Skip to content

[Snyk] Fix for 28 vulnerabilities#25

Open
snyk-bot wants to merge 1 commit into
masterfrom
snyk-fix-0ca8b6b00fa8263dc077d3d2efe888cf
Open

[Snyk] Fix for 28 vulnerabilities#25
snyk-bot wants to merge 1 commit into
masterfrom
snyk-fix-0ca8b6b00fa8263dc077d3d2efe888cf

Conversation

@snyk-bot

@snyk-bot snyk-bot commented Aug 15, 2021

Copy link
Copy Markdown

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Prototype Pollution
SNYK-JS-AJV-584908		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HOSTEDGITINFO-1088355		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ISSVG-1085627		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ISSVG-1243891		 Yes Proof of Concept
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service (DoS)
SNYK-JS-JSYAML-173999		 Yes No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Arbitrary Code Execution
SNYK-JS-JSYAML-174129		 Yes No Known Exploit
medium severity 658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3		 Denial of Service (DoS)
SNYK-JS-JSZIP-1251497		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-174116		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-451540		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-MERGE-1040469		 Yes No Known Exploit
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-MERGE-1042987		 Yes Proof of Concept
low severity 486/1000
Why? Mature exploit, Has a fix available, CVSS 2		 Prototype Pollution
SNYK-JS-MERGE-72553		 No Mature
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 No Proof of Concept
high severity 706/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.7		 Server-side Request Forgery (SSRF)
SNYK-JS-NETMASK-1089716		 No Proof of Concept
medium severity 520/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service
SNYK-JS-NODEFETCH-674311		 Yes No Known Exploit
high severity 726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1		 Arbitrary File Overwrite
SNYK-JS-NPM-537603		 Yes Proof of Concept
low severity 451/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 2.6		 Unauthorized File Access
SNYK-JS-NPM-537604		 Yes Proof of Concept
high severity 726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1		 Arbitrary File Write
SNYK-JS-NPM-537606		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Insertion of Sensitive Information into Log File
SNYK-JS-NPM-575435		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-NPMUSERVALIDATE-1019352		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1255640		 Yes Proof of Concept
high severity 696/1000
Why? Recently disclosed, Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 Yes No Known Exploit
high severity 696/1000
Why? Recently disclosed, Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 Yes No Known Exploit
low severity 481/1000
Why? Recently disclosed, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-TRIMNEWLINES-1298042		 Yes No Known Exploit
medium severity 434/1000
Why? Has a fix available, CVSS 4.4		 Time of Check Time of Use (TOCTOU)
npm:chownr:20180731		 Yes No Known Exploit
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:hoek:20180212		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Access Restriction Bypass
npm:npm:20180222		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: isomorphic-fetch The new version differs by 12 commits.

See the full diff

Package name: merge The new version differs by 29 commits.

See the full diff

Package name: meta-marked The new version differs by 5 commits.

See the full diff

Package name: mkdirp The new version differs by 4 commits.
  • b2e7ba0 0.5.2
  • c5b97d1 bump minimist to 1.2 to fix security issue
  • f2003bb test: add v4 and v5 to travis
  • b8629ff tools: update tap + mock-fs. Fix broken test

See the full diff

Package name: node-sass The new version differs by 64 commits.
  • c167004 6.0.1
  • 911d4db remove mkdirp dep (#3108)
  • 30a52f7 build(deps): bump meow from 3.7.0 to 9.0.0
  • 7e08463 build(deps-dev): bump mocha from 8.4.0 to 9.0.1
  • cfcbb2c chore: Use default Apline version from docker-node (#3121)
  • 886319b chore: Drop Node 10 support
  • c908f4f fix: Bump OSX minimum to 10.11
  • 8ab02da fix: Remove old compiler gyp settings
  • 3d7b9d0 chore: Add Node 16 support
  • 4115e9d build(deps): bump actions/setup-node from v2.1.4 to v2.1.5
  • 06f3ab4 Update TROUBLESHOOTING.md
  • c1cb367 build(deps): bump actions/setup-node from v2.1.3 to v2.1.4
  • 769f3a6 build(deps): bump actions/setup-node from v2.1.2 to v2.1.3
  • a2a3a78 chore: Bump dependabot limit
  • 7105b0a 5.0.0 (#3015)
  • 0648b5a chore: Add Node 15 support (#2983)
  • e2391c2 Add a deprecation message to the readme (#3011)
  • 6a33e53 chore: Don't upload artifacts on PRs
  • d763506 chore: Only run coverage on main repo
  • d4ebe72 build(deps): update actions/setup-node requirement to v2.1.2
  • 2bebe05 build(deps-dev): bump rimraf from 2.7.1 to 3.0.2
  • f877689 chore: Don't double build DependaBot PRs
  • b48fac4 chore: Add weekly DependaBot updates
  • 91c40a0 Remove deprecated process.sass API

See the full diff

Package name: npm The new version differs by 250 commits.

See the full diff

Package name: prop-types The new version differs by 23 commits.

See the full diff

Package name: snyk The new version differs by 250 commits.
  • 8387aed Merge pull request #2111 from snyk/fix/update-jszip
  • e686299 fix: update plugins package versions
  • 7f0b32e Merge pull request #2108 from snyk/smoke/binary-cdn
  • e974b9d test: use binary from cdn for smoke tests
  • 64e3fe8 Merge pull request #2107 from snyk/refactor/analytics-tests
  • 0f2a7e3 refactor: call anaytics module the right way
  • 0b833f6 refactor: use await syntax rather than callbacks
  • fce83d5 Merge pull request #2096 from snyk/feat/iac-tracking
  • f7f2961 feat: track IaC local execution tests [CC-972]
  • 9e7f79a Merge pull request #2104 from snyk/feat/centralize-colors
  • 3292ffb feat: Centralize icons and err messages by theme
  • e3c3ac0 feat: central colors theme
  • 2aecd40 Merge pull request #2074 from snyk/docs/update-protect-readme
  • 0203c6c Merge pull request #2100 from snyk/fix/propagate-error-message
  • 7416bc9 docs: update protect readme
  • 42288e0 fix: propagate userMessage to 404 errors
  • 77336a0 Merge pull request #2099 from snyk/test/migrate-trust-policies-jest
  • e2106f1 test: migrate trust-policies to jest
  • b227f78 Merge pull request #2095 from snyk/protect/smoke-tests
  • 20b05d0 Merge pull request #2087 from snyk/chore/async-test-with-polling
  • d7f23e0 Merge pull request #2098 from snyk/fix/bump-docker-plugin
  • cb2ecf1 fix: bump docker plugin version with fixes
  • 697f81f chore(protect): fix production test caching
  • d21cff7 chore: init support async test with polling

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

@snyk-bot
fix: package.json & package-lock.json to reduce vulnerabilities
4431fad 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
- https://snyk.io/vuln/SNYK-JS-ISSVG-1085627
- https://snyk.io/vuln/SNYK-JS-ISSVG-1243891
- https://snyk.io/vuln/SNYK-JS-JSYAML-173999
- https://snyk.io/vuln/SNYK-JS-JSYAML-174129
- https://snyk.io/vuln/SNYK-JS-JSZIP-1251497
- https://snyk.io/vuln/SNYK-JS-MARKED-174116
- https://snyk.io/vuln/SNYK-JS-MARKED-451540
- https://snyk.io/vuln/SNYK-JS-MERGE-1040469
- https://snyk.io/vuln/SNYK-JS-MERGE-1042987
- https://snyk.io/vuln/SNYK-JS-MERGE-72553
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-NETMASK-1089716
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-NPM-537603
- https://snyk.io/vuln/SNYK-JS-NPM-537604
- https://snyk.io/vuln/SNYK-JS-NPM-537606
- https://snyk.io/vuln/SNYK-JS-NPM-575435
- https://snyk.io/vuln/SNYK-JS-NPMUSERVALIDATE-1019352
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://snyk.io/vuln/SNYK-JS-TAR-1536528
- https://snyk.io/vuln/SNYK-JS-TAR-1536531
- https://snyk.io/vuln/SNYK-JS-TAR-1536758
- https://snyk.io/vuln/SNYK-JS-TRIMNEWLINES-1298042
- https://snyk.io/vuln/npm:chownr:20180731
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:npm:20180222
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

PR: unreviewed

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@snyk-bot