Skip to content
This repository has been archived by the owner on Jan 2, 2024. It is now read-only.

[Snyk] Fix for 37 vulnerabilities #103

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 37 vulnerabilities #103

wants to merge 1 commit into from

Conversation

haysclark
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Prototype Pollution
SNYK-JS-AJV-584908		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
critical severity 786/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.3		 Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962462		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-CSSWHAT-3035488		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-DECODEURICOMPONENT-3149970		 Yes Proof of Concept
medium severity 703/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.2		 Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-INI-1048974		 Yes Proof of Concept
medium severity 641/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.4		 Prototype Pollution
SNYK-JS-JSON5-3182856		 Yes Proof of Concept
high severity 644/1000
Why? Has a fix available, CVSS 8.6		 Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922		 No No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service (DoS)
SNYK-JS-JSYAML-173999		 Yes No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Arbitrary Code Execution
SNYK-JS-JSYAML-174129		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Validation Bypass
SNYK-JS-KINDOF-537849		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LOADERUTILS-3042992		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-LOADERUTILS-3043105		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LOADERUTILS-3105943		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASH-1040724		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-450202		 Yes Proof of Concept
high severity 731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		 Prototype Pollution
SNYK-JS-LODASH-567746		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-608086		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-MIXINDEEP-450212		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Poisoning
SNYK-JS-QS-3153490		 No Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-SETVALUE-1540541		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-SETVALUE-450213		 Yes Proof of Concept
high severity 624/1000
Why? Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 Yes No Known Exploit
high severity 624/1000
Why? Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 Yes No Known Exploit
low severity 410/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 Yes No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579147		 Yes No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579152		 Yes No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579155		 Yes No Known Exploit
high severity 726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1		 Arbitrary File Overwrite
SNYK-JS-TAR-174125		 Yes Proof of Concept
medium severity 434/1000
Why? Has a fix available, CVSS 4.4		 Time of Check Time of Use (TOCTOU)
npm:chownr:20180731		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: gatsby The new version differs by 250 commits.
  • 0a455df chore(release): Publish
  • 91dc167 fix(gatsby): don't log FAST_DEV message for each worker (#32961) (#32967)
  • f936c93 fix(gatsby): set staticQueryResultHash to new hash on data change (#32949) (#32966)
  • ea161ce feat(gatsby-graphiql-explorer): upgrade to webpack 5 (#30642)
  • 944e381 chore(release): Publish next
  • d6326df fix(gatsby-core-utils): Switch `auth` option from got to username/password (#32665)
  • cf9c066 fix(gatsby): add this typings to actions (#32210)
  • 53aa88e chore: enable test parallelism (#32766)
  • b7deabc fix(deps): update starters and examples - gatsby (#32843)
  • 6025c84 chore(deps): update dependency katex to ^0.13.13 for gatsby-remark-katex (#32567)
  • d87c5cb chore: enable lmdb by default and update node for next major (#32695)
  • 818d6c1 feat(gatsby-plugin-gatsby-cloud): Add `disablePreviewUI` option (#32907)
  • f556a00 chore: update changelogs (#32924)
  • aba5eba feat(gatsby): enable webpack caching in development for everyone (#32922)
  • ac7bd4e feat(gatsby-source-wordpress): allow path to js file for beforeChangeNode option (#32901)
  • 1a87a8a docs(gatsby-source-wordpress): document content sync (#32768)
  • 417df15 chore: re-generate changelogs (#32886)
  • 1810874 fix(gatsby-source-wordpress): draft previews (#32915)
  • 7c72ab8 chore(gatsby): remove unused packages (#32903)
  • afb06d7 chore(docs): Add hint for MDX plugin in remark-plugin-tutorial (#32876)
  • 1303ecb chore(docs): Update wording for "using-web-fonts" (#32902)
  • 9589911 chore(docs): Fix code highlighting in part 6 (#32900)
  • 568d4ce feat(gatsby-source-drupal): Use the collection count from JSON:API extras to enable parallel API requests for cold builds (#32883)
  • 41f5337 fix(deps): update typescript to ^4.29.3 (#32614)

See the full diff

Package name: gatsby-plugin-sharp The new version differs by 250 commits.
  • c1e67a2 chore(release): Publish
  • 0c45654 chore: remove tracedSVG (#37093) (#37137)
  • d7edf95 chore(release): Publish
  • 2d00ea0 fix(gatsby-plugin-mdx): Do not leak frontmatter into page (#35859) (#35913)
  • 4997d63 chore(release): Publish
  • ff94ed5 fix(gatsby-plugin-mdx): don't allow JS frontmatter by default (#35830) (#35834)
  • 36f21b0 chore: Removate validate-renovate from v3-latest branch (#34460)
  • 1acb1bc chore(release): Publish
  • 1589bd8 fix(gatsby): ensure that writing node manifests to disk does not break on Windows (#33853) (#34020)
  • 9694010 fix(gatsby-source-drupal): Ensure all new nodes are created before creating relationships (#33864) (#34019)
  • 76deb39 fix(gatsby-source-drupal): searcParams missing from urls (#33861) (#34018)
  • f74cc8f feat(gatsby-source-drupal): Add node manifest support for previews (#33683) (#34017)
  • 476a591 chore(release): Publish
  • 35b48f8 fix(gatsby-plugin-image): GatsbyImage not displaying image in IE11 (#33416) (#33806)
  • 880022e fix(gatsby-plugin-image): flickering when state changes (#33732) (#33807)
  • c0d07e7 feat(gatsby-source-wordpress): Update supported-remote-plugin-versions.ts (#33801) (#33804)
  • 3d9a702 chore(release): Publish
  • 84053a2 fix(gatsby-plugin-sharp): pass input buffer instead of readStream when processing image jobs (#33685) (#33703)
  • 4722a0d fix(gatsby-source-drupal): Add timeout in case of stalled API requests (#33668) (#33705)
  • 857a628 fix(gatsby): single page node manifest accuracy (#33642) (#33698)
  • 6bfd0f1 Properly set the pathPrefix and assetPrefix in the pluginData (#33667) (#33702)
  • 26c51c0 fix(gatsby-source-drupal): cache backlink records (#33444) (#33701)
  • b80c53a fix(gatsby-source-drupal): Correctly update nodes with changed back references so queries are re-run (#33328) (#33699)
  • e29a194 chore: use gatsby-dev-cli@latest-v3 in tests

See the full diff

Package name: gatsby-remark-copy-linked-files The new version differs by 250 commits.
  • fbc5893 chore(release): Publish
  • e693b62 chore: update yarn.lock (#29078)
  • e998870 fix(gatsby): Always render the body component to ensure needed head & pre/post body components are added (#29077)
  • a1921b5 feat(gatsby): bump opt-in % to dev-ssr to 20% (#29075)
  • 2439b44 feat(gatsby-codemods): Handle or warn on nested options changes (#29046)
  • c0e6c92 fix(gatsby-plugin-typescript): add missing options validations (#29066)
  • 3163ca6 fix(gatsby-plugin-mdx): Add `root` to plugin validation (#29010)
  • 6233382 fix(gatsby-plugin-image): Fix onload race condition (#29064)
  • c76c175 benchmark(gabe-fs-markdown-images): add img benchmark (#29009)
  • bd5b5f7 feat(gatsby): allow to skip cache persistence (#29047)
  • 48db6ac fix(gatsby): fix broken GraphQL resolver tracing (#29015)
  • 90b6e3d fix(gatsby): Use fast-refresh for React 17 (#28930)
  • 9a55d12 feat(gatsby): Add eslint rules to warn against bad patterns in pageTemplates (for Fast Refresh) (#28689)
  • b9978e1 fix(gatsby-plugin-image): Handle imgStyle in SSR (#29043)
  • f23ba4b fix(gatsby-source-contentful): Improve base64 placeholders (#29034)
  • 18b5f30 fix(security): update vulnerable packages, include React 17 in peerDeps (#28545)
  • f8bbc06 docs: edit search documentation (#28737)
  • 004acf0 fix(sharp) wrap sharp calls in try/catch to avoid crashing on bad images (#28645)
  • bf6f264 Hydrate when the page was server rendered (#29016)
  • e72533d chore(gatsby-plugin-image): Unflag remote images (#29032)
  • 332543c chore(docs): adjust Contentful Rich Text example codes (#29029)
  • 9bcc12c feat(gatsby-plugin-image): Change fullWidth to use breakpoints (#29002)
  • 168ff60 Fix/contentful add header (#29028)
  • a3ad6d7 fix(gatsbu-source-contentful): apply useNameForId when creating the graphql schema (#28649)

See the full diff

Package name: gatsby-source-filesystem The new version differs by 250 commits.
  • 7884025 chore(release): Publish
  • 816d475 fix: update dependency chokidar to v3 (#16975)
  • 90ac3a5 chore(release): Publish
  • 92df1cf fix(gatsby-plugin-feed): respect custom options and require title in config (#16814)
  • efb0198 chore: update babel monorepo (#16977)
  • d16474d fix(gatsby): update check for default exports (#16979)
  • 043bebe fix: update gatsby monorepo (#16978)
  • 42c1c5e chore: Set lerna concurrency on ci (#16973)
  • a25bc27 docs: Add reddit link to Awesome Gatsby docs (#16982)
  • 41d3e1c chore(gatsby-image): Clarify IntersectionObserver support in README.md (#16962)
  • 7912336 chore(release): Publish
  • f355bf8 Revert "chore: update babel monorepo" (#16976)
  • 29d5e3c chore: update babel monorepo (#16929)
  • 182407f chore: update react monorepo to ^16.9.0 (#16943)
  • f7382ae feat(www): add code snippet with install command to starters (#16972)
  • 3299192 chore: update dependency aws-sdk to ^2.516.0 (#16967)
  • 7d2bf0d chore: update dependency flow-bin to ^0.106.0 (#16966)
  • 5757af9 fix: update dependency theme-ui to ^0.2.36 (#16964)
  • ebe6131 chore: update gatsby monorepo (#16950)
  • 8b08b8c chore: Added my city to my creator description (#16955)
  • d6bd515 fix: update minor updates in packages except react, babel and… (#16960)
  • e9c8e8a chore(release): Publish
  • 27d3efc chore(gatsby): Remove fallback for v8 serialize (#16958)
  • 58ed3ca fix(gatsby): Remove deprecation warning from express-graphql (#16956)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Arbitrary Code Execution
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json & package-lock.json to reduce vulnerabilities
44822cf 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962462
- https://snyk.io/vuln/SNYK-JS-CSSWHAT-3035488
- https://snyk.io/vuln/SNYK-JS-DECODEURICOMPONENT-3149970
- https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://snyk.io/vuln/SNYK-JS-JSON5-3182856
- https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922
- https://snyk.io/vuln/SNYK-JS-JSYAML-173999
- https://snyk.io/vuln/SNYK-JS-JSYAML-174129
- https://snyk.io/vuln/SNYK-JS-KINDOF-537849
- https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3042992
- https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3043105
- https://snyk.io/vuln/SNYK-JS-LOADERUTILS-3105943
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-MIXINDEEP-450212
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-SETVALUE-1540541
- https://snyk.io/vuln/SNYK-JS-SETVALUE-450213
- https://snyk.io/vuln/SNYK-JS-TAR-1536528
- https://snyk.io/vuln/SNYK-JS-TAR-1536531
- https://snyk.io/vuln/SNYK-JS-TAR-1536758
- https://snyk.io/vuln/SNYK-JS-TAR-1579147
- https://snyk.io/vuln/SNYK-JS-TAR-1579152
- https://snyk.io/vuln/SNYK-JS-TAR-1579155
- https://snyk.io/vuln/SNYK-JS-TAR-174125
- https://snyk.io/vuln/npm:chownr:20180731
- https://snyk.io/vuln/npm:debug:20170905
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@haysclark @snyk-bot