Skip to content

[Snyk] Fix for 28 vulnerabilities - #185

Open
B020239 wants to merge 25 commits into
mainfrom
snyk-fix-8bcbfc0b6a1f160ea35f4589205074f5
Open

[Snyk] Fix for 28 vulnerabilities#185
B020239 wants to merge 25 commits into
mainfrom
snyk-fix-8bcbfc0b6a1f160ea35f4589205074f5

Conversation

@B020239

@B020239B020239 commented Jun 30, 2023

Copy link
Copy Markdown
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
⚠️Warning
Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
SeverityPriority Score (*)IssueBreaking ChangeExploit Maturity
medium severity464/1000
Why? Has a fix available, CVSS 5		Improper Input Validation
SNYK-JS-ACTIONSCORE-2980270		NoNo Known Exploit
high severity619/1000
Why? Has a fix available, CVSS 8.1		Prototype Pollution
SNYK-JS-AJV-584908		NoNo Known Exploit
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		YesProof of Concept
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Prototype Pollution
SNYK-JS-ASYNC-2441827		NoProof of Concept
high severity686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		Prototype Pollution
SNYK-JS-AWSSDK-1059424		NoProof of Concept
medium severity616/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.9		Server-Side Request Forgery (SSRF)
SNYK-JS-AXIOS-1038255		NoProof of Concept
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-AXIOS-1579269		NoProof of Concept
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2332181		NoProof of Concept
low severity344/1000
Why? Has a fix available, CVSS 2.6		Information Exposure
SNYK-JS-FOLLOWREDIRECTS-2396346		NoNo Known Exploit
medium severity484/1000
Why? Has a fix available, CVSS 5.4		Open Redirect
SNYK-JS-GOT-2932019		YesNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-LOADERUTILS-3042992		NoNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Prototype Pollution
SNYK-JS-LOADERUTILS-3043105		NoNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-LOADERUTILS-3105943		NoNo Known Exploit
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		NoProof of Concept
high severity681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		Command Injection
SNYK-JS-LODASH-1040724		NoProof of Concept
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		NoNo Known Exploit
medium severity539/1000
Why? Has a fix available, CVSS 6.5		Information Exposure
SNYK-JS-NODEFETCH-2342118		NoNo Known Exploit
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1090595		NoProof of Concept
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1255640		NoProof of Concept
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Prototype Poisoning
SNYK-JS-QS-3153490		NoProof of Concept
medium severity658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		YesProof of Concept
medium severity536/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVERREGEX-1047770		NoProof of Concept
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVERREGEX-1584358		NoNo Known Exploit
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVERREGEX-1585624		NoProof of Concept
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVERREGEX-2824151		NoProof of Concept
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-TRIM-1017038		YesProof of Concept
high severity736/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.3		Sandbox Bypass
SNYK-JS-WEBPACK-3358798		NoProof of Concept
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Prototype Pollution
SNYK-JS-XML2JS-5414874		NoProof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: ajv The new version differs by 111 commits.

See the full diff

Package name: aws-sdk The new version differs by 250 commits.

See the full diff

Package name: copy-webpack-plugin The new version differs by 40 commits.

See the full diff

Package name: domwaiter The new version differs by 8 commits.

See the full diff

Package name: eslint-plugin-import The new version differs by 181 commits.
  • b0131d2 Bump to v2.25.0
  • 7463de2 utils: v2.7.0
  • 900ac9a [resolvers/webpack] [deps] update `is-core-module`
  • c117be5 [Dev Deps] update `array.prototype.flatmap`, `glob`; remove `babel-preset-es2015-argon`
  • 0e857b6 [Deps] update `array-includes`, `array.prototype.flat`, `is-core-module`, `is-glob`, `object.values`
  • 62e2d88 [New] Support `eslint` v8
  • 9a744f7 [Fix] `default`, `ExportMap`: Resolve extended TypeScript configuration files
  • dd81424 [Refactor] `no-unresolved`, `no-extraneous-dependencies`: moduleVisitor usage
  • 4f0f560 [Docs] `no-namespace`: fix a typo
  • 430d16c [Tests] eslint-import-resolver-typescript@1.0.2 doesn't resolve .js
  • 47e9c89 [Tests] type-only imports were added in TypeScript ESTree 2.23.0
  • 28669b9 [Tests] `no-extraneous-dependencies` ignores unresolved imports
  • 471790f [Tests] fix skip usage
  • fd85369 [Tests] skip failing test on eslint < 6 + node < 8
  • 64423e9 [Tests] add passing test for export-star
  • 58fe766 [Tests] ignore resolver tests, scripts, and unused memo-parser
  • 47ea669 [Fix] `order`: Fix import ordering in TypeScript module declarations
  • 4ed7867 [Fix] `no-unresolved`: ignore type-only imports
  • 4d15e26 [patch] TypeScript config: remove `.d.ts` from `import/parsers` setting and `import/extensions` setting
  • 9ccdcb7 [Refactor] switch to an internal replacement for `pkg-up` and `read-pkg-up`
  • 1571913 [utils] [new] create internal replacement for `pkg-up` and `read-pkg-up`
  • 7c382f0 [New] `no-unused-modules`: support dynamic imports
  • 7579748 [utils] [new] add `visit`, to support dynamic imports
  • 35bd977 [New] `no-unresolved`: add `caseSensitiveStrict` option

See the full diff

Package name: express The new version differs by 117 commits.
  • 3d7fce5 4.17.3
  • f906371 build: update example dependencies
  • 6381bc6 deps: qs@6.9.7
  • a007863 deps: body-parser@1.19.2
  • e98f584 Revert "build: use minimatch@3.0.4 for Node.js < 4"
  • a659137 tests: use strict mode
  • a39e409 tests: prevent leaking changes to NODE_ENV
  • 82de4de examples: fix path traversal in downloads example
  • 12310c5 build: use nyc for test coverage
  • 884657d examples: remove bitwise syntax for includes check
  • 7511d08 build: use minimatch@3.0.4 for Node.js < 4
  • 2585f20 tests: fix test missing assertion
  • 9d09762 build: supertest@6.2.2
  • 43cc56e build: clean up gitignore
  • 1c7bbcc build: Node.js@14.19
  • 9cbbc8a deps: cookie@0.4.2
  • 6fbc269 pref: remove unnecessary regexp for trust proxy
  • 2bc734a deps: accepts@~1.3.8
  • 89bb531 docs: fix typo in res.download jsdoc
  • 744564f tests: add test for multiple ips in "trust proxy"
  • da6cb0e tests: add range tests to res.download
  • 00ad5be tests: add more tests for app.request & app.response
  • 141914e tests: fix tests that did not bubble errors
  • bd4fdfe tests: remove global dependency on should

See the full diff

Package name: got The new version differs by 250 commits.

See the full diff

Package name: hubdown The new version differs by 37 commits.

See the full diff

Package name: husky The new version differs by 58 commits.

See the full diff

Package name: jest The new version differs by 250 commits.

See the full diff

Package name: linkinator The new version differs by 141 commits.

See the full diff

Package name: lodash The new version differs by 1 commits.

See the full diff

Package name: node-fetch The new version differs by 7 commits.

See the full diff

Package name: nodemon The new version differs by 95 commits.

See the full diff

Package name: pa11y-ci The new version differs by 21 commits.
  • efad302 Fix minimum node version in README
  • 28f161a Version 3.0.0
  • 52fd274 Fix error with absolute paths on ...

snyk-botand others added 25 commits December 26, 2020 10:13
@snyk-bot
fix: package.json & package-lock.json to reduce vulnerabilities
57c4a77
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-FLAT-596927
- https://snyk.io/vuln/SNYK-JS-LODASH-590103
@B020239
Merge pull request#1from B020239/snyk-fix-de08bbc38eceb81147e922896…
12463d6
…48f8f83
[Snyk] Fix for 2 vulnerabilities
@snyk-bot
fix: package.json & package-lock.json to reduce vulnerabilities
965edc2
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-CACHEBASE-1054631
@B020239
Merge pull request#7from B020239/snyk-fix-93d87a10f2ab6b83b178684a5…
f23c286
…1d2c531
[Snyk] Security upgrade webpack from 4.44.0 to 5.0.0
@snyk-bot
fix: translations/es-XL/content/actions/creating-actions/dockerfile-s…
545b9aa
…upport-for-github-actions.md to reduce vulnerabilities
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-DEBIAN9-APT-407402
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356506
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356506
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356851
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356851
@snyk-bot
fix: translations/ko-KR/content/actions/creating-actions/dockerfile-s…
8237473
…upport-for-github-actions.md to reduce vulnerabilities
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-DEBIAN9-APT-407402
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356506
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356851
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356851
- https://snyk.io/vuln/SNYK-DEBIAN9-LIBGCRYPT20-1297891
@snyk-bot
fix: translations/de-DE/content/actions/creating-actions/dockerfile-s…
c25c25f
…upport-for-github-actions.md to reduce vulnerabilities
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-DEBIAN9-APT-407402
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356506
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356851
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356851
- https://snyk.io/vuln/SNYK-DEBIAN9-LIBGCRYPT20-1297891
@B020239
Merge pull request#61from B020239/snyk-fix-caec899c077f0319b2b620aa…
55ef6a3
…c84012d5
[Snyk] Security upgrade debian from 9.5-slim to 9.13-slim
@B020239
Merge pull request#60from B020239/snyk-fix-7bcc5dbdf3354168717d05d0…
9e83e0c
…159d27c5
[Snyk] Security upgrade debian from 9.5-slim to stretch-20210621-slim
@snyk-bot
fix: translations/ko-KR/content/actions/creating-actions/dockerfile-s…
87826d7
…upport-for-github-actions.md to reduce vulnerabilities
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356851
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356851
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-356851
- https://snyk.io/vuln/SNYK-DEBIAN9-LIBGCRYPT20-1297891
- https://snyk.io/vuln/SNYK-DEBIAN9-UTILLINUX-285822
@B020239
Merge pull request#63from B020239/snyk-fix-cf56e611401adacd7c1b90c8…
8f5cf36
…5c3c3bf8
[Snyk] Security upgrade debian from stretch-20210621-slim to 10-slim
@snyk-bot
fix: package.json to reduce vulnerabilities
79ffbb7
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424
- https://snyk.io/vuln/SNYK-JS-AXIOS-1038255
- https://snyk.io/vuln/SNYK-JS-AXIOS-1579269
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1090595
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1047770
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1584358
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1585624
@B020239
Merge pull request#96from B020239/snyk-fix-928a65805373d7fc4bc48bb5…
e6cddbe
…c99f2b6a
[Snyk] Fix for 12 vulnerabilities
@B020239
Merge pull request#51from B020239/snyk-fix-f07fae9410b0ed601888d1bb…
5798cde
…47ad8496
[Snyk] Security upgrade debian from 9.5-slim to stretch-slim
@snyk-bot
fix: translations/ja-JP/content/actions/creating-actions/dockerfile-s…
a3b6f2c
…upport-for-github-actions.md to reduce vulnerabilities
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-DEBIAN9-APT-407402
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-2340913
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-2340913
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-2340924
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-2340924
@snyk-bot
fix: content/actions/creating-actions/dockerfile-support-for-github-a…
90e6a79
…ctions.md to reduce vulnerabilities
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-DEBIAN9-APT-407402
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-2340913
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-2340913
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-2340924
- https://snyk.io/vuln/SNYK-DEBIAN9-GLIBC-2340924
@B020239
Merge pull request#112from B020239/snyk-fix-f78e78d4384388ee3ccc09b…
e80014c
…addf26c05
[Snyk] Security upgrade debian from 9.5-slim to stretch-20211201-slim
@B020239
Merge pull request#111from B020239/snyk-fix-13b7a690a1a987e9c6ac1f1…
c193123
…16556dfed
[Snyk] Security upgrade debian from 9.5-slim to stretch-20211201-slim
@snyk-bot
fix: package.json to reduce vulnerabilities
2323b31
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424
- https://snyk.io/vuln/SNYK-JS-AXIOS-1038255
- https://snyk.io/vuln/SNYK-JS-AXIOS-1579269
- https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2332181
- https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2396346
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1090595
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1047770
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1584358
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1585624
@B020239
Merge pull request#124from B020239/snyk-fix-dee29cb90795cba6181fa04…
9181441
…c63c0e6a1
[Snyk] Fix for 15 vulnerabilities
@snyk-bot
fix: package.json to reduce vulnerabilities
b64ff4e
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-ASYNC-2441827
- https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424
- https://snyk.io/vuln/SNYK-JS-AXIOS-1038255
- https://snyk.io/vuln/SNYK-JS-AXIOS-1579269
- https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2332181
- https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2396346
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1090595
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1047770
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1584358
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1585624
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-2824151
@B020239
Merge pull request#141from B020239/snyk-fix-3a7c9d37c70271e6fe74a6e…
1e6d26e
…5cbffdcc0
[Snyk] Fix for 17 vulnerabilities
@snyk-bot
fix: package.json to reduce vulnerabilities
364ed8e
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-GOT-2932019
@B020239
Merge pull request#152from B020239/snyk-fix-ea9858b878eeb3915746c5d…
796a040
…74397274f
[Snyk] Security upgrade linkinator from 2.2.2 to 4.0.0
@snyk-bot
fix: package.json to reduce vulnerabilities
166fc61
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ACTIONSCORE-2980270
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-ASYNC-2441827
- https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424
- https://snyk.io/vuln/SNYK-JS-AXIOS-1038255
- https://snyk.io/vuln/SNYK-JS-AXIOS-1579269
- https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2332181
- https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2396346
- https://snyk.io/vuln/SNYK-JS-GOT-2932019
- https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3042992
- https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3043105
- https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3105943
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1090595
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1047770
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1584358
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-1585624
- https://snyk.io/vuln/SNYK-JS-SEMVERREGEX-2824151
- https://snyk.io/vuln/SNYK-JS-TRIM-1017038
- https://snyk.io/vuln/SNYK-JS-WEBPACK-3358798
- https://snyk.io/vuln/SNYK-JS-XML2JS-5414874
@B020239
B020239force-pushed the main branch 2 times, most recently from 8ff769d to 8e324deCompareJuly 2, 2023 14:57
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@B020239@snyk-bot