Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Upgrade local-web-server from 4.2.1 to 5.3.1 #6

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

gr00nd
Copy link
Owner

@gr00nd gr00nd commented Feb 5, 2024

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to upgrade local-web-server from 4.2.1 to 5.3.1.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


Warning: This is a major version upgrade, and may be a breaking change.

  • The recommended version is 8 versions ahead of your current version.
  • The recommended version was released a month ago, on 2024-01-08.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Origin Validation Error
SNYK-JS-KOACORS-6117545
137/1000
Why? Confidentiality impact: None, Integrity impact: High, Availability impact: None, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00043, Social Trends: No, Days since published: 55, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 98, Impact: 6.65, Likelihood: 2.06, Score Version: V5
No Known Exploit
Prototype Poisoning
SNYK-JS-QS-3153490
137/1000
Why? Confidentiality impact: None, Integrity impact: High, Availability impact: None, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00043, Social Trends: No, Days since published: 55, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 98, Impact: 6.65, Likelihood: 2.06, Score Version: V5
Proof of Concept
Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795
137/1000
Why? Confidentiality impact: None, Integrity impact: High, Availability impact: None, Scope: Changed, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00043, Social Trends: No, Days since published: 55, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 98, Impact: 6.65, Likelihood: 2.06, Score Version: V5
Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: local-web-server
  • 5.3.1 - 2024-01-08

    5.3.1

  • 5.3.0 - 2023-02-07

    New features since v5.2.1

  • 5.2.1 - 2022-05-28

    5.2.1

  • 5.2.0 - 2022-03-13

    5.2.0

  • 5.1.1 - 2021-08-25

    5.1.1

  • 5.1.0 - 2021-08-06

    New features since v5.0.0

    • Support extended back to Node.js v12.20
      • This is because support for exports, conditional exports and exports patterns have been retro-fitted back to v12 (see the Package module history)

    Upgrade notes

    Users of Node.js v12.20 and above may now use local-web-server (previously, you needed a minimum of node v14). There are no further changes.

  • 5.0.0 - 2021-07-06

    This is a refresher release - there are no functional or behavioural changes to the web server itself.

    Breaking changes since v4.2.1

    • Dropped support for Node.js < v14
    • Dropped support for CommonJS in general
    • Dropped support for plugin prefixes
      • Previously, you could omit the lws- in plugin names, (i.e. you could use --stack static instead of --stack lws-static). This was ambigious and introduced the risk of incorrectly loading a module named static, if it existed.
    • Several of the API methods have changed from sync to async, most importantly the Lws.create method. You now need to await the result.
      const lws = await Lws.create()
      

    New feature

    • The default config file lws.config.js may now also be named lws.config.mjs or lws.config.cjs if preferred.

    Other improvements

    • All source code converted from CommonJS to ECMAScript modules.
    • All dependencies upgraded.

    Upgrade notes

    • If you previously used shortened plugin names (e.g. --stack static) please use the full name (e.g. --stack lws-static)
    • If you launch a server using Lws.create you must now await the result.
    • Lws can now only be used programmatically from ECMAScript modules - you must use import to load the library.
  • 5.0.0-0 - 2021-06-09

    5.0.0-0

  • 4.2.1 - 2020-06-11

    4.2.1

from local-web-server GitHub release notes
Commit messages
Package name: local-web-server

Compare


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

Copy link

codesandbox bot commented Feb 5, 2024

Review or Edit in CodeSandbox

Open the branch in Web EditorVS CodeInsiders

Open Preview

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants