New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 13 vulnerabilities #33

Open

GTVolk wants to merge 1 commit into master from snyk-fix-82565ba0cd2bd01707b1f025aa80df02

Owner

GTVolk commented Dec 19, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- client/package.json
- client/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962462	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	Yes	Proof of Concept
	641/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.4	Prototype Pollution SNYK-JS-JSON5-3182856	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Validation Bypass SNYK-JS-KINDOF-537849	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-TMPL-1583443	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-TRIM-1017038	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: jest

The new version differs by 250 commits.

be16e47 v27.0.0
63102ec chore: update changelog for release
564694a docs(blog): Jest 27 blog post (#11131)
b68d91b feat(pretty-print): add option `printBasicPrototype` (#11441)
2226742 chore: minor simplify format results error (#11432)
78eb25d chore: remove needless assign (#11433)
696c455 chore: update lockfile after publish
e2eb9ae v27.0.0-next.11
3b253f8 Wait for closed resources to actually close before detecting open handles (#11429)
27bee72 fix: run GC before collecting open handles (#11278)
50451df feat: use fallback if prettier not found (#11400)
150dbd8 chore: update lockfile after publish
6f44529 v27.0.0-next.10
cbcec7d Upgrade fsevents in jest-haste-map (#11428)
9633a26 feat: support reporters written in ESM (#11427)
59f42d8 fix: do not cache modules that throw during evaluation (#11263)
57e32e9 Detect open handles with done callbacks (#11382)
a397607 Document and test dontThrow for custom inline snapshot matchers (#10995)
4fa3a0b feat: custom haste (#11107)
2047a36 chore: bump deps (#11419)
a4358d6 chore: run prettier on changelog
bdd6282 Move all default values into `jest-config` (#9924)
db643a1 Link to Jest config (#11106)
b16082c Fix locale issue #10014 (#11412)

See the full diff

Package name: stylelint

The new version differs by 250 commits.

060310c 14.0.0
ff4a1ef Prepare CHANGELOG
8d2f6e1 Bump postcss (DNS not working on mobile AdguardTeam/AdGuardHome#5619)
f552608 Merge pull request Release v0.107.23 AdguardTeam/AdGuardHome#5618 from stylelint/dependabot/npm_and_yarn/husky-7.0.4
7ed17ad Bump husky from 7.0.2 to 7.0.4
4d9f75e Merge pull request Use AGH as a router AdguardTeam/AdGuardHome#5617 from stylelint/dependabot/npm_and_yarn/jest-27.3.1
bc9dd0b Bump jest from 27.2.5 to 27.3.1
82e2507 Merge pull request Get latest lists using querystring in the backend. AdguardTeam/AdGuardHome#5604 from stylelint/v14
16d259f Update CHANGELOG.md
70b1149 Fix false positives for dynamic-range keywords in media-feature-name-no-unknown (ratelimit_whitelist & ClientiD AdguardTeam/AdGuardHome#5613)
8dca498 Show more info in missing customSyntax warning (ADH Not Using Local Time AdguardTeam/AdGuardHome#5611)
2eee0a9 Remove v14 CI triggers ((Feature request) full backup/restore via web interface AdguardTeam/AdGuardHome#5610)
12f8081 14.0.0-0
5dd7ec1 Prepare 14.0.0
67313a3 Add support for `extends` in `overrides` config (Adguard VPN? AdguardTeam/AdGuardHome#5603)
b6fd2fc Document no need for postcss-html maintainer (DNS queries fail inside Docker containers on same host as AGH AdguardTeam/AdGuardHome#5602)
bf28025 Recommend using shared configs (Lookup with SNI Enabled (Firefox) to Cloudflare test laggy (20 sec delay) while dnscrypt-proxy instantaneous.... AdguardTeam/AdGuardHome#5598)
07118d6 Update CHANGELOG.md
367142a Change `ignoreFiles` to be extendable (Strange log errors in version 107.26 AdguardTeam/AdGuardHome#5596)
1b4162f Fix conflicts in dependabot
87c5fde Bump picocolors from 0.2.1 to 1.0.0 (one-by-one option to Upstream DNS servers AdguardTeam/AdGuardHome#5601)
1f32094 Bump typescript from 4.4.3 to 4.4.4 (How does the "disallowed_clients" option work? AdguardTeam/AdGuardHome#5599)
88b9575 Revise contributors section of README (DNS rewrites are not working and DHCP wrong allocation AdguardTeam/AdGuardHome#5585)
e38da70 Use problem rather than violation in docs and types (yt3.ggpht.com AdguardTeam/AdGuardHome#5592)

See the full diff

Package name: webpack

The new version differs by 250 commits.

610f368 5.0.0
5ce65c1 update examples
bbe1230 Merge pull request #11628 from webpack/bugfix/real-content-hash
75ecff2 5.0.0-rc.6
bfc35d6 Merge pull request #11603 from MayaWolf/master
76e8cbd Merge pull request #11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
36bcfaa Merge pull request #11621 from webpack/bugfix/11619
9130d10 fix called variables with ProvidePlugin
3e42105 Merge pull request #11620 from webpack/bugfix/11617
4709719 skip connections copied to concatenated module
57b493f 5.0.0-rc.5
1658e2f Merge pull request #11618 from webpack/bugfix/11615
a8fb45d fixes crash in SideEffectsFlagPlugin
84b196d emit error instead of crashing when unexpected problem occurs
5573fed Merge pull request #11601 from Hornwitser/improve-suggested-polyfill-config
9b5cce9 Merge pull request #11609 from snitin315/export-types
37c495c export type RuleSetUseItem
39faf34 export type RuleSetUse
e5fd246 export type RuleSetConditionAbsolute
660baad export RuleSetCondition types
13e3ca5 Merge pull request #11602 from webpack/bugfix/shared-runtime-chunk
9c0587e Merge pull request #11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
502d166 Merge pull request #11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4

See the full diff

Package name: webpack-cli

The new version differs by 250 commits.

fb50f76 chore(release): publish new version
2c75aeb chore: new version of the packages
0d05c30 chore(release): publish %s
3f9e151 chore: fix lerna config
2c1e34c tests(generator): enhance init generator tests (Firefox Plugin AdguardTeam/AdGuardHome#1236)
6ee61b9 Fix loader-generator and plugin-generator tests (Update translations AdguardTeam/AdGuardHome#1250)
52956a2 Fixing the typos and grammatical errors in Readme files (Add "Required-Start: $network" to the sysv init script AdguardTeam/AdGuardHome#1246)
7faaed2 chore: update Bug_report & Feature_request Templates (correction on message toast AdguardTeam/AdGuardHome#1256)
7a5b33d feat(webpack-cli): added mode argument (Sort clients table by requests count by default AdguardTeam/AdGuardHome#1253)
3715756 tests(webpack-cli): add test case for defaults flag (How to build from source for Windows? AdguardTeam/AdGuardHome#1254)
a7cba2f chore: project maintanance and typescript fix (Infinity loop with safebrowsing enabled AdguardTeam/AdGuardHome#1247)
7748472 chore: ignore package-lock.json and remove its references (Whois column is not needed in the "static" clients table AdguardTeam/AdGuardHome#1252)
a014aa7 docs: fix supported arguments & commands link in README ([QUESTION] 5 filters with 10K rules or 1 filter with 50K rules AdguardTeam/AdGuardHome#1244)
06129a1 feat(webpack-cli): add progress bar for progress flag (short domain that resolves to AdGuardHome IP Address AdguardTeam/AdGuardHome#1238)
6cc6a49 chore: post refactor CLI (Allow user and group mapping AdguardTeam/AdGuardHome#1237)
358651e chore: move cli under lerna package (The AD server is upgrading AdguardTeam/AdGuardHome#1225)
2dc495a fix(init): fix webpack config scaffold (Ability to check which Malware/Phishing site was blocked AdguardTeam/AdGuardHome#1231)
1ab62d2 tests(generator): add tests for plugin generator (Whitelist & temp disable blocking for unprivileged clients AdguardTeam/AdGuardHome#1235)
d2dd0c1 tests(sourcemap): fix flaky stats statement (AdGuard Home Crash/Hangs while updating filters AdguardTeam/AdGuardHome#1232)
f6dc680 tests(loader-generator): add tests for loader generator (Log timestamp not match system timezone AdguardTeam/AdGuardHome#1234)
35d1381 tests(generator): enable init generator test (my DNS log time is incorrect. how to correct it ? AdguardTeam/AdGuardHome#1233)
66cdcb6 chore(generator): remove transpiled tests (I want to use adguard home on AWS. AdguardTeam/AdGuardHome#1229)
f29a170 fix(init): fix the invalid package name (Add content blocking proxy settings AdguardTeam/AdGuardHome#1228)
8c3a66d chore(cli): updated changelog of v3 (Что происходит при блокировке запроса? AdguardTeam/AdGuardHome#1224)

See the full diff

Package name: webpack-dev-server

The new version differs by 250 commits.

c9271b9 chore(release): 4.0.0
18bf369 test: fix stability (Need help - Custom Filter Rules doesnt work AdguardTeam/AdGuardHome#3676)
cdcabb2 fix: respect protocol from browser for manual setup (Quality of parental control feature AdguardTeam/AdGuardHome#3675)
1768d6b fix: initial reloading for lazy compilation (Webhook on client query AdguardTeam/AdGuardHome#3662)
4f5bab1 docs: improve examples (Check that "load balancing" strategy properly selects the fastest upstream more often AdguardTeam/AdGuardHome#3672)
f2d87fb fix: improve https CLI output (Personal DNS server become unreacheable in a couple of days after start but local keeps working AdguardTeam/AdGuardHome#3673)
0277c5e chore: remove redundant console statements (Get fastest IP in background AdguardTeam/AdGuardHome#3671)
16fcdbc docs: add `ipc` example (Make a suggestion AdguardTeam/AdGuardHome#3667)
8915fb8 test: add e2e tests for built in routes (Android ipv6 dns. AdguardTeam/AdGuardHome#3669)
4d1cbe1 docs: ask `version` information in issue template (Android ipv6 dns. AdguardTeam/AdGuardHome#3668)
b6c1881 chore(deps-dev): bump core-js from 3.16.1 to 3.16.2 (#3666)
ffa8cc5 chore(deps-dev): bump supertest from 6.1.5 to 6.1.6 (How much volume can AGH handle in a busy edu environment? AdguardTeam/AdGuardHome#3665)
f1fdaa7 chore(release): 4.0.0-rc.1
c4678bc fix: legacy API (Support for servers list URL AdguardTeam/AdGuardHome#3660)
d8bdd03 test: fix stability (#3661)
22b1414 refactor: remove `killable` (Inconvenience of the user filters view window. AdguardTeam/AdGuardHome#3657)
75bafbf test: add e2e tests for module federation (Bug AdguardTeam/AdGuardHome#3658)
493ccbd chore(deps): update `ws` (Retry without ECS when REFUSED returned from resolver (RFC 7871 7.1.3) AdguardTeam/AdGuardHome#3652)
ae8c523 test: add e2e test for universal compiler (Some cached records take a long time to resolve AdguardTeam/AdGuardHome#3656)
f94b84f chore(deps): update (Panic on CTRL-C (v0.107.0-b.11) AdguardTeam/AdGuardHome#3655)
1923132 test: fix cli
2adfd01 test: fix todo (Displaying statistics AdguardTeam/AdGuardHome#3653)
6e2cbde fix: proxy logging and allow to pass options without the `target` option (AGH - pause/disable protection has no effect AdguardTeam/AdGuardHome#3651)
c9ccc96 fix: respect infastructureLogging.level for client.logging (#3613)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Prototype Pollution
🦉 Validation Bypass
🦉 More lessons are available in Snyk Learn


          fix: client/package.json & client/package-lock.json to reduce vulnera…

2b39e78

…bilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962462
- https://snyk.io/vuln/SNYK-JS-DECODEURICOMPONENT-3149970
- https://snyk.io/vuln/SNYK-JS-JSON5-3182856
- https://snyk.io/vuln/SNYK-JS-KINDOF-537849
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-TMPL-1583443
- https://snyk.io/vuln/SNYK-JS-TRIM-1017038
- https://snyk.io/vuln/npm:debug:20170905

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet