Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk-local] Fix for 6 vulnerabilities #2

Merged
merged 1 commit into from
Nov 17, 2020
Merged

[Snyk-local] Fix for 6 vulnerabilities #2

merged 1 commit into from
Nov 17, 2020

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

✨ Snyk has automatically assigned this pull request, set who gets assigned.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

    • package.json
    • package-lock.json

  • Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
    Find out more.

Vulnerabilities that will be fixed

With an upgrade:
Severity Issue Breaking Change Exploit Maturity
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-1019388		 No No Known Exploit
medium severity Information Exposure
SNYK-JS-MONGOOSE-472486		 No No Known Exploit
low severity Insecure use of /tmp folder
npm:cli:20160615		 No No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 No No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
npm:minimatch:20160620		 No No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 No No Known Exploit
Commit messages
Package name: body-parser The new version differs by 53 commits.
  • b2659a7 1.18.2
  • 6339bf7 perf: remove argument reassignment
  • d5f9a4a deps: debug@2.6.9
  • d041563 1.18.1
  • 9efa9ab deps: content-type@~1.0.4
  • f1ef6cc deps: qs@6.5.1
  • e438db5 deps: raw-body@2.3.2
  • 15c3585 deps: iconv-lite@0.4.19
  • adfa01c 1.18.0
  • 0632e2f Include the "type" property on all generated errors
  • b8f97cd Include the "body" property on verify errors
  • c659e8a tests: add test for err.body on json parse error
  • 4e15325 tests: reorganize json error tests
  • 5bd7ed5 tests: reorganize json strict option tests
  • 3cb380b tests: store server on mocha context instead of variable shadowing
  • 29c8cd0 docs: document too many parameters error
  • 7b9cb14 Use http-errors to set status code on errors
  • 29a27f1 docs: fix typo in jsdoc comment
  • 448dc57 Fix JSON strict violation error to match native parse error
  • 87df7e6 tests: add leading whitespace strict json test
  • 1841248 deps: raw-body@2.3.1
  • e666dbe deps: http-errors@~1.6.2
  • c2a110a deps: bytes@3.0.0
  • a1a2e31 build: Node.js@8.4

See the full diff

Package name: mongoose The new version differs by 250 commits.
  • 40a879b chore: release 5.7.5
  • 159457d chore: add vpn black friday as sponsor
  • e6285ea Merge pull request #8244 from AbdelrahmanHafez/master
  • d9163f5 fix: correct order for declaration
  • cec9dda Minor refactor to ValidationError
  • 13ae085 docs(index): add favicon to home page
  • 96ce0eb style: fix lint
  • 973b1e0 docs: add schema options to API docs
  • cdfb507 chore: add useUnifiedTopology for tests re: #8212
  • 936ddfb fix(update): handle subdocument pre('validate') errors in update validation
  • 98b3b09 test(update): repro #7187
  • b9c1012 docs(middleware): add note about accessing the document being updated in pre('findOneAndUpdate')
  • 327b47a fix(subdocument): make subdocument#isModified use parent document's isModified
  • 54db026 test(subdocument): repro #8223
  • 89eb449 chore: now working on 5.7.5
  • ffbff22 chore: change version for recompiling website
  • 0562ca7 chore: add opencollective sponsors: top web design companies, casino top
  • ee22c09 chore: now working on 5.7.5
  • f3eca5b fix(query): delete top-level `_bsontype` property in queries to prevent silent empty queries
  • cc10e0d test(query): repro #8222
  • ede5aef chore: release 5.7.4
  • 402db1a fix(model): support passing `options` to `Model.remove()`
  • 7a20276 fix(schema): handle `required: null` and `required: undefined` as `required: false`
  • 9b4a323 test(schema): repro #8219

See the full diff

With a Snyk patch:
Severity Issue Exploit Maturity
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 No Known Exploit

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

👩‍💻 Set who automatically gets assigned

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

@snyk-bot
fix: package.json, package-lock.json & .snyk to reduce vulnerabilities
9e5df88 
The following vulnerabilities are fixed with an upgrade:
- http://localhost:8000/vuln/SNYK-JS-MINIMATCH-1019388
- http://localhost:8000/vuln/SNYK-JS-MONGOOSE-472486
- http://localhost:8000/vuln/npm:cli:20160615
- http://localhost:8000/vuln/npm:debug:20170905
- http://localhost:8000/vuln/npm:minimatch:20160620
- http://localhost:8000/vuln/npm:ms:20170412


The following vulnerabilities are fixed with a Snyk patch:
- http://localhost:8000/vuln/npm:debug:20170905
- http://localhost:8000/vuln/npm:ms:20170412
@Nealm03 Nealm03 merged commit 4a58f49 into master Nov 17, 2020
@Nealm03 Nealm03 deleted the snyk-fix-7c330271d57280f140edc731ce115d1a branch November 17, 2020 15:56
@Nealm03 Nealm03 mentioned this pull request Nov 29, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@snyk-bot @Nealm03