Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 1 vulnerabilities #131

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #131

wants to merge 1 commit into from

Conversation

Omrisnyk
Copy link
Owner

@Omrisnyk Omrisnyk commented Dec 7, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • large-file/package.json
    • large-file/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
low severity 58/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00296, Social Trends: No, Days since published: 2262, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Low, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.43, Score Version: V5		 Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: @cypress/browserify-preprocessor
  • 3.0.2 - 2021-11-04

    3.0.2 (2021-11-04)

    Miscellaneous

    • deps: update dependency glob-parent to version 5.1.2 🌟 (#84) (61dae70)
  • 3.0.1 - 2020-07-14

    3.0.1 (2020-07-14)

    Bug Fixes

    • Handle function transforms when typescript is set (#57) (fb2f417), closes #56
  • 3.0.0 - 2020-05-21

    3.0.0 (2020-05-21)

    Breaking Changes

    • This plugin now requires Node.js 8+

    Bug Fixes

    • Validate type of typescript option and its existence as a path (3fb7b2c)
    • Improve error when attempting to preprocess a TypeScript file but the typescript option is not set (36d77a8)
  • 2.2.4 - 2020-05-11

    2.2.4 (2020-05-11)

    Bug Fixes

    • generate sourcemaps on .ts and .tsx files (#51) (d64122c)
  • 2.2.3 - 2020-05-08

    2.2.3 (2020-05-08)

    Bug Fixes

    • Only enable TypeScript jsx compiling for .js, .jsx, and .tsx files (#45) (00e9be9)
  • 2.2.2 - 2020-04-23

    2.2.2 (2020-04-23)

    Bug Fixes

    • Fix TypeScript iterator support. (#43) (f549896)
  • 2.2.1 - 2020-04-04

    2.2.1 (2020-04-04)

    Bug Fixes

    • Fix lib files not being published (#40) (24117d0)
  • 2.2.0 - 2020-04-03

    2.2.0 (2020-04-03)

    Features

    • Add out-of-the-tbox typescript support (#38) (344a057)
  • 2.1.4 - 2020-02-11

    2.1.4 (2020-02-11)

    Bug Fixes

  • 2.1.3 - 2020-02-05

    2.1.3 (2020-02-05)

    Bug Fixes

  • 2.1.2 - 2020-02-05
  • 2.1.1 - 2019-06-07
from @cypress/browserify-preprocessor GitHub release notes
Package name: mocha
  • 8.3.0 - 2021-02-11

    8.3.0 / 2021-02-11

    🎉 Enhancements

    🐛 Fixes

    📖 Documentation

    🔩 Other

    Also thanks to @ outsideris and @ HyunSangHan for various fixes to our website and documentation.

  • 8.2.1 - 2020-11-02

    8.2.1 / 2020-11-02

    Fixed stuff.

    🐛 Fixes

    • #4489: Fix problematic handling of otherwise-unhandled Promise rejections and erroneous "done() called twice" errors (@ boneskull)
    • #4496: Avoid MaxListenersExceededWarning in watch mode (@ boneskull)

    Also thanks to @ akeating for a documentation fix!

  • 8.2.0 - 2020-10-16

    8.2.0 / 2020-10-16

    The major feature added in v8.2.0 is addition of support for global fixtures.

    While Mocha has always had the ability to run setup and teardown via a hook (e.g., a before() at the top level of a test file) when running tests in serial, Mocha v8.0.0 added support for parallel runs. Parallel runs are incompatible with this strategy; e.g., a top-level before() would only run for the file in which it was defined.

    With global fixtures, Mocha can now perform user-defined setup and teardown regardless of mode, and these fixtures are guaranteed to run once and only once. This holds for parallel mode, serial mode, and even "watch" mode (the teardown will run once you hit Ctrl-C, just before Mocha finally exits). Tasks such as starting and stopping servers are well-suited to global fixtures, but not sharing resources--global fixtures do not share context with your test files (but they do share context with each other).

    Here's a short example of usage:

    // fixtures.js

    // can be async or not
    exports.mochaGlobalSetup = async function() {
    this.server = await startSomeServer({port: process.env.TEST_PORT});
    console.log(server running on port <span class="pl-s1"><span class="pl-kos">${</span><span class="pl-smi">this</span><span class="pl-kos">.</span><span class="pl-c1">server</span><span class="pl-kos">.</span><span class="pl-c1">port</span><span class="pl-kos">}</span></span>);
    };

    exports.mochaGlobalTeardown = async function() {
    // the context (this) is shared, but not with the test files
    await this.server.stop();
    console.log(server on port <span class="pl-s1"><span class="pl-kos">${</span><span class="pl-smi">this</span><span class="pl-kos">.</span><span class="pl-c1">server</span><span class="pl-kos">.</span><span class="pl-c1">port</span><span class="pl-kos">}</span></span> stopped);
    };

    // this file can contain root hook plugins as well!
    // exports.mochaHooks = { ... }

    Fixtures are loaded with --require, e.g., mocha --require fixtures.js.

    For detailed information, please see the documentation and this handy-dandy flowchart to help understand the differences between hooks, root hook plugins, and global fixtures (and when you should use each).

    🎉 Enhancements

    For implementors of custom reporters:

    • #4409: Parallel mode and custom reporter improvements (@ boneskull):
      • Support custom worker-process-only reporters (Runner.prototype.workerReporter()); reporters should subclass ParallelBufferedReporter in mocha/lib/nodejs/reporters/parallel-buffered
      • Allow opt-in of object reference matching for "sufficiently advanced" custom reporters (Runner.prototype.linkPartialObjects()); use if strict object equality is needed when consuming Runner event data
      • Enable detection of parallel mode (Runner.prototype.isParallelMode())

    🐛 Fixes

    • #4476: Workaround for profoundly bizarre issue affecting npm v6.x causing some of Mocha's deps to be installed when mocha is present in a package's devDependencies and npm install --production is run the package's working copy (@ boneskull)
    • #4465: Worker processes guaranteed (as opposed to "very likely") to exit before Mocha does; fixes a problem when using nyc with Mocha in parallel mode (@ boneskull)
    • #4419: Restore lookupFiles() in mocha/lib/utils, which was broken/missing in Mocha v8.1.0; it now prints a deprecation warning (use const {lookupFiles} = require('mocha/lib/cli') instead) (@ boneskull)

    Thanks to @ AviVahl, @ donghoon-song, @ ValeriaVG, @ znarf, @ sujin-park, and @ majecty for other helpful contributions!

  • 8.1.3 - 2020-08-28

    8.1.3 / 2020-08-28

    🐛 Fixes

    • #4425: Restore Mocha.utils.lookupFiles() and Webpack compatibility (both broken since v8.1.0); Mocha.utils.lookupFiles() is now deprecated and will be removed in the next major revision of Mocha; use require('mocha/lib/cli').lookupFiles instead (@ boneskull)
  • 8.1.2 - 2020-08-25

    8.1.2 / 2020-08-25

    🐛 Fixes

    🔒 Security Fixes

    📖 Documentation

  • 8.1.1 - 2020-08-04

    8.1.1 / 2020-08-04

    🐛 Fixes

    • #4394: Fix regression wherein certain reporters did not correctly detect terminal width (@ boneskull)
  • 8.1.0 - 2020-07-30

    8.1.0 / 2020-07-30

    In this release, Mocha now builds its browser bundle with Rollup and Babel, which will provide the project's codebase more flexibility and consistency.

    While we've been diligent about backwards compatibility, it's possible consumers of the browser bundle will encounter differences (other than an increase in the bundle size). If you do encounter an issue with the build, please report it here.

    This release does not drop support for IE11.

    Other community contributions came from @ Devjeel, @ Harsha509 and @ sharath2106. Thank you to everyone who contributed to this release!

    Do you read Korean? See this guide to running parallel tests in Mocha, translated by our maintainer, @ outsideris.

    🎉 Enhancements

    🐛 Fixes

    🔒 Security Fixes

    📖 Documentation & Website

    🔩 Other

    • #4293: Use Rollup and Babel in build pipeline; add source map to published files (@ Munter)
  • 8.0.1 - 2020-06-10

    8.0.1 / 2020-06-10

    The obligatory patch after a major.

    🐛 Fixes

  • 8.0.0 - 2020-06-10

    8.0.0 / 2020-06-10

    In this major release, Mocha adds the ability to run tests in parallel. Better late than never! Please note the breaking changes detailed below.

    Let's welcome @ giltayar and @ nicojs to the maintenance team!

    💥 Breaking Changes

    • #4164: Mocha v8.0.0 now requires Node.js v10.12.0 or newer. Mocha no longer supports the Node.js v8.x line ("Carbon"), which entered End-of-Life at the end of 2019 (@ UlisesGascon)

    • #4175: Having been deprecated with a warning since v7.0.0, mocha.opts is no longer supported (@ juergba)

      ✨ WORKAROUND: Replace mocha.opts with a configuration file.

    • #4260: Remove enableTimeout() (this.enableTimeout()) from the context object (@ craigtaub)

      ✨ WORKAROUND: Replace usage of this.enableTimeout(false) in your tests with this.timeout(0).

    • #4315: The spec option no longer supports a comma-delimited list of files (@ juergba)

      ✨ WORKAROUND: Use an array instead (e.g., "spec": "foo.js,bar.js" becomes "spec": ["foo.js", "bar.js"]).

    • #4309: Drop support for Node.js v13.x line, which is now End-of-Life (@ juergba)

    • #4282: --forbid-only will throw an error even if exclusive tests are avoided via --grep or other means (@ arvidOtt)

    • #4223: The context object's skip() (this.skip()) in a "before all" (before()) hook will no longer execute subsequent sibling hooks, in addition to hooks in child suites (@ juergba)

    • #4178: Remove previously soft-deprecated APIs (@ wnghdcjfe):

      • Mocha.prototype.ignoreLeaks()
      • Mocha.prototype.useColors()
      • Mocha.prototype.useInlineDiffs()
      • Mocha.prototype.hideDiff()

    🎉 Enhancements

    📖 Documentation

    • #4246: Add documentation for parallel mode and Root Hook plugins (@ boneskull)

    🔩 Other

    🐛 Fixes

    (All bug fixes in Mocha v8.0.0 are also breaking changes, and are listed above)

  • 7.2.0 - 2020-05-23

    7.2.0 / 2020-05-22

    🎉 Enhancements

    🐛 Fixes

    📖 Documentation

    🔩 Other

  • 7.1.2 - 2020-04-26
  • 7.1.1 - 2020-03-18
  • 7.1.0 - 2020-02-26
  • 7.0.1 - 2020-01-26
  • 7.0.0 - 2020-01-04
  • 7.0.0-esm1 - 2020-01-12
  • 6.2.3 - 2020-03-25
from mocha GitHub release notes
Commit messages
Package name: @cypress/browserify-preprocessor The new version differs by 59 commits.

See the full diff

Package name: mocha The new version differs by 250 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

@snyk-bot
fix: large-file/package.json & large-file/package-lock.json to reduce…
2664d94 
… vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/npm:debug:20170905
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

TypeScript handling assumes all transforms are specified as arrays
2 participants
@Omrisnyk @snyk-bot