Repo Added
|
Files
3
|
Badge
Embed ▾
README BADGES
|
drone
Bumps [color-string](https://github.com/Qix-/color-string) from 1.5.3 to 1.6.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Qix-/color-string/releases">color-string's releases</a>.</em></p> <blockquote> <h2>1.6.0</h2> <h1>Minor release 1.6.0</h1> <ul> <li><a href="https://github.com/Qix-/color-string/issues/55">#55</a> - Add support for space-separated HSL</li> </ul> <p>Thanks <a href="https://github.com/htunnicliff"><code>@htunnicliff</code></a> for the contribution :)</p> <h2>1.5.5 (Patch/Security Release) - hwb() ReDos patch (low-severity)</h2> <blockquote> <p>Release notes copied verbatim from the commit message, which can be found here: 0789e2128</p> </blockquote> <pre><code>Discovered by Yeting Li, c/o Colin Ife via Snyk.io. <p>A ReDos (Regular Expression Denial of Service) vulnerability was responsibly disclosed to me via email by Colin on Mar 5 2021 regarding an exponential time complexity for linearly increasing input lengths for <code>hwb()</code> color strings.</p> <p>Strings reaching more than 5000 characters would see several milliseconds of processing time; strings reaching more than 50,000 characters began seeing 1500ms (1.5s) of processing time.</p> <p>The cause was due to a the regular expression that parses hwb() strings - specifically, the hue value - where the integer portion of the hue value used a 0-or-more quantifier shortly thereafter followed by a 1-or-more quantifier.</p> <p>This caused excessive backtracking and a cartesian scan, resulting in exponential time complexity given a linear increase in input length.</p> <p>Thank you Yeting Li and Colin Ife for bringing this to my attention in a secure, responsible and professional manner.</p> <p>A CVE will not be assigned for this vulnerability. </code></pre></p> <h2>1.5.4 (Patch Release)</h2> <ul> <li>Removes rounding of alpha values in RGBA hex (<code>#rrggbbaa</code>) and condensed-hex (<code>#rgba</code>) parsers,
35 of 38 branches covered (92.11%)
Branch coverage included in aggregate %.
54 of 56 relevant lines covered (96.43%)
36.38 hits per line
Coverage | ∆ | File | Lines | Relevant | Covered | Missed | Hits/Line | Branch Hits | Branch Misses |
---|