New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade ecmarkup from 7.1.0 to 10.0.1 #16

Open

aliscco wants to merge 1 commit into master from snyk-fix-6a44fb4dd129048332edfc25d942bbc4

Owner

aliscco commented Dec 20, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	619/1000 Why? Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-AJV-584908	Yes	No Known Exploit
	644/1000 Why? Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Yes	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: ecmarkup

The new version differs by 88 commits.

016c0bb Version 10.0.1
5ce4e28 Version 10.0.0 (Remove interoperability between TypedArrays and DataView instances tc39/ecma262#411)
a7ebc3c fix build-spec (Remove unnecessary step on %ArrayIteratorPrototype%.next tc39/ecma262#412)
92a4e60 drop changelog (Allow non-HTML-encoded entities tc39/ecma262#404)
e919955 completion-record local typechecking (Editorial: Correct typo tc39/ecma262#408)
b0cc87e rename some cli flags (Editorial: Minor ReturnIfAbrupt cleanup tc39/ecma262#406)
5b19588 various tweaks to the biblio (Normative: account for possible abrupt completion tc39/ecma262#405)
33de657 Bump various dependencies (B.1.4 AtomEscape production syntax incomplete tc39/ecma262#378)
a5f95e9 remove runtime dependency on eslint by depending on the codeframe formatter directly (Behavior of for-in on null or undefined tc39/ecma262#377)
8471723 switch from nomnom to command-line-args (editorial: tweak recent commit tc39/ecma262#376)
8e577d8 ecmascript spelling (Editorial: Start all fields and slots with an uppercase code point tc39/ecma262#407)
6b5838b Version 9.8.1
ce4a276 Fix header parser (RegExp fixes tc39/ecma262#403)
74db0e9 Version 9.8.0
b971460 Add shortcuts help dialog (Normative: Fix Annex B FiB to only assign function Objects out of blocks and allow redeclarations. tc39/ecma262#400)
f34a045 Version 9.7.1
da3f316 Ensure emu-meta tags are fenced by the same mechanisms that xrefs are (Built-in Modules tc39/ecma262#395)
7f9c84c fix test broken in last commit, oops
2e7e5f2 stop trying to use the ecmarkdown parse tree from the linting phase (Make Realm's field records start with an uppercase code point tc39/ecma262#393)
57cf9cb Version 9.7.0
ff18989 Add [fence-effects=""] to stop effect propagation (PropertyName doesn't inherit Yield in AssignmentProperty tc39/ecma262#388)
67b40a0 bump ecmarkdown and support arbitrary attributes for steps (NewPromiseCapability & GetCapabilitiesExecutor Functions tc39/ecma262#392)
da9b7e9 Rename Xref#canHaveEffect to Xref#shouldPropagateEffect (Typo: "must be true so, let" should be "must be true, so let" tc39/ecma262#389)
d457b66 Version 9.6.5

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Command Injection


          fix: package.json & package-lock.json to reduce vulnerabilities

9e9ac3a

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-QS-3153490

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet