New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 10 vulnerabilities #57

Open

TheRealPiotrP wants to merge 1 commit into master from snyk-fix-ace8c4e5d0505d8f432a92b8ff3c55bd

Owner

TheRealPiotrP commented Dec 20, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	No	Proof of Concept
	644/1000 Why? Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	No	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	No	Proof of Concept
	579/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution npm:extend:20180424	No	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:sshpk:20180409	No	Proof of Concept
	646/1000 Why? Mature exploit, Has a fix available, CVSS 5.2	Uninitialized Memory Exposure npm:stringstream:20180511	No	Mature

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: codecov

The new version differs by 25 commits.

e427d90 feat(services): add azure pipelines (C# support not working after C# extension installed dotnet/vscode-csharp#114)
023d204 Use small HTTP dependency (Update launch.json 'program' description dotnet/vscode-csharp#110)
500f308 Update Readme
0ce3c76 v3.1.0
7c1f16e fix: support `.codecov.yml`/`codecov.yml` files for token (After update the Unity to Latest version,I cannot use the IntelliSense. dotnet/vscode-csharp#108)
1fff4dc Allow custom `yaml` file. (Don't blindly construct signature help if OmniSharp returns null dotnet/vscode-csharp#107)
77d7a5e Add ESLint (Code formatting does not obey editor.insertSpaces dotnet/vscode-csharp#93)
625807c Removing Makefile (Console.WriteLine snippet always prepends System dotnet/vscode-csharp#104)
94cd1c6 Change from istanbul to nyc (Improved generic method and parameters syntax highlighting dotnet/vscode-csharp#103)
b0b580b Update README.md
08ca881 v3.0.4
012ef08 Update dependencies (Lots of code clean up dotnet/vscode-csharp#102)
f954f91 Prettier (Open C# colorizing issues dotnet/vscode-csharp#101)
16efd18 Update README.md
49257a9 Update Readme
15cdae3 v3.0.3
39dc2d8 Support non-git/hg root dirs (Update MIEngine reference dotnet/vscode-csharp#75)
a19efbe Updated readme
31926f7 v3.0.2
1114b03 Stop outputting upload-token in logs (C# Unity auto complete hints are wrong dotnet/vscode-csharp#97)
e903e88 v3.0.1 (Error while Downloading and configuring the .NET Core Debugger dotnet/vscode-csharp#96)
75cc0dd package: unpin request so i stop getting these vulnerability reports (ignore dotnet/vscode-csharp#91)
4a7561e add -X s3 to disable uploading to s3 ([VSCodeEndGameTesting-Aditi][Command-Palette] Getting error when trying to run command for dnx. dotnet/vscode-csharp#84)
19facba Replace the `cd` command with the `pwd` option. ([VSCodeEndGameTesting-Aditi][Intellisense] Intellisense pop-up is not displaying at right position and options are misleading. dotnet/vscode-csharp#85)

See the full diff

Package name: gulp

The new version differs by 134 commits.

55eb23a Release: 4.0.0
173a532 Docs: Fix the installation instructions
ec54d09 Docs: Improve note about out-of-date docs
03b7c98 Docs: Update recipes to install gulp@next
2eba29e Docs: Remove run-sequence from recipes
76eb4d6 Docs: Add installation instructions & update badges
fbc162f Docs: Remove references to gulp-util
3011cf9 Scaffold: Normalize repository
f27be05 Update: Remove graceful-fs from test suite
361ab63 Upgrade: Update glob-watcher
064d100 Build: Avoid broken node 9
057df59 Release: 4.0.0-alpha.3
c1ba80c Breaking: Upgrade major versions of glob-watcher, gulp-cli & vinyl-fs
89acc5c Docs: Improve ES2015 task exporting examples (C# 7.2 syntax still not working? dotnet/vscode-csharp#1999)
0ac9e04 Docs: Add "Project structure" section to CONTRIBUTING.md (Support expanding large arrays >1000 in debug view dotnet/vscode-csharp#1859)
723cbc4 Docs: Fix syntax in recipe example (No IntelliSense & parameter hints for calls to local functions dotnet/vscode-csharp#1715)
d420a6a Docs: Have gulp.lastRun take a function to avoid task registration (Unable to breakpoint and debug cshtml dotnet/vscode-csharp#1828)
29ece6f Upgrade: Update undertaker
e931cb0 Docs: Fix changelog typos (Errors showing, Intellisense, using resolving doesn't work. dotnet/vscode-csharp#1696)
477db84 Docs: Add a "BrowserSync with Gulp 4" recipe (Syntax highlighting lost after certain comments dotnet/vscode-csharp#1659)
d4ed3c7 Docs: Add options.cwd for gulp.src API (Invalid project name (doubles at solution-file) for unity project dotnet/vscode-csharp#1645)
5dc3b07 Docs: Update gulp.watch API to align with glob-watcher
0c66069 Breaking: Replace chokidar as gulp.watch with glob-watcher wrapper
c3dbc10 Docs: Clarify incremental builds example (Provide IntelliSense in DEBUG CONSOLE dotnet/vscode-csharp#1609)

See the full diff

Package name: gulp-mocha

The new version differs by 7 commits.

983b0ac 5.0.0
7bc8d9c Add example of using the `exit` option (Fix typo in dotnet restore dotnet/vscode-csharp#185)
3f53145 Add example of using reporterOptions in readme.md (Debugger doesn't work, looking for nuget.config dotnet/vscode-csharp#179)
5045939 Improve usage example
64fef33 Bump Mocha to v4
06b96ba Meta tweaks
ac3d7fc Drop dependency on deprecated `gulp-util` (Warning: could not load new.dll ... new.pdb is a Windows PDB dotnet/vscode-csharp#187)

See the full diff

Package name: gulp-tslint

The new version differs by 4 commits.

c86c5ad Release 8.1.3
e8c153d Update dependencies.
5d72ae5 Merge pull request Debugging on Windows fails with "Could not load host policy library" dotnet/vscode-csharp#143 from demurgos/issue-140
63be315 Drop dependency on deprecated gulp-util

See the full diff

Package name: remap-istanbul

The new version differs by 6 commits.

981dac8 Release 0.10.0
a50dbf6 Drop dependency on deprecated `gulp-util` (dotnet crashes when debuging dotnet/vscode-csharp#158)
9ed0670 Removed typo (Missing auto indenting inside of switch blocks dotnet/vscode-csharp#156)
8342b28 Allow null file name (Don't search for OmniSharp launcher case-insensitively dotnet/vscode-csharp#153)
18ba8f6 Add warnMissingSourceMaps parameter (Fix launch on Windows with forward slashes in program (#143) dotnet/vscode-csharp#150)
50b3f4f checking if origFileName is defined before using it to build a file path (C# extension cannot start omnisharp on Linux due to wrong casing of 'omnisharp' executable dotnet/vscode-csharp#152)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution


          fix: package.json & package-lock.json to reduce vulnerabilities

b2010d8

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
- https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/npm:extend:20180424
- https://snyk.io/vuln/npm:sshpk:20180409
- https://snyk.io/vuln/npm:stringstream:20180511

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet