Update dependency node-notifier to v8 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
node-notifier	^5.1.2 → ^8.0.0

---

OS Command Injection in node-notifier

CVE-2020-7789 / GHSA-5fw9-fq32-wv5p

More information

Details

This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Severity

• CVSS Score: 5.6 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-7789
• https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794
• https://github.com/mikaelbr/node-notifier/commit/5d62799dab88505a709cd032653b2320c5813fce
• https://github.com/mikaelbr/node-notifier/blob/master/lib/utils.js%23L303
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371
• https://github.com/advisories/GHSA-5fw9-fq32-wv5p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

OS Command Injection in node-notifier

CVE-2020-7789 / GHSA-5fw9-fq32-wv5p

More information

Details

This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Severity

• CVSS Score: 5.6 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References

• https://nvd.nist.gov/vuln/detail/CVE-2020-7789
• https://github.com/mikaelbr/node-notifier/commit/5d62799dab88505a709cd032653b2320c5813fce
• https://github.com/mikaelbr/node-notifier/blob/master/lib/utils.js%23L303
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1050371
• https://snyk.io/vuln/SNYK-JS-NODENOTIFIER-1035794

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mikaelbr/node-notifier (node-notifier)

v8.0.1

Compare Source

v8.0.0

Compare Source

Breaking changes:

• Expire time for notify-send is made to match macOS and Windows with default time of 10 seconds. The API is changed to take seconds as input and converting it to milliseconds before passing it on to notify-send. See #​341.

v7.0.2

Compare Source

• Updates dependencies
• Fixes issue with haning Windows notifications when disabled (#​335)

v7.0.1

Compare Source

• Fixes import of uuid, removes deprecation warnings

v7.0.0

Compare Source

Features

• NotifySend support for app-name (#​299, see docs)

Breaking Changes

• All notify messages now have auto bound context to make it easier to pass as variables/arguments (#​306)
• Updated snoreToast to version 0.7.0 with new input features (#​293)
• Breaking snoreToast: Sanitizing data now changes "timedout" to "timeout"

v6.0.0

Compare Source

Breaking Changes

• Dropped support for node v6. As of v6 we currently support node versions 8, 10, and 12 (latest).
• Updated to the latest version of SnoreToast. This removes support for the wait option in that environment as it is now always on. Prepares the way for other new features added to the WindowsToaster.

Other

• Update to latest version of dependencies.

v5.4.5

Compare Source

v5.4.4

Compare Source

• Fixes potential security issue with non-escaping input parameters for notify-send.

v5.4.3

Compare Source

• Fixes potential security issue with non-escaping input parameters for notify-send.

v5.4.2

Compare Source

• Updates dependencies

v5.4.1

Compare Source

• Reverts changes to default timeout as they are causing some issues. See #​271

v5.4.0

Compare Source

• Prevent Spotlight from indexing terminal-notifier.app (#​238)
• Changes from legacy url.parse api
• Adds default timeout to notification center
• Adds mapping from timeout to expire time for linux
• Enables the use of WindowsToaster when using WSL (#​260)

v5.3.0

Compare Source

• Re-adds notifu update.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Never, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.