Skip to content

[Snyk] Fix for 29 vulnerabilities - #67

Open
srmibextesting wants to merge 1 commit into
masterfrom
snyk-fix-3ec5145fc8a065f40a2bd871566d0a6d
Open

[Snyk] Fix for 29 vulnerabilities#67
srmibextesting wants to merge 1 commit into
masterfrom
snyk-fix-3ec5145fc8a065f40a2bd871566d0a6d

Conversation

@srmibextesting

@srmibextestingsrmibextesting commented Oct 7, 2022

Copy link
Copy Markdown
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • script/package.json
    • script/package-lock.json
    • script/.snyk

Vulnerabilities that will be fixed

With an upgrade:
SeverityPriority Score (*)IssueBreaking ChangeExploit Maturity
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		YesProof of Concept
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Prototype Pollution
SNYK-JS-ASYNC-2441827		NoProof of Concept
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-BROWSERSLIST-1090194		NoProof of Concept
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		YesProof of Concept
medium severity484/1000
Why? Has a fix available, CVSS 5.4		Open Redirect
SNYK-JS-GOT-2932019		YesNo Known Exploit
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		YesProof of Concept
high severity681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		Command Injection
SNYK-JS-LODASH-1040724		YesProof of Concept
high severity686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		Prototype Pollution
SNYK-JS-LODASH-450202		YesProof of Concept
high severity731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		Prototype Pollution
SNYK-JS-LODASH-567746		YesProof of Concept
high severity686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		Prototype Pollution
SNYK-JS-LODASH-608086		YesProof of Concept
high severity686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		Prototype Pollution
SNYK-JS-LODASH-73638		YesProof of Concept
medium severity541/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.4		Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		YesProof of Concept
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-1019388		YesNo Known Exploit
low severity506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		Prototype Pollution
SNYK-JS-MINIMIST-2429795		NoProof of Concept
medium severity601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		Prototype Pollution
SNYK-JS-MINIMIST-559764		NoProof of Concept
medium severity539/1000
Why? Has a fix available, CVSS 6.5		Information Exposure
SNYK-JS-NODEFETCH-2342118		NoNo Known Exploit
medium severity586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1255640		NoProof of Concept
high severity726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1		Command Injection
SNYK-JS-SIMPLEGIT-2421199		YesProof of Concept
high severity726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1		Command Injection
SNYK-JS-SIMPLEGIT-2434306		YesProof of Concept
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-STYLELINT-1585622		YesNo Known Exploit
medium severity509/1000
Why? Has a fix available, CVSS 5.9		Regular Expression Denial of Service (ReDoS)
SNYK-JS-STYLELINT-460283		YesNo Known Exploit
medium severity479/1000
Why? Has a fix available, CVSS 5.3		Regular Expression Denial of Service (ReDoS)
SNYK-JS-TERSER-2806366		YesNo Known Exploit
high severity696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
SNYK-JS-TRIM-1017038		YesProof of Concept
high severity589/1000
Why? Has a fix available, CVSS 7.5		Denial of Service (DoS)
SNYK-JS-TRIMNEWLINES-1298042		YesNo Known Exploit
medium severity601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		Prototype Pollution
SNYK-JS-YARGSPARSER-560381		YesProof of Concept
low severity506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		Regular Expression Denial of Service (ReDoS)
npm:braces:20180219		YesProof of Concept
medium severity636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		Prototype Pollution
npm:lodash:20180130		YesProof of Concept
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
npm:minimatch:20160620		YesNo Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: electron-chromedriver The new version differs by 46 commits.

See the full diff

Package name: electron-packager The new version differs by 89 commits.

See the full diff

Package name: fs-admin The new version differs by 110 commits.

See the full diff

Package name: klaw-sync The new version differs by 14 commits.

See the full diff

Package name: mkdirp The new version differs by 4 commits.
  • b2e7ba0 0.5.2
  • c5b97d1 bump minimist to 1.2 to fix security issue
  • f2003bb test: add v4 and v5 to travis
  • b8629ff tools: update tap + mock-fs. Fix broken test

See the full diff

Package name: node-fetch The new version differs by 7 commits.

See the full diff

Package name: npm The new version differs by 250 commits.
  • 30a9844 7.21.0
  • 0b2cd9d update AUTHORS
  • 06461ec docs: changelog for v7.21.0
  • 771a1cb chore(tests): fix snapshots
  • 71cdfd8 spdx-license-ids@3.0.10
  • 94f92de make-fetch-happen@9.0.5
  • 7ac621c smart-buffer@4.2.0
  • 218caca is-core-module@2.6.0
  • ff6626a fix(docs): update npm-publish access flag info
  • b6f40b5 tar@6.1.10
  • e9e5ee5 @ npmcli/arborist@2.8.2
  • 991a3bd read-package-json@4.0.0
  • f077724 init-package-json@2.0.4
  • 68a19bb fix(error-message): look for er.path not er.file
  • ff34d6c feat(cache): initial implementation of ls and rm
  • 8183976 normalize-package-data@3.0.3
  • df57f0d @ npmcli/run-script@1.8.6
  • 487731c fix(logging): sanitize logged argv
  • 7a58264 chore(ci): check that docs are up to date in ci
  • 22f3bbb chore(docs): add more 'autogenerated' comments
  • 4314490 fix(docs): revert auto-generated portion of docs
  • 32e88c9 fix(did-you-mean): switch levenshtein libraries
  • 59b9851 7.20.6
  • 2591e67 update AUTHORS

See the full diff

Package name: npm-check The new version differs by 5 commits.

See the full diff

Package name: simple-git The new version differs by 250 commits.

See the full diff

Package name: stylelint The new version differs by 250 commits.

See the full diff

Package name: terser The new version differs by 250 commits.

See the full diff

Package name: yargs The new version differs by 250 commits.

See the full diff

With a Snyk patch:
SeverityPriority Score (*)IssueExploit Maturity
high severity731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		Prototype Pollution
SNYK-JS-LODASH-567746		Proof of Concept
high severity579/1000
Why? Has a fix available, CVSS 7.3		Prototype Pollution
npm:extend:20180424		No Known Exploit
medium severity636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		Prototype Pollution
npm:lodash:20180130		Proof of Concept
high severity589/1000
Why? Has a fix available, CVSS 7.5		Regular Expression Denial of Service (ReDoS)
npm:minimatch:20160620		No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: script/package.json, script/package-lock.json & script/.snyk to …
939de60
…reduce vulnerabilities
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-ASYNC-2441827
- https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-GOT-2932019
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-1019388
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199
- https://snyk.io/vuln/SNYK-JS-SIMPLEGIT-2434306
- https://snyk.io/vuln/SNYK-JS-STYLELINT-1585622
- https://snyk.io/vuln/SNYK-JS-STYLELINT-460283
- https://snyk.io/vuln/SNYK-JS-TERSER-2806366
- https://snyk.io/vuln/SNYK-JS-TRIM-1017038
- https://snyk.io/vuln/SNYK-JS-TRIMNEWLINES-1298042
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
- https://snyk.io/vuln/npm:braces:20180219
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:minimatch:20160620
The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/npm:extend:20180424
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:minimatch:20160620
@snyk-botsnyk-bot mentioned this pull request Dec 2, 2022
Open
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

specs cannot be run from release build

2 participants

@srmibextesting@snyk-bot