New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 4 vulnerabilities #32

Open

webwurst wants to merge 1 commit into master from snyk-fix-a1271519f063cd75791d5d0e80b9a853

Member

webwurst commented Dec 1, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	661/1000 Why? Recently disclosed, Has a fix available, CVSS 7.5	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-TRIMNEWLINES-1298042	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: dateformat

The new version differs by 9 commits.

8802071 2.0.0
ba00ce7 update `contributors`
9222537 remove cli.js
85d577e removes CLI
6fb6e92 Merge pull request #49 from thejameskyle/patch-1
fbc280f Create .npmignore
261aec5 Merge pull request #47 from samt/master
dd04e87 Fix code-block intent
5cd7114 Add mask options and named formats to Readme.md

See the full diff

Package name: webpack

The new version differs by 250 commits.

610f368 5.0.0
5ce65c1 update examples
bbe1230 Merge pull request #11628 from webpack/bugfix/real-content-hash
75ecff2 5.0.0-rc.6
bfc35d6 Merge pull request #11603 from MayaWolf/master
76e8cbd Merge pull request #11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
36bcfaa Merge pull request #11621 from webpack/bugfix/11619
9130d10 fix called variables with ProvidePlugin
3e42105 Merge pull request #11620 from webpack/bugfix/11617
4709719 skip connections copied to concatenated module
57b493f 5.0.0-rc.5
1658e2f Merge pull request #11618 from webpack/bugfix/11615
a8fb45d fixes crash in SideEffectsFlagPlugin
84b196d emit error instead of crashing when unexpected problem occurs
5573fed Merge pull request #11601 from Hornwitser/improve-suggested-polyfill-config
9b5cce9 Merge pull request #11609 from snitin315/export-types
37c495c export type RuleSetUseItem
39faf34 export type RuleSetUse
e5fd246 export type RuleSetConditionAbsolute
660baad export RuleSetCondition types
13e3ca5 Merge pull request #11602 from webpack/bugfix/shared-runtime-chunk
9c0587e Merge pull request #11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
502d166 Merge pull request #11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4

See the full diff

Package name: webpack-dev-server

The new version differs by 250 commits.

5aad1e7 chore(release): 4.8.0
28ad7ed chore(deps): bump graceful-fs from 4.2.9 to 4.2.10 (#4368)
7920364 feat: export initialized socket client (#4304)
4e7800e chore: update webpack (#4367)
fbda2a8 chore(deps-dev): bump body-parser from 1.19.2 to 1.20.0 (#4366)
67c080b chore(deps-dev): bump puppeteer from 13.5.1 to 13.5.2 (#4361)
56ec411 chore(deps): bump html-entities from 2.3.2 to 2.3.3 (#4358)
ca8a53a chore: update deps and fix audit (#4356)
501f6aa chore(deps-dev): bump @ babel/runtime
7d2b4f0 chore(deps-dev): bump @ babel/core
95e26fe test: add cases for `webSocketURL` with `server` option (#4346)
84b4774 chore: migrate script for examples on `setupMiddlewares` option (#4347)
a7ccab1 chore: replace deprecated String.prototype.substr() (#4343)
1bf2614 chore(deps-dev): bump lint-staged from 12.3.6 to 12.3.7 (#4344)
188497a chore(deps-dev): bump prettier from 2.5.1 to 2.6.0 (#4339)
7560a37 chore(deps-dev): bump lint-staged from 12.3.5 to 12.3.6 (#4341)
dc2d6f7 chore(deps): bump http-proxy-middleware from 2.0.3 to 2.0.4 (#4333)
552e4ab chore(deps-dev): bump @ babel/runtime
af3de07 chore(deps-dev): bump @ babel/core
a80fa1f chore(deps): bump @ types/ws
457e1e5 chore(deps-dev): bump eslint from 8.10.0 to 8.11.0 (#4334)
b48ff7f chore(deps-dev): bump puppeteer from 13.5.0 to 13.5.1 (#4330)
3ce15d4 chore(deps-dev): bump puppeteer from 13.4.1 to 13.5.0 (#4329)
a892235 chore(deps-dev): bump lint-staged from 12.3.4 to 12.3.5 (#4328)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution


          fix: package.json to reduce vulnerabilities

72aff2b

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
- https://snyk.io/vuln/SNYK-JS-TRIMNEWLINES-1298042
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet