New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 8 vulnerabilities #92

Merged

Itchibon777 merged 1 commit into master from snyk-fix-5fcd913d39b35421e6a5b3aa073fcc4c

Mar 17, 2021

snyk-bot commented Mar 17, 2021

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- search-indexing/package.json
- search-indexing/package-lock.json
- search-indexing/.snyk

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	616/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.9	Server-Side Request Forgery (SSRF) SNYK-JS-AXIOS-1038255	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-JSONBIGINT-608659	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	No	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	No	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-LODASH-567746	No	Proof of Concept
	704/1000 Why? Has a fix available, CVSS 9.8	Prototype Pollution SNYK-JS-LODASH-590103	No	No Known Exploit
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	No	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-NODEFORGE-598677	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: axios

The new version differs by 127 commits.

a64050a Releasing 0.21.1
d57cd97 Updating changelog for 0.21.1 release
8b0f373 Use different socket for Win32 test (Issue with "Bonfire: Pairwise". Test wrong? freeCodeCamp/freeCodeCamp#3375)
e426910 Protocol not parsed when setting proxy config from env vars (improve jquery challenge wording freeCodeCamp/freeCodeCamp#3070)
c7329fe Hotfix: Prevent SSRF (Wiki request - rewrite and simplify explanation of Smallest Common Multiple freeCodeCamp/freeCodeCamp#3410)
f472e5d Adding a type guard for `AxiosError` (Code doesn't validate until "Run Code" is pushed several times freeCodeCamp/freeCodeCamp#2949)
7688255 Remove the skipping of the `socket` http test (Allowed to Proceed with Incomplete Declaration freeCodeCamp/freeCodeCamp#3364)
820fe6e Updating axios in types to be lower case (Sequence of numbers in a set freeCodeCamp/freeCodeCamp#2797)
94ca24b Releasing 0.21.0
2130a0c Updating changelog for 0.21.0 release
fbdc150 Lock travis to not use node v15 (Added test to determine num of elements with class freeCodeCamp/freeCodeCamp#3361)
3a8b87d Fixing an issue that type 'null' and 'undefined' is not assignable to validateStatus when typescript strict option is enabled (Lesson was already completed freeCodeCamp/freeCodeCamp#3200)
9a78465 Revert "Fixing overwrite Blob/File type as Content-Type in browser. (Not able to run the code when I hit Ctrl+Enter freeCodeCamp/freeCodeCamp#1773)" (Should explain .map() better. freeCodeCamp/freeCodeCamp#3289)
6d05b96 Fix typos (Chrome 45 on a surface... the code lines dont all show up freeCodeCamp/freeCodeCamp#3309)
fa36737 fix axios.delete ignores config.data (Challenges showing complete/incomplete incorrrectly freeCodeCamp/freeCodeCamp#3282)
b7e954e Fixing node types (Updated instructions of basejump waypoint for new C9 interface freeCodeCamp/freeCodeCamp#3237)
04d45f2 Fixing requestHeaders.Authorization (Fix confusing Waypoint: Write Reusable JavaScript with Functions freeCodeCamp/freeCodeCamp#3287)
e8c6e19 docs: Fix simple typo, existant -> existent (The "Run Test" button is not working. freeCodeCamp/freeCodeCamp#3252)
0d87655 Releasing 0.20.0
cd27741 Updating changelog for 0.20.0 release
ffea034 Releasing 0.20.0-0
fe147fb Updating changlog for 0.20.0 beta release
16aa2ce Fixing response with utf-8 BOM can not parse to json (fixed unclosed "code" tag #1064 freeCodeCamp/freeCodeCamp#2419)
c4300a8 Adding support for URLSearchParams in node (something seems wrong freeCodeCamp/freeCodeCamp#1900)

See the full diff

Package name: googleapis

The new version differs by 157 commits.

20409df chore: release 49.0.0 (fix #2011 freeCodeCamp/freeCodeCamp#2022)
7de4e78 chore(deps): update dependency null-loader to v4 (Input bug freeCodeCamp/freeCodeCamp#2044)
340f78d chore(deps): update dependency ts-loader to v7 (confusing description freeCodeCamp/freeCodeCamp#2043)
254f878 chore: remove unused dev packages (not clear statement freeCodeCamp/freeCodeCamp#2042)
f4eb6e0 chore: update lint ignore files (Worng text freeCodeCamp/freeCodeCamp#2040)
0110f3e docs: update readme for drive readme (change step 46 heroku addons:create mongolab to heroku addons:add mongolab freeCodeCamp/freeCodeCamp#2039)
73d284b fix(deps): update common and auth ("Take me to the Help Room" button is currenlty not working freeCodeCamp/freeCodeCamp#2038)
476b71e test: use discovery docs from fixture (Fix #2030 freeCodeCamp/freeCodeCamp#2037)
3a3b61d build: remove unused codecov config (Can you put the while loop challange before the for loop challenge? freeCodeCamp/freeCodeCamp#2034)
fea414a feat!: regenerate the API (Waypoint: Remove Classes from an element with jQuery - Typo? freeCodeCamp/freeCodeCamp#2028)
48a4f05 chore(dep)!: deprecate node 8 (Delete camper news story functionality freeCodeCamp/freeCodeCamp#2021)
99ebacf test: the kitchen sink system test sometimes times out (second item does not get 'ticked' (var expression = /and/gi;) freeCodeCamp/freeCodeCamp#2020)
05090da fix: apache license URL (fix typo on line 97 of coursewwares.json freeCodeCamp/freeCodeCamp#468) (solutions for Slot Machine drills are not saved freeCodeCamp/freeCodeCamp#2017)
d15c656 chore: remove duplicate mocha config (Wording is weird freeCodeCamp/freeCodeCamp#2016)
874edc3 build: update templates (Hi, I think there is a bug or a sort of catch 22 in the tutorial. We are asked to comment out the 'Lobster' font but when we do that the first two tasks change from being accomplished to being unaccomplished. If you take the comments out the last to change to being unaccomplished. There is no way to get through the task. freeCodeCamp/freeCodeCamp#2013)
dc16586 build: set AUTOSYNTH_MULTIPLE_COMMITS=true for context aware commits (button "Go to my next challenge" waits 3 seconds to get activated. freeCodeCamp/freeCodeCamp#2012)
741c58b chore: update github actions configuration (errors on waypoint-comment-your-javascript-code freeCodeCamp/freeCodeCamp#1999)
1fe744b chore(deps): update dependency @ types/rimraf to v3 (Fixes #1833 freeCodeCamp/freeCodeCamp#1995)
5512eb5 chore(deps): update dependency typedoc to ^0.17.0 (Potentially missing ; freeCodeCamp/freeCodeCamp#1993)
0a4db38 chore: release 48.0.0 (Grammar freeCodeCamp/freeCodeCamp#1979)
074f641 fix: allow an empty requestBody to be provided for APIs that support multipart post (Clarity freeCodeCamp/freeCodeCamp#1988)
8bcb212 feat!: run the generator (adds: displayvideo, gamesConfiguration, managedidentities, networkmanagement) (Run code button not working freeCodeCamp/freeCodeCamp#1989)
8677588 build(tests): fix coveralls and enable build cop (Extra words freeCodeCamp/freeCodeCamp#1982)
0679c78 build: update linkinator config (Browser hanging while editing code. freeCodeCamp/freeCodeCamp#1981)

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-LODASH-567746	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


          fix: search-indexing/package.json, search-indexing/package-lock.json …

a65d716

…& search-indexing/.snyk to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AXIOS-1038255
- https://snyk.io/vuln/SNYK-JS-JSONBIGINT-608659
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-590103
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746

Itchibon777 merged commit 6272b9d into master

Itchibon777 deleted the snyk-fix-5fcd913d39b35421e6a5b3aa073fcc4c branch

March 17, 2021 18:09

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet