New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 6 vulnerabilities #34

Open

Bhanditz wants to merge 1 commit into master from snyk-fix-44bbbb33a5165667d7597d1054c4c96e

Owner

Bhanditz commented Nov 25, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- packages/midway-core/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	761/1000 Why? Mature exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-DICER-2311764	Yes	Mature
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
	484/1000 Why? Has a fix available, CVSS 5.4	XML External Entity (XXE) Injection SNYK-JS-XMLDOM-1084960	Yes	No Known Exploit
	539/1000 Why? Has a fix available, CVSS 6.5	Improper Input Validation SNYK-JS-XMLDOM-1534562	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Prototype Pollution SNYK-JS-XMLDOM-3042242	Yes	No Known Exploit
	811/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.8	Improper Input Validation SNYK-JS-XMLDOM-3092935	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: egg

The new version differs by 8 commits.

6a24fd8 Release 3.2.0
733d669 feat: update egg-multipart 2.x -> 3.x (#5023)
4857813 docs: update the version of the required Node (#5021)
bbd0e43 chore: change the templates of bug/suggestion report (#5019)
64dd9fe Release 3.1.0 (#5003)
2c5ba48 🐛 FIX: Add config.httpclient.useHttpClientNext defined (#5001)
2ffb37a feat: Support urllib@3 (#5000)
ff1850f Release 3.0.0 (#4999)

See the full diff

Package name: globby

The new version differs by 33 commits.

878ef6e 10.0.0
3706920 Upgrade `fast-glob` package to v3 (fix: app.runSchedule task key midwayjs/midway#126)
8aadde8 Add `globby.stream` (feat: add tslint rules midwayjs/midway#113)
2dd76d2 Remove `**/bower_components/**` as a default ignore pattern
9f781ce Require Node.js 8
04d51bf Upgrade `ignore` package (我用midway-init test 初始化了一个项目，用npm start 启动访问的时候报错。 midwayjs/midway#120)
2b61484 Readme tweaks
ff3e1f9 Tidelift tasks
31f18ae Create funding.yml
33ca01c Fix using the `gitignore` and `stats` options together (TS 版本里手动运行 schedule 报错提示找不到对应的 schedule midwayjs/midway#121)
c737820 Minor TypeScript definition improvements
82db101 Add Node.js 12 to testing (是否考虑向 typeorm 捐赠？ midwayjs/midway#117)
766b728 9.2.0
dc0a49c Refactor TypeScript definition to CommonJS compatible export (请问在service里面怎么取得之前egg的那个app属性？ midwayjs/midway#115)
89cee24 9.1.0
59f4b48 Add check to ensure `cwd` is a directory (chore: upgrade dep package version midwayjs/midway#110)
9a9cf1e Add TypeScript definition (初学者想问一下我这样做对吗 midwayjs/midway#111)
eb26c7e Meta tweaks
d77a623 Add failing test for <fix> proofread CONTRIBUTING.md and README.md midwayjs/midway#105 (同为TS的node框架与nest相比有什么优劣呢？ midwayjs/midway#108)
2294618 Deduplicate identical file patterns (feat: custom decorator with decorators manager midwayjs/midway#102)
ba9c267 Add failing test for chore: upgrade template to ts3 and add readme for sub package midwayjs/midway#97 (fix: override alinode default path midwayjs/midway#100)
71b9c58 9.0.0
39ad0d9 Update dependencies
d804228 Fix compatibility with latest `dir-glob` release (midway-serverless 方案讨论 midwayjs/midway#99)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Prototype Pollution
🦉 XML External Entity (XXE) Injection
🦉 More lessons are available in Snyk Learn


          fix: packages/midway-core/package.json to reduce vulnerabilities

0e5a69d

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-DICER-2311764
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660
- https://snyk.io/vuln/SNYK-JS-XMLDOM-1084960
- https://snyk.io/vuln/SNYK-JS-XMLDOM-1534562
- https://snyk.io/vuln/SNYK-JS-XMLDOM-3042242
- https://snyk.io/vuln/SNYK-JS-XMLDOM-3092935

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet