Ant Design (antd) is a popular, enterprise-class UI design language and React-based component library. Version 2.5.3 represents a minor update over the previous stable version, 2.5.2, offering refinements and potential bug fixes. Developers will notice a shift in the rc-upload dependency, moving from version ~2.2.0 to ~2.3.0, which likely includes enhancements or fixes related to file uploading functionality. Another key difference lies in the antd-tools dev dependency, which sees an update from ~0.14.6 to ~0.16.0, this suggests changes or improvements in the build or development tooling used internally by the antd team. While both versions share a common foundation with dependencies like React, Moment.js, and a suite of rc-* components (covering everything from forms and menus to tables and calendars), these subtle dependency adjustments can impact stability and performance.
For developers considering upgrading, examining the changelog for both rc-upload and antd-tools is crucial to understand the specific modifications. Version 2.5.3 maintains the core strengths of antd, offering a rich set of pre-built components styled with a consistent design language. This library simplifies building complex user interfaces, speeding up development time. The comprehensive documentation and active community support make antd a go-to choice for React developers seeking a robust and well-maintained UI solution. The release date of version 2.5.3 was December 24th, 2016 a couple of weeks after the release of version 2.5.2.
All the vulnerabilities related to the version 2.5.3 of the package
Regular Expression Denial of Service in moment
Affected versions of moment are vulnerable to a low severity regular expression denial of service when parsing dates as strings.
Update to version 2.19.3 or later.
Path Traversal: 'dir/../../filename' in moment.locale
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).
Sanitize user-provided locale name before passing it to moment.js.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
node-fetch forwards secure headers to untrusted sites
node-fetch forwards secure headers such as authorization, www-authenticate, cookie, & cookie2 when redirecting to a untrusted site.
