New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 4 vulnerabilities #290

Open

wouldgo wants to merge 1 commit into master from snyk-fix-3c069a0abf27d1217db0652f1af033cb

Member

wouldgo commented Nov 30, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	661/1000 Why? Recently disclosed, Has a fix available, CVSS 7.5	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: npm

The new version differs by 250 commits.

30a9844 7.21.0
0b2cd9d update AUTHORS
06461ec docs: changelog for v7.21.0
771a1cb chore(tests): fix snapshots
71cdfd8 [email protected]
94f92de [email protected]
7ac621c [email protected]
218caca [email protected]
ff6626a fix(docs): update npm-publish access flag info
b6f40b5 [email protected]
e9e5ee5 @ npmcli/[email protected]
991a3bd [email protected]
f077724 [email protected]
68a19bb fix(error-message): look for er.path not er.file
ff34d6c feat(cache): initial implementation of ls and rm
8183976 [email protected]
df57f0d @ npmcli/[email protected]
487731c fix(logging): sanitize logged argv
7a58264 chore(ci): check that docs are up to date in ci
22f3bbb chore(docs): add more 'autogenerated' comments
4314490 fix(docs): revert auto-generated portion of docs
32e88c9 fix(did-you-mean): switch levenshtein libraries
59b9851 7.20.6
2591e67 update AUTHORS

See the full diff

Package name: rimraf

The new version differs by 52 commits.

3b6b098 4.0.0
e0cffea ci: reduce workload even more
0e6646d ci: remove unnecessary lint filter
546e017 update action versions
6d88a65 tone down benchmark intensity
842a8d2 fix benchmark workflow yaml
1b91697 chore: add copyright year to license
08bbb06 rewrite in TS, export hybrid, update changelog, docs
1b3f46e drop support for node versions below 14
2e1f003 gh actions workflow for benchmarks
52f9370 tests for retry-busy behavior
188e3ed don't test on very old node versions
d1d5495 test for fix-eperm
e7501cd prettier formatting
40f64ec windows: only fall back to move-remove when absolutely necessary
b6f7819 update tap
99496cd test: run posix test on windows, why not?
51d43c1 benchmarks
6b8aa29 doc: correct os.tmp default
4b228c9 do not ever actually try to rmdir /
2442655 consolidate all the spellings of 'opt' into one
d4eec2e add cli script
0c82d74 accept strings, arrays of strings, and no other types
ad4f2db Do not rimraf /, override with preserveRoot:false

See the full diff

Package name: universal-analytics

The new version differs by 13 commits.

4736a56 Version 0.5
6444683 Merge branch 'lekoaf-feat/inline-request'
eef566e Merge branch 'feat/inline-request' of https://github.com/lekoaf/universal-analytics into lekoaf-feat/inline-request
286a398 Merge pull request Ng table keyboard #134 from adityapatadia/patch-1
d086cea Merge pull request #138 from mantacode/master
1229f36 Merge pull request #154 from johndpope/patch-1
f4ffe5c Merge pull request #165 from AhmadIbrahiim/patch-1
980a576 Update README.md
3f24484 Update README.md
8d14502 feat: Use own version of request library
216b205 Better naming and updated docs
4ae354e Add option to change the name of the visitor instance on request object from the default "req.visitor"
54acd95 added nodejs 10 and 12 in travis tests

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Server-side Request Forgery (SSRF)
🦉 Prototype Pollution


          fix: package.json to reduce vulnerabilities

82baa0f

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet