Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Fix for 1 vulnerabilities #35

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 758/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.3
Prototype Pollution
SNYK-JS-LODASH-608086
Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: sequelize The new version differs by 250 commits.
  • bd215e9 3.19.0
  • 2c33d23 changelog for v3.19.0
  • 87a22eb Merge pull request #5227 from sushantdhiman/fix-966
  • bb4315b Fix(#966) : Added more test, fixed mysql,mssql,postgres changeColumn logic
  • 1f1604d fix(#966) : Fixed dialects to properly generate ADD CONSTRAINT when using changeColumn
  • b98af0b fix(#966) : Added test which fails to change column to foreignKey
  • ece7631 bug(scopes) Set Default value for defaultScope to an empty object. Closes #5277
  • 7b44a87 Merge pull request #5283 from onzag/geography
  • 046620a Merge pull request #5336 from sequelize/greenkeeper-lodash-4.1.0
  • e739d81 Update to lodash 4.0 API
  • 778ec12 geography and tests
  • 2efa123 Merge pull request #5316 from sequelize/greenkeeper-sinon-1.17.3
  • 03fe8db Merge pull request #5326 from sequelize/greenkeeper-chai-3.5.0
  • e942c95 Merge pull request #5314 from sequelize/greenkeeper-mocha-2.4.2
  • 2235e7d Merge pull request #5303 from sequelize/greenkeeper-bluebird-3.1.2
  • bb05cd1 refactor(test): Replace promise.delay with fake timers except for transaction tests
  • f778e40 Add changelog for #5298. Replaced delay in upsert test with fake timers
  • 11a92a2 Merge pull request #5298 from PhinCo/master
  • 68e6130 Merge pull request #5328 from ashokfernandez/master
  • cdad10a chore(package): update lodash to version 4.1.0
  • 12acc40 Fixed typo in code example
  • 0ddfbc5 Merge pull request #5331 from zaggino/master
  • 42c0791 fix #5300: false and 0 are now properly encoded when using JSON/JSONB
  • 8d5ae0c Added documentation note about bulkCreate hook and updatesOnDuplicate option

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant