Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 11 vulnerabilities #689

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 11 vulnerabilities #689

wants to merge 1 commit into from

Conversation

baby636
Copy link
Owner

@baby636 baby636 commented Nov 27, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • examples/ipfs-client-add-files/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Open Redirect
SNYK-JS-NODEFORGE-2330875		 No Proof of Concept
medium severity 529/1000
Why? Has a fix available, CVSS 6.3		 Prototype Pollution
SNYK-JS-NODEFORGE-2331908		 No No Known Exploit
medium severity 494/1000
Why? Has a fix available, CVSS 5.6		 Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430337		 No No Known Exploit
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430339		 No No Known Exploit
medium severity 494/1000
Why? Has a fix available, CVSS 5.6		 Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430341		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1255640		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JS-POSTCSS-5926692		 Yes No Known Exploit
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831		 Yes Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-UNSETVALUE-2400660		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: ipfs The new version differs by 43 commits.

See the full diff

Package name: parcel The new version differs by 250 commits.
  • 84da50a v2.0.0
  • aa0a369 Small copy change
  • c78601b shouldVisitChild: Check parent and child node previously deferred separately (#7043)
  • 2c83842 Fix scope resolution for TS enums (#7057)
  • dbe1153 Fix order of hoisted variable declarations (#7053)
  • bea9442 Fix named export with different export name for wrapped assets (#7052)
  • 2175e1b Mark '*' as used when the reexport is only decided at runtime (#7049)
  • 4312b91 Update Micromatch (#6958)
  • 5afe766 Fail when unable to build a native package (#6962)
  • 971ed24 Update watcher and source-map library to 2.0.0 (#7044)
  • 810a854 Add missing C flags for SIMD support in build workflow (#7045)
  • d6de61d Fix shaking for functions types with overload signatures (#7036)
  • daf2cd9 Safely position the HMR script (#6961)
  • 89b4e51 Unmark defer for dependency that become used ('does not export') (#7035)
  • b575212 Bump swc (#7033)
  • 415710f Fix CSS tree shaking with 'build --no-scope-hoist' (#5728)
  • ea0f4e4 Allow jsx and tsx as lang for script block in Vue SFCs (#6983)
  • d2d4f1c Never enable JSX in a .ts file (#7031)
  • aafc318 Don't use deprecated querystring package (#6806)
  • a6a6fb2 Fix cache invalidation when shouldOptimize changes (#7030)
  • 7d4d53a Update all references to v2.parceljs.org to just parceljs.org (#7029)
  • 91de5c0 Ensure symbol order is consistent (#7021)
  • 2ebed00 Ensure named exports are prioritized over wildcard re-exports (#7016)
  • 4904f20 Fix autoinstall with Yarn 2+ (#7023)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@baby636 @snyk-bot