Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade @parcel/plugin from 2.0.0-rc.0 to 2.0.0 #105

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

JakeLane
Copy link

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • packages/plugins/parcel-reporter-manifest/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 713/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.4
Prototype Pollution
SNYK-JS-JSON5-3182856
No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @parcel/plugin The new version differs by 90 commits.
  • 84da50a v2.0.0
  • aa0a369 Small copy change
  • c78601b shouldVisitChild: Check parent and child node previously deferred separately (#7043)
  • 2c83842 Fix scope resolution for TS enums (#7057)
  • dbe1153 Fix order of hoisted variable declarations (#7053)
  • bea9442 Fix named export with different export name for wrapped assets (#7052)
  • 2175e1b Mark '*' as used when the reexport is only decided at runtime (#7049)
  • 4312b91 Update Micromatch (#6958)
  • 5afe766 Fail when unable to build a native package (#6962)
  • 971ed24 Update watcher and source-map library to 2.0.0 (#7044)
  • 810a854 Add missing C flags for SIMD support in build workflow (#7045)
  • d6de61d Fix shaking for functions types with overload signatures (#7036)
  • daf2cd9 Safely position the HMR script (#6961)
  • 89b4e51 Unmark defer for dependency that become used ('does not export') (#7035)
  • b575212 Bump swc (#7033)
  • 415710f Fix CSS tree shaking with 'build --no-scope-hoist' (#5728)
  • ea0f4e4 Allow jsx and tsx as lang for script block in Vue SFCs (#6983)
  • d2d4f1c Never enable JSX in a .ts file (#7031)
  • aafc318 Don't use deprecated querystring package (#6806)
  • a6a6fb2 Fix cache invalidation when shouldOptimize changes (#7030)
  • 7d4d53a Update all references to v2.parceljs.org to just parceljs.org (#7029)
  • 91de5c0 Ensure symbol order is consistent (#7021)
  • 2ebed00 Ensure named exports are prioritized over wildcard re-exports (#7016)
  • 4904f20 Fix autoinstall with Yarn 2+ (#7023)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

… vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-JSON5-3182856
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants