[Snyk] Upgrade sinon from 9.0.2 to 14.0.0 #57

MarcelRaschke · 2022-09-30T03:00:46Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade sinon from 9.0.2 to 14.0.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Warning: This is a major version upgrade, and may be a breaking change.

The recommended version is 19 versions ahead of your current version.
The recommended version was released 5 months ago, on 2022-05-07.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Prototype Pollution SNYK-JS-Y18N-1021887	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Arbitrary File Write SNYK-JS-TAR-1579155	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579147	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536528	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579155	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579147	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536528	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Remote Code Execution (RCE) SNYK-JS-SHELLQUOTE-1766506	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Improper Privilege Management SNYK-JS-SHELLJS-2332187	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVERREGEX-1585624	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVERREGEX-1584358	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Prototype Pollution SNYK-JS-MERGEDEEP-1070277	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Prototype Pollution SNYK-JS-ASYNC-2441827	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-ASYNC-2441827	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-AJV-584908	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVERREGEX-2824151	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVERREGEX-1047770	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-PATHVAL-596926	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Prototype Pollution SNYK-JS-FLAT-596927	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	472/1000 Why? Proof of Concept exploit, CVSS 7.3	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-2429795	472/1000 Why? Proof of Concept exploit, CVSS 7.3	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: sinon

from sinon GitHub release notes

Commit messages

Package name: sinon

242b429 14.0.0
c2bbd82 Drop node 12
18d5601 13.0.2
bddb631 Update fake-timers
9e334cd master => main
eaed0eb Bump nokogiri from 1.13.3 to 1.13.4 ([gui error report] Error: Initializing daemon... ipfs/ipfs-desktop#2451)
0ed91d7 Bump minimist from 1.2.5 to 1.2.6 ([gui error report] ipfs/ipfs-desktop#2450)
ff1443e Bump nokogiri from 1.13.1 to 1.13.3
238f14b Add some jsdoc
698fe79 13.0.1
a21ad7a omission 💩
ec4223f Bump nise to fix TypeError: performance.mark is not a function on node@16 sinonjs/nise#193
f329a01 Add unimported to workflow (feat: Specify IPFS node on the network instead of running localy ipfs/ipfs-desktop#2441)
209f71f Fix fake tests ([gui error report] Error: Initializing daemon... ipfs/ipfs-desktop#2439)
7f16cec Enable updates to same major version
0dd4d93 Merge branch 'single-release-per-major__master'
91dab22 Persist prettier fix to the script that generates this
f784d7a Re-introduce new version.sh script to version hook
51c508a Add dry run mode to `npm version` (chore(deps): bump minimatch and electron-builder ipfs/ipfs-desktop#2436)
a57bbf6 Remove dry-run flag from npm publish ([gui error report] Error: multiaddr "http://127.0.0.1/5001" must start with a "/" ipfs/ipfs-desktop#2434)
ae134d2 Add sort_id
0cb7c09 Adjust copy script
3cfd12a update script
b217ba9 Update scripts and Liquid templates

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Snyk has created this PR to upgrade ipfs-http-client from 47.0.1 to 57.0.3. See this package in npm: https://www.npmjs.com/package/ipfs-http-client See this project in Snyk: https://app.snyk.io/org/marcelraschke/project/c43862e2-04e0-46c7-9027-49ad8d871d46?utm_source=github&utm_medium=referral&page=upgrade-pr

Snyk has created this PR to upgrade i18next from 19.4.4 to 21.8.14. See this package in npm: https://www.npmjs.com/package/i18next See this project in Snyk: https://app.snyk.io/org/marcelraschke/project/c43862e2-04e0-46c7-9027-49ad8d871d46?utm_source=github&utm_medium=referral&page=upgrade-pr

Snyk has created this PR to upgrade: - electron-builder from 22.8.1 to 23.3.3. See this package in npm: https://www.npmjs.com/package/electron-builder - electron-updater from 4.3.5 to 5.2.1. See this package in npm: https://www.npmjs.com/package/electron-updater See this project in Snyk: https://app.snyk.io/org/marcelraschke/project/c43862e2-04e0-46c7-9027-49ad8d871d46?utm_source=github&utm_medium=referral&page=upgrade-pr

Snyk has created this PR to upgrade yargs from 15.3.1 to 17.5.1. See this package in npm: https://www.npmjs.com/package/yargs See this project in Snyk: https://app.snyk.io/org/marcelraschke/project/c43862e2-04e0-46c7-9027-49ad8d871d46?utm_source=github&utm_medium=referral&page=upgrade-pr

Snyk has created this PR to upgrade dotenv from 8.2.0 to 16.0.1. See this package in npm: https://www.npmjs.com/package/dotenv See this project in Snyk: https://app.snyk.io/org/marcelraschke/project/c43862e2-04e0-46c7-9027-49ad8d871d46?utm_source=github&utm_medium=referral&page=upgrade-pr

Snyk has created this PR to upgrade mocha from 7.1.2 to 10.0.0. See this package in npm: https://www.npmjs.com/package/mocha See this project in Snyk: https://app.snyk.io/org/marcelraschke/project/c43862e2-04e0-46c7-9027-49ad8d871d46?utm_source=github&utm_medium=referral&page=upgrade-pr

Snyk has created this PR to upgrade go-ipfs from 0.7.0 to 0.14.0. See this package in npm: https://www.npmjs.com/package/go-ipfs See this project in Snyk: https://app.snyk.io/org/marcelraschke/project/c43862e2-04e0-46c7-9027-49ad8d871d46?utm_source=github&utm_medium=referral&page=upgrade-pr

Snyk has created this PR to upgrade ipfsd-ctl from 7.0.0 to 12.0.0. See this package in npm: https://www.npmjs.com/package/ipfsd-ctl See this project in Snyk: https://app.snyk.io/org/marcelraschke/project/c43862e2-04e0-46c7-9027-49ad8d871d46?utm_source=github&utm_medium=referral&page=upgrade-pr

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-ELECTRON-2805803

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-GOT-2932019

Bumps [ejs](https://github.com/mde/ejs) from 3.1.5 to 3.1.8. - [Release notes](https://github.com/mde/ejs/releases) - [Changelog](https://github.com/mde/ejs/blob/main/CHANGELOG.md) - [Commits](mde/ejs@v3.1.5...v3.1.8) --- updated-dependencies: - dependency-name: ejs dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>

Bumps [nanoid](https://github.com/ai/nanoid) from 3.1.12 to 3.3.4. - [Release notes](https://github.com/ai/nanoid/releases) - [Changelog](https://github.com/ai/nanoid/blob/main/CHANGELOG.md) - [Commits](ai/nanoid@3.1.12...3.3.4) --- updated-dependencies: - dependency-name: nanoid dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-ELECTRON-3014407

[pull] master from 47-studio-org:master

Bumps [ws](https://github.com/websockets/ws) from 7.3.1 to 7.5.9. - [Release notes](https://github.com/websockets/ws/releases) - [Commits](websockets/ws@7.3.1...7.5.9) --- updated-dependencies: - dependency-name: ws dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>

…5dcf6690cef3 [Snyk] Security upgrade electron from 9.3.2 to 18.3.12

chore(deps): bump ws from 7.3.1 to 7.5.9

…66fcf9339667 [Snyk] Security upgrade electron from 9.3.2 to 17.4.11

…d-3.3.4 chore(deps): bump nanoid from 3.1.12 to 3.3.4

….1.8 chore(deps): bump ejs from 3.1.5 to 3.1.8

…330e9ff545e0 [Snyk] Security upgrade electron-builder from 22.8.1 to 23.5.0

…d70c99e2a0b3 [Snyk] Security upgrade electron from 9.3.2 to 15.5.3

Bumps [color-string](https://github.com/Qix-/color-string) from 1.5.3 to 1.9.1. - [Release notes](https://github.com/Qix-/color-string/releases) - [Changelog](https://github.com/Qix-/color-string/blob/master/CHANGELOG.md) - [Commits](https://github.com/Qix-/color-string/commits/1.9.1) --- updated-dependencies: - dependency-name: color-string dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]>

…92ac5b9b263c7bdc [Snyk] Upgrade ipfsd-ctl from 7.0.0 to 12.0.0

…-string-1.9.1 chore(deps): bump color-string from 1.5.3 to 1.9.1

…3971876f99e17817 [Snyk] Upgrade go-ipfs from 0.7.0 to 0.14.0

…5e05192124953a87 [Snyk] Upgrade mocha from 7.1.2 to 10.0.0

…3d71f9255dce7a66 [Snyk] Upgrade dotenv from 8.2.0 to 16.0.1

…16e9be90d79e1c63 [Snyk] Upgrade yargs from 15.3.1 to 17.5.1

…ed44409fd305138c [Snyk] Upgrade: electron-builder, electron-updater

…faca25ef8f2fc106 [Snyk] Upgrade i18next from 19.4.4 to 21.8.14

…9b5501d4ffd996a0 [Snyk] Upgrade ipfs-http-client from 47.0.1 to 57.0.3

Snyk has created this PR to upgrade sinon from 9.0.2 to 14.0.0. See this package in npm: https://www.npmjs.com/package/sinon See this project in Snyk: https://app.snyk.io/org/marcelraschke/project/c43862e2-04e0-46c7-9027-49ad8d871d46?utm_source=github&utm_medium=referral&page=upgrade-pr

snyk-bot and others added 30 commits August 20, 2022 00:26

fix: package.json to reduce vulnerabilities

615f237

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-ELECTRON-2805803

fix: package.json to reduce vulnerabilities

081778c

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-GOT-2932019

fix: package.json to reduce vulnerabilities

7027b3e

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-ELECTRON-3014407

Merge pull request #45 from 47-studio-org/master

5f2f8ba

[pull] master from 47-studio-org:master

Merge branch 'master' into snyk-fix-89145fc9f6b2a778813d5dcf6690cef3

05297b2

Merge pull request #47 from devcode1981/snyk-fix-89145fc9f6b2a778813d…

29f348e

…5dcf6690cef3 [Snyk] Security upgrade electron from 9.3.2 to 18.3.12

Merge pull request #52 from devcode1981/dependabot/npm_and_yarn/ws-7.5.9

c7ee9eb

chore(deps): bump ws from 7.3.1 to 7.5.9

Merge branch 'master' into snyk-fix-7805b70d54e5a862b0e266fcf9339667

4ae3802

Merge pull request #30 from devcode1981/snyk-fix-7805b70d54e5a862b0e2…

59c6b74

…66fcf9339667 [Snyk] Security upgrade electron from 9.3.2 to 17.4.11

Merge pull request #44 from devcode1981/dependabot/npm_and_yarn/nanoi…

03f78f1

…d-3.3.4 chore(deps): bump nanoid from 3.1.12 to 3.3.4

Merge pull request #43 from devcode1981/dependabot/npm_and_yarn/ejs-3…

cc95115

….1.8 chore(deps): bump ejs from 3.1.5 to 3.1.8

Merge branch 'master' into snyk-fix-c9c39c38b507e852a614330e9ff545e0

70f4cde

Merge pull request #41 from devcode1981/snyk-fix-c9c39c38b507e852a614…

2407de6

…330e9ff545e0 [Snyk] Security upgrade electron-builder from 22.8.1 to 23.5.0

Merge branch 'master' into snyk-fix-21d68bdbe82082f6bb64d70c99e2a0b3

c372a96

Merge pull request #40 from devcode1981/snyk-fix-21d68bdbe82082f6bb64…

5325dd9

…d70c99e2a0b3 [Snyk] Security upgrade electron from 9.3.2 to 15.5.3

Merge pull request #39 from devcode1981/snyk-upgrade-739b227ce3012acf…

609c2f0

…92ac5b9b263c7bdc [Snyk] Upgrade ipfsd-ctl from 7.0.0 to 12.0.0

Merge pull request #53 from devcode1981/dependabot/npm_and_yarn/color…

223af26

…-string-1.9.1 chore(deps): bump color-string from 1.5.3 to 1.9.1

MarcelRaschke and others added 12 commits September 29, 2022 01:27

Merge pull request #38 from devcode1981/snyk-upgrade-efe51cb8782e83b3…

edb38fc

…3971876f99e17817 [Snyk] Upgrade go-ipfs from 0.7.0 to 0.14.0

Merge pull request #37 from devcode1981/snyk-upgrade-73b7077cf52a2dbe…

708e66a

…5e05192124953a87 [Snyk] Upgrade mocha from 7.1.2 to 10.0.0

Merge branch 'master' into snyk-upgrade-d5cd3145200b3bf33d71f9255dce7a66

f17e15d

Merge pull request #36 from devcode1981/snyk-upgrade-d5cd3145200b3bf3…

7bb82c2

…3d71f9255dce7a66 [Snyk] Upgrade dotenv from 8.2.0 to 16.0.1

Merge pull request #35 from devcode1981/snyk-upgrade-1383b5f2ea226bb8…

1bfeabd

…16e9be90d79e1c63 [Snyk] Upgrade yargs from 15.3.1 to 17.5.1

Merge branch 'master' into snyk-upgrade-142144d9df93ee2aed44409fd305138c

f7b4ec2

Merge pull request #34 from devcode1981/snyk-upgrade-142144d9df93ee2a…

1830f40

…ed44409fd305138c [Snyk] Upgrade: electron-builder, electron-updater

Merge branch 'master' into snyk-upgrade-a9b349a8e1efaef4faca25ef8f2fc106

4229d90

Merge pull request #33 from devcode1981/snyk-upgrade-a9b349a8e1efaef4…

89a3bef

…faca25ef8f2fc106 [Snyk] Upgrade i18next from 19.4.4 to 21.8.14

Merge branch 'master' into snyk-upgrade-48086ea1028ad3b19b5501d4ffd996a0

b7b553a

Merge pull request #32 from devcode1981/snyk-upgrade-48086ea1028ad3b1…

1ee9693

…9b5501d4ffd996a0 [Snyk] Upgrade ipfs-http-client from 47.0.1 to 57.0.3

MarcelRaschke force-pushed the master branch from 1ee9693 to d3055b1 Compare October 28, 2022 07:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade sinon from 9.0.2 to 14.0.0 #57

[Snyk] Upgrade sinon from 9.0.2 to 14.0.0 #57

MarcelRaschke commented Sep 30, 2022

[Snyk] Upgrade sinon from 9.0.2 to 14.0.0 #57

Are you sure you want to change the base?

[Snyk] Upgrade sinon from 9.0.2 to 14.0.0 #57

Conversation

MarcelRaschke commented Sep 30, 2022

Snyk has created this PR to upgrade sinon from 9.0.2 to 14.0.0.