Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 10 vulnerabilities #135

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

[Snyk] Fix for 10 vulnerabilities #135

wants to merge 1 commit into from

Conversation

MiroDojkic
Copy link
Member

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Prototype Pollution
SNYK-JS-AJV-584908		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-DECODEURICOMPONENT-3149970		 Yes Proof of Concept
high severity 644/1000
Why? Has a fix available, CVSS 8.6		 Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASH-1040724		 Yes Proof of Concept
high severity 731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		 Prototype Pollution
SNYK-JS-LODASH-567746		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Poisoning
SNYK-JS-QS-3153490		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: bili The new version differs by 24 commits.
  • 023f2c5 feat: Upgrade Rollup and Plugins (#357)
  • a21420c fix(docs): configuration link (#355)
  • 6a58956 feat: babel support new syntax and fine tuning compile (#342)
  • 51cc78b docs: add hint for bug of rollup-plugin-vue (#343)
  • 8d69656 chore: semantic-release support more types (#338)
  • 3621d65 fix: rollup-plugin-typescript2 objectHashIgnoreUnknownHack warning (fix #305) (#339)
  • 9388b17 chore(deps-dev): bump p-waterfall from 1.0.0 to 2.1.0 (#341)
  • 0e83028 chore(deps-dev): bump @ types/babel__traverse from 7.0.10 to 7.0.11 (#340)
  • 633e01a fix: drop env.NODE_ENV from umd/iife (fix #274) (#337)
  • f15d134 chore(deps): replace `rollup-plugin-replace` with `@ rollup/plugin-replace` (#336)
  • 8bbe976 chore(build): skip lib check
  • a385899 chore(deps): bump @ babel/preset-typescript from 7.3.3 to 7.9.0 (#330)
  • 1f2bc5b chore(deps): bump @ babel/preset-env from 7.4.5 to 7.9.5 (#329)
  • c7e2be4 chore(deps-dev): bump gzip-size from 5.0.0 to 5.1.1 (#331)
  • 84f23ed chore(deps-dev): bump @ types/babel__core from 7.0.4 to 7.1.7 (#319)
  • 632cfa7 chore(deps): bump @ babel/core from 7.2.2 to 7.9.0 (#317)
  • a5a891c chore(deps-dev): bump typescript from 3.2.4 to 3.8.3 (#311)
  • 4140ca3 chore(deps-dev): bump cac from 6.4.2 to 6.5.8 (#316)
  • 5629bad chore(deps): [security] bump mixin-deep from 1.3.1 to 1.3.2 (#235)
  • 3b343f8 chore(deps): [security] bump https-proxy-agent from 2.2.1 to 2.2.4 (#265)
  • ccca20d chore(deps): [security] bump acorn from 5.7.3 to 5.7.4 (#315)
  • 4eae8bb fix(deps): [security] bump handlebars from 4.1.2 to 4.7.6 (#323)
  • a4160c5 chore(deps): [security] bump handlebars from 4.0.2 to 5.3.0 (fix #303) (#327)
  • eba6f06 feat: support scoped rollup plugin (fix #275) (#320)

See the full diff

Package name: node-sass The new version differs by 90 commits.
  • 3b556c1 7.0.2
  • c716359 Bump sass-graph@^4.0.1 (#3292)
  • 24741b3 docs(readme): fix docpad plugin link
  • 1523330 feat: Drop Node 12
  • 365d357 update https://registry.npm.taobao.org to https://registry.npmmirror.com
  • 1456114 build(deps): bump actions/upload-artifact from 2 to 3
  • b465b69 chore: bump GitHub Actions to Windows 2019 (#3254)
  • e6194b1 build(deps): bump make-fetch-happen from 9.1.0 to 10.0.4
  • 4edf594 build(deps): bump node-gyp from 8.4.1 to 9.0.0
  • 29e2344 build(deps): bump actions/checkout from 2 to 3
  • 85b0d22 build(deps): bump actions/setup-node from 2 to 3
  • 3bb51da Use make-fetch-happen instead of request (#3193)
  • adc2f8b build(deps): bump true-case-path from 1.0.3 to 2.2.1 (#3000)
  • 77d12f0 chore: disable Apline for Node 16/17 builds
  • 308d533 ci: use Python 3 for Node 12
  • c818907 ci: unpin actions/setup-node to v2
  • 99242d7 7.0.1
  • 77049d1 build(deps): bump sass-graph from 2.2.5 to 4.0.0 (#3224)
  • c929f25 build(deps): bump node-gyp from 7.1.2 to 8.4.1 (#3209)
  • 918dcb3 Lint fix
  • 0a21792 Set rejectUnauthorized to true by default (#3149)
  • e80d4af chore: Drop EOL Node 15 (#3122)
  • d753397 feat: Add Node 17 support (#3195)
  • dcf2e75 build(deps-dev): bump eslint from 7.32.0 to 8.0.0

See the full diff

Package name: stylelint The new version differs by 192 commits.
  • 04af9e4 13.0.0
  • 704f6a2 Prepare 13.0.0
  • 50ba8a9 Reorder changelog
  • 1666bba Update devDependencies (#4542)
  • 062d298 Reindent nodejs.yml (#4541)
  • a24e44a Fix atypical rule README structure (#4537)
  • 616ad71 Bump husky from 4.0.3 to 4.0.6 (#4536)
  • 5e58ee7 Bump globby from 10.0.2 to 11.0.0 (#4528)
  • eaee6a4 Refactor CLI options definition (#4530)
  • 6a2ffbd Fix plugin path
  • 644b713 Fix Windows path problem
  • 1005cbd Add info about invalid syntax in FAQ (#4535)
  • 18b1f99 Fix help text indentation (#4531)
  • d3c4a9f Update CHANGELOG.md
  • 32f67e7 Update CHANGELOG.md
  • 04ec577 Bump globby from 10.0.1 to 11.0.0
  • d9dbce2 Process multiple spaces in media-feature-parentheses-space-inside (#4513)
  • 1dc203e Regenerate package-lock.json (#4517)
  • 36bf292 Bump husky from 3.1.0 to 4.0.3 (#4527)
  • f5529d5 Bump @ types/micromatch from 3.1.1 to 4.0.0 (#4526)
  • a254fd2 Bump got from 10.2.0 to 10.2.1 (#4525)
  • f2e9f02 Bump remark-validate-links from 9.0.1 to 9.1.0 (#4524)
  • 74d5233 Remove unneeded `@ types/meow` package (#4523)
  • cef0b95 Update CHANGELOG.md

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Denial of Service (DoS)
🦉 Command Injection

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@MiroDojkic @snyk-bot