Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 2 vulnerabilities #1

Merged
merged 1 commit into from
May 18, 2024
Merged

[Snyk] Fix for 2 vulnerabilities #1

merged 1 commit into from
May 18, 2024

Conversation

paul007ex
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ACORN-559469		 No No Known Exploit
critical severity 811/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.8		 Prototype Pollution
SNYK-JS-JSONPOINTER-598804		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @snyk/nodejs-runtime-agent The new version differs by 38 commits.

See the full diff

Package name: tap The new version differs by 250 commits.
  • fe8158e 11.1.3
  • b17542d Upgrade deps (changing semver requirements)
  • bc3ba17 update deps
  • bd4de92 Clean up nyc output so Travis passes on node 6
  • 2292432 Add hexagonal-lambda to the tap 100 list
  • fed62c9 Merge remote-tracking branch 'origin/master'
  • 3cdf1c7 11.1.2
  • ddf938b Only ship files we want to ship
  • 5b5e2ee docs: add unique page titles
  • 2323c3b Merge tag 'v11.1.1'
  • 95faf6c 11.1.1
  • 283c8e6 Handle EPIPE better in exceptional edge cases
  • b727234 Fix obscure edge case when this.results is not set
  • 1699eb9 process: update docs on the master branch
  • ac366a0 docs: fix typo ('heirarchical' -> 'hierarchical')
  • 13073a7 docs: correct 100 PR link
  • b95ee22 v11.1.0
  • fcf70aa Add support for disabling autoend
  • 94be0a7 v11.0.1
  • 6c3f019 remove badges that are no longer accurate or in use
  • ae562a7 don't ignore coverage doc
  • 9fcfd52 Migrate docs into main repository
  • f189c50 v11.0.0
  • 5cde128 Merge branch 'v11'

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Note: This is a default PR template raised by Snyk. Find out more about how you can customise Snyk PRs in our documentation.

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution

@dryrunsecurity DryRunSecurity
Copy link

dryrunsecurity bot commented May 18, 2024 •
edited
Loading

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security Status Findings
AppSec Analyzer ✅ 0 findings
Configured Codepaths Analyzer ✅ 0 findings
Secrets Analyzer ✅ 0 findings
Sensitive Files Analyzer ❕ 1 finding
Authn/Authz Analyzer ✅ 0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The provided code change in the package.json file appears to be an update to the dependencies of the "goof" application. The key changes include an update to the @snyk/nodejs-runtime-agent dependency from version ^1.31.0 to ^1.47.3, and an update to the tap dependency from version ^5.7.0 to ^11.1.3. From an application security perspective, the updates to the dependencies are generally positive, as they may address known vulnerabilities or security issues. However, it's important to review the release notes or changelogs for the updated dependencies to understand the specific changes and their impact on the application's security. Additionally, it's recommended to thoroughly test the application after the dependency updates to ensure that the changes do not introduce any regressions or unintended consequences. It's also a good practice to monitor the application's security posture and keep all dependencies up-to-date to mitigate potential security risks.

Files Changed:

  • package.json: The package.json file has been updated to include a newer version of the @snyk/nodejs-runtime-agent dependency (from ^1.31.0 to ^1.47.3) and a newer version of the tap dependency (from ^5.7.0 to ^11.1.3). These updates may address known security vulnerabilities or introduce other improvements to the application's dependencies.

Powered by DryRun Security

@paul007ex paul007ex merged commit aae4f75 into master May 18, 2024
6 checks passed
@paul007ex paul007ex mentioned this pull request May 21, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@paul007ex @snyk-bot