Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk-dev] Fix for 24 vulnerabilities #45

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

[Snyk-dev] Fix for 24 vulnerabilities #45

wants to merge 1 commit into from

Conversation

orsagie
Copy link
Owner

@orsagie orsagie commented Sep 17, 2024

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
⚠️ Warning 
Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-ASYNC-2441827		 No Proof of Concept
critical severity 786/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.3		 Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962462		 Yes Proof of Concept
high severity 706/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.7		 Remote Memory Exposure
SNYK-JS-BL-608877		 No Proof of Concept
high severity 696/1000
Why? Recently disclosed, Has a fix available, CVSS 8.2		 Asymmetric Resource Consumption (Amplification)
SNYK-JS-BODYPARSER-7926860		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Uncontrolled resource consumption
SNYK-JS-BRACES-6838727		 Yes Proof of Concept
medium severity 541/1000
Why? Recently disclosed, Has a fix available, CVSS 5.1		 Cross-site Scripting
SNYK-JS-EXPRESS-7926867		 No No Known Exploit
medium severity 504/1000
Why? Has a fix available, CVSS 5.8		 Prototype Pollution
SNYK-JS-HIGHLIGHTJS-1045326		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HIGHLIGHTJS-1048676		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HOSTEDGITINFO-1088355		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 No Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Code Injection
SNYK-JS-LODASH-1040724		 No Proof of Concept
high severity 731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		 Prototype Pollution
SNYK-JS-LODASH-567746		 No Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-608086		 No Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-LODASH-6139239		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 Yes Proof of Concept
low severity 391/1000
Why? Recently disclosed, Has a fix available, CVSS 2.1		 Cross-site Scripting
SNYK-JS-SEND-7926862		 No No Known Exploit
low severity 391/1000
Why? Recently disclosed, Has a fix available, CVSS 2.1		 Cross-site Scripting
SNYK-JS-SERVESTATIC-7926865		 No No Known Exploit
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-Y18N-1021887		 No Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: body-parser The new version differs by 250 commits.

See the full diff

Package name: express The new version differs by 250 commits.

See the full diff

Package name: hbs The new version differs by 34 commits.

See the full diff

Package name: mongodb The new version differs by 236 commits.
  • dfb03ad chore(release): 3.6.6
  • 5a0d706 chore: reintroduce nodejs fermium testing (#2775)
  • af49ba3 test(NODE-3070): Ensure that SDAM should ignore the writeErrors field (#2769)
  • 312ffef fix(NODE-3109): prevent servername from being IP (#2763)
  • 9256242 fix(NODE-2995): Add shared metadata MongoClient (#2760)
  • 91ba19e fix: ensure cursor readPreference is applied to find operations (#2751)
  • f2a4ff8 fix: no infinite loop on windows requiring optional deps
  • 86bddf1 fix(csfle): ensure that monitoring connections are not encrypted (#2749)
  • b94519b fix: ensure monitor has rtt pinger in when calculating rtt (#2757)
  • c976a01 fix: always close gridfs upload stream on finish (#2758)
  • 6887e8d chore(release): 3.6.5
  • 8b370a7 fix: move session support check to operation layer (#2739)
  • 2d76492 chore: boron node version test failures (#2747)
  • 8bd9777 fix: use emitWarning API for internal messages (#2743)
  • d67ffa7 fix: MongoError circular dependency warning (#2734)
  • 9baec71 fix: session support detection spec compliance (#2732)
  • e8ac558 test: restrict destroy test to versions of node that support it (#2728)
  • db1ab0b chore: format readme and add note about 4.0 beta (#2729)
  • a485346 chore(release): 3.6.4
  • 2fffb52 test: Adding test for cursor cloning removing session (#2723)
  • 6314f5a chore(ci): fix aws auth tests (#2720)
  • 617d9de fix: restore auto direct connection behavior (#2719)
  • 8082c89 fix(cursor): don't use other operation's session for cloned cursor operation (#2705)
  • f89e4c1 fix: dont parse tls/ssl file paths in uri (#2718)

See the full diff

Package name: tap The new version differs by 250 commits.
  • 793c1c0 update versions
  • 47a2289 add missing @ tapjs/mock service key polyfill
  • 6622dca snapshot: update snapshot
  • 556e520 mock: actually be resilient against multiple instances
  • 2c135b0 Add `t.mockAll` method
  • d7e7e4f clean process.cwd() out of snapshots by default
  • 4c0dc72 use the released version of tshy
  • c858f37 need to check in .tshy configs for typedoc to work
  • 82f48cd update versions
  • 0f27f73 TypeScript 5.2, use tshy for hybrid builds
  • de09096 remove my home directory from parser snapshots
  • 46e2bbb repl: mkdirp the .tap dir if missing
  • acfae01 link typedocs to main website
  • 2ece1da core spawn test even less flaky
  • a7a12d2 update typedoc to latest, ts-node to temporary fork
  • a5c0e0c some changelog updates
  • caf8d81 document repl
  • a5dc854 Store t.testdir() fixtures in .tap/fixtures
  • 6914d23 remove docs from source control
  • 1dcc6a7 exclude test files themselves from coverage
  • aff25fc update versions
  • c5972e7 core: make spawn timeout test less flaky
  • 1c11b37 stack: properly parse ErrnoException errors
  • 1280a55 parser: remove node v12 skip check

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Cross-site Scripting
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json to reduce vulnerabilities
4f54d00 
The following vulnerabilities are fixed with an upgrade:
- https://dev.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://dev.snyk.io/vuln/SNYK-JS-ASYNC-2441827
- https://dev.snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962462
- https://dev.snyk.io/vuln/SNYK-JS-BL-608877
- https://dev.snyk.io/vuln/SNYK-JS-BODYPARSER-7926860
- https://dev.snyk.io/vuln/SNYK-JS-BRACES-6838727
- https://dev.snyk.io/vuln/SNYK-JS-EXPRESS-7926867
- https://dev.snyk.io/vuln/SNYK-JS-HIGHLIGHTJS-1045326
- https://dev.snyk.io/vuln/SNYK-JS-HIGHLIGHTJS-1048676
- https://dev.snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-567746
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-608086
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-6139239
- https://dev.snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://dev.snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://dev.snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://dev.snyk.io/vuln/SNYK-JS-PATHPARSE-1077067
- https://dev.snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://dev.snyk.io/vuln/SNYK-JS-SEND-7926862
- https://dev.snyk.io/vuln/SNYK-JS-SERVESTATIC-7926865
- https://dev.snyk.io/vuln/SNYK-JS-Y18N-1021887
- https://dev.snyk.io/vuln/npm:debug:20170905
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@orsagie @snyk-bot