Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade @pattern-lab/uikit-workshop from 5.14.0 to 5.15.5 #381

Open
wants to merge 1 commit into
base: 1.0.x
Choose a base branch
from
Open

[Snyk] Security upgrade @pattern-lab/uikit-workshop from 5.14.0 to 5.15.5 #381

wants to merge 1 commit into from

Conversation

riteshgurung
Copy link
Contributor

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • pattern-lab/package.json
  • pattern-lab/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-DECODEURICOMPONENT-3149970		 No Proof of Concept
medium severity 641/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.4		 Prototype Pollution
SNYK-JS-JSON5-3182856		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LOADERUTILS-3042992		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-LOADERUTILS-3043105		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LOADERUTILS-3105943		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 No Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASH-1040724		 No Proof of Concept
high severity 731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		 Prototype Pollution
SNYK-JS-LODASH-567746		 No Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1090595		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1255640		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JS-URIJS-1078286		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Open Redirect
SNYK-JS-URIJS-1319803		 No Proof of Concept
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-URIJS-1319806		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Open Redirect
SNYK-JS-URIJS-2401466		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JS-URIJS-2415026		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Open Redirect
SNYK-JS-URIJS-2419067		 No Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Misinterpretation of Input
SNYK-JS-URIJS-2440699		 No Proof of Concept
medium severity 591/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.4		 Cross-site Scripting (XSS)
SNYK-JS-URIJS-2441239		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @pattern-lab/uikit-workshop The new version differs by 87 commits.
  • 627d6a3 [skip travis] chore(release): publish v5.15.5
  • c9e4151 [skip travis] chore(release): publish v5.15.4
  • 108eb43 Update babel config
  • 7f37e9d fix: corrected some github urls (#1388)
  • b86bf0a chore: code optimizations (#1387)
  • 91d2d3e refactor: updated lerna dependency (#1382)
  • 62901a3 refactor: moved dependencies to devDependencies @ uikit-workshop (#1381)
  • 49cd8f8 refactor: updated 11ty dependencies (#1383)
  • 2939561 refactor: moved dependencies to devDependencies @ cli (#1384)
  • 6fa630e feat: define initial viewport (#1386)
  • 8fb9fb4 refactor: updated http-auth dependency (#1379)
  • e284703 chore: adding simple pattern descriptions (#1378)
  • 57aad3d [skip travis] chore(release): publish v5.15.3
  • a75ee0d refactor: updated our redux version (#1374)
  • 1ebcd53 Includes additional twig syntax featires (#1367)
  • 7c66f8a fix(handlebars-demo): move and modify the icon files (#1377)
  • cfa74c0 feat(vs-code): added recommendations (#1375)
  • 82c5592 refactor: replace node-sass by sass (#1373)
  • 57efccb feat: ensure consistent line endings across files (#1372)
  • d7b428c refactor(docs): added forked plugin to the list (#1371)
  • 384dc89 fix(docs): tiles z-index to not overlay the menu anymore (#1370)
  • acca120 [skip travis] chore(release): publish v5.15.2
  • 3ce13ab fix(core): Subgroup cannot be hidden (#1368)
  • 7495275 refactor: optimized engines directory retrieval #1359 (#1364)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Note: This is a default PR template raised by Snyk. Find out more about how you can customise Snyk PRs in our documentation.

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Prototype Pollution
🦉 Command Injection
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: pattern-lab/package.json & pattern-lab/package-lock.json to redu…
2f9d537 
…ce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-DECODEURICOMPONENT-3149970
- https://snyk.io/vuln/SNYK-JS-JSON5-3182856
- https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3042992
- https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3043105
- https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3105943
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1090595
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://snyk.io/vuln/SNYK-JS-URIJS-1078286
- https://snyk.io/vuln/SNYK-JS-URIJS-1319803
- https://snyk.io/vuln/SNYK-JS-URIJS-1319806
- https://snyk.io/vuln/SNYK-JS-URIJS-2401466
- https://snyk.io/vuln/SNYK-JS-URIJS-2415026
- https://snyk.io/vuln/SNYK-JS-URIJS-2419067
- https://snyk.io/vuln/SNYK-JS-URIJS-2440699
- https://snyk.io/vuln/SNYK-JS-URIJS-2441239
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@riteshgurung @snyk-bot