Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 22 vulnerabilities #1

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 22 vulnerabilities #1

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Prototype Pollution
SNYK-JS-AJV-584908		 Yes No Known Exploit
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ISMOBILEJS-72624		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ISSVG-1085627		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ISSVG-1243891		 Yes Proof of Concept
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service (DoS)
SNYK-JS-JSYAML-173999		 Yes No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Arbitrary Code Execution
SNYK-JS-JSYAML-174129		 Yes No Known Exploit
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOCHA-561476		 Yes No Known Exploit
medium severity 520/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service
SNYK-JS-NODEFETCH-674311		 Yes No Known Exploit
critical severity 704/1000
Why? Has a fix available, CVSS 9.8		 Arbitrary Code Injection
SNYK-JS-OPEN-174041		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1255640		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Information Exposure
SNYK-JS-WEBPACKDEVSERVER-72405		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:braces:20180219		 Yes Proof of Concept
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 Yes No Known Exploit
high severity 676/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.1		 Regular Expression Denial of Service (ReDoS)
npm:diff:20180305		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:eslint:20180222		 Yes Proof of Concept
critical severity 704/1000
Why? Has a fix available, CVSS 9.8		 Arbitrary Code Injection
npm:growl:20160721		 Yes No Known Exploit
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:hoek:20180212		 Yes Proof of Concept
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:mime:20170907		 No No Known Exploit
high severity 741/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.4		 Arbitrary Command Injection
npm:open:20180512		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: css-loader The new version differs by 80 commits.

See the full diff

Package name: eslint The new version differs by 250 commits.
  • b7d79b1 7.3.0
  • bf98627 Build: changelog update for 7.3.0
  • 638a6d6 Update: add missing `additionalProperties: false` to some rules' schema (#13198)
  • 949a5cd Update: fix operator-linebreak overrides schema (#13199)
  • 9e1414e New: Add no-promise-executor-return rule (fixes #12640) (#12648)
  • 09cc0a2 Update: max-lines reporting loc improvement (refs #12334) (#13318)
  • ee2fc2e Update: object-property-newline end location (refs #12334) (#13399)
  • d98152a Update: added empty error array check for false negative (#13200)
  • 7fb45cf Fix: clone config before validating (fixes #12592) (#13034)
  • aed46f6 Sponsors: Sync README with website
  • 7686d7f Update: semi-spacing should check do-while statements (#13358)
  • cbd0d00 Update: disallow multiple options in comma-dangle schema (fixes #13165) (#13166)
  • b550330 New: Add no-unreachable-loop rule (fixes #12381) (#12660)
  • 13999d2 Update: curly should check consequent `if` statements (#12947)
  • c42e548 Chore: enable exceptRange option in the yoda rule (#12857)
  • 6cfbd03 Update: Drop @ typescript-eslint/eslint-recommended from `eslint --init` (#13340)
  • 796f269 Chore: update eslint-config-eslint's required node version (#13379)
  • 9d0186e Docs: Fix changelog versions (#13410)
  • 1ee3c42 Docs: On maxEOF with eol-last (fixes #12742) (#13374)
  • 2a21049 Update: key-spacing loc changes for extra space (refs #12334) (#13362)
  • 7ce7988 Chore: Replace the inquirer dependency with enquirer (#13254)
  • 0f1f5ed Docs: Add security policy link to README (#13403)
  • 9e9ba89 Sponsors: Sync README with website
  • ca59fb9 Sponsors: Sync README with website

See the full diff

Package name: husky The new version differs by 11 commits.

See the full diff

Package name: ismobilejs The new version differs by 4 commits.

See the full diff

Package name: isomorphic-fetch The new version differs by 12 commits.

See the full diff

Package name: less The new version differs by 127 commits.
  • b873737 Merge pull request #3177 from Kartoffelsalat/master
  • bd2a93f chore(package): update request to 2.83.0
  • 3699921 Merge pull request #3170 from thorn0/patch-1
  • 6985541 Having `inline` and `less` imports of the same name lead to a race condition
  • 2f1386f Merge pull request #3168 from matthew-dean/master
  • 4272871 Fixes #3116 - lessc not loading plugins in 3.0
  • ba5ad9c Point badges at master branch
  • 4962988 Update CHANGELOG.md
  • 12fe0c6 Update README.md
  • 45d06b9 Merge pull request #3163 from matthew-dean/master
  • 9590b7b Add dist files
  • 0b6536b Merge branch '3.x'
  • a48c24c calc() fix - fixes #974 (partially #1880)
  • 367b46a Merge pull request #3161 from matthew-dean/3.x
  • 4508495 Remove legacy upgrade
  • 2a4a63a Update CHANGELOG.md with 3.x list
  • bb6da28 Update README.md
  • f80a021 Merge pull request #3159 from matthew-dean/3.x
  • 8b4524f Bump to 3.0.0-RC.1
  • d30e3a6 Merge pull request #3150 from anthony-redFox/3.x
  • 0b7c81c Removed install npm 2 version for appveyor. It was hotfix for old node version.
  • 5d230dd Drop node 0.10 and 0.12 and added node 9 matrix testing
  • 385da8f Update stale.yml
  • d384779 Create stale.yml

See the full diff

Package name: lint-staged The new version differs by 250 commits.
  • 885a644 Merge pull request Bump terser from 4.6.7 to 4.8.1 moroshko/react-autosuggest#852 from okonet/listr2
  • aba3421 fix: all lint-staged output respects the `quiet` option
  • b8df31a fix: do not show incorrect error when verbose and no output
  • eed6198 style: simplify eslint and prettier config
  • b746290 ci: replace Node.js 13 with 14, since 14 will be next LTS
  • 2c6f3ad docs: improve `verbose` description
  • e749a0b test: remove redundant, misbehaving test
  • 16848d8 fix: use test renderer during tests and when TERM=dumb
  • efffa22 test: cover `--verbose` option usage
  • 1b18550 test: restore variable in test output
  • 6aede38 test: add test for error during merge state restoration
  • b565481 test: integration test targets the full Node.js API instead of just `runAll`
  • a3bd9d7 feat: allow specifying `cwd` using the Node.js API
  • 85de3a3 feat: add `--verbose` to show output even when tasks succeed
  • d69c65b fix: log task output after running listr to keep everything
  • e95d1b0 refactor: move skip and enable cheks of listr tasks to separate file
  • 6da7667 refactor: move messages to separate file
  • 6392480 refactor: use symbols for errors
  • 8f32a3e feat: replace listr with listr2 and print errors inline
  • c9adca5 fix: use stash create/store to prevent files from disappearing from disk
  • e093b1d fix(deps): update dependencies
  • 6066b07 fix: pass correct path to unstaged patch during cleanup
  • 0bf1fb0 fix: allow lint-staged to run on empty git repo by disabling backup
  • 1ac6863 Merge pull request Bump follow-redirects from 1.11.0 to 1.14.7 moroshko/react-autosuggest#837 from okonet/serial-git-add

See the full diff

Package name: mocha The new version differs by 250 commits.
  • eb781e2 Release v6.2.3
  • 10dbe94 update CHANGELOG for v6.2.3 [ci skip]
  • 848d6fb security: update mkdirp, yargs, yargs-parser
  • 843a322 6.2.2
  • aec8b02 update CHANGELOG for v6.2.2 [ci skip]
  • 7a8b95a npm audit fixes
  • cebddf2 Improve reporter documentation for mocha in browser. (#4026)
  • 3f7b987 uncaughtException: report more than one exception per test (#4033)
  • ee82d38 modify alt text of image from Backers to Sponsors inside Sponsors section in Readme (#4046)
  • e9c036c special-case parsing of "require" in unparseNodeArgs(); closes #4035 (#4063)
  • 954cf0b Fix HTMLCollection iteration to make unhide function work as expected (#4051)
  • 816dc27 uncaughtException: fix double EVENT_RUN_END events (#4025)
  • 9650d3f add OpenJS Foundation logo to website (#4008)
  • f04b81d Adopt the OpenJSF Code of Conduct (#3971)
  • aca8895 Add link checking to docs build step (#3972)
  • ef6c820 Release v6.2.1
  • 9524978 updated CHANGELOG for v6.2.1 [ci skip]
  • dfdb8b3 Update yargs to v13.3.0 (#3986)
  • 18ad1c1 treat '--require esm' as Node option (#3983)
  • fcffd5a Update yargs-unparser to v1.6.0 (#3984)
  • ad4860e Remove extraGlobals() (#3970)
  • b269ad0 Clarify effect of .skip() (#3947)
  • 1e6cf3b Add Matomo to website (#3765)
  • 91b3a54 fix style on mochajs.org (#3886)

See the full diff

Package name: nyc The new version differs by 109 commits.

See the full diff

Package name: postcss-loader The new version differs by 143 commits.

See the full diff

Package name: style-loader The new version differs by 22 commits.

See the full diff

Package name: svgo The new version differs by 156 commits.
  • e7bdce6 v1.1.0
  • 37d4ca8 Fix cleanupListOfValues to preserve non-numeric values
  • eeeb67d Fix convertTransform wrong rotate sign
  • 7a07b84 Fix collapseGroups plugin affecting switch and subgroups
  • 5800635 Fix converting to large arcs from nearly straight lines curves
  • a4fb3a4 Prevent removeUnknownsAndDefaults removing attributes from elements with id
  • 831f95f Fix empty path segments removing with stroke-linecap
  • a165206 Update presentation attribute collection for removeNonInheritableGroupAttrs plugin
  • 36db31a Fix removeNonInheritableGroupAttrs not working as intended
  • f3bcbcc Fix viewBox value parsing
  • 3c82fd7 Correct parsing of arc flags without following comma/spaces
  • 86ecd37 Handle !important keyword in convertStyleToAttrs
  • 72fa7d3 Sync readme and tty help
  • 32e9e41 Update css-select to version 2
  • aa99c6f Update js-yaml to version 3.12
  • 7fd5bde Add rollup-plugin-svgo to list of usage
  • 8a43a5c adds jshint to devDependencies
  • f92629f Add keepRoleAttr option for removeUnknownsAndDefaults (#1002)
  • 62f67de Return the path, so it can be used to overwrite the file with the optimized version
  • b2b9acb tweak: do not collapse group properties to children if they contain filters.
  • 3e2fd44 feat: offer ES module interop default export (#934)
  • e7b8a6c Upgrade css-tree from alpha25 to alpha.28
  • e928c1f Update convertPathData.js (#906)
  • 50f4fed dont transform stroke width for non-scaling-strokes (Bump express from 4.17.1 to 4.18.2 moroshko/react-autosuggest#857)

See the full diff

Package name: url-loader The new version differs by 8 commits.

See the full diff

Package name: webpack The new version differs by 250 commits.
  • 4be093d 2.2.0
  • 2278469 2.2.0-rc.8
  • b946eb4 Merge pull request #3988 from malstoun/bug/2664
  • 260e413 Merge pull request #3986 from webpack/bugfix/revert_use_of_buffer_dot_from
  • 0ec7de9 Fix regression with watch cli opt, add tests for this case
  • 72226db add missing disable line
  • 4d30675 build fresh yarn.lock file to remove buffer polyfill
  • 91c1f35 fix(node): rollback changes of Buffer.from to new Buffer() and bump down travis to 4.3 min node v
  • 0b47602 2.2.0-rc.7
  • db6ccbc Merge pull request #3978 from webpack/bugfix/conditional-reexports
  • 82a5b03 Merge pull request #3977 from malstoun/bug/2664
  • fc1a43b Merge pull request #3976 from timse/rely-on-defaults
  • a44694a hoist exports declarations too
  • 682bde8 Fix lint
  • c6d7d90 Add tests
  • af8d49e remove defaults values to shave a few bytes
  • 9796696 2.2.0-rc.6
  • e9bdb05 Merge pull request #3971 from webpack/bugfix/fix_available_vars_in_fmtp
  • bd45bdc add test case for global in harmony modules
  • bfccb20 fix PR
  • 5a3a23f fix(nmf): Fix exports for var injection to include free glob exports or arguments
  • 437dce4 2.2.0-rc.5
  • 91cb1df Merge pull request #3970 from webpack/ci/appveyor
  • 9fd55e5 Merge pull request #3969 from webpack/bugfix/issue-3964

See the full diff

Package name: webpack-dev-server The new version differs by 250 commits.
  • c9271b9 chore(release): 4.0.0
  • 18bf369 test: fix stability (#3676)
  • cdcabb2 fix: respect protocol from browser for manual setup (#3675)
  • 1768d6b fix: initial reloading for lazy compilation (#3662)
  • 4f5bab1 docs: improve examples (#3672)
  • f2d87fb fix: improve https CLI output (#3673)
  • 0277c5e chore: remove redundant console statements (#3671)
  • 16fcdbc docs: add `ipc` example (#3667)
  • 8915fb8 test: add e2e tests for built in routes (#3669)
  • 4d1cbe1 docs: ask `version` information in issue template (#3668)
  • b6c1881 chore(deps-dev): bump core-js from 3.16.1 to 3.16.2 (#3666)
  • ffa8cc5 chore(deps-dev): bump supertest from 6.1.5 to 6.1.6 (#3665)
  • f1fdaa7 chore(release): 4.0.0-rc.1
  • c4678bc fix: legacy API (#3660)
  • d8bdd03 test: fix stability (#3661)
  • 22b1414 refactor: remove `killable` (#3657)
  • 75bafbf test: add e2e tests for module federation (#3658)
  • 493ccbd chore(deps): update `ws` (#3652)
  • ae8c523 test: add e2e test for universal compiler (#3656)
  • f94b84f chore(deps): update (#3655)
  • 1923132 test: fix cli
  • 2adfd01 test: fix todo (#3653)
  • 6e2cbde fix: proxy logging and allow to pass options without the `target` option (#3651)
  • c9ccc96 fix: respect infastructureLogging.level for client.logging (#3613)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

@snyk-bot
fix: package.json to reduce vulnerabilities
9257618 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-ISMOBILEJS-72624
- https://snyk.io/vuln/SNYK-JS-ISSVG-1085627
- https://snyk.io/vuln/SNYK-JS-ISSVG-1243891
- https://snyk.io/vuln/SNYK-JS-JSYAML-173999
- https://snyk.io/vuln/SNYK-JS-JSYAML-174129
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-MOCHA-561476
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-OPEN-174041
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://snyk.io/vuln/SNYK-JS-WEBPACKDEVSERVER-72405
- https://snyk.io/vuln/npm:braces:20180219
- https://snyk.io/vuln/npm:debug:20170905
- https://snyk.io/vuln/npm:diff:20180305
- https://snyk.io/vuln/npm:eslint:20180222
- https://snyk.io/vuln/npm:growl:20160721
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:mime:20170907
- https://snyk.io/vuln/npm:open:20180512
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@snyk-bot