Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 1 vulnerabilities #21

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #21

wants to merge 1 commit into from

Conversation

sitedata
Copy link
Owner

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • deps/npm/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SSRI-1085630		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: cacache The new version differs by 68 commits.
  • f9c677b chore(release): 15.0.0
  • e8afcff chore: ssri 8
  • 81b3fd9 docs: update options info
  • 57d11bc feat: remove figgy-pudding
  • a36bb4b chore: basic project updates
  • 9ab38aa chore(release): 14.0.0
  • 5a66e7a chore(deps): tar v6 and mkdirp v1
  • f96e40d chore: enforce tap 100% coverage
  • 5390048 test: Add to lib/verify.js test coverage
  • fee725d test: Add to lib/entry.index.js test coverage
  • 5488bcb test: Add to get.js test coverage
  • c40323f chore: Remove translation ref from README
  • b45a2bc test: coverage for last few lines of content/write.js
  • 025d585 chore: clean up path.join call for readability
  • 2128770 chore: collapse conditionals in lib/content/rm.js
  • 7bd8620 chore: Removes unnecessary check for error
  • fbbcf93 chore: Removes unnecessary if block
  • 79e3f1c chore: small readability refactor
  • cdb4e48 test: Add lib/content/read.js tests
  • 6a6716a test: verify strange EPERM on Windows handling in move-file
  • 94ea1cf Use explicit block in order to isolate istanbul ignore comment
  • c8d624e Moved ignore line
  • 75c2ba5 test(move-file): Added test to renaming fallback
  • a931c99 chore(release): 13.0.1

See the full diff

Package name: libnpmaccess The new version differs by 28 commits.
  • 9652c2f 4.0.0
  • 3dcfb4f chore: updated CHANGELOG
  • e04c455 chore: removed standard-version as a dep; updated scripts for version/publishing
  • 1732154 fix: pull-request feedback; read full commit message
  • df9cf82 chore: added return types to function docs in README
  • 1f266cb chore: updated README
  • 61398e7 chore: updated test, made case more clear
  • 867137c fix: refactored 'pwrap' function out of code base; use native promises
  • 511f2cf chore: updated package scripts; update CI workflow
  • 4ef719f chore: renamed test/util/ to test/fixture/; tap will ignore now
  • 53b208e chore: linted test file; made tap usage 'better'
  • feb1972 docs: removed opts.Promise from docs; no longer in use
  • da71971 chore: removed travis badge, added github actions badge
  • 113ea98 chore: updated gitignore; includes coverage folder
  • 15a46b8 fix: added default values to params for API functions (with tests)
  • d3d5596 deps: standard-version@7.1.0 (audit fix)
  • 0a596f7 deps: nock@12.0.1 (audit fix)
  • 2d4f909 fix: update return value; add tests
  • c8e7bef deps: npm-registry-fetch@8.0.0
  • 2970999 deps: tap@14.10.6
  • 6ad0662 feat: replace get-stream with minipass
  • df54f9c chore: rename opts.mapJson to opts.mapJSON
  • c4616d9 chore: basic project updates
  • 2894cd2 fix: remove figgy-pudding

See the full diff

Package name: libnpmhook The new version differs by 4 commits.

See the full diff

Package name: libnpmorg The new version differs by 15 commits.
  • 33e705e 2.0.0
  • 38716c0 chore: updated auto publish; removed stanard-version as dep
  • 65ce432 docs: updated CHANGELOG for v2.0.0
  • 5c9643f chore: added files property to package.json
  • 54620fb fix: remove unneed promises; [PR feedback]
  • 36c5330 chore: updated README with GHA badge
  • 4559df9 fix: updated promise return logic; makes code a little easier to grok/read
  • 3aaab1d fix: fixed function return type; added tests to catch a change like this
  • 58081b5 chore: small linting change
  • 8c4ac7f ci: updated GHA workflow; added supporting script to package.json
  • b25d703 chore: basic project updates
  • 79b9c46 fix: remove figgy-pudding
  • d9ca35d chore: remove pr template
  • bb107d0 chore: cleanup badges + contributing
  • 48a8a38 travis: only test on supported node versions

See the full diff

Package name: libnpmsearch The new version differs by 5 commits.

See the full diff

Package name: libnpmteam The new version differs by 28 commits.
  • ad3b0e6 2.0.0
  • ef44cce docs: updated CHNAGELOG for v2.0.0
  • cfbf750 chore: updates package.json scripts; mostly for publishing
  • 68342f8 fix: remove unnecessary promises [PR feedback]
  • 25fd13f ci: update scripts and ci.yml to handle coverage better
  • a3d9380 docs: updated README with publish instructions
  • 938c8a4 feat: removed 'standard-version' dependency; updated publish scripts
  • ea19e24 test: added tests; 100% code coverage ✅💯
  • 9e95457 deps: nock@12.0.1
  • 09f241b chore: updated .gitignore; added coverage/
  • 603fc62 fix: refactored out 'pwrap' function
  • 5e6b41e fix: removed get-streams as a dependency
  • 0c51827 deps: npm-registry-fetch@8.0.0
  • 529f6ed feat: removed figgy-pudding as a dependency
  • 57b0cb8 chore: added engines field in package.json
  • c3f93b8 chore: updates due to dependency changes
  • bf416e2 chore: fixed failing linting; because of dep update
  • 7e5696c deps: standard@14.3.1
  • 1bb38d1 deps: tap@14.10.6
  • 04ce7e8 chore: update author field; standardize into string
  • b27599b deps: removed weall* deps; removed referencing scripts
  • a7b3f59 docs: updated README; removed opts.Promise, will be removing
  • 53c1a58 ci: removed travis and appveyor
  • a8caae6 chore: add GH settings; extend from boilerplate

See the full diff

Package name: npm-registry-fetch The new version differs by 35 commits.
  • 68a2570 chore(release): 7.0.0
  • 5d78c78 chore: ignore coverage folder
  • 57fcc88 chore: update cacache, ssri, make-fetch-happen
  • 152e666 chore: remove extraneous safe-buffer dep
  • 6bccc1a chore: remove extraneous semver dep
  • ede3c08 fix: Remove figgy-pudding, use canonical option names
  • ae7e994 chore(release): 6.0.2
  • 1770f1b chore(doc): document the effect of ?write=true on caching
  • 450447f chore: fix the 'not in ci' config test when in CI
  • 83f89f3 fix: always bypass cache when ?write=true
  • 55d602e chore(release): 6.0.1
  • 50e8afc fix: use 30s default for timeout as per README
  • 42f998a Added missing ci tests
  • 280ad2f chore: cleanup, force 100% test cov
  • d370dba chore(release): 6.0.0
  • 8c6622f chore: make-fetch-happen 7.1.0
  • 5813da6 fix: detect CI so our tests don't fail in CI
  • 3de1695 chore: replace nyc config with tap config
  • e18ed22 chore: bump make-fetch-happen to v7
  • 62f81a2 chore: bump ssri to v7
  • 8ccfa8a fix: Use WhatWG URLs instead of url.parse
  • 510b125 chore: normalize settings, drop old nodes, update deps
  • 622afb4 chore(release): 5.0.1
  • 7aa14fd deps: update all deps

See the full diff

Package name: pacote The new version differs by 124 commits.
  • f156b62 11.0.0
  • 7eabcc4 remove all traces of figgy-pudding
  • ee19d6f Do not mutate the opts arg passed into Fetcher
  • 872a63e 10.3.2
  • 96d364c Never provide the string 'null' as an integrity value
  • aef0f62 10.3.1
  • f119a20 update cacache and other deps to latest
  • 71dd75f tar@6
  • 7d95bdf Upgrade to mkdirp v1
  • e88f844 10.3.0
  • b21dd92 update semver
  • d8ab8cf update npm-packlist
  • 361f0b3 update tap
  • c4bbf23 test: make the remote timeout test time out forever
  • b4ea91f npm-registry-fetch 6.0.0
  • 591edd8 @ npmcli/installed-package-contents@1.0.5
  • 5ce1093 test: make remote timeout test more reliably time out
  • 48fc9b8 use WhatWG URL instead of url.parse
  • e515bce Update deps, float patch for npm-registry-fetch
  • cf50f54 update @ npmcli/installed-package-contents, require node >=10
  • 698e996 Extract: rimraf dir contents, not dir itself
  • e568305 add @ npmcli/installed-package-contents module
  • e8a80d7 upgrade all deps
  • dfccb4f remove extraneous isNaN checking in git opts

See the full diff

Package name: ssri The new version differs by 25 commits.
  • 3eec7a3 chore(release): 8.0.1
  • 2083289 chore: update package-lock and dev dependencies
  • 76e2233 fix: simplify regex for strict mode, add tests
  • 41b764f chore(release): 8.0.0
  • 4062735 fix: harden SRI parsing against ../ funny business
  • a6811cb fix: throw null when sri is empty or bad
  • 1727a7c chore: consistent project setup
  • 4a963e5 fix: IntegrityStream responds to mutating opts object mid-stream
  • 0e78fd7 feat: remove figgy-pudding
  • 79ba4ec chore(release): 7.1.0
  • 0572c1d feat: Add Integrity#merge method
  • 3084efd deps: tap@14.8.2
  • 6545b4b deps: minipass@3.1.1
  • 806e8c8 fix: Do not blow up if the opts object is mutated
  • cea474f chore(release): 7.0.1
  • 3ff8ba8 chore: require node >=8, update minipass
  • 9c76e0c chore(release): 7.0.0
  • 55b055d fix: return super.write() return value
  • d834c8d chore: add code owners to github metadata
  • 6d13165 Use native promises only
  • f7224bc docs: update github repository links
  • 0659cca test: bring up to 100% coverage
  • 2e54956 test: update tap, standard, standard-version, travis
  • 34a7c74 chore(streams): refactor integrityStream fn

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@sitedata @snyk-bot