Ant Design (version 2.5.1) represents a minor update over its predecessor, version 2.5.0, within this enterprise-grade UI framework tailored for React applications. As a whole, Ant Design provides a comprehensive suite of meticulously crafted components, adhering to a consistent design language to facilitate rapid and robust front-end development.
The primary distinction between versions 2.5.0 and 2.5.1 lies in their dependency versions. Version 2.5.1 updates the moment dependency to "~2.17.0" from "~2.15.1" in version 2.5.0, and the rc-input-number dependency from "~2.7.0" to "~2.8.3". Additionally, in devDependencies the eslint-plugin-babel dependency moves from "^3.0.0" to "^4.0.0" and the antd-tools version moves from "0.14.2" to "~0.14.6".
For developers, these changes primarily translate to bug fixes and potential performance improvements inherent in the updated dependencies. While the core API and component structure remain largely consistent, developers should review the changelogs for moment, rc-input-number,eslint-plugin-babel and antd-tools to understand the specific implications of these updates and ensure compatibility within their existing projects. The update is recommended for maintaining a secure, performant and up-to-date Ant Design integration.
All the vulnerabilities related to the version 2.5.1 of the package
Regular Expression Denial of Service in moment
Affected versions of moment are vulnerable to a low severity regular expression denial of service when parsing dates as strings.
Update to version 2.19.3 or later.
Path Traversal: 'dir/../../filename' in moment.locale
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).
Sanitize user-provided locale name before passing it to moment.js.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.
