Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk-dev] Fix for 14 vulnerabilities #4051

Closed
wants to merge 1 commit into from
Closed

[Snyk-dev] Fix for 14 vulnerabilities #4051

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link
Contributor

@snyk-bot snyk-bot commented Oct 4, 2022

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • test/fixtures/qs-package/node_modules/snyk/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
medium severity 484/1000
Why? Has a fix available, CVSS 5.4		 Open Redirect
SNYK-JS-GOT-2932019		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASH-1040724		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-450202		 Yes Proof of Concept
high severity 731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		 Prototype Pollution
SNYK-JS-LODASH-567746		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-608086		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-73638		 Yes Proof of Concept
medium severity 541/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-NCONF-2395478		 Yes Proof of Concept
critical severity 704/1000
Why? Has a fix available, CVSS 9.8		 Arbitrary Code Injection
SNYK-JS-OPEN-174041		 Yes No Known Exploit
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
SNYK-JS-UNDEFSAFE-548940		 Yes Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:lodash:20180130		 Yes Proof of Concept
high severity 741/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.4		 Arbitrary Command Injection
npm:open:20180512		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: chalk The new version differs by 53 commits.

See the full diff

Package name: inquirer The new version differs by 92 commits.

See the full diff

Package name: snyk-config The new version differs by 64 commits.
  • 34bd34e Merge pull request #43 from snyk/fix/bundle-nconf
  • b9cc6b6 feat: swap yargs parser with minimist
  • 2b3935c feat: re-enable argv parsing with yargs
  • 3b8a4e1 feat: add the original argv module
  • 392e6f2 fix: use vendored nconf
  • b90e7e7 fix: vendor nconf to remove vulnerable yargs version
  • f2c0e1e chore: add the original nconf library
  • eb0f55f Merge pull request #42 from snyk/test/add-more-test-cases
  • bf4231e test: add more tests for argument parsing
  • c10881d test: add test case for value type changing
  • f167704 Merge pull request chore: 'npm run build' in appveyor #40 from snyk/fix/less-lodash
  • d671a6e fix: Reduce lodash, use lodash.merge directly
  • 136b3a9 Merge pull request #39 from snyk/feat/use-patched-lodash
  • a2d2453 feat: use forked lodash patched against zipObjectDeep vulnerability
  • b4b4912 Merge pull request #38 from snyk/fix/major-release
  • 5c3aaef fix: trigger a major release
  • af60412 Merge pull request #37 from snyk/feat/service-env
  • d177015 docs: package name is wrong
  • 1037183 BREAKING CHANGE: load SERVICE_ENV instead of local by default
  • 5e90504 chore: disable lots of eslint warnings
  • 9cac115 feat: eslint --fix
  • e670f86 BREAKING CHANGE: drop node 6 support
  • 39eba76 chore: remove unused npm run semantic-release, travis runs it
  • 6e60b3b feat: basic types

See the full diff

Package name: undefsafe The new version differs by 23 commits.
  • f272681 fix: prevent changes in prototype chain
  • f495954 chore: prettier changes
  • e4180ba fix: add .npmignore (#11)
  • 29c8d32 Merge branch 'master' of github.com:remy/undefsafe
  • 9a1631a fix: handle null as the root object
  • 2d38e72 feat: * rule returns all matches (#7)
  • 9c7867e fix: when first prop is a string lookup
  • f6a7369 feat: support string properties
  • 4096e74 docs: update use with star rules
  • a8ec59c chore: Merge branch 'master'
  • 9fff017 feat: support `*` in paths
  • c1ff86d Merge pull request #3 from kasicka/master
  • 454e910 Add license
  • aab63c2 feat: support setting values
  • 0dca1f4 chore: ignore dev output
  • 45ac637 chore: add linting files
  • fff7997 refactor: move to tap over mocha
  • 3d82f24 chore: merge branch 'master'
  • 951081b chore: release 1.0.0
  • 2d70b33 fix: add tonic demo
  • 60181c2 Merge pull request #2 from cbas/patch-1
  • acce87b SPDX expression
  • 98aa896 Better example in readme

See the full diff

Package name: update-notifier The new version differs by 102 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect
🦉 Regular Expression Denial of Service (ReDoS)
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: test/fixtures/qs-package/node_modules/snyk/package.json to reduc…
21129f0 
…e vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://dev.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://dev.snyk.io/vuln/SNYK-JS-GOT-2932019
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-450202
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-567746
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-608086
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-73638
- https://dev.snyk.io/vuln/SNYK-JS-LODASH-73639
- https://dev.snyk.io/vuln/SNYK-JS-NCONF-2395478
- https://dev.snyk.io/vuln/SNYK-JS-OPEN-174041
- https://dev.snyk.io/vuln/SNYK-JS-UNDEFSAFE-548940
- https://dev.snyk.io/vuln/npm:lodash:20180130
- https://dev.snyk.io/vuln/npm:open:20180512
@snyk-bot snyk-bot requested review from a team as code owners October 4, 2022 12:53
@github-actions
Copy link
Contributor

github-actions bot commented Oct 4, 2022

Warnings
⚠️

"fix: test/fixtures/qs-package/node_modules/snyk/package.json to reduce vulnerabilities" is too long. Keep the first line of your commit message under 72 characters.

Generated by 🚫 dangerJS against 21129f0

@shaniHerz shaniHerz closed this Oct 8, 2022
@darscan darscan deleted the snyk-fix-4355423bd9b296e035d81c50091eea57 branch January 20, 2023 18:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@klesniewski klesniewski Awaiting requested review from klesniewski klesniewski was automatically assigned from snyk/snyk-open-source

@nirshirion nirshirion Awaiting requested review from nirshirion nirshirion was automatically assigned from snyk/snyk-open-source

@robh-snyk robh-snyk Awaiting requested review from robh-snyk robh-snyk was automatically assigned from snyk/snyk-open-source

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@snyk-bot @shaniHerz