chore(deps): update dependency joi to v18.2.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
joi	18.2.5 → 18.2.6

---

joi: Quadratic regular-expression backtracking in Joi.string().isoDate()

GHSA-6h2x-m376-mqjq

More information

Details

Impact

Any application that validates a user-supplied string with Joi.string().isoDate() can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart its search from every position in the string, costing time proportional to the square of the input length. 64 KB of digits costs about 1.4 s and 256 KB about 22 s.

Patches

Upgrade to version 17.13.7 or 18.2.6 depending on your current major version.

Workarounds

None except capping the length of the string before it reaches joi.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq
• https://github.com/hapijs/joi/pull/3143
• https://github.com/hapijs/joi/pull/3145
• https://github.com/hapijs/joi/commit/115e7b58d5eaaecc5e9b7093d41899ad6fb053ec
• https://github.com/hapijs/joi/commit/e70df424c367f2976db63b089504413744a21245
• https://github.com/advisories/GHSA-6h2x-m376-mqjq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

hapijs/joi (joi)

v18.2.6

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.