CVE-2021-43861

Advisory

Dash-extensions 0.1.1 updates its NPM dependency 'mermaid' to v9.0.1 to include a security fix.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Added

- Added `CycleBreaker` component, strategy contributed by TomaszRewak
- Added `CycleBreakerTransform` transform

Changed

- Add [location path name in `WebSocket` component default url](https://github.com/thedirtyfew/dash-extensions/pull/91) by 0x0ACB
- Improve `BlockingCallbackTransform` adding a [final callback invocation blocking ends](https://github.com/thedirtyfew/dash-extensions/pull/169) by TomaszRewak
- Bug when a single output of list type was used with `LogTransform` and `BlockingCallbackTransform` fixed by TomaszRewak
- Bug where an attempt was made to write to read-only properties in `hijack` utility function fixed by RafaelWO
- Remap of callback bindings in `DashProxy` post init to enable callback registration via the `before_first_request` hook (need for compatibility with the latest `pages` implementation)
- Updated various dependencies to address security vulnerabilities

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43861