Osd-react-renderer - A custom React renderer for OpenSeadragon

Last update: Jan 24, 2022

`osd-react-renderer`

A custom React renderer for OpenSeadragon viewer, built using react-reconciler package.

Install

npm

$ npm install @lunit/osd-react-renderer

yarn

$ yarn add @lunit/osd-react-renderer

GitHub

https://github.com/lunit-io/osd-react-renderer

Comments

1. feat(renderer): add mouse tracker component
📝 Description

implement mouseTracker component

✔️ PR Type

What kind of change does this PR introduce?

[ ] Bugfix

[x] Feature

[ ] Code style update (formatting, local variables)

[ ] Refactoring (no functional changes, no api changes)

[ ] Chore (non-breaking change which does not affect codebase; Build related changes, version modification, etc.)

[ ] CI related changes

[ ] Test Case

[ ] Performance optimization

[ ] Site/documentation update

[ ] Other... Please describe:

🎯 Current behavior

Please describe the current behavior that you are modifying, or link to a relevant issue.

Issue Number: N/A

🚀 New behavior

Please describe the behavior or changes this PR adds.

💣 Is this a breaking change?

[ ] Yes

[x] No

If this PR contains a breaking change, please describe the impact and migration path for existing applications below.
Reviewed by lunit-msseo at 2022-05-15 14:32
2. chore(deps): bump node-forge from 1.2.0 to 1.3.0
Bumps node-forge from 1.2.0 to 1.3.0.

Changelog

Sourced from node-forge's changelog.

1.3.0 - 2022-03-17

Security

Three RSA PKCS#1 v1.5 signature verification issues were reported by Moosa Yahyazadeh ([email protected]).

HIGH: Leniency in checking digestAlgorithm structure can lead to signature forgery.

The code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. For more information, please see "Bleichenbacher's RSA signature forgery based on implementation error" by Hal Finney.

CVE ID: CVE-2022-24771

GHSA ID: GHSA-cfm4-qjh2-4765

HIGH: Failing to check tailing garbage bytes can lead to signature forgery.

The code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. For more information, please see "Bleichenbacher's RSA signature forgery based on implementation error" by Hal Finney.

CVE ID: CVE-2022-24772

GHSA ID: GHSA-x4jg-mjrx-434g

MEDIUM: Leniency in checking type octet.

DigestInfo is not properly checked for proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.

CVE ID: CVE-2022-24773

GHSA ID: GHSA-2r2c-g63r-vccr

Fixed

[asn1] Add fallback to pretty print invalid UTF8 data.

[asn1] fromDer is now more strict and will default to ensuring all input bytes are parsed or throw an error. A new option parseAllBytes can disable this behavior.

NOTE: The previous behavior is being changed since it can lead to security issues with crafted inputs. It is possible that code doing custom DER parsing may need to adapt to this new behavior and optional flag.

[rsa] Add and use a validator to check for proper structure of parsed ASN.1 RSASSA-PKCS-v1_5 DigestInfo data. Additionally check that the hash algorithm identifier is a known value from RFC 8017 PKCS1-v1-5DigestAlgorithms. An invalid DigestInfo or algorithm identifier will now throw an error.

NOTE: The previous lenient behavior is being changed to be more strict since it could lead to security issues with crafted inputs. It is possible that code may have to handle the errors from these stricter checks.

... (truncated)

Commits

6c5b901 Release 1.3.0.

0f3972a Update changelog.

dc77b39 Fix error checking.

bb822c0 Add advisory links.

d4395fe Update changelog.

a4405bb Improve signature verification tests.

aa9372d Add missing RFC 8017 algorithm identifiers.

3f0b49a Fix signature verification issues.

c20f309 Adjust remaining length.

e27f612 Remove unused option.

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.
Reviewed by dependabot[bot] at 2022-03-25 21:42
3. chore(deps): bump url-parse from 1.5.4 to 1.5.7
Bumps url-parse from 1.5.4 to 1.5.7.

Commits

8b3f5f2 1.5.7

ef45a13 [fix] Readd the empty userinfo to url.href (#226)

88df234 [doc] Add soft deprecation notice

78e9f2f [security] Fix nits

e6fa434 [security] Add credits for incorrect handling of userinfo vulnerability

4c9fa23 1.5.6

7b0b8a6 Merge pull request #223 from unshiftio/fix/at-sign-handling-in-userinfo

e4a5807 1.5.5

193b44b [minor] Simplify whitespace regex

319851b [fix] Remove CR, HT, and LF

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.
Reviewed by dependabot[bot] at 2022-02-19 14:52
4. chore(deps): bump nanoid from 3.1.30 to 3.2.0
Bumps nanoid from 3.1.30 to 3.2.0.

Changelog

Sourced from nanoid's changelog.

Change Log

This project adheres to Semantic Versioning.

3.2

Added --size and --alphabet arguments to binary (by Vitaly Baev).

3.1.32

Reduced async exports size (by Artyom Arutyunyan).

Moved from Jest to uvu (by Vitaly Baev).

3.1.31

Fixed collision vulnerability on object in size (by Artyom Arutyunyan).

Commits

23b1369 Release 3.2 version

967788e Remove TS test tools

27eaa90 Simplify new binary tool

a9d9123 Update dependencies

32b9bda Allows passing size or custom alphabet via cli as args (#334)

246d5f8 Update vite

afdf9c9 doc: Fixed Typo (#335)

90a446f Update benchmark results

8ba2319 bench: add @napi-rs/uuid v4 (#333)

f425778 Release 3.1.32 version

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.
Reviewed by dependabot[bot] at 2022-01-22 11:59
5. Feature/osd migration v3
📝 Description

Update and migrate OpenSeadragon version v.2.4.2 to v.3.1.0 Add viewer-demo-v2 app Add target element selector prop on MouseTracker

✔️ PR Type

What kind of change does this PR introduce?

[ ] Bugfix

[X] Feature

[ ] Code style update (formatting, local variables)

[ ] Refactoring (no functional changes, no api changes)

[X] Chore (non-breaking change which does not affect codebase; Build related changes, version modification, etc.)

[ ] CI related changes

[ ] Test Case

[ ] Performance optimization

[ ] Site/documentation update

[ ] Other... Please describe:

🚀 New behavior

Issue Number: OFET-9, OFET-26

💣 Is this a breaking change?

[X] Yes

[ ] No
Reviewed by hyunjin-lunit at 2022-07-12 05:58
6. feat(renderer): change event type
📝 Description

Add a brief description

✔️ PR Type

What kind of change does this PR introduce?

[ ] Bugfix

[ ] Feature

[ ] Code style update (formatting, local variables)

[ ] Refactoring (no functional changes, no api changes)

[ ] Chore (non-breaking change which does not affect codebase; Build related changes, version modification, etc.)

[ ] CI related changes

[ ] Test Case

[ ] Performance optimization

[ ] Site/documentation update

[ ] Other... Please describe:

🎯 Current behavior

Please describe the current behavior that you are modifying, or link to a relevant issue.

Issue Number: N/A

🚀 New behavior

Please describe the behavior or changes this PR adds.

💣 Is this a breaking change?

[ ] Yes

[ ] No

If this PR contains a breaking change, please describe the impact and migration path for existing applications below.
Reviewed by lunit-msseo at 2022-05-16 10:56
7. Feature/dzi retry loading
📝 Description

added retry logic during dzi metadata loading process

✔️ PR Type

What kind of change does this PR introduce?

[ ] Bugfix

[x] Feature

[ ] Code style update (formatting, local variables)

[ ] Refactoring (no functional changes, no api changes)

[ ] Chore (non-breaking change which does not affect codebase; Build related changes, version modification, etc.)

[ ] CI related changes

[ ] Test Case

[ ] Performance optimization

[ ] Site/documentation update

[ ] Other... Please describe:

🎯 Current behavior

Please describe the current behavior that you are modifying, or link to a relevant issue.

Issue Number: N/A

🚀 New behavior

Please describe the behavior or changes this PR adds.

💣 Is this a breaking change?

[ ] Yes

[x] No

If this PR contains a breaking change, please describe the impact and migration path for existing applications below.
Reviewed by lunit-msseo at 2022-04-28 14:46
8. feat(renderer): add TiledImage open failure handler
📝 Description

added 'onOpenTiledImageFailed' to TiledImage component

There wasn't any error handling logic in TiledImage component, So any error that is thrown during image loading process(e.g. fetch error of loading dzi metadata process) could cause unexpected unmounting behavior.

✔️ PR Type

What kind of change does this PR introduce?

[x] Bugfix

[x] Feature

[ ] Code style update (formatting, local variables)

[ ] Refactoring (no functional changes, no api changes)

[ ] Chore (non-breaking change which does not affect codebase; Build related changes, version modification, etc.)

[ ] CI related changes

[ ] Test Case

[ ] Performance optimization

[ ] Site/documentation update

[ ] Other... Please describe:

🎯 Current behavior

Please describe the current behavior that you are modifying, or link to a relevant issue.

Issue Number: N/A

🚀 New behavior

If onOpenTiledImageFailed exists in props, it throw error to the handler, otherwise it just throws as before.

💣 Is this a breaking change?

[ ] Yes

[x] No

If this PR contains a breaking change, please describe the impact and migration path for existing applications below.
Reviewed by lunit-msseo at 2022-04-20 13:22
9. Feature/osdviewer types
📝 Description

Moved react, react-dom, openseadragon packages from dependencies to devDependencies Changed to optional type options type in OSDViewer Changed to accept props other than 'children' and 'options'

✔️ PR Type

What kind of change does this PR introduce?

[ ] Bugfix

[ ] Feature

[ ] Code style update (formatting, local variables)

[ ] Refactoring (no functional changes, no api changes)

[X] Chore (non-breaking change which does not affect codebase; Build related changes, version modification, etc.)

[ ] CI related changes

[ ] Test Case

[ ] Performance optimization

[ ] Site/documentation update

[ ] Other... Please describe:

🎯 Current behavior

Please describe the current behavior that you are modifying, or link to a relevant issue.

Issue Number: N/A

🚀 New behavior

Please describe the behavior or changes this PR adds.

💣 Is this a breaking change?

[ ] Yes

[X] No

If this PR contains a breaking change, please describe the impact and migration path for existing applications below.
Reviewed by hyunjin-lunit at 2022-01-24 04:21
10. chore(release): publish release
@lunit/[email protected]

📝 Description

Testing publish from new repo

✔️ PR Type

What kind of change does this PR introduce?

[ ] Bugfix

[ ] Feature

[ ] Code style update (formatting, local variables)

[ ] Refactoring (no functional changes, no api changes)

[x] Chore (non-breaking change which does not affect codebase; Build related changes, version modification, etc.)

[ ] CI related changes

[ ] Test Case

[ ] Performance optimization

[ ] Site/documentation update

[ ] Other... Please describe:
Reviewed by tchung1118 at 2022-01-11 07:40
11. chore(deps): bump terser from 4.8.0 to 4.8.1
Bumps terser from 4.8.0 to 4.8.1.

Changelog

Sourced from terser's changelog.

v4.8.1 (backport)

Security fix for RegExps that should not be evaluated (regexp DDOS)

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.
Reviewed by dependabot[bot] at 2022-07-20 15:57
12. chore(deps): bump parse-url from 6.0.0 to 6.0.2
Bumps parse-url from 6.0.0 to 6.0.2.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.
Reviewed by dependabot[bot] at 2022-07-06 01:45
13. chore(deps): bump eventsource from 1.1.0 to 1.1.1
Bumps eventsource from 1.1.0 to 1.1.1.

Changelog

Sourced from eventsource's changelog.

1.1.1

Do not include authorization and cookie headers on redirect to different origin (#273 Espen Hovlandsdal)

Commits

aa7a408 1.1.1

56d489e chore: rebuild polyfill

4a951e5 docs: update history for 1.1.1

f9f6416 fix: strip sensitive headers on redirect to different origin

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.
Reviewed by dependabot[bot] at 2022-06-01 22:28
14. chore(deps): bump nanoid from 3.1.30 to 3.3.4
Bumps nanoid from 3.1.30 to 3.3.4.

Changelog

Sourced from nanoid's changelog.

3.3.4

Fixed --help in CLI (by @Lete114).

3.3.3

Reduced size (by Anton Khlynovskiy).

3.3.2

Fixed enhanced-resolve support.

3.3.1

Reduced package size.

3.3

Added size argument to function from customAlphabet (by Stefan Sundin).

3.2

Added --size and --alphabet arguments to binary (by Vitaly Baev).

3.1.32

Reduced async exports size (by Artyom Arutyunyan).

Moved from Jest to uvu (by Vitaly Baev).

3.1.31

Fixed collision vulnerability on object in size (by Artyom Arutyunyan).

Commits

fc5bd0d Release 3.3.4 version

5ae2628 Update dependencies

2f48e9c Try to fix CI

85991e3 fix: CLI help examples (#361)

89d994c Update dependencies

00547e7 Fix benchmark order

a8f4099 bench: add back @napi-rs/uuid (#360)

acd897f Added postgres extension to various README files (#359)

772a613 Update CI and dependencies

e7aeb0f Added zig-nanoid to readme. (#357)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.
Reviewed by dependabot[bot] at 2022-05-17 17:46
15. chore(deps): bump node-forge from 1.2.0 to 1.3.1
Bumps node-forge from 1.2.0 to 1.3.1.

Changelog

Sourced from node-forge's changelog.

1.3.1 - 2022-03-29

Fixes

RFC 3447 and RFC 8017 allow for optional DigestAlgorithm NULL parameters for sha* algorithms and require NULL paramters for md2 and md5 algorithms.

1.3.0 - 2022-03-17

Security

Three RSA PKCS#1 v1.5 signature verification issues were reported by Moosa Yahyazadeh ([email protected]).

HIGH: Leniency in checking digestAlgorithm structure can lead to signature forgery.

The code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. For more information, please see "Bleichenbacher's RSA signature forgery based on implementation error" by Hal Finney.

CVE ID: CVE-2022-24771

GHSA ID: GHSA-cfm4-qjh2-4765

HIGH: Failing to check tailing garbage bytes can lead to signature forgery.

The code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. For more information, please see "Bleichenbacher's RSA signature forgery based on implementation error" by Hal Finney.

CVE ID: CVE-2022-24772

GHSA ID: GHSA-x4jg-mjrx-434g

MEDIUM: Leniency in checking type octet.

DigestInfo is not properly checked for proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.

CVE ID: CVE-2022-24773

GHSA ID: GHSA-2r2c-g63r-vccr

Fixed

[asn1] Add fallback to pretty print invalid UTF8 data.

[asn1] fromDer is now more strict and will default to ensuring all input bytes are parsed or throw an error. A new option parseAllBytes can disable this behavior.

NOTE: The previous behavior is being changed since it can lead to security issues with crafted inputs. It is possible that code doing custom DER parsing may need to adapt to this new behavior and optional flag.

[rsa] Add and use a validator to check for proper structure of parsed ASN.1

... (truncated)

Commits

a0a4a42 Release 1.3.1.

a33830f Update changelog.

740954d Allow optional DigestAlgorithm parameters.

56f4316 Allow DigestInfo.DigestAlgorith.parameters to be optional

cbf0bd5 Start 1.3.1-0.

6c5b901 Release 1.3.0.

0f3972a Update changelog.

dc77b39 Fix error checking.

bb822c0 Add advisory links.

d4395fe Update changelog.

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.
Reviewed by dependabot[bot] at 2022-05-17 17:46

Osd-react-renderer - A custom React renderer for OpenSeadragon

osd-react-renderer

Install

npm

yarn

GitHub

Comments

1. feat(renderer): add mouse tracker component

📝 Description

✔️ PR Type

🎯 Current behavior

🚀 New behavior

💣 Is this a breaking change?

2. chore(deps): bump node-forge from 1.2.0 to 1.3.0

1.3.0 - 2022-03-17

Security

Fixed

3. chore(deps): bump url-parse from 1.5.4 to 1.5.7

4. chore(deps): bump nanoid from 3.1.30 to 3.2.0

Change Log

3.2

3.1.32

3.1.31

5. Feature/osd migration v3

📝 Description

✔️ PR Type

🚀 New behavior

💣 Is this a breaking change?

6. feat(renderer): change event type

📝 Description

✔️ PR Type

🎯 Current behavior

🚀 New behavior

💣 Is this a breaking change?

7. Feature/dzi retry loading

📝 Description

✔️ PR Type

🎯 Current behavior

🚀 New behavior

💣 Is this a breaking change?

8. feat(renderer): add TiledImage open failure handler

📝 Description

✔️ PR Type

🎯 Current behavior

🚀 New behavior

💣 Is this a breaking change?

9. Feature/osdviewer types

📝 Description

✔️ PR Type

🎯 Current behavior

🚀 New behavior

💣 Is this a breaking change?

10. chore(release): publish release

📝 Description

✔️ PR Type

11. chore(deps): bump terser from 4.8.0 to 4.8.1

v4.8.1 (backport)

12. chore(deps): bump parse-url from 6.0.0 to 6.0.2

13. chore(deps): bump eventsource from 1.1.0 to 1.1.1

1.1.1

14. chore(deps): bump nanoid from 3.1.30 to 3.3.4

3.3.4

3.3.3

3.3.2

3.3.1

3.3

3.2

3.1.32

3.1.31

15. chore(deps): bump node-forge from 1.2.0 to 1.3.1

1.3.1 - 2022-03-29

Fixes

1.3.0 - 2022-03-17

Security

Fixed

Related tags

A custom Slack renderer for React! 3

React JSX Renderer is a React Component for rendering JSX to React nodes.

🇨🇭 A React renderer for Three.js (web and react-native)

🇨🇭 A React renderer for Three.js (web and react-native)

`osd-react-renderer`