chore(deps): update dependency joi to v18.2.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
joi	18.2.5 → 18.2.6

---

joi: Quadratic regular-expression backtracking in Joi.string().isoDate()

GHSA-6h2x-m376-mqjq

More information

Details

Impact

Any application that validates a user-supplied string with Joi.string().isoDate() can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart its search from every position in the string, costing time proportional to the square of the input length. 64 KB of digits costs about 1.4 s and 256 KB about 22 s.

Patches

Upgrade to version 17.13.7 or 18.2.6 depending on your current major version.

Workarounds

None except capping the length of the string before it reaches joi.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq
• https://github.com/hapijs/joi/pull/3143
• https://github.com/hapijs/joi/pull/3145
• https://github.com/hapijs/joi/commit/115e7b58d5eaaecc5e9b7093d41899ad6fb053ec
• https://github.com/hapijs/joi/commit/e70df424c367f2976db63b089504413744a21245
• https://github.com/advisories/GHSA-6h2x-m376-mqjq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

hapijs/joi (joi)

v18.2.6

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4e381d4

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR