New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 8 vulnerabilities #1

Open

snyk-bot wants to merge 1 commit into master from snyk-fix-41a84daf9c2291d9a30c3f307f09d78f

snyk-bot commented Aug 17, 2021

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOCHA-561476	Yes	No Known Exploit
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	No Known Exploit
	676/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.1	Regular Expression Denial of Service (ReDoS) npm:diff:20180305	Yes	Proof of Concept
	704/1000 Why? Has a fix available, CVSS 9.8	Arbitrary Code Injection npm:growl:20160721	Yes	No Known Exploit
	469/1000 Why? Has a fix available, CVSS 5.1	Denial of Service (DoS) npm:mem:20180117	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: babel-plugin-istanbul

The new version differs by 4 commits.

ad1177e chore(release): 5.0.1
7a2d891 chore: Update istanbul dependency versions.
9f006e9 chore(release): 5.0.0
a9e1564 feat: upgrade to babel 7 and newest istanbul libraries (Rule proposal: no-core import-js/eslint-plugin-import#158)

See the full diff

Package name: mocha

The new version differs by 250 commits.

eb781e2 Release v6.2.3
10dbe94 update CHANGELOG for v6.2.3 [ci skip]
848d6fb security: update mkdirp, yargs, yargs-parser
843a322 6.2.2
aec8b02 update CHANGELOG for v6.2.2 [ci skip]
7a8b95a npm audit fixes
cebddf2 Improve reporter documentation for mocha in browser. (#4026)
3f7b987 uncaughtException: report more than one exception per test (#4033)
ee82d38 modify alt text of image from Backers to Sponsors inside Sponsors section in Readme (#4046)
e9c036c special-case parsing of "require" in unparseNodeArgs(); closes #4035 (#4063)
954cf0b Fix HTMLCollection iteration to make unhide function work as expected (#4051)
816dc27 uncaughtException: fix double EVENT_RUN_END events (#4025)
9650d3f add OpenJS Foundation logo to website (#4008)
f04b81d Adopt the OpenJSF Code of Conduct (#3971)
aca8895 Add link checking to docs build step (#3972)
ef6c820 Release v6.2.1
9524978 updated CHANGELOG for v6.2.1 [ci skip]
dfdb8b3 Update yargs to v13.3.0 (#3986)
18ad1c1 treat '--require esm' as Node option (#3983)
fcffd5a Update yargs-unparser to v1.6.0 (#3984)
ad4860e Remove extraGlobals() (#3970)
b269ad0 Clarify effect of .skip() (#3947)
1e6cf3b Add Matomo to website (#3765)
91b3a54 fix style on mochajs.org (#3886)

See the full diff

Package name: nyc

The new version differs by 94 commits.

e21721a chore(release): 14.0.0
8cf8a89 docs: update issue template [skip ci] ([documentation] add example of how to add import/resolver config to settings import-js/eslint-plugin-import#1008)
d7a9d6a chore: Update package-lock.json
189bae8 chore: Update dependencies for 14.0.0-rc.1
2eb13c6 feat: instrument `--complete-copy` implementation (no-cycle: consider deep require calls import-js/eslint-plugin-import#1056)
c88a852 docs: `nyc instrument` and `--exclude-node-modules` (#656: Fix crashes that caused when using object-rest properties in namespace rule import-js/eslint-plugin-import#1039)
c213469 feat: always build the processinfo temp dir (packageDir should be relative to eslint config file not cwd import-js/eslint-plugin-import#1061)
e597c46 feat: Add support for --exclude-node-modules to subcommands. (Change packageDir to packageDirs for no-extraneous-dependencies rule import-js/eslint-plugin-import#1053)
8dcf180 feat: add processinfo index, add externalId (Release 2.10.0 import-js/eslint-plugin-import#1055)
32f75b0 fix: set processinfo pid/ppid to actual numbers (Ignore type imports for named rule. import-js/eslint-plugin-import#1057)
16d4315 chore: Stop excluding `bin` from coverage results. ([WIP] Do not report type imports from flow-typed packages import-js/eslint-plugin-import#1060)
b909575 fix: Use a single instance of nyc for all actions of main command. (add option to sort import in an alphabetical order import-js/eslint-plugin-import#1059)
997ed29 chore: Remove arrify dependency. (Performance regression when updating from 2.9.0 to 2.10.0 import-js/eslint-plugin-import#1058)
68d6333 docs: move setup docs out of the readme [skip ci] (rule: no-cycle import-js/eslint-plugin-import#1052)
8da097e feat: add `include` and `exclude` options to instrument command (Imports that are resolvable should not be reported as builtins import-js/eslint-plugin-import#1007)
31817de chore: Update dependencies (no-unresolved error when linting using eslint-import-resolver-webpack import-js/eslint-plugin-import#1050)
18e04ba fix: make --all work for transpiled code (same file in different paths causes false error import-js/eslint-plugin-import#1047)
b7e16cd feat: Support turning off node_modules default exclude via flag (add no-useless-path-segments rule Fixes #471 import-js/eslint-plugin-import#912)
3eb0e37 docs: A bunch of docs fix-ups (eslint-import-resolver-webpack not working when use webpack-merge import-js/eslint-plugin-import#1038)
5c1eb38 test(instrument): should return unmodified source if no transform found (Header-ify rule categories for easy linking import-js/eslint-plugin-import#1036)
1f6c3d4 docs: project root directory and `--cwd` doc (Document no-useless-path-segments import-js/eslint-plugin-import#1032)
051d95a fix: Add `cwd` option to instrument command (Fixes #1023 - Load exceptions in user resolvers are not reported import-js/eslint-plugin-import#1024)
91e02c6 chore: A few code cleanups (Doesn't work correctly with package.json trick import-js/eslint-plugin-import#1033)
2867538 feat: Rename `plugins` option to `parser-plugins`. (Error while loading rule 'import/group-exports': rule.create is not a function import-js/eslint-plugin-import#1031)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


          fix: package.json to reduce vulnerabilities

026120f

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-MOCHA-561476
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
- https://snyk.io/vuln/npm:braces:20180219
- https://snyk.io/vuln/npm:debug:20170905
- https://snyk.io/vuln/npm:diff:20180305
- https://snyk.io/vuln/npm:growl:20160721
- https://snyk.io/vuln/npm:mem:20180117

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet