[Snyk] Security upgrade tap from 2.3.4 to 14.6.8 #21

leonardoadame · 2023-07-06T19:06:06Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- deps/npm/node_modules/wrappy/package.json
- deps/npm/node_modules/wrappy/.snyk

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
584/1000 Why? Has a fix available, CVSS 7.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-HAWK-2808852	Yes	No Known Exploit
509/1000 Why? Has a fix available, CVSS 5.9	Denial of Service (DoS) SNYK-JS-JSYAML-173999	Yes	No Known Exploit
619/1000 Why? Has a fix available, CVSS 8.1	Arbitrary Code Execution SNYK-JS-JSYAML-174129	Yes	No Known Exploit
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	Yes	Proof of Concept
541/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	Yes	Proof of Concept
589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-1019388	Yes	No Known Exploit
479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:hoek:20180212	Yes	Proof of Concept
636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Yes	Proof of Concept
589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	Yes	No Known Exploit
576/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.1	Uninitialized Memory Exposure npm:tunnel-agent:20170305	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: tap

The new version differs by 250 commits.

eaa0084 14.6.8
e7cff4d update deps to node >=8 requirements
b9e53c2 update cli doc
9917a7a 14.6.7
125aae3 async-hook-domain@1.1.1
ce0c629 update cli doc
eb2bded 14.6.6
7f453f5 Set nyc color watermarks based on check-coverage levels
28e7db5 update cli doc
fb852ee 14.6.5
eeb423a minipass@2.8.3
5b83028 watch: add --no-clean to nyc args on change tests
6a4d64b track thrown error when timeout/throws happen during promise waiting
5b977e1 update cli doc
49e9df0 14.6.4
6d37040 update deps, remove npm-shrinkwrap.json
d19ab3d update cli doc
1436f4f 14.6.3
a266e30 Fail if error is thrown while awaiting a Promise
73e7496 update cli doc
443786c 14.6.2
36d6dc5 Properly handle test aborts when awaiting promises
28cd2ff update cli doc
8d280c3 14.6.1

See the full diff

With a Snyk patch:

Priority Score (*)	Issue	Exploit Maturity
399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:hawk:20160119	No Known Exploit
539/1000 Why? Has a fix available, CVSS 6.5	Timing Attack npm:http-signature:20150122	No Known Exploit
399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:mime:20170907	No Known Exploit
469/1000 Why? Has a fix available, CVSS 5.1	Remote Memory Exposure npm:request:20160119	No Known Exploit
576/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.1	Uninitialized Memory Exposure npm:tunnel-agent:20170305	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Arbitrary Code Execution
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-BABEL-1278589 - https://snyk.io/vuln/SNYK-PYTHON-CERTIFI-3164749 - https://snyk.io/vuln/SNYK-PYTHON-SETUPTOOLS-3180412 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-1014645 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-1533435

Snyk has created this PR to upgrade: - @babel/types from 7.1.3 to 7.21.4. See this package in npm: https://www.npmjs.com/package/@babel/types - @babel/generator from 7.1.3 to 7.21.4. See this package in npm: https://www.npmjs.com/package/@babel/generator - @babel/parser from 7.1.3 to 7.21.4. See this package in npm: https://www.npmjs.com/package/@babel/parser - @babel/template from 7.1.2 to 7.20.7. See this package in npm: https://www.npmjs.com/package/@babel/template - @babel/traverse from 7.1.4 to 7.21.4. See this package in npm: https://www.npmjs.com/package/@babel/traverse See this project in Snyk: https://app.snyk.io/org/leonardoadame/project/17b9377e-05c7-466c-817b-64859e210aa8?utm_source=github&utm_medium=referral&page=upgrade-pr

Snyk has created this PR to upgrade globals from 10.1.0 to 10.4.0. See this package in npm: https://www.npmjs.com/package/globals See this project in Snyk: https://app.snyk.io/org/leonardoadame/project/17b9377e-05c7-466c-817b-64859e210aa8?utm_source=github&utm_medium=referral&page=upgrade-pr

Snyk has created this PR to upgrade tempy from 0.5.0 to 0.7.1. See this package in npm: https://www.npmjs.com/package/tempy See this project in Snyk: https://app.snyk.io/org/leonardoadame/project/17b9377e-05c7-466c-817b-64859e210aa8?utm_source=github&utm_medium=referral&page=upgrade-pr

…94a74ffadedd8032d [Snyk] Upgrade tempy from 0.5.0 to 0.7.1

…2cad22ca48f99fb34 [Snyk] Upgrade globals from 10.1.0 to 10.4.0

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-REQUESTS-5595532

…14fcf9fdb45341 [Snyk] Security upgrade requests from 2.22.0 to 2.31.0

…452a2501c403d [Snyk] Fix for 5 vulnerabilities

…to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

…age.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

…reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

…-targets/package.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

…8829879580bfb4 [Snyk] Security upgrade semver from 6.3.0 to 7.5.2

…aa20aac868f5e5 [Snyk] Security upgrade semver from 6.3.0 to 7.5.2

…5479ebc6233124 [Snyk] Security upgrade local-web-server from 4.2.1 to 5.0.0

…fa026d85a0edb65c5 [Snyk] Upgrade: @babel/types, @babel/generator, @babel/parser, @babel/template, @babel/traverse

…11126a17ab65f0 [Snyk] Security upgrade semver from 6.3.0 to 7.5.2

stackblitz · 2023-07-06T19:06:09Z

Run & review this pull request in StackBlitz Codeflow.

changeset-bot · 2023-07-06T19:06:11Z

⚠️ No Changeset found

Latest commit: 50d937d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

snyk-bot and others added 19 commits May 2, 2023 17:57

Merge pull request #7 from leonardoadame/snyk-upgrade-2995fc05233b7a0…

6292d1a

…94a74ffadedd8032d [Snyk] Upgrade tempy from 0.5.0 to 0.7.1

Merge pull request #6 from leonardoadame/snyk-upgrade-4d5b4bd486c2748…

616a8bf

…2cad22ca48f99fb34 [Snyk] Upgrade globals from 10.1.0 to 10.4.0

fix: deps/uv/docs/requirements.txt to reduce vulnerabilities

a614a8a

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-REQUESTS-5595532

Merge pull request #10 from leonardoadame/snyk-fix-8d86d74fb78e75dbf9…

52682c9

…14fcf9fdb45341 [Snyk] Security upgrade requests from 2.22.0 to 2.31.0

Merge pull request #3 from leonardoadame/snyk-fix-3fed45732244c5baec2…

2e2374f

…452a2501c403d [Snyk] Fix for 5 vulnerabilities

fix: tools/node_modules/eslint/node_modules/@babel/core/package.json …

eb66b7e

…to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

fix: tools/node_modules/eslint/node_modules/@babel/eslint-parser/pack…

47a5b14

…age.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

fix: deps/v8/tools/package.json & deps/v8/tools/package-lock.json to …

30fc1d1

…reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

fix: tools/node_modules/eslint/node_modules/@babel/helper-compilation…

1100bde

…-targets/package.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

Merge pull request #13 from leonardoadame/snyk-fix-ee8912d3a9cd5262aa…

853f217

…8829879580bfb4 [Snyk] Security upgrade semver from 6.3.0 to 7.5.2

Merge pull request #15 from leonardoadame/snyk-fix-900859a513e8ed4cc8…

35fab6e

…aa20aac868f5e5 [Snyk] Security upgrade semver from 6.3.0 to 7.5.2

Merge pull request #14 from leonardoadame/snyk-fix-b7180ea97e108aabee…

f827f4a

…5479ebc6233124 [Snyk] Security upgrade local-web-server from 4.2.1 to 5.0.0

Merge pull request #4 from leonardoadame/snyk-upgrade-f919faf2a9ba7c3…

73ba401

…fa026d85a0edb65c5 [Snyk] Upgrade: @babel/types, @babel/generator, @babel/parser, @babel/template, @babel/traverse

Merge pull request #12 from leonardoadame/snyk-fix-763b7501c41ba23cc9…

d735ea2

…11126a17ab65f0 [Snyk] Security upgrade semver from 6.3.0 to 7.5.2

leonardoadame force-pushed the main branch 2 times, most recently from 1eeaa09 to d9438cc Compare July 7, 2023 00:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Security upgrade tap from 2.3.4 to 14.6.8 #21

[Snyk] Security upgrade tap from 2.3.4 to 14.6.8 #21

leonardoadame commented Jul 6, 2023

stackblitz bot commented Jul 6, 2023

changeset-bot bot commented Jul 6, 2023

[Snyk] Security upgrade tap from 2.3.4 to 14.6.8 #21

Are you sure you want to change the base?

[Snyk] Security upgrade tap from 2.3.4 to 14.6.8 #21

Conversation

leonardoadame commented Jul 6, 2023

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:

With a Snyk patch:

stackblitz bot commented Jul 6, 2023

changeset-bot bot commented Jul 6, 2023

⚠️ No Changeset found