Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade ccxt from 1.17.321 to 1.18.609 #25

Open
wants to merge 1 commit into
base: unstable
Choose a base branch
from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Issue Breaking Change Exploit Maturity
high severity Insecure Randomness
SNYK-JS-CRYPTOJS-548472
No No Known Exploit
medium severity Arbitrary File Write via Archive Extraction (Zip Slip)
SNYK-JS-DECOMPRESS-557358
No Proof of Concept
medium severity Timing Attack
SNYK-JS-ELLIPTIC-511941
No No Known Exploit
high severity Cryptographic Issues
SNYK-JS-ELLIPTIC-571484
No Proof of Concept
medium severity Prototype Pollution
SNYK-JS-MINIMIST-559764
No Proof of Concept
medium severity Insecure Randomness
npm:cryptiles:20180710
No No Known Exploit
high severity Prototype Pollution
npm:extend:20180424
No No Known Exploit
medium severity Uninitialized Memory Exposure
npm:stringstream:20180511
No Mature
Commit messages
Package name: ccxt The new version differs by 250 commits.
  • 310d123 1.18.609
  • 8e50b4d Merge branch 'frosty00-vendor-cryptojs' #4875 fix #5180
  • 8ca3989 Merge branch 'vendor-cryptojs' of https://github.com/frosty00/ccxt into frosty00-vendor-cryptojs
  • 325cbca 1.18.608
  • ebdca74 removed a reference to node 'constants' from Node-RSA.js
  • 4a02c13 oceanex py/php files
  • 281c710 remove a reference to node 'constants' from node-rsa pkcs1.js
  • dbc66b6 Update pkcs1.js
  • 7a6c56d revert .travis.yml
  • c2f5ce6 cleanup .travis.yml cache
  • fbfa5dc 1.18.607
  • ede89d7 bx.in.th minor edit
  • e8b5e75 Merge branch 'master' of github.com:ccxt/ccxt
  • 662ff7a 1.18.606
  • 8ebd879 Merge pull request #5219 from npomfret/master
  • a2b09c6 quotes in Exchange.js
  • 31e92dd livecoin LEO → LeoCoin fix #5226
  • f877a0a bx.in.th LEO → LeoCoin fix #5226
  • 98a43f3 bittrex parseTransaction minor edit
  • 79952d0 Update bittrex.js
  • 2b7977f bittrex v3 hostname support
  • 2e6c547 bittrex fetchClosedOrdersV3 cleanup
  • eedc5c1 bittrex parseOrderV3 minor edits
  • f5866ce bittrex v3 minor edits

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant