Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 29 vulnerabilities #31

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 29 vulnerabilities #31

wants to merge 1 commit into from

Conversation

abdullahceylan
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Internal Property Tampering
SNYK-JS-BSON-561052		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-CONVICT-1062508		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-CONVICT-2340604		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-CONVICT-2774757		 Yes No Known Exploit
high severity 741/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.4		 DLL Injection
SNYK-JS-KERBEROS-568900		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASH-1040724		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-450202		 Yes Proof of Concept
high severity 731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		 Prototype Pollution
SNYK-JS-LODASH-567746		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-608086		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-73638		 Yes Proof of Concept
medium severity 541/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Directory Traversal
SNYK-JS-MOMENT-2440688		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-MONGODB-473855		 Yes No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Information Exposure
SNYK-JS-NODEFETCH-2342118		 Yes No Known Exploit
medium severity 520/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service
SNYK-JS-NODEFETCH-674311		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090599		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090600		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090601		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090602		 Yes Proof of Concept
high severity 816/1000
Why? Mature exploit, Has a fix available, CVSS 8.6		 Uninitialized Memory Exposure
npm:base64-url:20180512		 Yes Mature
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:hoek:20180212		 Yes Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:lodash:20180130		 Yes Proof of Concept
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Regular Expression Denial of Service (ReDoS)
npm:moment:20161019		 Yes No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:moment:20170905		 Yes No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Buffer Overflow
npm:validator:20160218		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: base64-url The new version differs by 6 commits.

See the full diff

Package name: bassmaster The new version differs by 4 commits.

See the full diff

Package name: bell The new version differs by 58 commits.

See the full diff

Package name: convict The new version differs by 250 commits.

See the full diff

Package name: good The new version differs by 83 commits.
  • f0b562e version 7.1.0
  • 45606c7 Restored wreck logging. Closes #469. (#514)
  • 6584880 Upgrade async. Fixes #515. (#538)
  • 265a5ca Update deps. Closes #515
  • f957062 Don't create a reporter if no streams were provided. Addresses #534 (#535)
  • 9d198f8 update stream example in docs and other minors (#536)
  • dfe7912 non breaking change adds responseSentTime. Closes #530 (#533)
  • 3bd61be current version shield links to good @ npmjs (#521)
  • ae1778b Support functions as modules (#517)
  • b8f923e Add request route tags to response event (#516)
  • 7a78ec8 Fix previous hapi versions
  • 77bae30 Fix hapi v15.0.2 timing errors in tests
  • 4a22673 hapi 15. Closes #509
  • 2d510b1 handle missing coverage on hapi < 15
  • 3f9a36a hapi 15 tests
  • 51e8ec5 hapi 15
  • 502b961 hapi 15
  • 673af3e Changed keys used to identify reporters in example (#508)
  • cf9f3fb Update CONTRIBUTING.md
  • 65730b1 correct and improve documentation (#505)
  • a55e808 Not enough feedback when error. Closes #498 (#499)
  • 8561ecc Added .npmignore file. Closes #485 (#496)
  • 0c93720 Update LICENSE
  • 0434d88 Closes #491. Update tests to code3.

See the full diff

Package name: good-console The new version differs by 33 commits.

See the full diff

Package name: hapi The new version differs by 107 commits.
  • faacf02 deps and passthrough validation error. Closes #3136. Closes #3137. Closes #3138. Closes #3139. Closes #3140. Closes #3141. Closes #3142. Closes #3143. Closes #3144. Closes #3145. Closes #3146. Closes #3147
  • 40dbdc1 Merge pull request #3128 from mikefrey/patch-1
  • e169ee3 Spelling/grammar fix
  • af95913 Merge pull request #3111 from hapijs/johnbrett-patch-1
  • 2752e23 add test for multipart payload exceeding byte limit
  • d870e6a Merge pull request #3113 from danielb2/master
  • 5d1b437 test for strictHeader false
  • f8e897d Update hapijs/subtext to 4.0.1 from 4.0.0
  • 8aef93a typo
  • 526d5ea Cleanup
  • fb83094 Merge branch 'master' of github.com:hapijs/hapi
  • a739abe Allow validating any input. Closes #3107
  • 6f20a78 Merge pull request #3105 from devinivy/api-deps-on-init
  • d3ca463 Clarify that plugin deps are enforced during initialize
  • 0cd1b62 Merge pull request #3068 from kanongil/fast-shutdown
  • ea04005 version
  • 9e5c889 Fix incorrect entity error message. Closes #3101
  • 7a47a85 Actively end idle persistent connections on server.stop()
  • 2435a08 Test that server.stop() completes active requests before denying new requests
  • a123307 Add server.stop() destroy test for in-progress connections
  • 6e80746 Revise server.stop() self close test
  • ed195fa 13.2.1
  • 23e333e Cleanup for #3044
  • 687a378 Merge pull request #3044 from csabapalfi/disable-cache-control

See the full diff

Package name: inert The new version differs by 23 commits.

See the full diff

Package name: jsonwebtoken The new version differs by 120 commits.

See the full diff

Package name: mongodb The new version differs by 250 commits.
  • c6f417e chore(release): 3.1.13
  • 210c71d fix(db_ops): ensure we async resolve errors in createCollection
  • 5ad9fa9 fix(changeStream): properly handle changeStream event mid-close (#1902)
  • e806be4 fix(bulk): honor ignoreUndefined in initializeUnorderedBulkOp
  • 050267d fix(*): restore ability to webpack by removing `makeLazyLoader`
  • 6e896f4 docs: adding aggregation, createIndex, and runCommand examples
  • cb3cd12 chore(release): 3.1.12
  • 508d685 Revert "chore(release): 3.2.0"
  • e7619aa chore(release): 3.2.0
  • d0dc228 chore(travis): include forgotten stage info for sharded builds
  • ffbe90b chore(travis): run sharded tests in travis as well
  • 9bef6e7 feat(core): update to mongodb-core v3.1.11
  • e4bb39e chore(release): 3.1.11
  • 76c0130 chore(core): bump version of mongodb-core
  • a3adb3f fix(bulk): fix error propagation in empty bulk.execute
  • ec0e30e doc(change-streams): correct typo, add missing example
  • 10ea992 chore(package): update lock file
  • fcb3ec1 test(sharded): reduce some sharded errors
  • d4eae97 test(sessions): undo hack for apm events in sessions tests
  • 0eaca21 test(sessions): fixing broken session test
  • 6790a74 test(sharding): fixing old sharding tests
  • 98f0c68 test(sharded): fixing sharded operation test
  • c6a9baa test(sessions): fixing session tests in sharded env
  • 985f0e9 test(drop): fixing drop assertions for sharded tests

See the full diff

Package name: node-fetch The new version differs by 240 commits.
  • 1ef4b56 backport of #1449 (#1453)
  • 8fe5c4e 2.x: Specify encoding as an optional peer dependency in package.json (#1310)
  • f56b0c6 fix(URL): prefer built in URL version when available and fallback to whatwg (#1352)
  • b5417ae fix: import whatwg-url in a way compatible with ESM Node (#1303)
  • 18193c5 fix v2.6.3 that did not sending query params (#1301)
  • ace7536 fix: properly encode url with unicode characters (#1291)
  • 152214c Fix(package.json): Corrected main file path in package.json (#1274)
  • b5e2e41 update version number
  • 2358a6c Honor the `size` option after following a redirect and revert data uri support
  • 8c197f8 docs: Fix typos and grammatical errors in README.md (#686)
  • 1e99050 fix: Change error message thrown with redirect mode set to error (#653)
  • 244e6f6 docs: Show backers in README
  • 6a5d192 fix: Properly parse meta tag when parameters are reversed (#682)
  • 47a24a0 chore: Add opencollective badge
  • 7b13662 chore: Add funding link
  • 5535c2e fix: Check for global.fetch before binding it (#674)
  • 1d5778a docs: Add Discord badge
  • eb3a572 feat: Data URI support (#659)
  • 086be6f Remove --save option as it isn't required anymore (#581)
  • 95286f5 v2.6.0 (#638)
  • bf8b4e8 Allow agent option to be a function (#632)
  • 0c2294e 2.5.0 release (#630)
  • 0fc414c Allow third party blob implementation (#629)
  • d8f5ba0 build: disable generation of package-lock since it is not used (#623)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Buffer Overflow
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json to reduce vulnerabilities
2b41527 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-BSON-561052
- https://snyk.io/vuln/SNYK-JS-CONVICT-1062508
- https://snyk.io/vuln/SNYK-JS-CONVICT-2340604
- https://snyk.io/vuln/SNYK-JS-CONVICT-2774757
- https://snyk.io/vuln/SNYK-JS-KERBEROS-568900
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-MOMENT-2440688
- https://snyk.io/vuln/SNYK-JS-MONGODB-473855
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090599
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090600
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090601
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090602
- https://snyk.io/vuln/npm:base64-url:20180512
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:moment:20161019
- https://snyk.io/vuln/npm:moment:20170905
- https://snyk.io/vuln/npm:ms:20170412
- https://snyk.io/vuln/npm:validator:20160218
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@abdullahceylan @snyk-bot