___union_value_1.0.1.tgz";
url = "https://registry.yarnpkg.com/union-value/-/union-value-1.0.1.tgz";
sha1 = "0b6fe7b835aecda61c6ea4d4f02c14221e109847";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "uniqs___uniqs_2.0.0.tgz";
path = fetchurl {
name = "uniqs___uniqs_2.0.0.tgz";
url = "https://registry.yarnpkg.com/uniqs/-/uniqs-2.0.0.tgz";
sha1 = "ffede4b36b25290696e6e165d4a59edb998e6b02";
};
}
{
name = "unique_filename___unique_filename_1.1.1.tgz";
path = fetchurl {
name = "unique_filename___unique_filename_1.1.1.tgz";
url = "https://registry.yarnpkg.com/unique-filename/-/unique-filename-1.1.1.tgz";
sha1 = "1d69769369ada0583103a1e6ae87681b56573230";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "unique_slug___unique_slug_2.0.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "unique_slug___unique_slug_2.0.2.tgz";
url = "https://registry.yarnpkg.com/unique-slug/-/unique-slug-2.0.2.tgz";
sha1 = "baabce91083fc64e945b0f3ad613e264f7cd4e6c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_generated___unist_util_generated_2.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_generated___unist_util_generated_2.0.0.tgz";
url = "https://registry.yarnpkg.com/unist-util-generated/-/unist-util-generated-2.0.0.tgz";
sha1 = "86fafb77eb6ce9bfa6b663c3f5ad4f8e56a60113";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_inspect___unist_util_inspect_7.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_inspect___unist_util_inspect_7.0.0.tgz";
url = "https://registry.yarnpkg.com/unist-util-inspect/-/unist-util-inspect-7.0.0.tgz";
sha1 = "98426f0219e24d011a27e32539be0693d9eb973e";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_is___unist_util_is_5.1.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_is___unist_util_is_5.1.1.tgz";
url = "https://registry.yarnpkg.com/unist-util-is/-/unist-util-is-5.1.1.tgz";
sha1 = "e8aece0b102fa9bc097b0fef8f870c496d4a6236";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_position___unist_util_position_4.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_position___unist_util_position_4.0.1.tgz";
url = "https://registry.yarnpkg.com/unist-util-position/-/unist-util-position-4.0.1.tgz";
sha1 = "f8484b2da19a897a0180556d160c28633070dbb9";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_stringify_position___unist_util_stringify_position_3.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_stringify_position___unist_util_stringify_position_3.0.0.tgz";
url = "https://registry.yarnpkg.com/unist-util-stringify-position/-/unist-util-stringify-position-3.0.0.tgz";
sha1 = "d517d2883d74d0daa0b565adc3d10a02b4a8cde9";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_visit_parents___unist_util_visit_parents_4.1.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_visit_parents___unist_util_visit_parents_4.1.1.tgz";
url = "https://registry.yarnpkg.com/unist-util-visit-parents/-/unist-util-visit-parents-4.1.1.tgz";
sha1 = "e83559a4ad7e6048a46b1bdb22614f2f3f4724f2";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_visit_parents___unist_util_visit_parents_5.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_visit_parents___unist_util_visit_parents_5.0.0.tgz";
url = "https://registry.yarnpkg.com/unist-util-visit-parents/-/unist-util-visit-parents-5.0.0.tgz";
sha1 = "5ae2440f8710a0c18a2b4ba0c4471d18e1090494";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_visit___unist_util_visit_3.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_visit___unist_util_visit_3.1.0.tgz";
url = "https://registry.yarnpkg.com/unist-util-visit/-/unist-util-visit-3.1.0.tgz";
sha1 = "9420d285e1aee938c7d9acbafc8e160186dbaf7b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_visit___unist_util_visit_4.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "unist_util_visit___unist_util_visit_4.0.0.tgz";
url = "https://registry.yarnpkg.com/unist-util-visit/-/unist-util-visit-4.0.0.tgz";
sha1 = "6e1f7e8e163921d20281354c38bfd3244b64580a";
};
}
{
name = "unpipe___unpipe_1.0.0.tgz";
path = fetchurl {
name = "unpipe___unpipe_1.0.0.tgz";
url = "https://registry.yarnpkg.com/unpipe/-/unpipe-1.0.0.tgz";
sha1 = "b2bf4ee8514aae6165b4817829d21b2ef49904ec";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "unset_value___unset_value_1.0.0.tgz";
path = fetchurl {
name = "unset_value___unset_value_1.0.0.tgz";
url = "https://registry.yarnpkg.com/unset-value/-/unset-value-1.0.0.tgz";
sha1 = "8376873f7d2335179ffb1e6fc3a8ed0dfc8ab559";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "upath___upath_1.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "upath___upath_1.2.0.tgz";
url = "https://registry.yarnpkg.com/upath/-/upath-1.2.0.tgz";
sha1 = "8f66dbcd55a883acdae4408af8b035a5044c1894";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "uri_js___uri_js_4.4.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
name = "uri_js___uri_js_4.4.1.tgz";
url = "https://registry.yarnpkg.com/uri-js/-/uri-js-4.4.1.tgz";
sha1 = "9b1a52595225859e55f669d928f88c6c57f2a77e";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "urix___urix_0.1.0.tgz";
path = fetchurl {
name = "urix___urix_0.1.0.tgz";
url = "https://registry.yarnpkg.com/urix/-/urix-0.1.0.tgz";
sha1 = "da937f7a62e21fec1fd18d49b35c2935067a6c72";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "url_loader___url_loader_4.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "url_loader___url_loader_4.1.1.tgz";
url = "https://registry.yarnpkg.com/url-loader/-/url-loader-4.1.1.tgz";
sha1 = "28505e905cae158cf07c92ca622d7f237e70a4e2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "url___url_0.10.3.tgz";
path = fetchurl {
name = "url___url_0.10.3.tgz";
url = "https://registry.yarnpkg.com/url/-/url-0.10.3.tgz";
sha1 = "021e4d9c7705f21bbf37d03ceb58767402774c64";
};
}
{
name = "url___url_0.11.0.tgz";
path = fetchurl {
name = "url___url_0.11.0.tgz";
url = "https://registry.yarnpkg.com/url/-/url-0.11.0.tgz";
sha1 = "3838e97cfc60521eb73c525a8e55bfdd9e2e28f1";
};
}
{
name = "use___use_3.1.1.tgz";
path = fetchurl {
name = "use___use_3.1.1.tgz";
url = "https://registry.yarnpkg.com/use/-/use-3.1.1.tgz";
sha1 = "d50c8cac79a19fbc20f2911f56eb973f4e10070f";
};
}
{
name = "user_home___user_home_1.1.1.tgz";
path = fetchurl {
name = "user_home___user_home_1.1.1.tgz";
url = "https://registry.yarnpkg.com/user-home/-/user-home-1.1.1.tgz";
sha1 = "2b5be23a32b63a7c9deb8d0f28d485724a3df190";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "utf_8_validate___utf_8_validate_5.0.5.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "utf_8_validate___utf_8_validate_5.0.5.tgz";
url = "https://registry.yarnpkg.com/utf-8-validate/-/utf-8-validate-5.0.5.tgz";
sha1 = "dd32c2e82c72002dc9f02eb67ba6761f43456ca1";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "util_deprecate___util_deprecate_1.0.2.tgz";
path = fetchurl {
name = "util_deprecate___util_deprecate_1.0.2.tgz";
url = "https://registry.yarnpkg.com/util-deprecate/-/util-deprecate-1.0.2.tgz";
sha1 = "450d4dc9fa70de732762fbd2d4a28981419a0ccf";
};
}
{
name = "util.promisify___util.promisify_1.0.0.tgz";
path = fetchurl {
name = "util.promisify___util.promisify_1.0.0.tgz";
url = "https://registry.yarnpkg.com/util.promisify/-/util.promisify-1.0.0.tgz";
sha1 = "440f7165a459c9a16dc145eb8e72f35687097030";
};
}
{
name = "util___util_0.10.3.tgz";
path = fetchurl {
name = "util___util_0.10.3.tgz";
url = "https://registry.yarnpkg.com/util/-/util-0.10.3.tgz";
sha1 = "7afb1afe50805246489e3db7fe0ed379336ac0f9";
};
}
{
name = "util___util_0.11.1.tgz";
path = fetchurl {
name = "util___util_0.11.1.tgz";
url = "https://registry.yarnpkg.com/util/-/util-0.11.1.tgz";
sha1 = "3236733720ec64bb27f6e26f421aaa2e1b588d61";
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "util___util_0.12.4.tgz";
path = fetchurl {
name = "util___util_0.12.4.tgz";
url = "https://registry.yarnpkg.com/util/-/util-0.12.4.tgz";
sha1 = "66121a31420df8f01ca0c464be15dfa1d1850253";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "utila___utila_0.4.0.tgz";
path = fetchurl {
name = "utila___utila_0.4.0.tgz";
url = "https://registry.yarnpkg.com/utila/-/utila-0.4.0.tgz";
sha1 = "8a16a05d445657a3aea5eecc5b12a4fa5379772c";
};
}
{
name = "utils_merge___utils_merge_1.0.1.tgz";
path = fetchurl {
name = "utils_merge___utils_merge_1.0.1.tgz";
url = "https://registry.yarnpkg.com/utils-merge/-/utils-merge-1.0.1.tgz";
sha1 = "9f95710f50a267947b2ccc124741c1028427e713";
};
}
{
name = "uuid___uuid_3.3.2.tgz";
path = fetchurl {
name = "uuid___uuid_3.3.2.tgz";
url = "https://registry.yarnpkg.com/uuid/-/uuid-3.3.2.tgz";
sha1 = "1b4af4955eb3077c501c23872fc6513811587131";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
name = "uuid___uuid_3.4.0.tgz";
path = fetchurl {
name = "uuid___uuid_3.4.0.tgz";
url = "https://registry.yarnpkg.com/uuid/-/uuid-3.4.0.tgz";
sha1 = "b23e4358afa8a202fe7a100af1f5f883f02007ee";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "uuid___uuid_8.3.2.tgz";
path = fetchurl {
name = "uuid___uuid_8.3.2.tgz";
url = "https://registry.yarnpkg.com/uuid/-/uuid-8.3.2.tgz";
sha1 = "80d5b5ced271bb9af6c445f21a1a04c606cefbe2";
};
}
{
name = "v8_compile_cache___v8_compile_cache_2.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "v8_compile_cache___v8_compile_cache_2.3.0.tgz";
url = "https://registry.yarnpkg.com/v8-compile-cache/-/v8-compile-cache-2.3.0.tgz";
sha1 = "2de19618c66dc247dcfb6f99338035d8245a2cee";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "v8flags___v8flags_2.1.1.tgz";
path = fetchurl {
name = "v8flags___v8flags_2.1.1.tgz";
url = "https://registry.yarnpkg.com/v8flags/-/v8flags-2.1.1.tgz";
sha1 = "aab1a1fa30d45f88dd321148875ac02c0b55e5b4";
};
}
{
name = "validate_npm_package_license___validate_npm_package_license_3.0.4.tgz";
path = fetchurl {
name = "validate_npm_package_license___validate_npm_package_license_3.0.4.tgz";
url = "https://registry.yarnpkg.com/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz";
sha1 = "fc91f6b9c7ba15c857f4cb2c5defeec39d4f410a";
};
}
{
name = "validator___validator_10.11.0.tgz";
path = fetchurl {
name = "validator___validator_10.11.0.tgz";
url = "https://registry.yarnpkg.com/validator/-/validator-10.11.0.tgz";
sha1 = "003108ea6e9a9874d31ccc9e5006856ccd76b228";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "validator___validator_13.6.0.tgz";
path = fetchurl {
name = "validator___validator_13.6.0.tgz";
url = "https://registry.yarnpkg.com/validator/-/validator-13.6.0.tgz";
sha1 = "1e71899c14cdc7b2068463cb24c1cc16f6ec7059";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "validator___validator_9.4.1.tgz";
path = fetchurl {
name = "validator___validator_9.4.1.tgz";
url = "https://registry.yarnpkg.com/validator/-/validator-9.4.1.tgz";
sha1 = "abf466d398b561cd243050112c6ff1de6cc12663";
};
}
{
name = "vary___vary_1.1.2.tgz";
path = fetchurl {
name = "vary___vary_1.1.2.tgz";
url = "https://registry.yarnpkg.com/vary/-/vary-1.1.2.tgz";
sha1 = "2299f02c6ded30d4a5961b0b9f74524a18f634fc";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "vasync___vasync_2.2.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "vasync___vasync_2.2.0.tgz";
url = "https://registry.yarnpkg.com/vasync/-/vasync-2.2.0.tgz";
sha1 = "cfde751860a15822db3b132bc59b116a4adaf01b";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "velocity_animate___velocity_animate_1.5.2.tgz";
path = fetchurl {
name = "velocity_animate___velocity_animate_1.5.2.tgz";
url = "https://registry.yarnpkg.com/velocity-animate/-/velocity-animate-1.5.2.tgz";
sha1 = "5a351d75fca2a92756f5c3867548b873f6c32105";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "vendors___vendors_1.0.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "vendors___vendors_1.0.4.tgz";
url = "https://registry.yarnpkg.com/vendors/-/vendors-1.0.4.tgz";
sha1 = "e2b800a53e7a29b93506c3cf41100d16c4c4ad8e";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "verror___verror_1.10.0.tgz";
path = fetchurl {
name = "verror___verror_1.10.0.tgz";
url = "https://registry.yarnpkg.com/verror/-/verror-1.10.0.tgz";
sha1 = "3a105ca17053af55d6e270c1f8288682e18da400";
};
}
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "vfile_location___vfile_location_4.0.1.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "vfile_location___vfile_location_4.0.1.tgz";
url = "https://registry.yarnpkg.com/vfile-location/-/vfile-location-4.0.1.tgz";
sha1 = "06f2b9244a3565bef91f099359486a08b10d3a95";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "vfile_message___vfile_message_3.0.2.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "vfile_message___vfile_message_3.0.2.tgz";
url = "https://registry.yarnpkg.com/vfile-message/-/vfile-message-3.0.2.tgz";
sha1 = "db7eaebe7fecb853010f2ef1664427f52baf8f74";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "vfile_reporter___vfile_reporter_7.0.2.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "vfile_reporter___vfile_reporter_7.0.2.tgz";
url = "https://registry.yarnpkg.com/vfile-reporter/-/vfile-reporter-7.0.2.tgz";
sha1 = "2b3bfafb428581e72073c4337acdf82912385356";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "vfile_sort___vfile_sort_3.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "vfile_sort___vfile_sort_3.0.0.tgz";
url = "https://registry.yarnpkg.com/vfile-sort/-/vfile-sort-3.0.0.tgz";
sha1 = "ee13d3eaac0446200a2047a3b45d78fad6b106e6";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "vfile_statistics___vfile_statistics_2.0.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "vfile_statistics___vfile_statistics_2.0.0.tgz";
url = "https://registry.yarnpkg.com/vfile-statistics/-/vfile-statistics-2.0.0.tgz";
sha1 = "f04ee3e3c666809a3c10c06021becd41ea9c8037";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "vfile___vfile_5.1.0.tgz";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "vfile___vfile_5.1.0.tgz";
url = "https://registry.yarnpkg.com/vfile/-/vfile-5.1.0.tgz";
sha1 = "18e78016f0f71e98d737d40f0fca921dc264a600";
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "visibilityjs___visibilityjs_2.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "visibilityjs___visibilityjs_2.0.2.tgz";
url = "https://registry.yarnpkg.com/visibilityjs/-/visibilityjs-2.0.2.tgz";
sha1 = "d7c466e922024bb6c413d2136d5567e71f5fdc2f";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "viz.js___viz.js_1.8.2.tgz";
path = fetchurl {
name = "viz.js___viz.js_1.8.2.tgz";
url = "https://registry.yarnpkg.com/viz.js/-/viz.js-1.8.2.tgz";
sha1 = "d9cc04cd99f98ec986bf9054db76a6cbcdc5d97a";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "vm_browserify___vm_browserify_1.1.2.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "vm_browserify___vm_browserify_1.1.2.tgz";
url = "https://registry.yarnpkg.com/vm-browserify/-/vm-browserify-1.1.2.tgz";
sha1 = "78641c488b8e6ca91a75f511e7a3b32a86e5dda0";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "watchpack_chokidar2___watchpack_chokidar2_2.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "watchpack_chokidar2___watchpack_chokidar2_2.0.1.tgz";
url = "https://registry.yarnpkg.com/watchpack-chokidar2/-/watchpack-chokidar2-2.0.1.tgz";
sha1 = "38500072ee6ece66f3769936950ea1771be1c957";
};
}
{
name = "watchpack___watchpack_1.7.5.tgz";
path = fetchurl {
name = "watchpack___watchpack_1.7.5.tgz";
url = "https://registry.yarnpkg.com/watchpack/-/watchpack-1.7.5.tgz";
sha1 = "1267e6c55e0b9b5be44c2023aed5437a2c26c453";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "web_encoding___web_encoding_1.1.5.tgz";
path = fetchurl {
name = "web_encoding___web_encoding_1.1.5.tgz";
url = "https://registry.yarnpkg.com/web-encoding/-/web-encoding-1.1.5.tgz";
sha1 = "fc810cf7667364a6335c939913f5051d3e0c4864";
};
}
{
name = "web_namespaces___web_namespaces_2.0.0.tgz";
path = fetchurl {
name = "web_namespaces___web_namespaces_2.0.0.tgz";
url = "https://registry.yarnpkg.com/web-namespaces/-/web-namespaces-2.0.0.tgz";
sha1 = "1f6a2d7b5823329abaedeb6bdf09ef2fed35db13";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "webfontloader___webfontloader_1.6.28.tgz";
path = fetchurl {
name = "webfontloader___webfontloader_1.6.28.tgz";
url = "https://registry.yarnpkg.com/webfontloader/-/webfontloader-1.6.28.tgz";
sha1 = "db786129253cb6e8eae54c2fb05f870af6675bae";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "webpack_cli___webpack_cli_4.8.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "webpack_cli___webpack_cli_4.8.0.tgz";
url = "https://registry.yarnpkg.com/webpack-cli/-/webpack-cli-4.8.0.tgz";
sha1 = "5fc3c8b9401d3c8a43e2afceacfa8261962338d1";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "webpack_merge___webpack_merge_5.8.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "webpack_merge___webpack_merge_5.8.0.tgz";
url = "https://registry.yarnpkg.com/webpack-merge/-/webpack-merge-5.8.0.tgz";
sha1 = "2b39dbf22af87776ad744c390223731d30a68f61";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "webpack_sources___webpack_sources_1.4.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "webpack_sources___webpack_sources_1.4.3.tgz";
url = "https://registry.yarnpkg.com/webpack-sources/-/webpack-sources-1.4.3.tgz";
sha1 = "eedd8ec0b928fbf1cbfe994e22d2d890f330a933";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "webpack_sources___webpack_sources_2.3.1.tgz";
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "webpack_sources___webpack_sources_2.3.1.tgz";
url = "https://registry.yarnpkg.com/webpack-sources/-/webpack-sources-2.3.1.tgz";
sha1 = "570de0af163949fe272233c2cefe1b56f74511fd";
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "webpack___webpack_4.46.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "webpack___webpack_4.46.0.tgz";
url = "https://registry.yarnpkg.com/webpack/-/webpack-4.46.0.tgz";
sha1 = "bf9b4404ea20a073605e0a011d188d77cb6ad542";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "which_boxed_primitive___which_boxed_primitive_1.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "which_boxed_primitive___which_boxed_primitive_1.0.2.tgz";
url = "https://registry.yarnpkg.com/which-boxed-primitive/-/which-boxed-primitive-1.0.2.tgz";
sha1 = "13757bc89b209b049fe5d86430e21cf40a89a8e6";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "which_collection___which_collection_1.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "which_collection___which_collection_1.0.1.tgz";
url = "https://registry.yarnpkg.com/which-collection/-/which-collection-1.0.1.tgz";
sha1 = "70eab71ebbbd2aefaf32f917082fc62cdcb70906";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "which_typed_array___which_typed_array_1.1.7.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "which_typed_array___which_typed_array_1.1.7.tgz";
url = "https://registry.yarnpkg.com/which-typed-array/-/which-typed-array-1.1.7.tgz";
sha1 = "2761799b9a22d4b8660b3c1b40abaa7739691793";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "which___which_1.3.1.tgz";
path = fetchurl {
name = "which___which_1.3.1.tgz";
url = "https://registry.yarnpkg.com/which/-/which-1.3.1.tgz";
sha1 = "a45043d54f5805316da8d62f9f50918d3da70b0a";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "which___which_2.0.2.tgz";
path = fetchurl {
name = "which___which_2.0.2.tgz";
url = "https://registry.yarnpkg.com/which/-/which-2.0.2.tgz";
sha1 = "7c6a8dd0a636a0327e10b59c9286eee93f3f51b1";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "wide_align___wide_align_1.1.3.tgz";
path = fetchurl {
name = "wide_align___wide_align_1.1.3.tgz";
url = "https://registry.yarnpkg.com/wide-align/-/wide-align-1.1.3.tgz";
sha1 = "ae074e6bdc0c14a431e804e624549c633b000457";
};
}
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
{
name = "wildcard___wildcard_2.0.0.tgz";
path = fetchurl {
name = "wildcard___wildcard_2.0.0.tgz";
url = "https://registry.yarnpkg.com/wildcard/-/wildcard-2.0.0.tgz";
sha1 = "a77d20e5200c6faaac979e4b3aadc7b3dd7f8fec";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "winston_transport___winston_transport_4.4.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "winston_transport___winston_transport_4.4.0.tgz";
url = "https://registry.yarnpkg.com/winston-transport/-/winston-transport-4.4.0.tgz";
sha1 = "17af518daa690d5b2ecccaa7acf7b20ca7925e59";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "winston___winston_3.3.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "winston___winston_3.3.3.tgz";
url = "https://registry.yarnpkg.com/winston/-/winston-3.3.3.tgz";
sha1 = "ae6172042cafb29786afa3d09c8ff833ab7c9170";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "wkx___wkx_0.4.8.tgz";
path = fetchurl {
name = "wkx___wkx_0.4.8.tgz";
url = "https://registry.yarnpkg.com/wkx/-/wkx-0.4.8.tgz";
sha1 = "a092cf088d112683fdc7182fd31493b2c5820003";
};
}
{
name = "word_wrap___word_wrap_1.2.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "word_wrap___word_wrap_1.2.3.tgz";
url = "https://registry.yarnpkg.com/word-wrap/-/word-wrap-1.2.3.tgz";
sha1 = "610636f6b1f703891bd34771ccb17fb93b47079c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "worker_farm___worker_farm_1.7.0.tgz";
path = fetchurl {
name = "worker_farm___worker_farm_1.7.0.tgz";
url = "https://registry.yarnpkg.com/worker-farm/-/worker-farm-1.7.0.tgz";
sha1 = "26a94c5391bbca926152002f69b84a4bf772e5a8";
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "workerpool___workerpool_6.1.5.tgz";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "workerpool___workerpool_6.1.5.tgz";
url = "https://registry.yarnpkg.com/workerpool/-/workerpool-6.1.5.tgz";
sha1 = "0f7cf076b6215fd7e1da903ff6f22ddd1886b581";
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
};
}
{
name = "wrap_ansi___wrap_ansi_7.0.0.tgz";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "wrap_ansi___wrap_ansi_7.0.0.tgz";
url = "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz";
sha1 = "67e145cff510a6a6984bdf1152911d69d2eb9e43";
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "wrappy___wrappy_1.0.2.tgz";
path = fetchurl {
name = "wrappy___wrappy_1.0.2.tgz";
url = "https://registry.yarnpkg.com/wrappy/-/wrappy-1.0.2.tgz";
sha1 = "b5243d8f3ec1aa35f1364605bc0d1036e30ab69f";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "ws___ws_7.4.6.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "ws___ws_7.4.6.tgz";
url = "https://registry.yarnpkg.com/ws/-/ws-7.4.6.tgz";
sha1 = "5654ca8ecdeee47c33a9a4bf6d28e2be2980377c";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "wurl___wurl_2.5.4.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "wurl___wurl_2.5.4.tgz";
url = "https://registry.yarnpkg.com/wurl/-/wurl-2.5.4.tgz";
sha1 = "6af35a6c623296c4a0c607c4651d01b8f4e3fdec";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "xml_crypto___xml_crypto_2.1.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "xml_crypto___xml_crypto_2.1.3.tgz";
url = "https://registry.yarnpkg.com/xml-crypto/-/xml-crypto-2.1.3.tgz";
sha1 = "6a7272b610ea3e4ea7f13e9e4876f1b20cbc32c8";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "xml_encryption___xml_encryption_1.3.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "xml_encryption___xml_encryption_1.3.0.tgz";
url = "https://registry.yarnpkg.com/xml-encryption/-/xml-encryption-1.3.0.tgz";
sha1 = "4cad44a59bf8bdec76d7865ce0b89e13c09962f4";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "xml2js___xml2js_0.2.8.tgz";
path = fetchurl {
name = "xml2js___xml2js_0.2.8.tgz";
url = "https://registry.yarnpkg.com/xml2js/-/xml2js-0.2.8.tgz";
sha1 = "9b81690931631ff09d1957549faf54f4f980b3c2";
};
}
{
name = "xml2js___xml2js_0.4.19.tgz";
path = fetchurl {
name = "xml2js___xml2js_0.4.19.tgz";
url = "https://registry.yarnpkg.com/xml2js/-/xml2js-0.4.19.tgz";
sha1 = "686c20f213209e94abf0d1bcf1efaa291c7827a7";
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
name = "xml2js___xml2js_0.4.23.tgz";
path = fetchurl {
name = "xml2js___xml2js_0.4.23.tgz";
url = "https://registry.yarnpkg.com/xml2js/-/xml2js-0.4.23.tgz";
sha1 = "a0c69516752421eb2ac758ee4d4ccf58843eac66";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
name = "xml___xml_1.0.1.tgz";
path = fetchurl {
name = "xml___xml_1.0.1.tgz";
url = "https://registry.yarnpkg.com/xml/-/xml-1.0.1.tgz";
sha1 = "78ba72020029c5bc87b8a81a3cfcd74b4a2fc1e5";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "xmlbuilder___xmlbuilder_15.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "xmlbuilder___xmlbuilder_15.1.1.tgz";
url = "https://registry.yarnpkg.com/xmlbuilder/-/xmlbuilder-15.1.1.tgz";
sha1 = "9dcdce49eea66d8d10b42cae94a79c3c8d0c2ec5";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "xmlbuilder___xmlbuilder_9.0.7.tgz";
path = fetchurl {
name = "xmlbuilder___xmlbuilder_9.0.7.tgz";
url = "https://registry.yarnpkg.com/xmlbuilder/-/xmlbuilder-9.0.7.tgz";
sha1 = "132ee63d2ec5565c557e20f4c22df9aca686b10d";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "xmlbuilder___xmlbuilder_11.0.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "xmlbuilder___xmlbuilder_11.0.1.tgz";
url = "https://registry.yarnpkg.com/xmlbuilder/-/xmlbuilder-11.0.1.tgz";
sha1 = "be9bae1c8a046e76b31127726347d0ad7002beb3";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
{
name = "xmldom___xmldom_0.1.31.tgz";
path = fetchurl {
name = "xmldom___xmldom_0.1.31.tgz";
url = "https://registry.yarnpkg.com/xmldom/-/xmldom-0.1.31.tgz";
sha1 = "b76c9a1bd9f0a9737e5a72dc37231cf38375e2ff";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "xmlhttprequest_ssl___xmlhttprequest_ssl_1.6.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "xmlhttprequest_ssl___xmlhttprequest_ssl_1.6.3.tgz";
url = "https://registry.yarnpkg.com/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.6.3.tgz";
sha1 = "03b713873b01659dfa2c1c5d056065b27ddc2de6";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "xmlhttprequest___xmlhttprequest_1.8.0.tgz";
path = fetchurl {
name = "xmlhttprequest___xmlhttprequest_1.8.0.tgz";
url = "https://registry.yarnpkg.com/xmlhttprequest/-/xmlhttprequest-1.8.0.tgz";
sha1 = "67fe075c5c24fef39f9d65f5f7b7fe75171968fc";
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "xpath___xpath_0.0.32.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "xpath___xpath_0.0.32.tgz";
url = "https://registry.yarnpkg.com/xpath/-/xpath-0.0.32.tgz";
sha1 = "1b73d3351af736e17ec078d6da4b8175405c48af";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "xss___xss_1.0.9.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.0 -> 1.8.2 includes fixes for: * CVE-2021-29503: Improper Neutralization of Script-Related HTML Tags in Notes * a potential XSS-vector in the handling of usernames and profile pictures https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.2
2021-05-11 22:59:13 +01:00
name = "xss___xss_1.0.9.tgz";
url = "https://registry.yarnpkg.com/xss/-/xss-1.0.9.tgz";
sha1 = "3ffd565571ff60d2e40db7f3b80b4677bec770d2";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "xtend___xtend_4.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "xtend___xtend_4.0.2.tgz";
url = "https://registry.yarnpkg.com/xtend/-/xtend-4.0.2.tgz";
sha1 = "bb72779f5fa465186b1f438f674fa347fdb5db54";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "xtraverse___xtraverse_0.1.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.4.0 -> 1.5.0
2019-08-16 10:17:14 +01:00
name = "xtraverse___xtraverse_0.1.0.tgz";
url = "https://registry.yarnpkg.com/xtraverse/-/xtraverse-0.1.0.tgz";
sha1 = "b741bad018ef78d8a9d2e83ade007b3f7959c732";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "y18n___y18n_4.0.3.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "y18n___y18n_4.0.3.tgz";
url = "https://registry.yarnpkg.com/y18n/-/y18n-4.0.3.tgz";
sha1 = "b5f259c82cd6e336921efd7bfd8bf560de9eeedf";
};
}
{
name = "y18n___y18n_5.0.8.tgz";
path = fetchurl {
name = "y18n___y18n_5.0.8.tgz";
url = "https://registry.yarnpkg.com/y18n/-/y18n-5.0.8.tgz";
sha1 = "7f4934d0f7ca8c56f95314939ddcd2dd91ce1d55";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "yallist___yallist_2.1.2.tgz";
path = fetchurl {
name = "yallist___yallist_2.1.2.tgz";
url = "https://registry.yarnpkg.com/yallist/-/yallist-2.1.2.tgz";
sha1 = "1c11f9218f076089a47dd512f93c6699a6a81d52";
};
}
{
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "yallist___yallist_3.1.1.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
name = "yallist___yallist_3.1.1.tgz";
url = "https://registry.yarnpkg.com/yallist/-/yallist-3.1.1.tgz";
sha1 = "dbb7daf9bfd8bac9ab45ebf602b8cbad0d5d08fd";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "yallist___yallist_4.0.0.tgz";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
path = fetchurl {
codimd: 1.6.0 -> 1.7.0, rename to hedgedoc CodiMD was renamed to HedgeDoc and is now built with nodejs-14_x. https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.0
2020-11-29 17:47:34 +00:00
name = "yallist___yallist_4.0.0.tgz";
url = "https://registry.yarnpkg.com/yallist/-/yallist-4.0.0.tgz";
sha1 = "9bb92790d9c0effec63be73519e11a35019a3a72";
codimd: 1.5.0 -> 1.6.0
2020-02-19 14:14:26 +00:00
};
}
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
{
name = "yaml___yaml_1.10.2.tgz";
path = fetchurl {
name = "yaml___yaml_1.10.2.tgz";
url = "https://registry.yarnpkg.com/yaml/-/yaml-1.10.2.tgz";
sha1 = "2301c5ffbf12b467de8da2333a459e29e7920e4b";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "yargs_parser___yargs_parser_20.2.4.tgz";
path = fetchurl {
name = "yargs_parser___yargs_parser_20.2.4.tgz";
url = "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-20.2.4.tgz";
sha1 = "b42890f14566796f85ae8e3a25290d205f154a54";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "yargs_parser___yargs_parser_20.2.9.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "yargs_parser___yargs_parser_20.2.9.tgz";
url = "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-20.2.9.tgz";
sha1 = "2eb7dc3b0289718fc295f362753845c41a0c94ee";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "yargs_unparser___yargs_unparser_2.0.0.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "yargs_unparser___yargs_unparser_2.0.0.tgz";
url = "https://registry.yarnpkg.com/yargs-unparser/-/yargs-unparser-2.0.0.tgz";
sha1 = "f131f9226911ae5d9ad38c432fe809366c2325eb";
};
}
{
name = "yargs___yargs_16.2.0.tgz";
path = fetchurl {
name = "yargs___yargs_16.2.0.tgz";
url = "https://registry.yarnpkg.com/yargs/-/yargs-16.2.0.tgz";
sha1 = "1c82bf0f6b6a66eafce7ef30e376f49a12477f66";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
{
name = "yeast___yeast_0.1.2.tgz";
path = fetchurl {
name = "yeast___yeast_0.1.2.tgz";
url = "https://registry.yarnpkg.com/yeast/-/yeast-0.1.2.tgz";
sha1 = "008e06d8094320c372dbc2f8ed76a0ca6c8ac419";
};
}
hedgedoc: 1.7.1 -> 1.7.2, fixes CVE-2021-21259 https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.2 CVE-2021-21259: https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-44w9-vm8p-3cxw
2021-01-15 23:41:04 +00:00
{
name = "yocto_queue___yocto_queue_0.1.0.tgz";
path = fetchurl {
name = "yocto_queue___yocto_queue_0.1.0.tgz";
url = "https://registry.yarnpkg.com/yocto-queue/-/yocto-queue-0.1.0.tgz";
sha1 = "0294eb3dee05028d31ee1a5fa2c556a6aaf10a1b";
};
}
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
{
hedgedoc: 1.7.2 -> 1.8.0 https://github.com/hedgedoc/hedgedoc/releases/tag/1.8.0 includes fixes for CVE-2021-21306 and CVE-2021-29474
2021-05-03 23:46:00 +01:00
name = "zip_stream___zip_stream_4.1.0.tgz";
path = fetchurl {
name = "zip_stream___zip_stream_4.1.0.tgz";
url = "https://registry.yarnpkg.com/zip-stream/-/zip-stream-4.1.0.tgz";
sha1 = "51dd326571544e36aa3f756430b313576dc8fc79";
};
}
{
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "zwitch___zwitch_2.0.2.tgz";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
path = fetchurl {
hedgedoc: 1.8.2 -> 1.9.0, fixes CVE-2021-39175 ChangeLog: https://github.com/hedgedoc/hedgedoc/releases/tag/1.9.0 As documented in the Nix expression, I unfortunately had to patch `yarn.lock` manually (the `yarn.nix` result isn't affected by this). By adding a `git+https`-prefix to `midi "https://github.com/paulrosen/MIDI.js.git#abcjs"` in the lock-file I ensured that `yarn` actually uses the `MIDI.js` from the offline-cache from `yarn2nix` rather than trying to download a tarball from GitHub. Also, this release contains a fix for CVE-2021-39175 which doesn't seem to be backported to 1.8. To quote NVD[1]: > In versions prior to 1.9.0, an unauthenticated attacker can inject > arbitrary JavaScript into the speaker-notes of the slide-mode feature > by embedding an iframe hosting the malicious code into the slides or by > embedding the HedgeDoc instance into another page. Even though it "only" has a medium rating by NVD (6.1), this seems rather problematic to me (also, GitHub rates this as "High"), so it's actually a candidate for a backport. [1] https://nvd.nist.gov/vuln/detail/CVE-2021-39175
2021-09-18 23:09:26 +01:00
name = "zwitch___zwitch_2.0.2.tgz";
url = "https://registry.yarnpkg.com/zwitch/-/zwitch-2.0.2.tgz";
sha1 = "91f8d0e901ffa3d66599756dde7f57b17c95dce1";
codimd: 1.2.0 -> 1.4.0, repackage using yarn2nix-moretea
2019-07-13 14:09:39 +01:00
};
}
];
}
Reference in New Issue Copy Permalink