Skip to content

[Snyk] Fix for 23 vulnerabilities - #162

Open
snyk-bot wants to merge 1 commit into
mainfrom
snyk-fix-25e70497c4ea24bccc1e2ca231ea83fe
Open

[Snyk] Fix for 23 vulnerabilities#162
snyk-bot wants to merge 1 commit into
mainfrom
snyk-fix-25e70497c4ea24bccc1e2ca231ea83fe

Conversation

@snyk-bot

@snyk-botsnyk-bot commented Apr 25, 2023

Copy link
Copy Markdown

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • node_modules/file-entry-cache/package.json
    • node_modules/file-entry-cache/.snyk

Vulnerabilities that will be fixed

With an upgrade:
SeverityPriority Score (*)IssueBreaking ChangeExploit Maturity
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		YesProof of Concept
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		YesProof of Concept
high severity681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		Command Injection
SNYK-JS-LODASH-1040724		YesProof of Concept
high severity686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		Prototype Pollution
SNYK-JS-LODASH-450202		YesProof of Concept
high severity731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		Prototype Pollution
SNYK-JS-LODASH-567746		YesProof of Concept
high severity686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		Prototype Pollution
SNYK-JS-LODASH-608086		YesProof of Concept
high severity686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		Prototype Pollution
SNYK-JS-LODASH-73638		YesProof of Concept
medium severity541/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.4		Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		YesProof of Concept
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-174116		YesNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-451540		YesNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-1019388		YesNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		YesNo Known Exploit
low severity506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		Prototype Pollution
SNYK-JS-MINIMIST-2429795		YesProof of Concept
medium severity601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		Prototype Pollution
SNYK-JS-MINIMIST-559764		YesProof of Concept
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOCHA-2863123		YesNo Known Exploit
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOCHA-561476		YesNo Known Exploit
low severity506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		YesProof of Concept
high severity579/1000
Why? Has a fix available, CVSS 7.3		Prototype Pollution
npm:extend:20180424		YesNo Known Exploit
critical severity704/1000
Why? Has a fix available, CVSS 9.8		Arbitrary Code Injection
npm:growl:20160721		YesNo Known Exploit
medium severity636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		Prototype Pollution
npm:lodash:20180130		YesProof of Concept
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
npm:minimatch:20160620		YesNo Known Exploit
low severity399/1000
Why? Has a fix available, CVSS 3.7		Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		YesNo Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: changelogx The new version differs by 11 commits.

See the full diff

Package name: esbeautifier The new version differs by 66 commits.
  • 8387a6c DOC: Generate changelog
  • 2d3edf1 BLD: Release v8.0.0
  • 68445ab BLD: Update to latest version of esformatter-jsx to properly handle the async tokens
  • 3c89002 DOC: Generate changelog
  • 16b8390 BLD: Release v7.0.0
  • 969987e BLD: update deps to next major version
  • b21d97c DOC: Generate changelog
  • 2dbad56 BLD: Release v6.1.9
  • ab2ea59 BLD: Update to latest esformatter-jsx
  • af2e720 DOC: Generate changelog
  • dd68a9b BLD: Release v6.1.8
  • 9cb2e4f FIX: proper support for async/await
  • 1d2581e DOC: Generate changelog
  • 2719cb7 BLD: Release v6.1.7
  • 344b5b7 FEAT: support async/await
  • 89eeaa7 DOC: Generate changelog
  • 0ead874 BLD: Release v6.1.6
  • eff0371 FIX: Properly handle ES7 decorators that are expressions
  • c0ee2a0 DOC: Generate changelog
  • 0af7a88 BLD: Release v6.1.5
  • 87df818 BLD: Update esformatter-jsx dep to include fix for `NamedExportDeclaration`
  • 904a660 DOC: Generate changelog
  • 0705af5 BLD: Release v6.1.4
  • ccd58c1 BLD: lock dependencies to a specific commit in github

See the full diff

Package name: eslinter The new version differs by 3 commits.

See the full diff

Package name: istanbul The new version differs by 72 commits.

See the full diff

Package name: mocha The new version differs by 250 commits.

See the full diff

With a Snyk patch:
SeverityPriority Score (*)IssueExploit Maturity
high severity579/1000
Why? Has a fix available, CVSS 7.3		Prototype Pollution
npm:extend:20180424		No Known Exploit
medium severity636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		Prototype Pollution
npm:lodash:20180130		Proof of Concept
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
npm:minimatch:20160620		No Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
npm:semver:20150403		No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Arbitrary Code Injection

@snyk-bot
fix: node_modules/file-entry-cache/package.json & node_modules/file-e…
81725bf
…ntry-cache/.snyk to reduce vulnerabilities
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/SNYK-JS-MARKED-174116
- https://snyk.io/vuln/SNYK-JS-MARKED-451540
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-1019388
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-MOCHA-2863123
- https://snyk.io/vuln/SNYK-JS-MOCHA-561476
- https://snyk.io/vuln/npm:debug:20170905
- https://snyk.io/vuln/npm:extend:20180424
- https://snyk.io/vuln/npm:growl:20160721
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:minimatch:20160620
- https://snyk.io/vuln/npm:ms:20170412
The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/npm:extend:20180424
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:minimatch:20160620
- https://snyk.io/vuln/npm:semver:20150403
@alisccoaliscco mentioned this pull request Nov 29, 2023
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@snyk-bot