New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 8 vulnerabilities #12

Open

snyk-bot wants to merge 1 commit into master from snyk-fix-275ea42c9f5fd2d8cd39c9a9563b321e

snyk-bot commented Jan 10, 2020

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Issue	Breaking Change
	Uncontrolled Recursion SNYK-JS-NODESASS-540960	Yes
	Out-of-bounds Read SNYK-JS-NODESASS-540962	Yes
	Improper Input Validation SNYK-JS-NODESASS-540966	Yes
	Improper Input Validation SNYK-JS-NODESASS-540968	Yes
	Uncontrolled Recursion SNYK-JS-NODESASS-540970	Yes
	Out-of-bounds Read SNYK-JS-NODESASS-540972	Yes
	Out-of-bounds Read SNYK-JS-NODESASS-540984	Yes
	Denial of Service (DoS) SNYK-JS-NODESASS-540988	Yes

Commit messages

Package name: node-sass

The new version differs by 29 commits.

d628b10 4.4.0
323b193 Bump sass-spec for 3.5 features
1f5eaff Merge pull request #1866 from xzyfer/bump-libsass
1b9970a Bump LibSass to 3.5.0.beta.2
71a7a84 4.3.0
0ab145f Merge pull request #1849 from xzyfer/feat/no-git-in-build
46c0c2b Merge pull request #1851 from xzyfer/remove/git-sub-module-docs
1d3ec74 Merge pull request #1850 from xzyfer/remove/git-sub-module
1e76d99 4.2.0
93eeed1 Remove the git fallback
a00aece Remove LibSass git submdule from CI
ae31ada Remove contributing documentation about bumping LibSass
2d6d19e Remove reference to the LibSass to Sass Spec git submodules
6f1c5b3 Normalise whitespace in docs
7667dba Initial import of LibSass
c427728 Remove the LibSass git submodule
46266f1 LibSass 3.4.3 (#1848)
5c83bb7 4.1.1
8a8ec65 Lock a specific version of sass-spec
396ad28 4.1.0
5521bb6 Add a platform variant for installing a musl binary (#1836)
3c17b03 Fix output buffer is imcomplete working in child_process (#1834)
a5fca4f Merge pull request #1830 from daltones/no-lodash.isarray
d66eaee Drop dependency lodash.isarray

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:

🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


          fix: package.json to reduce vulnerabilities

618feb6

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-NODESASS-540960
- https://snyk.io/vuln/SNYK-JS-NODESASS-540962
- https://snyk.io/vuln/SNYK-JS-NODESASS-540966
- https://snyk.io/vuln/SNYK-JS-NODESASS-540968
- https://snyk.io/vuln/SNYK-JS-NODESASS-540970
- https://snyk.io/vuln/SNYK-JS-NODESASS-540972
- https://snyk.io/vuln/SNYK-JS-NODESASS-540984
- https://snyk.io/vuln/SNYK-JS-NODESASS-540988

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet