Update dependency papaparse to v5 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
papaparse (source)	4.3.6 -> 5.2.0

GitHub Vulnerability Alerts

GHSA-qvjc-g5vr-mfgr

Versions of papaparse prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The parse function contains a malformed regular expression that takes exponentially longer to process non-numerical inputs. This allows attackers to stall systems and lead to Denial of Service.

Recommendation

Upgrade to version 5.2.0 or later.

CVE-2020-36649

A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.

---

Release Notes

mholt/PapaParse (papaparse)

v5.2.0

Compare Source

We are happy to announce version 5.2.0.

This version contains a new feature that allows to perform post request when downloading files.

It also fixes a ReDOS vulnerability issue. See https://github.com/mholt/PapaParse/issues/777 for more details.

v5.1.1

Compare Source

v5.1.0

Compare Source

The release brings a the option to use a function to determine the fields that will be quoted. This function accepts the cell value and column index as parameters. Thanks to @​Puzzleton for contributing this feature.

This release also includes some bug fixes. Thanks to all who contributed.

v5.0.2

Compare Source

v5.0.1

Compare Source

v5.0.0: Version 5.0.0

Compare Source

We are happy to announce a new major release of PapaParse.

This relase (5.0.0) introduces the following changes:

• We drop support for Node 6.x branch.
• Workers are now loaded with inline blobs, which means that is only needed to specify the worker: true option and Paparse will load it's code from a blob
• Step function returns only a single row
• A function to transform header columns is added. The trimheader option is removed as it can be achieved with this new transform function.
• The API throws now Error objects instead of using error Strings.
• Handle delimiter guessing, when not all of the fields are quoted
• Add ability to support escapeChar on unparse
• Allow to specify the columns used for unparse
• Add DelimitersToGuess config option

Happy parsing!

v4.6.3

Compare Source

v4.6.2

Compare Source

v4.6.1

Compare Source

v4.6.0

Compare Source

The release brings a the option to skip lines with no content but with separators.

Thanks to @​MonkeyDZeke for it's contribution

v4.5.1

Compare Source

v4.5.0

Compare Source

This release brings several bug fixes and the the following improvements:

• Serialize dates using ISO Format
• Add config option to transform values before dynamic typing
• Drop support for node v4 and add support for node v10
• Add support for node-style streaming

Thanks to @​pushplay @​efossas @​gabegorelick and @​trevorharwell for contributing to this release

v4.4.0

Compare Source

This release brings several bug fixes and the the following improvements:

• Add option to trim whitespace from headers
• Upgrade dependencies to newer versions
• Remove support for node 0.12
• Add option to configure escape character
• Add support for spaces between quotes and separators

Thanks to @​thSteve, @​gabegorelick and @​marius-wieschollek for contributing to this release.

v4.3.7

Compare Source

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

Error response from daemon: toomanyrequests: You have reached your pull rate limit. You may increase the limit by authenticating and upgrading: https://www.docker.com/increase-rate-limit