New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 6 vulnerabilities #9

Open

one3chens wants to merge 1 commit into master from snyk-fix-e21be78797b703d9c47b4dfa9845db1d

Member

one3chens commented Oct 7, 2022

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	626/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.1	Man-in-the-Middle (MitM) SNYK-JS-HTTPSPROXYAGENT-469131	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	No	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	No	Proof of Concept
	796/1000 Why? Mature exploit, Has a fix available, CVSS 8.2	Uninitialized Memory Exposure npm:http-proxy-agent:20180406	Yes	Mature
	796/1000 Why? Mature exploit, Has a fix available, CVSS 8.2	Uninitialized Memory Exposure npm:https-proxy-agent:20180402	Yes	Mature

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: http-proxy-agent

The new version differs by 18 commits.

65307ac 2.1.0
1cd8967 Add "engines" to package.json
b7b7cc7 Use `Buffer.from()`
687da67 update package.json - outdated debug version ([Snyk] Security upgrade minimist from 1.2.0 to 1.2.6 #7)
8681658 Release 2.0.0
5fdb6eb update "mocha" to v3
6c68685 update to "agent-base" v4
5197ff9 rename http-proxy-agent.js to index.js
488df8a test Node.js 4, 5, 6, 7 and 8 on Travis-CI
a0c9cb0 remove "extend" dep
93595d5 remove `extend` dependency
c2a1e57 Release 1.0.0
7bb72b3 README: add note about node-https-proxy-agent
ee0beb4 test: add an assert() call
1f5543b http-proxy-agent: use %o debug() formatter
24a535c http-proxy-agent: remove `defaults` merging logic
fc88a97 package: update "agent-base" to v2
da57e1a test: use ssl-cert-snakeoil self-signed SSL certs

See the full diff

Package name: https-proxy-agent

The new version differs by 57 commits.

0d8e8bf 2.2.3
850b835 Revert "Use Mocha 5 for Node 4 support"
f5f56fa Remove Node 4 from Travis
bb837b9 Revert "Remove Node 4 from Travis"
1e34e0d Use Mocha 5 for Node 4 support
36d8cf5 Use an `EventEmitter` to replay failed proxy connect HTTP requests (Simplify shell command for Linux and OS X microsoft/vscode#77)
5252bb9 Revert "Meh…" (Getting "Visual Studio Code has crashed" a few times microsoft/vscode#79)
6c804a2 Remove Node 4 from Travis
2170151 [TypeScript] Allow `port` to be a string (Add text/ng-template to the HTML mime types microsoft/vscode#72)
590bc8b Remove Node 5 and 7 from Travis
c7d8161 Fix compatibility with Node.js >= 10.0.0 (add support for TFVC in on-premise TFS resp. Visual Studio Team Services microsoft/vscode#73)
2590f76 Meh…
3535951 Test on Node.js 10 and 12
2629ba6 Fix compatibility with Node.js >= 10.0.0
46aad09 Remove unreachable code
d0e3c18 Update `proxy` to v1.0.0
c17ccdc Update README with actual secureProxy behavior (We need translation support microsoft/vscode#65)
e145714 2.2.2
4a7ea92 Update `agent-base` to v4.3 (Proxy support for extension gallery microsoft/vscode#69)
13917f6 feat(typescript): Allow input to be options or string (Git: Support git history in VSCode microsoft/vscode#68)
c5c4ffc Add TypeScript type definitions (Git conflict highlighting can get messed up easily microsoft/vscode#66)
11bc347 Update `agent-base` to v4.2 (Crash when opening Code via the command line microsoft/vscode#50)
056c843 Ignore test directory, History.md and .travis.yml when creating npm package. Fixes Document symbols are duplicated microsoft/vscode#42 (Fixed Runnning typo microsoft/vscode#45)
c881009 Remove `package-lock.json`

See the full diff

Package name: keytar

The new version differs by 91 commits.

74f472b 7.1.0
fb33a40 bump node-abi and downstream packages (Dead link on https://code.visualstudio.com/docs/extensions/patterns-and-principles microsoft/vscode#326)
c4683fb Change binding.gyp to fix napi.h not found error (Extension Cannot be installed microsoft/vscode#325)
bc2ec26 Bump mocha from 8.2.0 to 8.2.1 (Implement soft text wrapping microsoft/vscode#324)
c435fe4 add support for building and testing with GitHub Actions ([html] Add documentationLabel's to HTML tags microsoft/vscode#323)
321ea32 Add prebuild Electron for arm64 (Error installing extensions microsoft/vscode#319)
346fdb7 Bump mocha from 8.1.3 to 8.2.0 (Find does not match multi-line regex strings microsoft/vscode#313)
6fbda33 Bump node-gyp from 7.1.0 to 7.1.2 (Find and replace with regex on does not allow replacing with \n microsoft/vscode#312)
a5162d3 Bump prebuild-install from 5.3.5 to 6.0.0 (Enable regex's ^, $ and ^$ to be matched in file dialog microsoft/vscode#314)
dd67c9b 7.0.0
30f769c Drop Electron v5 and v6 support (target not support ES7 in jsconfig.json file microsoft/vscode#311)
a6ee40c Fix memory leaks on macOS (Missing <angle> and <resolution> units in CSS auto-complete microsoft/vscode#293)
13633ed Bump node-addon-api from 3.0.0 to 3.0.2 (Proposal: Add support for bash/sh file type microsoft/vscode#309)
ed8da7b Bump bl from 3.0.0 to 3.0.1 (Debugger is not working microsoft/vscode#306)
f6def5b add prebuild targets for Electron 10 (Text selection cursor is visible when mousing over the git icon in the status bar microsoft/vscode#307)
f33fee4 add rust bindings to README (Support tilde character (~) in Razor links microsoft/vscode#305)
cdebd3d Bump mocha from 8.1.1 to 8.1.3 (High DPI scaling for UI or settings for UI addition microsoft/vscode#303)
4863f43 Bump node-abi from 2.19.0 to 2.19.1 (Update css at-rule support for auto-complete microsoft/vscode#304)
8007791 Bump node-abi from 2.18.0 to 2.19.0 (no responding microsoft/vscode#301)
686e450 Bump node-gyp from 7.0.0 to 7.1.0 ([Handlebars] No understanding of open Handlebars tags microsoft/vscode#299)
0279477 Bump mocha from 8.1.0 to 8.1.1 (Object methods are missing IntelliSense microsoft/vscode#298)
48e2fc0 Bump prebuild from 10.0.0 to 10.0.1 (Vim control mode microsoft/vscode#300)
a3f76de Bump mocha from 8.0.1 to 8.1.0 (Add 'turn' to <angle> and 'dppx' to <resolution> data types for CSS auto-complete microsoft/vscode#294)
1e22685 Bump lodash from 4.17.15 to 4.17.19 (Missing length units in CSS autocomplete microsoft/vscode#289)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)


          fix: package.json to reduce vulnerabilities

e4d4783

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-HTTPSPROXYAGENT-469131
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/npm:http-proxy-agent:20180406
- https://snyk.io/vuln/npm:https-proxy-agent:20180402

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet