[Snyk] Upgrade @truffle/hdwallet-provider from 2.0.3 to 2.1.15 #317

ReeceKidd · 2024-05-12T23:50:59Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade @truffle/hdwallet-provider from 2.0.3 to 2.1.15.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 34 versions ahead of your current version.
The recommended version was released 8 months ago, on 2023-09-07.

The recommended version fixes:

Issue	PriorityScore (*)	Exploit Maturity
Prototype Poisoning SNYK-JS-QS-3153490	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Improper Verification of Cryptographic Signature SNYK-JS-BROWSERIFYSIGN-6037026	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-ES5EXT-6095076	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Information Exposure SNYK-JS-SIMPLEGET-2361683	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Open Redirect SNYK-JS-GOT-2932019	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-COOKIEJAR-3149984	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept
Open Redirect SNYK-JS-EXPRESS-6474509	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Open Redirect SNYK-JS-GOT-2932019	482/1000 Why? Proof of Concept exploit, CVSS 7.5	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-2429795	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: @truffle/hdwallet-provider

2.1.15 - 2023-09-07
2.1.14 - 2023-08-29
2.1.13 - 2023-07-14
2.1.12 - 2023-06-06
2.1.11 - 2023-05-11
2.1.10 - 2023-04-20
2.1.10-visual-debugger.0 - 2023-05-12
2.1.9 - 2023-03-17
2.1.8 - 2023-03-10
2.1.7 - 2023-02-17
2.1.6 - 2023-02-02
2.1.5 - 2023-01-13
2.1.4 - 2022-12-21
2.1.3 - 2022-12-08
2.1.2 - 2022-11-23
2.1.1 - 2022-11-02
2.1.0 - 2022-10-12
2.0.17 - 2022-10-05
2.0.16 - 2022-09-30
2.0.15 - 2022-09-22
2.0.14 - 2022-08-17
2.0.13 - 2022-07-29
2.0.12 - 2022-07-21
2.0.12-typescript-migrations.0 - 2022-07-21
2.0.11 - 2022-07-15
2.0.10 - 2022-07-01
2.0.10-alpha.2 - 2022-06-24
2.0.10-alpha.0 - 2022-06-23
2.0.9 - 2022-06-09
2.0.8 - 2022-04-28
2.0.7 - 2022-04-21
2.0.6 - 2022-04-13
2.0.5 - 2022-04-08
2.0.4 - 2022-03-10
2.0.3 - 2022-02-03

from @truffle/hdwallet-provider GitHub release notes

Commit messages

Package name: @truffle/hdwallet-provider

033fc64 Publish
8c81e30 Merge pull request #6187 from trufflesuite/decapitate
7591024 Remove gitHead field that snuck its way in
4c80841 Merge pull request #6180 from legobeat/node-version
25f02d2 Merge pull request #6185 from legobeat/devdeps-dedupe-babel
d235365 Merge pull request #6186 from legobeat/ci-node-20.5
48a2052 chore: yarn dedupe @ babel/ packages
d355b79 chore(ci): pin node 20 to 20.5 due to regression in 20.6
d0d0c89 Merge pull request #6178 from legobeat/achrinza-node-ipc
a9d543f Merge pull request #6177 from legobeat/deps-semver
1c79efe chore(deps): unpin semver
5ae76e9 deps(codec-components): bump @ microsoft/api-extractor to fix semver CVE
cb8bf8b yarn dedupe browserslist@^4.x
a830ff5 deps: dedupe core-js-compat to remove semver@7.0.0
c31707c update yarn.lock
b349c1c deps: semver@^7.5.2->^7.5.4
53fcef0 update yarn.lock
005ebb9 deps: semver@7.5.2->7.5.4
4ff7c58 update yarn.lock
cfde067 devDeps(spinners): remove unused @ types/semver
6af2e11 devDeps: @ types/semver->7.5.1
b1810cc deps: semver@7.5.2->7.5.4
b7bc4c1 deps(core): semver@7.5.2->7.5.4
9c581ec compile-solidity: type-assertion due to incompletely typed @ types/semver