New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade ipfs from 0.55.4 to 0.57.0 #711

Open

baby636 wants to merge 1 commit into master from snyk-fix-56610ffe82c67c48c037f676cd802b06

Owner

baby636 commented Nov 28, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- examples/custom-ipfs-repo/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	No	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	No	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	No	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	No	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: ipfs

The new version differs by 43 commits.

7f24131 chore: publish
93b81f9 chore: update contributors
33fa734 feat: ed25519 keys by default (feat: ed25519 keys by default ipfs/js-ipfs#3693)
2886134 chore: upgrade go-ipfs to 0.9.x (chore: upgrade go-ipfs to 0.9.x ipfs/js-ipfs#3805)
2f3df7a fix: return rate in/out as number (fix: return rate in/out as number ipfs/js-ipfs#3798)
4f532a5 fix: do not write blocks we already have (fix: do not write blocks we already have ipfs/js-ipfs#3801)
db302d0 chore: revert "chore(deps-dev): bump go-ipfs from 0.8.0 to 0.9.1" (chore: revert "chore(deps-dev): bump go-ipfs from 0.8.0 to 0.9.1" ipfs/js-ipfs#3803)
4c7ac57 chore(deps-dev): bump go-ipfs from 0.8.0 to 0.9.1 (chore(deps-dev): bump go-ipfs from 0.8.0 to 0.9.1 ipfs/js-ipfs#3765)
746a54c fix: fix up examples (fix: fix up examples ipfs/js-ipfs#3799)
b7fc9e8 docs: update files.rm example (docs: update files.rm example ipfs/js-ipfs#3797)
1ad6001 feat: make ipfs.get output tarballs (feat: make ipfs.get output tarballs ipfs/js-ipfs#3785)
79f661e fix: typescript errors (fix: typescript errors ipfs/js-ipfs#3781)
7fdba64 docs: update remote pinning docs (docs: update remote pinning docs ipfs/js-ipfs#3786)
fdc03ab chore: updated example dependencies
dde3d28 chore: publish
8178225 chore: update contributors
1bf35f8 fix: typo in 'multiformats' type defs (fix: typo in 'multiformats' type defs ipfs/js-ipfs#3778)
8380d71 fix: restore default level-js options (fix: restore default level-js options ipfs/js-ipfs#3779)
bf23e48 docs: update ipld/multiformats docs (docs: update ipld/multiformats docs ipfs/js-ipfs#3771)
349cbd0 chore: use multiformats sha3 impl (chore: use multiformats sha3 impl ipfs/js-ipfs#3772)
bb6113a chore: only run example tests if code has changed (chore: only run example tests if code has changed ipfs/js-ipfs#3773)
d4090e0 chore: restore git and eth graph traversal examples (chore: restore git and eth graph traversal examples ipfs/js-ipfs#3770)
4b79dcb chore: updated example dependencies
ef41f92 chore: publish

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Open Redirect
🦉 Prototype Pollution


          fix: examples/custom-ipfs-repo/package.json to reduce vulnerabilities

a6472a4

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2330875
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2331908
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430337
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430339
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430341

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet