Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 13 vulnerabilities #10

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 13 vulnerabilities #10

wants to merge 1 commit into from

Conversation

rajis7474
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 Directory Traversal
SNYK-JS-ADMZIP-1065796		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HTTPCACHESEMANTICS-3248783		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASHSET-1320032		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASHTEMPLATE-1088054		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Authorization Bypass Through User-Controlled Key
SNYK-JS-PARSEPATH-2936439		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JS-POSTCSS-5926692		 Yes No Known Exploit
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831		 Yes Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-UNSETVALUE-2400660		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-USERAGENT-174737		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: eslint The new version differs by 68 commits.
  • 80b8d5d 5.5.0
  • b68e403 Build: changelog update for 5.5.0
  • 6e110e6 Fix: camelcase duplicate warning bug (fixes #10801) (#10802)
  • 5103ee7 Docs: Add Brackets integration (#10813)
  • b61d2cd Update: max-params to only highlight function header (#10815)
  • 2b2f11d Upgrade: babel-code-frame to version 7 (#10808)
  • 2824d43 Docs: fix comment placement in a code example (#10799)
  • 10690b7 Upgrade: devdeps and deps to latest (#10622)
  • 80c8598 Docs: gitignore syntax updates (fixes #8139) (#10776)
  • cb946af Chore: use meta.messages in some rules (1/4) (#10764)
  • a857cd9 5.4.0
  • 8dee250 Build: changelog update for 5.4.0
  • a70909f Docs: Add jscs-dev.github.io links (#10771)
  • 034690f Fix: no-invalid-meta crashes for non Object values (fixes #10750) (#10753)
  • 11a462d Docs: Broken jscs.info URLs (fixes #10732) (#10770)
  • 985567d Chore: rm unused dep string.prototype.matchall (#10756)
  • f3d8454 Update: Improve no-extra-parens error message (#10748)
  • 562a03f Fix: consistent-docs-url crashes if meta.docs is empty (fixes #10722) (#10749)
  • 6492233 Chore: enable no-prototype-builtins in codebase (fixes #10660) (#10664)
  • 137140f Chore: use eslintrc overrides (#10677)
  • 2af6f4f 5.3.0
  • 11e70c7 Build: changelog update for 5.3.0
  • dd6cb19 Docs: Updated no-return-await Rule Documentation (fixes #9695) (#10699)
  • 6009239 Chore: rename utils for consistency (#10727)

See the full diff

Package name: karma The new version differs by 36 commits.
  • 1b48637 chore(release): 5.0.0 [skip ci]
  • a5dbe89 Update issue templates (#3460)
  • 1074f38 chore(ci): rely on karma-runnre/integration-tests for saucelabs config (#3462)
  • 4d45cf0 chore(ci): remove more old connection security stuffs (#3459)
  • be76fcc chore(ci): use travis UI for sauce config (#3458)
  • a04a542 chore(ci): remove secure encryption var (#3457)
  • 1eaf35e fix: install semantic-release as a regular dev dependency (#3455)
  • 0647109 docs: Fix simple typo, overriden -> overridden (#3453)
  • ec1e69a fix(server): replace optimist on yargs lib (#3451)
  • ffad7fa refactor(launcher): use class syntax (#3437)
  • 7166ce2 fix(server): detection new MS Edge Chromium (#3440)
  • b8b2ed8 fix(ci): echo travis env that gates release after_success (#3446)
  • 33a069f refactor: use native Promise instead of Bluebird (#3436)
  • 131d154 refactor: drop safe-buffer dependency in favor of native Buffer (#3438)
  • cb1bcbf fix(server): cleanup import of the removed method (#3439)
  • 5c334f5 fix(server): createPreprocessor was removed (#3435)
  • d7128d4 refactor(server): remove PromiseContainer class (#3416)
  • 057d527 feat(docs): document `DEFAULT_LISTEN_ADDR` constant (#3443)
  • a673aa8 ci: drop node 8, adopt node 12 (#3430)
  • 9eb6436 chore(server): Convert PromiseContainer to object and remove (#3401)
  • 0856234 chore(travis): release on node 10 success (#3428)
  • 708ae13 feat(preprocessor): obey Pattern.isBinary when set (#3422)
  • 00d536f chore(test): logLevel debug in proxy test (#3427)
  • da9d8bd chore(docs): delete PULL_REQUEST_TEMPLATE.md

See the full diff

Package name: lerna The new version differs by 250 commits.
  • c567a29 chore(release): v5.1.8
  • f954404 fix: update git-url-parse to v12 (#3231)
  • f74c08c docs: fix typo
  • e4acb28 chore: fix formatting after publish
  • 0e47379 chore(release): v5.1.7
  • ead461e fix(run): add double quotes around script target containing colon (#3218)
  • 041f581 chore: add some version e2e coverage for --conventional-prerelease and --conventional-graduate (#3224)
  • 0eb7f7b docs(website): enable search (#3222)
  • 87278f0 chore: set longer jest timeout for version conventional commits e2e
  • 11c8247 docs: add info about npm automation tokens (#2825)
  • 808132f chore: more e2e coverage for conventional-commits (#3221)
  • 1129224 docs: add configuration guide
  • 54b693d chore: add initial coverage for version --conventional-commits (#3213)
  • 73492e2 chore: share normalization logic in jest serializers (#3212)
  • 93d2501 chore: fix typo in getting-started.md (#3206)
  • 7493610 chore: add some initial e2e coverage for version (#3209)
  • edf59da chore(release): v5.1.6
  • f80d03c fix: lerna run parallel should maximize concurrency with useNx (#3205)
  • a8b4ce4 chore: use ssh-agent 0.5.4 in github actions (#3204)
  • f7bc7a5 chore: tweak fixture insantiation
  • f1c765b chore: add contributors
  • fe4be62 chore: refactor e2e test implementation (#3203)
  • 18b1b54 chore: e2e test structure (#3200)
  • ef1ff4b chore(release): v5.1.5

See the full diff

Package name: stylelint-order The new version differs by 121 commits.
  • 46a1adf 5.0.0
  • cf60f75 Prepare 5.0.0
  • 5a2a9d4 Capitalize Stylelint name
  • b004e65 Merge pull request #150 from hudochenkov/stylelint-v14
  • 94c8847 Remove debugging commands
  • acd5c0f Use latest npm in all Node versions
  • 8337b7e Add debugging commands
  • 957a4ce Rebuild package-lock from scratch in attempt to fix CI
  • 9169c66 Use latest PostCSS
  • cec0a74 Use stylelint released version
  • 50f823f Remove `disableFix` option from rules
  • 6e7330a Compatibility with newer postcss-sorting
  • 4597116 Install PostCSS 8 and Stylelint v14
  • 12dbd81 Explicitly install custom syntaxes
  • 908f93f Upgrade dependencies
  • 2c2d40d Use tabs in package.json
  • 98c82b9 Update CI
  • aa85472 Remove lodash
  • 2a26ae3 Update ESLint config
  • 61ab714 Add note about declaration-empty-line-before (#134)
  • b2d454b Update dependencies
  • 35651ad Use lockfile v2
  • d1c8d91 Fix typo
  • 5d29236 Bump node-notifier from 8.0.0 to 8.0.1

See the full diff

Package name: webpack The new version differs by 250 commits.
  • 610f368 5.0.0
  • 5ce65c1 update examples
  • bbe1230 Merge pull request #11628 from webpack/bugfix/real-content-hash
  • 75ecff2 5.0.0-rc.6
  • bfc35d6 Merge pull request #11603 from MayaWolf/master
  • 76e8cbd Merge pull request #11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
  • 9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
  • 36bcfaa Merge pull request #11621 from webpack/bugfix/11619
  • 9130d10 fix called variables with ProvidePlugin
  • 3e42105 Merge pull request #11620 from webpack/bugfix/11617
  • 4709719 skip connections copied to concatenated module
  • 57b493f 5.0.0-rc.5
  • 1658e2f Merge pull request #11618 from webpack/bugfix/11615
  • a8fb45d fixes crash in SideEffectsFlagPlugin
  • 84b196d emit error instead of crashing when unexpected problem occurs
  • 5573fed Merge pull request #11601 from Hornwitser/improve-suggested-polyfill-config
  • 9b5cce9 Merge pull request #11609 from snitin315/export-types
  • 37c495c export type RuleSetUseItem
  • 39faf34 export type RuleSetUse
  • e5fd246 export type RuleSetConditionAbsolute
  • 660baad export RuleSetCondition types
  • 13e3ca5 Merge pull request #11602 from webpack/bugfix/shared-runtime-chunk
  • 9c0587e Merge pull request #11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
  • 502d166 Merge pull request #11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4

See the full diff

Package name: webpack-cli The new version differs by 250 commits.
  • fb50f76 chore(release): publish new version
  • 2c75aeb chore: new version of the packages
  • 0d05c30 chore(release): publish %s
  • 3f9e151 chore: fix lerna config
  • 2c1e34c tests(generator): enhance init generator tests (#1236)
  • 6ee61b9 Fix loader-generator and plugin-generator tests (#1250)
  • 52956a2 Fixing the typos and grammatical errors in Readme files (#1246)
  • 7faaed2 chore: update Bug_report & Feature_request Templates (#1256)
  • 7a5b33d feat(webpack-cli): added mode argument (#1253)
  • 3715756 tests(webpack-cli): add test case for defaults flag (#1254)
  • a7cba2f chore: project maintanance and typescript fix (#1247)
  • 7748472 chore: ignore package-lock.json and remove its references (#1252)
  • a014aa7 docs: fix supported arguments & commands link in README (#1244)
  • 06129a1 feat(webpack-cli): add progress bar for progress flag (#1238)
  • 6cc6a49 chore: post refactor CLI (#1237)
  • 358651e chore: move cli under lerna package (#1225)
  • 2dc495a fix(init): fix webpack config scaffold (#1231)
  • 1ab62d2 tests(generator): add tests for plugin generator (#1235)
  • d2dd0c1 tests(sourcemap): fix flaky stats statement (#1232)
  • f6dc680 tests(loader-generator): add tests for loader generator (#1234)
  • 35d1381 tests(generator): enable init generator test (#1233)
  • 66cdcb6 chore(generator): remove transpiled tests (#1229)
  • f29a170 fix(init): fix the invalid package name (#1228)
  • 8c3a66d chore(cli): updated changelog of v3 (#1224)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
馃 View latest project report

馃洜 Adjust project settings

馃摎 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

馃 Directory Traversal
馃 Regular Expression Denial of Service (ReDoS)
馃 Prototype Pollution
馃 More lessons are available in Snyk Learn

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@rajis7474 @snyk-bot