Bump jsonpath-plus from 7.2.0 to 10.2.0

[semgrep-box-scans]

Summary

Upgrades jsonpath-plus from 7.2.0 to 10.2.0.

This PR fixes a critical severity, reachable vulnerability.
A reachable issue is a real security risk because your project actually executes the vulnerable code.

Vulnerability details

mferdinand@box.com requested this Autofix PR for this finding.

Affected versions of jsonpath-plus are vulnerable to Improper Control of Generation of Code ('Code Injection').

References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3103,GHSA,CVE

Upgrade guidance

✨ Semgrep thinks this is safe to upgrade ✅

1 function in use unchanged
jsonpath-plus.JSONPath
• src/OpenAPI.js:12
• src/OpenAPI.js:66
• src/OpenAPI.js:75

jsonpath-plus references

Changelog

Sourced from jsonpath-plus's changelog.

10.2.0

• fix(eval): improve security of safe-eval (#233)
• chore: update deps. and devDeps.

10.1.0

• feat: add typeof operator to safe script

10.0.7

• fix(security): prevent constructor access
• docs: add security policy file

10.0.6

• fix(security): prevent call/apply invocation of Function

10.0.5

• fix: remove overly aggressive disabling of native functions but disallow __proto__

10.0.4

• fix(security): further prevent binding of Function calls which may evade detection

10.0.3

• fix(security): prevent binding of Function calls which may evade detection

10.0.2

• fix(security): prevent Function calls outside of member expressions

10.0.1

• fix(security): prohibit Function in "safe" vm

10.0.0

BREAKING CHANGES:

• Require Node 18+

• fix(security): use safe vm by default in Node

• chore: bump jsep, devDeps. and lint

9.0.0

BREAKING CHANGES:

... (truncated)

Commits

• 8e4acf8 chore: bump version
• f0708a4 chore: update deps. and devDeps.
• 0bfda55 build(deps): bump @​eslint/plugin-kit from 0.2.0 to 0.2.3 (#234)
• 73ad72e fix(eval): improve security of safe-eval (#233)
• 93612a3 chore: bump version
• 4a16cbd feat: add undefined, null literals to safe script
• f119fe3 feat: add typeof operator to safe script
• b70aa71 fix(security): prevent constructor access in safe vm
• 763ada0 fix(security): prevent call/apply invocation of Function
• 98a6b22 fix: remove overly aggressive disabling of native functions but disallow `__p...
• Additional commits viewable in compare view

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​jsonpath-plus@​7.2.0 ⏵ 10.2.0	+12	+60

View full report