Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade jointjs from 2.2.1 to 3.7.7 #131

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

mike-goodwin
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5
Prototype Pollution
SNYK-JS-LODASH-6139239
Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: jointjs The new version differs by 250 commits.
  • 59647a9 Release v3.7.7 (#2384)
  • c314a3d fix(util.breakText): take in account international characters (#2385)
  • 8d3a09f fix(dia.Paper): custom events on link label (#2381)
  • d033ff4 docs(standard.InscribedImage): fix typo in code example (#2377)
  • ad99755 chore: remove lodash3 test (#2372)
  • 739c7c1 Release v3.7.6 (#2362)
  • 7aca426 feat(routers.RightAngle): support user defined vertices (#2224)
  • 70a8631 fix(Geometry): prevent rounding errors in simplify() of Polyline (#2371)
  • 4684a9a chore(travis): update node and ubuntu dist (#2368)
  • 82213b1 chore(deps): bump node version to 18 (#2367)
  • dc9dc6f fix(util.breakText): use the specified separator to join words, allow empty string to be separator; fix(dia.attributes): textWrap reads all breakText options (#2360)
  • 2c4804e feat(Vectorizer): add option to support camel case attributes (#2339)
  • b65f3aa types: expose fallbackRouter in ManhattanRouterArguments (#2346)
  • 1a9ca06 fix(shapes.standard): fix cursor style on DoubleLink and ShadowLink (#2345)
  • e291c17 fix(connectors.Curve): wrong enum mapping fix
  • a364d87 docs fix (#2337)
  • 4f8c058 perf(dia.Cell): make prop()'s internal set() call more efficient (#2329)
  • e0a5aac fix(dia.attributes): fix ambiguous order of cache keys in text attribute (#2333)
  • f6ffb4b fix(linkTools.Segments): throw explicit error when incompatible router in use (#2334)
  • d9696c3 fix(dia.LinkView): Paper sometimes autosizes incorrectly after moving links with doubleLinkTools option (#2330)
  • 47a0fbb types(dia.Paper): fix labels layer name (#2313)
  • b8b8d9d perf(g.Rect): prevent unnecessary object instantiation in containsPoint()
  • 55de376 docs(tutorials): add cell namespace tutorial (#2287)
  • 41bd920 chore(demo.ts-demo): update demo dependencies (#2248)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-LODASH-6139239
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants