[Snyk] Fix for 11 vulnerabilities - #69

Open

ryan-ally wants to merge 1 commit into

snyk-fix-f1f476ef3cceef18b6c9bd42491e631a

ryan-ally commented Dec 20, 2023

Owner

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962462	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-INI-1048974	Yes	Proof of Concept
	641/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.4	Prototype Pollution SNYK-JS-JSON5-3182856	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-TRIM-1017038	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: stylelint

The new version differs by 250 commits.

060310c 14.0.0
ff4a1ef Prepare CHANGELOG
8d2f6e1 Bump postcss (fix: fixed theme flash on page load nodejs/nodejs.org#5619)
f552608 Merge pull request fix: main download button for linux incorrect nodejs/nodejs.org#5618 from stylelint/dependabot/npm_and_yarn/husky-7.0.4
7ed17ad Bump husky from 7.0.2 to 7.0.4
4d9f75e Merge pull request chore: add static builds to ci to ensure static builds are still working nodejs/nodejs.org#5617 from stylelint/dependabot/npm_and_yarn/jest-27.3.1
bc9dd0b Bump jest from 27.2.5 to 27.3.1
82e2507 Merge pull request fix: use correct matcher in middleware.ts nodejs/nodejs.org#5604 from stylelint/v14
16d259f Update CHANGELOG.md
70b1149 Fix false positives for dynamic-range keywords in media-feature-name-no-unknown (chore: node_env as global env nodejs/nodejs.org#5613)
8dca498 Show more info in missing customSyntax warning (blog: postpone sec release notice nodejs/nodejs.org#5611)
2eee0a9 Remove v14 CI triggers (Big green download button on nodejs.org from Linux/x64 gives source archive nodejs/nodejs.org#5610)
12f8081 14.0.0-0
5dd7ec1 Prepare 14.0.0
67313a3 Add support for `extends` in `overrides` config (Dist Is 404ing nodejs/nodejs.org#5603)
b6fd2fc Document no need for postcss-html maintainer (What's new from the Website team - News nodejs/nodejs.org#5602)
bf28025 Recommend using shared configs (meta: bump the storybook group with 6 updates nodejs/nodejs.org#5598)
07118d6 Update CHANGELOG.md
367142a Change `ignoreFiles` to be extendable (meta: bump the testing group with 5 updates nodejs/nodejs.org#5596)
1b4162f Fix conflicts in dependabot
87c5fde Bump picocolors from 0.2.1 to 1.0.0 (Link to security policy from blog post is 404ing nodejs/nodejs.org#5601)
1f32094 Bump typescript from 4.4.3 to 4.4.4 (fix: sitemap url for production deployments nodejs/nodejs.org#5599)
88b9575 Revise contributors section of README (blog: fix sec release date nodejs/nodejs.org#5585)
e38da70 Use problem rather than violation in docs and types (chore: configuration for merge queues nodejs/nodejs.org#5592)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Command Injection

fix: package.json & package-lock.json to reduce vulnerabilities

105a8c1

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962462
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://snyk.io/vuln/SNYK-JS-JSON5-3182856
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-TRIM-1017038
- https://snyk.io/vuln/npm:debug:20170905

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment