Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 2 vulnerabilities #90

Open
wants to merge 1 commit into
base: next
Choose a base branch
from
Open

[Snyk] Fix for 2 vulnerabilities #90

wants to merge 1 commit into from

Conversation

alejandrosuarez
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • examples/custom-tabbar-react/package.json
  • examples/custom-tabbar-react/yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5		 Uncontrolled resource consumption
SNYK-JS-BRACES-6838727		 No Proof of Concept
high severity 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728		 No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Note: This is a default PR template raised by Snyk. Find out more about how you can customise Snyk PRs in our documentation.

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled resource consumption

@snyk-bot
fix: examples/custom-tabbar-react/package.json & examples/custom-tabb…
19a18b3 
…ar-react/yarn.lock to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-BRACES-6838727
- https://snyk.io/vuln/SNYK-JS-MICROMATCH-6838728
@socket-security Socket Security
Copy link

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/@babel/compat-data@7.17.10 None 0 50.6 kB nicolo-ribaudo
npm/@babel/core@7.18.2 environment, filesystem, unsafe +13 905 kB nicolo-ribaudo
npm/@babel/helper-compilation-targets@7.18.2 None +1 21.5 kB nicolo-ribaudo
npm/@babel/helper-create-class-features-plugin@7.18.0 None +4 115 kB nicolo-ribaudo
npm/@babel/helper-create-regexp-features-plugin@7.17.12 None +1 10.4 kB nicolo-ribaudo
npm/@babel/helper-environment-visitor@7.18.2 None 0 3.37 kB nicolo-ribaudo
npm/@babel/helper-function-name@7.17.9 None 0 6.66 kB nicolo-ribaudo
npm/@babel/helper-plugin-utils@7.17.12 None 0 4.51 kB nicolo-ribaudo
npm/@babel/helper-replace-supers@7.18.2 None +2 63.4 kB nicolo-ribaudo
npm/@babel/helper-simple-access@7.18.2 None 0 5.16 kB nicolo-ribaudo
npm/@babel/parser@7.18.4 None 0 1.88 MB nicolo-ribaudo
npm/@babel/plugin-proposal-class-properties@7.17.12 None 0 3.32 kB nicolo-ribaudo
npm/@babel/plugin-proposal-nullish-coalescing-operator@7.17.12 None 0 4.39 kB nicolo-ribaudo
npm/@babel/plugin-proposal-object-rest-spread@7.18.0 None +1 102 kB nicolo-ribaudo
npm/@babel/plugin-proposal-optional-chaining@7.17.12 None +1 36.1 kB nicolo-ribaudo
npm/@babel/plugin-proposal-unicode-property-regex@7.17.12 None 0 3.46 kB nicolo-ribaudo
npm/@babel/plugin-syntax-flow@7.17.12 None 0 3.09 kB nicolo-ribaudo
npm/@babel/plugin-syntax-jsx@7.17.12 None 0 2.72 kB nicolo-ribaudo
npm/@babel/plugin-transform-arrow-functions@7.17.12 None 0 3.2 kB nicolo-ribaudo
npm/@babel/plugin-transform-async-to-generator@7.17.12 None +3 16.4 kB nicolo-ribaudo
npm/@babel/plugin-transform-block-scoping@7.18.4 None 0 27.2 kB nicolo-ribaudo
npm/@babel/plugin-transform-classes@7.18.4 None +4 76.6 kB nicolo-ribaudo
npm/@babel/plugin-transform-computed-properties@7.17.12 None 0 7.69 kB nicolo-ribaudo
npm/@babel/plugin-transform-destructuring@7.18.0 None 0 78.7 kB nicolo-ribaudo
npm/@babel/plugin-transform-for-of@7.18.1 None 0 14.7 kB nicolo-ribaudo
npm/@babel/plugin-transform-literals@7.17.12 None 0 3.03 kB nicolo-ribaudo
npm/@babel/plugin-transform-modules-commonjs@7.18.2 None +3 75.4 kB nicolo-ribaudo
npm/@babel/plugin-transform-parameters@7.17.12 None 0 18.1 kB nicolo-ribaudo
npm/@babel/plugin-transform-react-jsx@7.17.12 None +1 26.8 kB nicolo-ribaudo
npm/@babel/plugin-transform-regenerator@7.18.0 None 0 3.49 kB nicolo-ribaudo
npm/@babel/plugin-transform-runtime@7.18.2 unsafe +5 480 kB nicolo-ribaudo
npm/@babel/plugin-transform-spread@7.17.12 None +1 10.9 kB nicolo-ribaudo
npm/@babel/plugin-transform-template-literals@7.18.2 None 0 6.22 kB nicolo-ribaudo
npm/@babel/plugin-transform-typescript@7.18.4 None +1 36.8 kB nicolo-ribaudo
npm/@babel/runtime@7.18.3 None 0 201 kB nicolo-ribaudo
npm/@babel/traverse@7.18.2 None +8 483 kB nicolo-ribaudo
npm/@babel/types@7.18.4 environment +1 1.07 MB nicolo-ribaudo
npm/@jridgewell/trace-mapping@0.3.13 None +2 181 kB jridgewell
npm/@pmmmwh/react-refresh-webpack-plugin@0.5.5 environment, filesystem +8 370 kB pmmmwh
npm/@swc/core-android-arm-eabi@1.2.197 None 0 39.1 MB kdy1
npm/@swc/core-android-arm64@1.2.197 None 0 64 MB kdy1
npm/@swc/core-darwin-arm64@1.5.7 None 0 37.7 MB kdy1
npm/@swc/core-darwin-x64@1.5.7 None 0 41 MB kdy1
npm/@swc/core-freebsd-x64@1.2.197 None 0 106 MB kdy1
npm/@swc/core-linux-arm-gnueabihf@1.5.7 None 0 25.2 MB kdy1
npm/@swc/core-linux-arm64-gnu@1.5.7 None 0 43.9 MB kdy1
npm/@swc/core-linux-arm64-musl@1.5.7 None 0 55.3 MB kdy1
npm/@swc/core-linux-x64-gnu@1.5.7 None 0 50.3 MB kdy1
npm/@swc/core-linux-x64-musl@1.5.7 None 0 62.4 MB kdy1
npm/@swc/core-win32-arm64-msvc@1.5.7 None 0 33.8 MB kdy1
npm/@swc/core-win32-ia32-msvc@1.5.7 None 0 27.6 MB kdy1
npm/@swc/core-win32-x64-msvc@1.5.7 None 0 53.4 MB kdy1
npm/@swc/core@1.5.7 environment, filesystem, shell +1 396 kB kdy1
npm/@swc/counter@0.1.3 None 0 1.18 kB kdy1
npm/@tarojs/api@3.5.0-beta.2 environment 0 95.6 kB defaultlee
npm/@tarojs/components@3.5.0-beta.2 None +6 39.3 MB defaultlee
npm/@tarojs/helper@3.5.0 environment, filesystem, shell Transitive: unsafe +68 1.37 MB defaultlee
npm/@tarojs/plugin-framework-react@3.5.0-beta.2 environment 0 101 kB defaultlee
npm/@tarojs/plugin-platform-alipay@3.5.0-beta.2 None 0 148 kB defaultlee
npm/@tarojs/plugin-platform-jd@3.5.0-beta.2 None 0 16.2 kB defaultlee
npm/@tarojs/plugin-platform-qq@3.5.0 None 0 16.9 kB defaultlee
npm/@tarojs/plugin-platform-swan@3.5.0-beta.2 None 0 89.9 kB defaultlee
npm/@tarojs/plugin-platform-tt@3.5.0 None 0 29 kB defaultlee
npm/@tarojs/plugin-platform-weapp@3.5.0-beta.2 None 0 124 kB defaultlee
npm/@tarojs/react@3.5.0-beta.2 environment 0 25.6 kB defaultlee
npm/@tarojs/router@3.5.0-beta.2 environment +1 352 kB defaultlee
npm/@tarojs/runtime@3.5.0-beta.2 environment Transitive: eval +1 996 kB defaultlee
npm/@tarojs/service@3.5.0-beta.2 environment, filesystem +6 730 kB defaultlee
npm/@tarojs/shared@3.5.0-beta.2 None 0 377 kB defaultlee
npm/@tarojs/taro-h5@3.5.0-beta.2 environment, network +3 1.59 MB defaultlee
npm/@tarojs/taro@3.5.0-beta.2 None 0 1.03 MB defaultlee
npm/@tarojs/webpack5-runner@3.5.0-beta.2 environment, filesystem, unsafe Transitive: eval, network, shell +132 57.2 MB defaultlee
npm/@types/express-serve-static-core@4.17.28 None +3 1.78 MB types
npm/@types/express@4.17.13 None +6 1.73 MB types
npm/@types/json-schema@7.0.11 None 0 32.2 kB types
npm/@types/react@17.0.45 None +3 1.38 MB types
npm/@types/webpack-env@1.17.0 None 0 16.9 kB types
npm/@typescript-eslint/eslint-plugin@4.33.0 Transitive: environment, filesystem +9 4.54 MB jameshenry
npm/@typescript-eslint/parser@4.33.0 Transitive: environment, filesystem +5 1.34 MB jameshenry
npm/acorn@8.7.1 None 0 466 kB marijn
npm/arr-flatten@1.1.0 None 0 6.88 kB jonschlinkert
npm/array-includes@3.1.5 None 0 22.9 kB ljharb
npm/babel-preset-taro@3.5.0-beta.2 environment, filesystem Transitive: eval, unsafe +80 2.57 MB defaultlee
npm/babel-runtime@6.26.0 Transitive: environment, eval, filesystem +1 2.31 MB hzoo
npm/browserslist@4.20.3 environment, filesystem +3 110 kB ai
npm/caniuse-lite@1.0.30001346 None 0 1.54 MB caniuse-lite
npm/core-js-compat@3.22.8 None +1 603 kB zloirock
npm/core-js-pure@3.22.8 environment, eval, filesystem 0 867 kB zloirock
npm/core-util-is@1.0.2 None 0 23.2 kB isaacs
npm/css-tree@2.0.4 None +1 1.72 MB lahmatiy
npm/define-properties@1.1.4 None +1 19.7 kB ljharb
npm/electron-to-chromium@1.4.146 None 0 174 kB kilianvalkhof
npm/es-abstract@1.20.1 None +13 1.62 MB ljharb
npm/esbuild@0.14.42 environment, filesystem, network, shell +20 163 MB evanw
npm/eslint-config-taro@3.5.0-beta.2 Transitive: environment, filesystem, shell, unsafe +51 9.91 MB defaultlee
npm/eslint-plugin-import@2.26.0 filesystem, unsafe Transitive: environment +13 1.38 MB ljharb
npm/eslint-plugin-react-hooks@4.5.0 environment 0 118 kB acdlite
npm/eslint-plugin-react@7.30.0 filesystem +7 1.17 MB ljharb
npm/eslint@6.8.0 filesystem, unsafe Transitive: environment, eval, shell +39 8.01 MB eslintbot
npm/extend-shallow@3.0.2 None +2 21.4 kB phated
npm/fast-glob@3.2.11 filesystem 0 88.8 kB mrmlnc
npm/for-in@1.0.2 None 0 6.28 kB jonschlinkert
npm/get-value@2.0.6 None 0 3.71 kB jonschlinkert
npm/glob@7.2.3 filesystem Transitive: environment +2 72.3 kB isaacs
npm/graceful-fs@4.2.10 environment, filesystem 0 32.5 kB isaacs
npm/has-bigints@1.0.2 None 0 12.8 kB ljharb
npm/has-symbols@1.0.3 None 0 20.6 kB ljharb
npm/html-entities@2.3.3 None 0 95.5 kB mdevils
npm/is-core-module@2.9.0 None +2 54.8 kB ljharb
npm/is-descriptor@1.0.2 None +2 27.2 kB jonschlinkert
npm/is-extendable@0.1.1 None 0 5.09 kB jonschlinkert
npm/is-extglob@2.1.1 None 0 6.22 kB jonschlinkert
npm/is-glob@4.0.3 None 0 13.6 kB phated
npm/is-path-inside@3.0.3 None 0 4.12 kB sindresorhus
npm/is-plain-object@2.0.4 None 0 7.5 kB jonschlinkert
npm/is-regex@1.1.4 None +1 41 kB ljharb
npm/is-string@1.0.7 None +1 30 kB ljharb
npm/is-symbol@1.0.4 None 0 22 kB ljharb
npm/isarray@1.0.0 None 0 3.89 kB juliangruber
npm/isobject@3.0.1 None 0 6.93 kB doowb
npm/jest-worker@27.5.1 environment, shell +4 1.78 MB simenb
npm/js-tokens@4.0.0 None 0 15.1 kB lydell
npm/json-parse-better-errors@1.0.2 None 0 6.7 kB zkat
npm/json5@2.2.1 None 0 229 kB jordanbtucker
npm/kind-of@6.0.3 None 0 22.8 kB doowb
npm/klona@2.0.5 None 0 23 kB lukeed
npm/lodash@4.17.21 None 0 1.41 MB bnjmnt4n
npm/loose-envify@1.4.0 environment 0 5.81 kB zertosh
npm/make-dir@2.1.0 filesystem 0 9.2 kB sindresorhus
npm/merge2@1.4.1 None 0 8.9 kB zensh
npm/micromatch@4.0.5 None 0 55.9 kB jonschlinkert
npm/mime-db@1.52.0 None 0 206 kB dougwilson
npm/mime-types@2.1.35 None 0 18.3 kB dougwilson
npm/mime@1.6.0 environment, filesystem 0 51.7 kB broofa
npm/minimatch@3.1.2 None +3 57.8 kB isaacs
npm/minimist@1.2.6 None 0 33.2 kB substack
npm/mkdirp@1.0.4 environment, filesystem 0 19.1 kB isaacs
npm/ms@2.1.3 None 0 6.72 kB styfle
npm/nanoid@3.3.4 None 0 21.6 kB ai
npm/normalize-package-data@2.5.0 None +1 52.5 kB audrey.e
npm/normalize-path@3.0.0 None 0 9.22 kB jonschlinkert

🚮 Removed packages: npm/@babel/compat-data@7.17.0, npm/@babel/core@7.17.4, npm/@babel/generator@7.17.3, npm/@babel/helper-compilation-targets@7.16.7, npm/@babel/helper-create-class-features-plugin@7.17.1, npm/@babel/helper-create-regexp-features-plugin@7.17.0, npm/@babel/helper-environment-visitor@7.16.7, npm/@babel/helper-function-name@7.16.7, npm/@babel/helper-plugin-utils@7.16.7, npm/@babel/helper-string-parser@7.18.10, npm/@babel/highlight@7.16.10, npm/@babel/parser@7.17.3, npm/@babel/plugin-proposal-async-generator-functions@7.16.8, npm/@babel/plugin-proposal-class-properties@7.16.7, npm/@babel/plugin-proposal-nullish-coalescing-operator@7.16.7, npm/@babel/plugin-proposal-object-rest-spread@7.17.3, npm/@babel/plugin-proposal-optional-chaining@7.16.7, npm/@babel/plugin-proposal-unicode-property-regex@7.16.7, npm/@babel/plugin-syntax-flow@7.16.7, npm/@babel/plugin-syntax-jsx@7.16.7, npm/@babel/plugin-transform-arrow-functions@7.16.7, npm/@babel/plugin-transform-async-to-generator@7.16.8, npm/@babel/plugin-transform-block-scoping@7.16.7, npm/@babel/plugin-transform-classes@7.16.7, npm/@babel/plugin-transform-computed-properties@7.16.7, npm/@babel/plugin-transform-destructuring@7.17.3, npm/@babel/plugin-transform-literals@7.16.7, npm/@babel/plugin-transform-modules-commonjs@7.16.8, npm/@babel/plugin-transform-named-capturing-groups-regex@7.16.8, npm/@babel/plugin-transform-parameters@7.16.7, npm/@babel/plugin-transform-react-jsx@7.17.3, npm/@babel/plugin-transform-runtime@7.17.0, npm/@babel/plugin-transform-spread@7.16.7, npm/@babel/plugin-transform-template-literals@7.16.7, npm/@babel/plugin-transform-typescript@7.16.8, npm/@babel/runtime@7.17.2, npm/@babel/traverse@7.17.3, npm/@babel/types@7.17.0, npm/@jridgewell/gen-mapping@0.3.3, npm/@pmmmwh/react-refresh-webpack-plugin@0.5.11, npm/@tarojs/api@3.6.30, npm/@tarojs/binding-darwin-arm64@3.6.24, npm/@tarojs/binding-darwin-x64@3.6.24, npm/@tarojs/binding-linux-x64-gnu@3.6.24, npm/@tarojs/binding-win32-x64-msvc@3.6.24, npm/@tarojs/binding@3.6.24, npm/@tarojs/cli@3.6.24, npm/@tarojs/components-advanced@3.6.24, npm/@tarojs/components-react@3.6.30, npm/@tarojs/components@3.6.24, npm/@tarojs/helper@3.6.24, npm/@tarojs/plugin-framework-react@3.6.24, npm/@tarojs/plugin-platform-alipay@3.6.30, npm/@tarojs/plugin-platform-h5@3.6.30, npm/@tarojs/plugin-platform-jd@3.6.30, npm/@tarojs/plugin-platform-qq@3.6.30, npm/@tarojs/plugin-platform-swan@3.6.30, npm/@tarojs/plugin-platform-tt@3.6.30, npm/@tarojs/plugin-platform-weapp@3.6.24, npm/@tarojs/react@3.6.24, npm/@tarojs/router@3.6.30, npm/@tarojs/runner-utils@3.6.30, npm/@tarojs/runtime@3.6.24, npm/@tarojs/service@3.6.24, npm/@tarojs/shared@3.6.24, npm/@tarojs/taro-h5@3.6.30, npm/@tarojs/taro-loader@3.6.30, npm/@tarojs/taro@3.6.24, npm/@tarojs/webpack5-prebundle@3.6.30, npm/@tarojs/webpack5-runner@3.6.30, npm/@types/express-serve-static-core@4.17.35, npm/@types/express@4.17.17, npm/@types/json-schema@7.0.12, npm/@types/lodash@4.14.195, npm/@types/react@16.14.23, npm/@types/serve-static@1.15.5, npm/@types/webpack-env@1.16.3, npm/@typescript-eslint/parser@6.21.0, npm/@typescript-eslint/scope-manager@6.21.0, npm/@typescript-eslint/types@6.21.0, npm/@typescript-eslint/typescript-estree@6.21.0, npm/@typescript-eslint/visitor-keys@6.21.0, npm/acorn@8.7.0, npm/array-includes@3.1.4, npm/babel-plugin-transform-taroapi@3.6.30, npm/babel-preset-taro@3.6.24, npm/browserslist@4.19.1, npm/buffer@5.7.1, npm/caniuse-lite@1.0.30001495, npm/clone-response@1.0.2, npm/colord@2.9.3, npm/core-js-compat@3.21.1, npm/core-js-pure@3.35.1, npm/css-tree@2.2.1, npm/csstype@3.1.3, npm/debug@4.3.3, npm/decompress-tar@4.1.1, npm/electron-to-chromium@1.4.71, npm/end-of-stream@1.4.4, npm/enhanced-resolve@5.14.1, npm/es-abstract@1.19.1, npm/eslint-config-taro@3.6.24, npm/eslint-plugin-import@2.25.4, npm/eslint-plugin-react-hooks@4.6.0, npm/eslint-plugin-react@7.28.0, npm/eslint@8.23.0, npm/fast-glob@3.2.12, npm/fs-extra@9.1.0, npm/get-stream@3.0.0, npm/glob@7.2.0, npm/graceful-fs@4.2.9, npm/has-symbols@1.0.2, npm/html-entities@2.4.0, npm/ini@1.3.8, npm/is-core-module@2.8.1

View full report↗︎

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@alejandrosuarez @snyk-bot