Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 16 vulnerabilities #33

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 16 vulnerabilities #33

wants to merge 1 commit into from

Conversation

baby636
Copy link
Owner

@baby636 baby636 commented Nov 28, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
⚠️ Warning 
Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
critical severity 679/1000
Why? Has a fix available, CVSS 9.3		 Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962463		 Yes No Known Exploit
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Arbitrary File Write via Archive Extraction (Zip Slip)
SNYK-JS-DECOMPRESSTAR-559095		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
medium severity 484/1000
Why? Has a fix available, CVSS 5.4		 Open Redirect
SNYK-JS-GOT-2932019		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HTMLMINIFIER-3091181		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HTTPCACHESEMANTICS-3248783		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JS-POSTCSS-5926692		 Yes No Known Exploit
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831		 Yes Proof of Concept
medium severity 536/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVERREGEX-1047770		 No Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVERREGEX-1584358		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVERREGEX-1585624		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVERREGEX-2824151		 No Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-TRIMNEWLINES-1298042		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-UNSETVALUE-2400660		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: babel-eslint The new version differs by 103 commits.
  • a0fbd50 8.0.2
  • 2004b91 require correct deps
  • fa56d21 Always use unpad (#535)
  • 295091d Allow ^ version for babel dependencies (#534)
  • d3b8519 fix(package): update babylon to version 7.0.0-beta.31 (#533)
  • 54ab4ac 8.0.1
  • c1a7882 Update README.md support (#531) [skip ci]
  • 51100c9 chore(package): update mocha to version 4.0.0 (#524)
  • 5742b71 Adding optionalCatchBinding to plugins. (#521)
  • 905887c 8.0.0
  • 49493e4 update to beta.0
  • 42d0c5b Remove already fixed workaround (#508)
  • 25bd208 8.0.0-alpha.17
  • 1468905 alpha.17
  • 57c133e 8.0.0-alpha.15
  • 1e41162 update (#504)
  • c31b577 Readme update usage section (#501) [skip ci]
  • c2626f9 Update eslint to the latest version 🚀 (#500)
  • 3c6b2de chore(package): update husky to version 0.14.0 (#498)
  • e052d5a Update install instructions to use latest stable release (#497) [skip ci]
  • 8e3e088 8.0.0-alpha.13
  • f757e22 Merge pull request #493 from danez/regression-test
  • 5736be6 Update babylon
  • 37f9242 Add Prettier (#491)

See the full diff

Package name: browser-sync The new version differs by 53 commits.
  • 52ab250 v2.28.0
  • 019f8ea fix: remove document.write (#2019)
  • 3b0581e browser-sync-2017 use chalk everywhere (#2018)
  • c1db647 v2.27.12
  • 6a8133d build(deps): bump http-cache-semantics from 4.1.0 to 4.1.1 (#2011)
  • 61bfdd9 build(deps): bump cookiejar in /packages/browser-sync (#2006)
  • 9d71626 build(deps): bump cookiejar in /packages/browser-sync-ui (#2005)
  • f5fd00f build(deps): bump parse-url and lerna (#2000)
  • 54d16e4 build(deps): bump minimist in /packages/browser-sync-ui (#1998)
  • 98ae491 build(deps): bump minimist from 1.2.5 to 1.2.7 (#1997)
  • 423d137 build(deps): bump socket.io-parser in /packages/browser-sync-ui (#1996)
  • 9b46af3 build(deps): bump moment in /packages/browser-sync-ui (#1973)
  • 769c4df build(deps): bump ua-parser-js in /packages/browser-sync (#2007)
  • 01caeb3 v2.27.11
  • 74873cc updated deps (#1995)
  • 88527a8 Add CodeSee architecture diagram workflow to repository (#1972)
  • f6965a6 v2.27.10
  • e6c7bed Updated portscanner to 2.2.0 (#1960)
  • 6a587ec fix readme's
  • 91258ae Merge branch 'browser-sync-1946-esbuild'
  • f48d6b4 👋 app veyor
  • 30c24dc Merge pull request #1947
  • 9d24de5 drop webpack from UI
  • 7a00341 build client with esbuild

See the full diff

Package name: eslint The new version differs by 242 commits.
  • 80b8d5d 5.5.0
  • b68e403 Build: changelog update for 5.5.0
  • 6e110e6 Fix: camelcase duplicate warning bug (fixes #10801) (#10802)
  • 5103ee7 Docs: Add Brackets integration (#10813)
  • b61d2cd Update: max-params to only highlight function header (#10815)
  • 2b2f11d Upgrade: babel-code-frame to version 7 (#10808)
  • 2824d43 Docs: fix comment placement in a code example (#10799)
  • 10690b7 Upgrade: devdeps and deps to latest (#10622)
  • 80c8598 Docs: gitignore syntax updates (fixes #8139) (#10776)
  • cb946af Chore: use meta.messages in some rules (1/4) (#10764)
  • a857cd9 5.4.0
  • 8dee250 Build: changelog update for 5.4.0
  • a70909f Docs: Add jscs-dev.github.io links (#10771)
  • 034690f Fix: no-invalid-meta crashes for non Object values (fixes #10750) (#10753)
  • 11a462d Docs: Broken jscs.info URLs (fixes #10732) (#10770)
  • 985567d Chore: rm unused dep string.prototype.matchall (#10756)
  • f3d8454 Update: Improve no-extra-parens error message (#10748)
  • 562a03f Fix: consistent-docs-url crashes if meta.docs is empty (fixes #10722) (#10749)
  • 6492233 Chore: enable no-prototype-builtins in codebase (fixes #10660) (#10664)
  • 137140f Chore: use eslintrc overrides (#10677)
  • 2af6f4f 5.3.0
  • 11e70c7 Build: changelog update for 5.3.0
  • dd6cb19 Docs: Updated no-return-await Rule Documentation (fixes #9695) (#10699)
  • 6009239 Chore: rename utils for consistency (#10727)

See the full diff

Package name: gulp-imagemin The new version differs by 4 commits.
  • 2f7ecc9 8.0.0
  • 1b4baf6 Require Node.js 12.20 and move to ESM
  • ed39463 Move to GitHub Actions (#351)
  • 8b40da0 Update readme lossless note (#346)

See the full diff

Package name: gulp-svg-sprite The new version differs by 38 commits.

See the full diff

Package name: html-loader The new version differs by 55 commits.

See the full diff

Package name: hugo-bin The new version differs by 211 commits.

See the full diff

Package name: stylelint-config-sass-guidelines The new version differs by 48 commits.

See the full diff

Package name: stylelint-order The new version differs by 30 commits.

See the full diff

Package name: webpack The new version differs by 250 commits.
  • 610f368 5.0.0
  • 5ce65c1 update examples
  • bbe1230 Merge pull request #11628 from webpack/bugfix/real-content-hash
  • 75ecff2 5.0.0-rc.6
  • bfc35d6 Merge pull request #11603 from MayaWolf/master
  • 76e8cbd Merge pull request #11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
  • 9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
  • 36bcfaa Merge pull request #11621 from webpack/bugfix/11619
  • 9130d10 fix called variables with ProvidePlugin
  • 3e42105 Merge pull request #11620 from webpack/bugfix/11617
  • 4709719 skip connections copied to concatenated module
  • 57b493f 5.0.0-rc.5
  • 1658e2f Merge pull request #11618 from webpack/bugfix/11615
  • a8fb45d fixes crash in SideEffectsFlagPlugin
  • 84b196d emit error instead of crashing when unexpected problem occurs
  • 5573fed Merge pull request #11601 from Hornwitser/improve-suggested-polyfill-config
  • 9b5cce9 Merge pull request #11609 from snitin315/export-types
  • 37c495c export type RuleSetUseItem
  • 39faf34 export type RuleSetUse
  • e5fd246 export type RuleSetConditionAbsolute
  • 660baad export RuleSetCondition types
  • 13e3ca5 Merge pull request #11602 from webpack/bugfix/shared-runtime-chunk
  • 9c0587e Merge pull request #11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
  • 502d166 Merge pull request #11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4

See the full diff

Package name: webpack-stream The new version differs by 83 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect
🦉 Improper Input Validation
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json to reduce vulnerabilities
6b59088 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962463
- https://snyk.io/vuln/SNYK-JS-DECOMPRESSTAR-559095
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-GOT-2932019
- https://snyk.io/vuln/SNYK-JS-HTMLMINIFIER-3091181
- https://snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
- https://snyk.io/vuln/SNYK-JS-POSTCSS-5926692
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1047770
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1584358
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1585624
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-2824151
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://snyk.io/vuln/SNYK-JS-TRIMNEWLINES-1298042
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@baby636 @snyk-bot