security issue

security issue in node-webid consuming node-forge <0.10.0

v5.6.3

• uses mashlib 1.6.9 with source-pane update
• issues solved
  -- check of .meta body to text/turtle : to avoid containment triples parsing error
  -- acl-check : allow all rights on same origin, even if same origin is declared as trusted app with less rights

v5.6.2

5.6.2

v5.6.1

This release is the first solid/test-suite compliant as of 27th January 2021
Uses mashlib 1.6.8
Uses rdflib.js 2.1.7 with corrections on parsing of type NamedNode for JSON-LD and RDF/XML

• New : allows folder creation with PUT
• Corrections of bugs :
  -- no content-type errors, except on container creation with PUT
  -- add clearAclCache(url) on Write functions
  -- delete of root and root/.acl are forbidden
  -- container and resource cannot have same name differing with "/"
  -- delete existing file when using PUT with a different content-type
  -- auxiliaryResources can only be created with PUT (.acl, .meta)
  -- delete do not need check acl on parent
  -- pubsub on parent resource is test-suite compliant

v5.6.0

5.6.0

v5.5.6

Includes the ability to add a Solid ID to a contact.

v5.5.5

Contains a hotfix from nodeSolidServer/oidc-auth-manager#58
Version v5.5.4 contained a related hotfix from nodeSolidServer/oidc-rs#10
Note that we expect v5.5.6 soon, which will contain more significant new functionality
from SolidOS/contacts-pane#23 so it's fine to skip this version v5.5.5
and go straight to v5.5.6 when it becomes available.

New Token Compatibility

Version 5.3.0 adds the ability to enable and disable a new auth token.

• A new option, tokenTypesSupported, has been added to config.json. This configures token compatibility for the NSS storage server. It accepts an array of strings that could be either "legacyPop" (old token) or "dpop" (new token). For example tokenTypesSupported: [ "legacyPop", "dpop" ] would mean enable compatibility with both the old and new token on the storage server.
• A new option, token_types_supported, has been added to .db/oidc/op/provider.json. This configures token compatibility for the NSS identity provider server. It accepts an array of strings that could be either "legacyPop" (old token) or "dpop" (new token). For example token_types_supported: [ "legacyPop", "dpop" ] would mean enable compatibility with both the old and new token on the identity provider server.

Security Patch

This patch fixes to flaw described here: #1418

January Bug Fixes

The following release contains fixes for a number of bugs in Node Solid Server:

• Various dependencies have been upgraded to account for security vulnerabilities
• The data-browser has been updated to the latest version (1.2.1)
• New Docker Image
• ReadMe Updates
• Fix for locating an HTML file location: #1388