🚨 [security] Update joi 17.6.0 → 18.2.1 (major)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this upgrade. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ joi (17.6.0 → 18.2.1) · Repo · Changelog

Security Advisories 🚨

🚨 joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

Impact

Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.

The blast radius depends on how the application invokes joi:

• Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process.
• Lower impact: validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling.

Patches

Upgrade to version >= 18.2.1.

Workarounds

Try/catch the validation to avoid uncaught exceptions.

Resources

• Pull request: #3113

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ @​hapi/hoek (indirect, 9.3.0 → 11.0.7) · Repo · Changelog

Release Notes

11.0.4

What's Changed

• fix: provide reference to TS types for export map by @AndriiNyzhnyk in #389

New Contributors

• @AndriiNyzhnyk made their first contribution in #389

Full Changelog: v11.0.3...v11.0.4

11.0.3

What's Changed

• Support the URL type by @kanongil in #392

Full Changelog: v11.0.2...v11.0.3

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 25 commits:

• 11.0.7
• Fix cloning Util.inherit() subclassed errors. Backports #401
• 11.0.6
• Fix Error clone() when structuredClone uses bad prototype
• 11.0.5
• fix: missing stack starting from node 21+
• chore: pin eslint-plugin
• Fix default values for `merge.Options` interface
• 11.0.4
• fix: provide reference to TS types for export map (#389)
• 11.0.3
• Support the URL type (#392)
• 11.0.2
• chore: add individual module types
• 11.0.1
• Explicitly export methods
• 11.0.0
• Refactor AssertError (#382)
• 10.0.1
• Updates assert() type to declare condition to be true (#383)
• Fix version range (#379)
• Fix license years for Sideway versus contributors (#378)
• 10.0.0
• Remove CI reference to v10 branch
• Merge remote-tracking branch 'origin/v10'

↗️ @​hapi/topo (indirect, 5.1.0 → 6.0.2) · Repo

Commits

See the full diff on Github. The new version differs by 10 commits:

• 6.0.2
• chore: use standard require instead of exports (#71)
• 6.0.1
• chore: bump hoek (#70)
• 6.0.0
• Remove CI reference to v6 branch
• Support node v18 and drop node v12 (#69)
• Add @types/node to dev deps
• add dispatcher and use shared config
• add IDE linting

🆕 @​hapi/address (added, 5.1.1)

🆕 @​hapi/formula (added, 3.0.2)

🆕 @​hapi/pinpoint (added, 2.0.1)

🆕 @​hapi/tlds (added, 1.1.7)

🆕 @​standard-schema/spec (added, 1.1.0)

🗑️ @​sideway/address (removed)

🗑️ @​sideway/formula (removed)

🗑️ @​sideway/pinpoint (removed)

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)