Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 28 vulnerabilities #108

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 28 vulnerabilities #108

wants to merge 1 commit into from

Conversation

smithmanny
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Prototype Pollution
SNYK-JS-AJV-584908		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 No Proof of Concept
critical severity 786/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.3		 Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962462		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-DECODEURICOMPONENT-3149970		 Yes Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
SNYK-JS-DOTPROP-543489		 No Proof of Concept
medium severity 475/1000
Why? Has a fix available, CVSS 5		 Prototype Pollution
SNYK-JS-HAPIHOEK-548452		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HOSTEDGITINFO-1088355		 No Proof of Concept
medium severity 626/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.1		 Man-in-the-Middle (MitM)
SNYK-JS-HTTPSPROXYAGENT-469131		 No Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-INI-1048974		 No Proof of Concept
high severity 644/1000
Why? Has a fix available, CVSS 8.6		 Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Denial of Service (DoS)
SNYK-JS-JSZIP-1251497		 No Proof of Concept
medium severity 529/1000
Why? Has a fix available, CVSS 6.3		 Arbitrary File Write via Archive Extraction (Zip Slip)
SNYK-JS-JSZIP-3188562		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASH-1040724		 Yes Proof of Concept
high severity 731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		 Prototype Pollution
SNYK-JS-LODASH-567746		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-608086		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 No No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 Yes Proof of Concept
medium severity 591/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.4		 Cross-site Scripting (XSS)
SNYK-JS-PARSEURL-2935944		 No Proof of Concept
medium severity 561/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.8		 Information Exposure
SNYK-JS-PARSEURL-2935947		 No Proof of Concept
critical severity 791/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.4		 Server-side Request Forgery (SSRF)
SNYK-JS-PARSEURL-2936249		 No Proof of Concept
medium severity 591/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.4		 Cross-site Scripting (XSS)
SNYK-JS-PARSEURL-2942134		 No Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Poisoning
SNYK-JS-QS-3153490		 No Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 No Proof of Concept
high severity 671/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7		 Command Injection
SNYK-JS-TREEKILL-536781		 No Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-Y18N-1021887		 No Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: gatsby The new version differs by 250 commits.
  • 0a455df chore(release): Publish
  • 91dc167 fix(gatsby): don't log FAST_DEV message for each worker (#32961) (#32967)
  • f936c93 fix(gatsby): set staticQueryResultHash to new hash on data change (#32949) (#32966)
  • ea161ce feat(gatsby-graphiql-explorer): upgrade to webpack 5 (#30642)
  • 944e381 chore(release): Publish next
  • d6326df fix(gatsby-core-utils): Switch `auth` option from got to username/password (#32665)
  • cf9c066 fix(gatsby): add this typings to actions (#32210)
  • 53aa88e chore: enable test parallelism (#32766)
  • b7deabc fix(deps): update starters and examples - gatsby (#32843)
  • 6025c84 chore(deps): update dependency katex to ^0.13.13 for gatsby-remark-katex (#32567)
  • d87c5cb chore: enable lmdb by default and update node for next major (#32695)
  • 818d6c1 feat(gatsby-plugin-gatsby-cloud): Add `disablePreviewUI` option (#32907)
  • f556a00 chore: update changelogs (#32924)
  • aba5eba feat(gatsby): enable webpack caching in development for everyone (#32922)
  • ac7bd4e feat(gatsby-source-wordpress): allow path to js file for beforeChangeNode option (#32901)
  • 1a87a8a docs(gatsby-source-wordpress): document content sync (#32768)
  • 417df15 chore: re-generate changelogs (#32886)
  • 1810874 fix(gatsby-source-wordpress): draft previews (#32915)
  • 7c72ab8 chore(gatsby): remove unused packages (#32903)
  • afb06d7 chore(docs): Add hint for MDX plugin in remark-plugin-tutorial (#32876)
  • 1303ecb chore(docs): Update wording for "using-web-fonts" (#32902)
  • 9589911 chore(docs): Fix code highlighting in part 6 (#32900)
  • 568d4ce feat(gatsby-source-drupal): Use the collection count from JSON:API extras to enable parallel API requests for cold builds (#32883)
  • 41f5337 fix(deps): update typescript to ^4.29.3 (#32614)

See the full diff

Package name: gatsby-plugin-sharp The new version differs by 250 commits.
  • c1e67a2 chore(release): Publish
  • 0c45654 chore: remove tracedSVG (#37093) (#37137)
  • d7edf95 chore(release): Publish
  • 2d00ea0 fix(gatsby-plugin-mdx): Do not leak frontmatter into page (#35859) (#35913)
  • 4997d63 chore(release): Publish
  • ff94ed5 fix(gatsby-plugin-mdx): don't allow JS frontmatter by default (#35830) (#35834)
  • 36f21b0 chore: Removate validate-renovate from v3-latest branch (#34460)
  • 1acb1bc chore(release): Publish
  • 1589bd8 fix(gatsby): ensure that writing node manifests to disk does not break on Windows (#33853) (#34020)
  • 9694010 fix(gatsby-source-drupal): Ensure all new nodes are created before creating relationships (#33864) (#34019)
  • 76deb39 fix(gatsby-source-drupal): searcParams missing from urls (#33861) (#34018)
  • f74cc8f feat(gatsby-source-drupal): Add node manifest support for previews (#33683) (#34017)
  • 476a591 chore(release): Publish
  • 35b48f8 fix(gatsby-plugin-image): GatsbyImage not displaying image in IE11 (#33416) (#33806)
  • 880022e fix(gatsby-plugin-image): flickering when state changes (#33732) (#33807)
  • c0d07e7 feat(gatsby-source-wordpress): Update supported-remote-plugin-versions.ts (#33801) (#33804)
  • 3d9a702 chore(release): Publish
  • 84053a2 fix(gatsby-plugin-sharp): pass input buffer instead of readStream when processing image jobs (#33685) (#33703)
  • 4722a0d fix(gatsby-source-drupal): Add timeout in case of stalled API requests (#33668) (#33705)
  • 857a628 fix(gatsby): single page node manifest accuracy (#33642) (#33698)
  • 6bfd0f1 Properly set the pathPrefix and assetPrefix in the pluginData (#33667) (#33702)
  • 26c51c0 fix(gatsby-source-drupal): cache backlink records (#33444) (#33701)
  • b80c53a fix(gatsby-source-drupal): Correctly update nodes with changed back references so queries are re-run (#33328) (#33699)
  • e29a194 chore: use gatsby-dev-cli@latest-v3 in tests

See the full diff

Package name: gatsby-source-filesystem The new version differs by 250 commits.
  • 7884025 chore(release): Publish
  • 816d475 fix: update dependency chokidar to v3 (#16975)
  • 90ac3a5 chore(release): Publish
  • 92df1cf fix(gatsby-plugin-feed): respect custom options and require title in config (#16814)
  • efb0198 chore: update babel monorepo (#16977)
  • d16474d fix(gatsby): update check for default exports (#16979)
  • 043bebe fix: update gatsby monorepo (#16978)
  • 42c1c5e chore: Set lerna concurrency on ci (#16973)
  • a25bc27 docs: Add reddit link to Awesome Gatsby docs (#16982)
  • 41d3e1c chore(gatsby-image): Clarify IntersectionObserver support in README.md (#16962)
  • 7912336 chore(release): Publish
  • f355bf8 Revert "chore: update babel monorepo" (#16976)
  • 29d5e3c chore: update babel monorepo (#16929)
  • 182407f chore: update react monorepo to ^16.9.0 (#16943)
  • f7382ae feat(www): add code snippet with install command to starters (#16972)
  • 3299192 chore: update dependency aws-sdk to ^2.516.0 (#16967)
  • 7d2bf0d chore: update dependency flow-bin to ^0.106.0 (#16966)
  • 5757af9 fix: update dependency theme-ui to ^0.2.36 (#16964)
  • ebe6131 chore: update gatsby monorepo (#16950)
  • 8b08b8c chore: Added my city to my creator description (#16955)
  • d6bd515 fix: update minor updates in packages except react, babel and… (#16960)
  • e9c8e8a chore(release): Publish
  • 27d3efc chore(gatsby): Remove fallback for v8 serialize (#16958)
  • 58ed3ca fix(gatsby): Remove deprecation warning from express-graphql (#16956)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Command Injection
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json & package-lock.json to reduce vulnerabilities
b1a5e7a 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962462
- https://snyk.io/vuln/SNYK-JS-DECODEURICOMPONENT-3149970
- https://snyk.io/vuln/SNYK-JS-DOTPROP-543489
- https://snyk.io/vuln/SNYK-JS-HAPIHOEK-548452
- https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
- https://snyk.io/vuln/SNYK-JS-HTTPSPROXYAGENT-469131
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922
- https://snyk.io/vuln/SNYK-JS-JSZIP-1251497
- https://snyk.io/vuln/SNYK-JS-JSZIP-3188562
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-PARSEURL-2935944
- https://snyk.io/vuln/SNYK-JS-PARSEURL-2935947
- https://snyk.io/vuln/SNYK-JS-PARSEURL-2936249
- https://snyk.io/vuln/SNYK-JS-PARSEURL-2942134
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-TREEKILL-536781
- https://snyk.io/vuln/SNYK-JS-Y18N-1021887
- https://snyk.io/vuln/npm:debug:20170905
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@smithmanny @snyk-bot