New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 6 vulnerabilities #23

Open

choupijiang wants to merge 1 commit into dev from snyk-fix-21af28d54459b410e8d2f6262599a080

Owner

choupijiang commented Nov 27, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- dolphinscheduler-ui/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-ASYNCVALIDATOR-2311201	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Improper Input Validation SNYK-JS-XMLDOM-1534562	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Prototype Pollution SNYK-JS-XMLDOM-3042242	Yes	No Known Exploit
	811/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.8	Improper Input Validation SNYK-JS-XMLDOM-3092935	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @form-create/element-ui

The new version differs by 238 commits.

7d96843 v2.5.1
051a5dc docs(README): update
4520bdd fix(core): 优化
7a5b255 feat(core): 新增 payload
7e4eab2 refactor(core): 优化
f8cf403 refactor(core): 优化渲染
12cbcff refactor(core): 优化 input 事件
9d84ac4 fix(core): page 失效
2d3c1c1 fix(group): 功能优化
5b0d785 fix(core): 修复添加删除规则可能会报错问题
926aa9f v2.5.0-alpha.6
9f6ca78 cli(dev): 优化
f1135d3 docs(github): 优化 issue 模板
c4a8787 docs(ts): 完善 ts
71d585c fix(core): 修复 $formCreate 属性不完整
967d708 fix(antdv): 修复 group 组件删除问题
459bab6 fix(example): 优化示例
9b402a0 refactor(core): 优化 validate,增强 validateField
0ac2187 feat(core): 新增 sync 配置项,实现 props 同步
fe552ad feat(api): api 新增 parent,children 属性
c03b611 fix(use swagger for api docs apache/dolphinscheduler#306): 修复全局配置 col 无效问题
cb05f50 v2.5.0-alpha.5
8231a77 docs: 优化
6ed62fc refactor(group): 统一规则字段名称

See the full diff

Package name: canvg

The new version differs by 153 commits.

98a12cb Merge pull request Add unit tests for cn.escheduler.common.utils.JSONUtils apache/dolphinscheduler#712 from canvg/2.0.0
9eb51a5 rm beta
435d906 npm audit
4b9dee3 build
088abbe wip
d04bb60 Merge pull request only write core dependency in Proposal doc apache/dolphinscheduler#710 from IronGeek/issue_709
c2b43c6 fix build
67e33ec Merge pull request flink task support(flink 任务支持) apache/dolphinscheduler#711 from canvg/fix_build
4a9c313 lock node version
4eb5337 Parse number with scientific notation
fbebf8e Merge pull request remove category x what can we not include in an asf project apache/dolphinscheduler#707 from fargyriou/702-font-parsing
55d67f0 Issue 702: Fixed font parsing when defined as "font" and not through font properties
cef40f0 Merge pull request bug fix #688，a user generated multiple ip session, the query error apache/dolphinscheduler#689 from canvg/2.0.0-beta.1
aa8e62e 2.0.0-beta.1
4497122 Merge pull request [Ask a question]master port is occupied（master端口被占用) apache/dolphinscheduler#684 from bz2/browser_optional
2d75e00 Update docs for 2.0 dependency changes
a98c42d Support browser dist without canvas dependency
f79c146 Merge pull request refactor zk client (#692) apache/dolphinscheduler#687 from canvg/dgorbash_master
d9a772e adding test
fe49c3b Merge branch 'textPath_support'
fecc100 Backport upstream/master, minor code format fix
79c85e5 Sync master with upstream
f236319 Merge pull request make the edit button of the properties file clickable apache/dolphinscheduler#678 from canvg/beta_readme
b9c9223 spacing

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Server-side Request Forgery (SSRF)
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn


          fix: dolphinscheduler-ui/package.json to reduce vulnerabilities

4cb49fa

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ASYNCVALIDATOR-2311201
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://snyk.io/vuln/SNYK-JS-XMLDOM-1534562
- https://snyk.io/vuln/SNYK-JS-XMLDOM-3042242
- https://snyk.io/vuln/SNYK-JS-XMLDOM-3092935

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet