Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 3 vulnerabilities #147

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 3 vulnerabilities #147

wants to merge 1 commit into from

Conversation

gregnrobinson
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • docs/package.json
    • docs/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Command Injection
SNYK-JS-REACTDEVUTILS-1083268		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SCSSTOKENIZER-2339884		 Yes No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Remote Code Execution (RCE)
SNYK-JS-SHARP-2848109		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: gatsby The new version differs by 250 commits.

See the full diff

Package name: gatsby-plugin-manifest The new version differs by 250 commits.
  • f6734b9 chore(release): Publish
  • 9a616c0 fix(gatsby): wait for LMDB upserts to finish before emitting ENGINES_READY (#34853) (#34896)
  • f5705b9 fix(create-gatsby): Add required deps for theme-ui option (#34885) (#34897)
  • 9a579f1 fix(gatsby-core-utils): fix 304 when file does not exists (#34842) (#34888)
  • 148d016 fix(gatsby): Remove double enhanced-resolve dep (#34854) (#34889)
  • 19b0304 feat(gatsby-core-utils): improve fetch-remote-file (#34758)
  • ac1d777 fix(gatsby-source-contentful): avoid confusion of Gatsby node and Contentful node count in logs (#34830)
  • ee8c874 refactor(gatsby-source-contentful): remove unnecessary check for existing node (#34829)
  • 056b48e test(gatsby): Add a memory test suite command to the memory benchmark (#34810)
  • 45cb1f1 chore(release): Publish next
  • 4c832bf documentation: Add Third Party Schema (#34820)
  • 9f23dec chore(gatsby): cache shouldn't reference nodes strongly (#34821)
  • f2d4830 feat(gatsby-core-utils): create proper mutex (#34761)
  • 21ef185 chore(changelogs): update changelogs (#34826)
  • a2f99af fix(deps): update starters and examples gatsby packages to ^4.7.2 (#34822)
  • 76c89d8 chore(release): Publish next
  • 54d29c4 chore(gatsby): upgrade from lmdb-store to lmdb (#34576)
  • 3df8583 fix(core): Make filter/sort query only hold onto node properties it needs (#34747)
  • 3c3362b refactor(core): Make load plugins modular, prepare for TS (#34813)
  • 3d74584 feat(gatsby): allow referencing derived types in schema customization (#34787)
  • bfd04d3 fix(gatsby): Content Sync DSG bug (#34799)
  • 326a483 fix(deps): update dependency sharp to ^0.30.1 (#34755)
  • 7b958f9 docs: update typo Forestry (#34805)
  • ba8e21c feat(gatsby): Match node manifest pages by page context slug (#34790)

See the full diff

Package name: gatsby-plugin-sharp The new version differs by 250 commits.
  • f6734b9 chore(release): Publish
  • 9a616c0 fix(gatsby): wait for LMDB upserts to finish before emitting ENGINES_READY (#34853) (#34896)
  • f5705b9 fix(create-gatsby): Add required deps for theme-ui option (#34885) (#34897)
  • 9a579f1 fix(gatsby-core-utils): fix 304 when file does not exists (#34842) (#34888)
  • 148d016 fix(gatsby): Remove double enhanced-resolve dep (#34854) (#34889)
  • 19b0304 feat(gatsby-core-utils): improve fetch-remote-file (#34758)
  • ac1d777 fix(gatsby-source-contentful): avoid confusion of Gatsby node and Contentful node count in logs (#34830)
  • ee8c874 refactor(gatsby-source-contentful): remove unnecessary check for existing node (#34829)
  • 056b48e test(gatsby): Add a memory test suite command to the memory benchmark (#34810)
  • 45cb1f1 chore(release): Publish next
  • 4c832bf documentation: Add Third Party Schema (#34820)
  • 9f23dec chore(gatsby): cache shouldn't reference nodes strongly (#34821)
  • f2d4830 feat(gatsby-core-utils): create proper mutex (#34761)
  • 21ef185 chore(changelogs): update changelogs (#34826)
  • a2f99af fix(deps): update starters and examples gatsby packages to ^4.7.2 (#34822)
  • 76c89d8 chore(release): Publish next
  • 54d29c4 chore(gatsby): upgrade from lmdb-store to lmdb (#34576)
  • 3df8583 fix(core): Make filter/sort query only hold onto node properties it needs (#34747)
  • 3c3362b refactor(core): Make load plugins modular, prepare for TS (#34813)
  • 3d74584 feat(gatsby): allow referencing derived types in schema customization (#34787)
  • bfd04d3 fix(gatsby): Content Sync DSG bug (#34799)
  • 326a483 fix(deps): update dependency sharp to ^0.30.1 (#34755)
  • 7b958f9 docs: update typo Forestry (#34805)
  • ba8e21c feat(gatsby): Match node manifest pages by page context slug (#34790)

See the full diff

Package name: gatsby-transformer-sharp The new version differs by 250 commits.
  • f6734b9 chore(release): Publish
  • 9a616c0 fix(gatsby): wait for LMDB upserts to finish before emitting ENGINES_READY (#34853) (#34896)
  • f5705b9 fix(create-gatsby): Add required deps for theme-ui option (#34885) (#34897)
  • 9a579f1 fix(gatsby-core-utils): fix 304 when file does not exists (#34842) (#34888)
  • 148d016 fix(gatsby): Remove double enhanced-resolve dep (#34854) (#34889)
  • 19b0304 feat(gatsby-core-utils): improve fetch-remote-file (#34758)
  • ac1d777 fix(gatsby-source-contentful): avoid confusion of Gatsby node and Contentful node count in logs (#34830)
  • ee8c874 refactor(gatsby-source-contentful): remove unnecessary check for existing node (#34829)
  • 056b48e test(gatsby): Add a memory test suite command to the memory benchmark (#34810)
  • 45cb1f1 chore(release): Publish next
  • 4c832bf documentation: Add Third Party Schema (#34820)
  • 9f23dec chore(gatsby): cache shouldn't reference nodes strongly (#34821)
  • f2d4830 feat(gatsby-core-utils): create proper mutex (#34761)
  • 21ef185 chore(changelogs): update changelogs (#34826)
  • a2f99af fix(deps): update starters and examples gatsby packages to ^4.7.2 (#34822)
  • 76c89d8 chore(release): Publish next
  • 54d29c4 chore(gatsby): upgrade from lmdb-store to lmdb (#34576)
  • 3df8583 fix(core): Make filter/sort query only hold onto node properties it needs (#34747)
  • 3c3362b refactor(core): Make load plugins modular, prepare for TS (#34813)
  • 3d74584 feat(gatsby): allow referencing derived types in schema customization (#34787)
  • bfd04d3 fix(gatsby): Content Sync DSG bug (#34799)
  • 326a483 fix(deps): update dependency sharp to ^0.30.1 (#34755)
  • 7b958f9 docs: update typo Forestry (#34805)
  • ba8e21c feat(gatsby): Match node manifest pages by page context slug (#34790)

See the full diff

Package name: node-sass The new version differs by 90 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@gregnrobinson @snyk-bot