Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 9 vulnerabilities #31

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 9 vulnerabilities #31

wants to merge 1 commit into from

Conversation

sokis
Copy link
Owner

@sokis sokis commented Nov 28, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-COLORSTRING-1082939		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HTMLMINIFIER-3091181		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1255640		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JS-POSTCSS-5926692		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-UNSETVALUE-2400660		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: css-loader The new version differs by 136 commits.
  • 43179a8 chore(release): 1.0.0
  • 3d53968 Merge remote-tracking branch 'origin/master'
  • 240db53 version 1.0 (#742)
  • 1b7acf7 Merge remote-tracking branch 'origin/master'
  • 1703721 docs(README): add more context to `localIdentName` (#711)
  • 1c51265 docs(README): fix malformed emoji (#701)
  • 50f8ec0 Merge remote-tracking branch 'origin/master'
  • 07444ad tests: css custom variables (#709)
  • 3de8aa7 tests: css custom variables (#709)
  • df497db chore(release): 0.28.11
  • c788450 fix(lib/processCss): don't check `mode` for `url` handling (`options.modules`) (#698)
  • c35d8bd chore(release): 0.28.10
  • 9f876d2 fix(getLocalIdent): add `rootContext` support (`webpack >= v4.0.0`) (#681)
  • 0452f26 test: hashes inside `@ font-face` url (#678)
  • 630579d chore(release): 0.28.9
  • 604bd4b chore(package): update dependencies
  • d1d8221 fix: ignore invalid URLs (`url()`) (#663)
  • 0fc46c7 chore(release): 0.28.8
  • 333a2ce chore(package): update `dependencies`
  • 39773aa ci(travis): use `npm`
  • 8897d44 fix: proper URL escaping and wrapping (`url()`) (#627)
  • 0dccfa9 fix(loader): correctly check if source map is `undefined` (#641)
  • d999f4a docs: Update importLoaders documentation (#646)
  • 05c36db test: removed redundant `modules` argument (#599)

See the full diff

Package name: html-loader The new version differs by 93 commits.
  • d7cccfa chore(release): 1.0.0
  • 3c9a1d8 refactor: `attributes` option (#265)
  • 8c73761 feat: `preprocessor` option (#263)
  • f2ce5b1 feat: improve errors
  • 9923244 chore(deps): update (#260)
  • 9835bde feat: supports `link:href` attribute for css (#258)
  • 7af2eff refactor: improve schema (#257)
  • 98412f9 docs: `filter` sources (#256)
  • ff0f44c feat: implement the `filter` option for filtering some of sources (#255)
  • 1c24662 refactor: move the `root` option under the `attributes` option (#254)
  • 888b8fe docs: add footnote for `-attributes` (#252)
  • 3d2907e refactor: remove the `interpolate` option
  • bd979e2 refactor: remove the `interpolate` option
  • fcba4ec fix: handle only valid srcset tags (#253)
  • 9e5ce56 perf: improve source parse (#251)
  • c9c8dad refactor: improve source parse (#250)
  • 079d623 fix: respect `#hash` in sources
  • a17df49 fix: reduce `import`/`require` count
  • d0b0150 fix: adding quotes when necessary for unquoted sources (#247)
  • e3727ab test: minifier
  • 0bbe29c feat: migrate on `htmlparse2`
  • b7af031 fix: escape `\u2028` and `\u2029` characters (#244)
  • 24b0427 fix: parser tags and attributes according spec (#243)
  • 3df909d feat: support `script:src` attributes

See the full diff

Package name: html-webpack-plugin The new version differs by 196 commits.
  • eb73905 chore(release): 4.0.0
  • 42a6d4a Add typing for getHooks
  • a1a37cf Release html-webpack-plugin 4.0.0-beta.14
  • 97f9fb9 fix: load script files before style files files in defer script loading mode
  • e97ce17 Release html-webpack-plugin 4.0.0-beta.13
  • e448b5d Release html-webpack-plugin 4.0.0-beta.12
  • de315eb feat: Add defer script loading
  • 7df269f feat: Provide a verbose error message if html minification failed
  • 1d66e53 feat: merge templateParameters with default template parameters
  • dfb98e7 Fix typo in template option docts
  • 096a760 Fix broken links in examples
  • a195c34 docs: Update template-option documentation
  • 40b410e docs: Update example for template parameters
  • bf017f3 chore: Release 4.0.0-beta.11
  • 2549557 test: Don't use minification for speed measurement
  • de22fc2 test: Adjust measurment for node 6 on travis
  • 24bf1b5 fix: Update references to html-minifier
  • f4eafdc chore: Release 4.0.0-beta.10
  • a2ad30a refactor: Use getAssetPath instead of calling the hook directly
  • 2595a79 chore: Release 4.0.0-beta.9
  • c66766c feat: Add support for minifying inline ES6 inside html templates
  • 655cbcd Fix README typo
  • 6de319b update lodash dependency for prototype polution vulnerability
  • 35a1541 Properly encode file names emitted as part of URLs.

See the full diff

Package name: progress-bar-webpack-plugin The new version differs by 3 commits.
  • 4941000 2.0.0
  • 76a31dd Remove Object.assign() shim as it's now included by all supported node versions
  • 9f7b2d2 Update dependencies

See the full diff

Package name: update-notifier The new version differs by 31 commits.

See the full diff

Package name: webpack The new version differs by 250 commits.
  • 4be093d 2.2.0
  • 2278469 2.2.0-rc.8
  • b946eb4 Merge pull request #3988 from malstoun/bug/2664
  • 260e413 Merge pull request #3986 from webpack/bugfix/revert_use_of_buffer_dot_from
  • 0ec7de9 Fix regression with watch cli opt, add tests for this case
  • 72226db add missing disable line
  • 4d30675 build fresh yarn.lock file to remove buffer polyfill
  • 91c1f35 fix(node): rollback changes of Buffer.from to new Buffer() and bump down travis to 4.3 min node v
  • 0b47602 2.2.0-rc.7
  • db6ccbc Merge pull request #3978 from webpack/bugfix/conditional-reexports
  • 82a5b03 Merge pull request #3977 from malstoun/bug/2664
  • fc1a43b Merge pull request #3976 from timse/rely-on-defaults
  • a44694a hoist exports declarations too
  • 682bde8 Fix lint
  • c6d7d90 Add tests
  • af8d49e remove defaults values to shave a few bytes
  • 9796696 2.2.0-rc.6
  • e9bdb05 Merge pull request #3971 from webpack/bugfix/fix_available_vars_in_fmtp
  • bd45bdc add test case for global in harmony modules
  • bfccb20 fix PR
  • 5a3a23f fix(nmf): Fix exports for var injection to include free glob exports or arguments
  • 437dce4 2.2.0-rc.5
  • 91cb1df Merge pull request #3970 from webpack/ci/appveyor
  • 9fd55e5 Merge pull request #3969 from webpack/bugfix/issue-3964

See the full diff

Package name: webpack-dev-server The new version differs by 243 commits.
  • 7e18f6a 2.2.0
  • e9dd0ed Upgrade webpack dependency
  • cae704f Update README to new standard
  • d560695 Fix broken test after webpack update
  • 84a98ad update webpack dev dependency
  • a947336 Refactor to ES6
  • fb74672 Bring eslint config in line with webpack/webpack
  • 2f9ac82 Make Travis run Node.js v4 and v6
  • bbcca86 Require Node.js v4.7 or higher
  • fcf5f3c (fix) proxy config with bypass and without target (#721)
  • 00bdcd5 2.2.0-rc.0
  • cffd387 update webpack-dev-middleware dep
  • 1adb818 Allow webpack 2 rc
  • 658280d Update License to match with webpack/webpack
  • 1f60309 2.1.0-beta.12
  • 7eb7a92 Add warning for issues with Node.js v7
  • 8a4b070 Fix colors in CLI not working when using stats as a string
  • b072535 Simplify issue template
  • 5efc245 Bring back reloading the app after compiler warnings
  • 2a74a08 Fix tests after the schema change
  • 4131be5 Disallow usage of `true` in `contentBase` option
  • 10db4a7 Allow `none` as value for the `clientLogLevel` option
  • a874303 2.1.0-beta.11
  • 7cb0490 Fix `--open` flag opening wrong URL when using lazy mode

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Improper Input Validation

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@sokis @snyk-bot