New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 10 vulnerabilities #14

Open

kleddy17 wants to merge 1 commit into master from snyk-fix-396d524a1d709cbf10d8ae2173c66359

Owner

kleddy17 commented Jun 22, 2022

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- goof/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	509/1000 Why? Has a fix available, CVSS 5.9	Denial of Service (DoS) SNYK-JS-JSYAML-173999	Yes	No Known Exploit
	619/1000 Why? Has a fix available, CVSS 8.1	Arbitrary Code Execution SNYK-JS-JSYAML-174129	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:hoek:20180212	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) npm:ms:20151024	No	No Known Exploit
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	No	No Known Exploit
	576/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.1	Uninitialized Memory Exposure npm:tunnel-agent:20170305	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: humanize-ms

The new version differs by 7 commits.

d9cdffe Release 1.2.1
c6da77c deps: ms@2
3b6f1ba fix: package.json to reduce vulnerabilities ([Snyk] Upgrade marked from 0.3.5 to 0.8.2 #3)
51a95e8 Add license text ([Snyk] Upgrade moment from 2.15.1 to 2.29.1 #2)
627c5c4 Release 1.2.0
e584c58 add benchmark
4cf945f deps: upgrade ms to 0.7.0

See the full diff

Package name: tap

The new version differs by 250 commits.

fe8158e 11.1.3
b17542d Upgrade deps (changing semver requirements)
bc3ba17 update deps
bd4de92 Clean up nyc output so Travis passes on node 6
2292432 Add hexagonal-lambda to the tap 100 list
fed62c9 Merge remote-tracking branch 'origin/master'
3cdf1c7 11.1.2
ddf938b Only ship files we want to ship
5b5e2ee docs: add unique page titles
2323c3b Merge tag 'v11.1.1'
95faf6c 11.1.1
283c8e6 Handle EPIPE better in exceptional edge cases
b727234 Fix obscure edge case when this.results is not set
1699eb9 process: update docs on the master branch
ac366a0 docs: fix typo ('heirarchical' -> 'hierarchical')
13073a7 docs: correct 100 PR link
b95ee22 v11.1.0
fcf70aa Add support for disabling autoend
94be0a7 v11.0.1
6c3f019 remove badges that are no longer accurate or in use
ae562a7 don't ignore coverage doc
9fcfd52 Migrate docs into main repository
f189c50 v11.0.0
5cde128 Merge branch 'v11'

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Arbitrary Code Execution
🦉 Prototype Pollution


          fix: goof/package.json to reduce vulnerabilities

15eeb47

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-JSYAML-173999
- https://snyk.io/vuln/SNYK-JS-JSYAML-174129
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
- https://snyk.io/vuln/npm:braces:20180219
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:ms:20151024
- https://snyk.io/vuln/npm:ms:20170412
- https://snyk.io/vuln/npm:tunnel-agent:20170305

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet