Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade @parcel/plugin from 2.0.0-rc.0 to 2.0.0 #123

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

thombergs
Copy link
Member

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • packages/plugins/parcel-reporter-manifest/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Prototype Pollution
SNYK-JS-UNSETVALUE-2400660
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @parcel/plugin The new version differs by 90 commits.
  • 84da50a v2.0.0
  • aa0a369 Small copy change
  • c78601b shouldVisitChild: Check parent and child node previously deferred separately (#7043)
  • 2c83842 Fix scope resolution for TS enums (#7057)
  • dbe1153 Fix order of hoisted variable declarations (#7053)
  • bea9442 Fix named export with different export name for wrapped assets (#7052)
  • 2175e1b Mark '*' as used when the reexport is only decided at runtime (#7049)
  • 4312b91 Update Micromatch (#6958)
  • 5afe766 Fail when unable to build a native package (#6962)
  • 971ed24 Update watcher and source-map library to 2.0.0 (#7044)
  • 810a854 Add missing C flags for SIMD support in build workflow (#7045)
  • d6de61d Fix shaking for functions types with overload signatures (#7036)
  • daf2cd9 Safely position the HMR script (#6961)
  • 89b4e51 Unmark defer for dependency that become used ('does not export') (#7035)
  • b575212 Bump swc (#7033)
  • 415710f Fix CSS tree shaking with 'build --no-scope-hoist' (#5728)
  • ea0f4e4 Allow jsx and tsx as lang for script block in Vue SFCs (#6983)
  • d2d4f1c Never enable JSX in a .ts file (#7031)
  • aafc318 Don't use deprecated querystring package (#6806)
  • a6a6fb2 Fix cache invalidation when shouldOptimize changes (#7030)
  • 7d4d53a Update all references to v2.parceljs.org to just parceljs.org (#7029)
  • 91de5c0 Ensure symbol order is consistent (#7021)
  • 2ebed00 Ensure named exports are prioritized over wildcard re-exports (#7016)
  • 4904f20 Fix autoinstall with Yarn 2+ (#7023)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

… vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660
Copy link

changeset-bot bot commented Nov 27, 2023

⚠️ No Changeset found

Latest commit: b841833

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants