Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk-dev] Fix for 4 vulnerabilities #6058

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk-dev] Fix for 4 vulnerabilities #6058

wants to merge 1 commit into from

Conversation

lili2311
Copy link
Contributor

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • large-file/package.json
    • large-file/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 601/1000
Why? Recently disclosed, Has a fix available, CVSS 6.3		 Cross-site Scripting (XSS)
SNYK-JS-COOKIE-8163060		 Yes No Known Exploit
high severity 701/1000
Why? Recently disclosed, Has a fix available, CVSS 8.3		 Improper Verification of Cryptographic Signature
SNYK-JS-ELLIPTIC-8172694		 Yes No Known Exploit
medium severity 631/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.2		 Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: cookie The new version differs by 224 commits.

See the full diff

Package name: del The new version differs by 64 commits.

See the full diff

Package name: elliptic The new version differs by 10 commits.

See the full diff

Package name: engine.io The new version differs by 250 commits.
  • 9b80ab4 chore(release): engine.io@6.6.2
  • a5d2368 ci: ignore tests when publishing to npm (bis)
  • 88efd44 chore(deps): bump cookie to version 0.7.2 ([Snyk] Fix for 1 vulnerabilities #5205)
  • d0fc720 chore(release): socket.io@4.8.0
  • 4a0555c chore(release): socket.io-client@4.8.0
  • 2b60df1 chore(release): engine.io@6.6.1
  • d4cb375 ci: ignore tests when publishing to npm
  • c251ae7 chore(release): engine.io-client@6.6.1
  • 8a2f5a3 fix(eio-client): move 'offline' event listener at the top
  • b04fa64 fix(sio): allow to join a room in a middleware (uws)
  • 7085f0e refactor(sio-client): mangle private attributes
  • 4f66708 chore(sio-client): use babel loose mode when transpiling classes
  • 1a95db2 chore(sio-client): add a script to compute the bundle size
  • 282ae92 chore(sio-client): restore the debug package in the dev bundle
  • 93010ca chore(eio-client): bump xmlhttprequest-ssl to version 2.1.1
  • 132d05f fix(sio): expose type of default engine
  • d5095fe fix(eio): prevent the client from upgrading twice (uws)
  • da61381 test(eio): bump uWebSockets.js to version 20.48.0
  • 19c48a4 refactor(sio): break circular dependency in source code
  • 9b3c9ab fix(eio-client): only remove the event listener if it exists
  • 043b55c refactor(sio): simplify middleware execution (bis)
  • 32c761f refactor(sio): export the ExtendedError type
  • 1f54ee0 refactor(sio): simplify middleware execution
  • 923a12e fix(eio): discard all pending packets when the server is closed

See the full diff

Package name: express The new version differs by 250 commits.

See the full diff

Package name: react-middle-truncate The new version differs by 12 commits.

See the full diff

Package name: webpack The new version differs by 250 commits.
  • 610f368 5.0.0
  • 5ce65c1 update examples
  • bbe1230 Merge pull request #11628 from webpack/bugfix/real-content-hash
  • 75ecff2 5.0.0-rc.6
  • bfc35d6 Merge pull request #11603 from MayaWolf/master
  • 76e8cbd Merge pull request #11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
  • 9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
  • 36bcfaa Merge pull request #11621 from webpack/bugfix/11619
  • 9130d10 fix called variables with ProvidePlugin
  • 3e42105 Merge pull request #11620 from webpack/bugfix/11617
  • 4709719 skip connections copied to concatenated module
  • 57b493f 5.0.0-rc.5
  • 1658e2f Merge pull request #11618 from webpack/bugfix/11615
  • a8fb45d fixes crash in SideEffectsFlagPlugin
  • 84b196d emit error instead of crashing when unexpected problem occurs
  • 5573fed Merge pull request #11601 from Hornwitser/improve-suggested-polyfill-config
  • 9b5cce9 Merge pull request #11609 from snitin315/export-types
  • 37c495c export type RuleSetUseItem
  • 39faf34 export type RuleSetUse
  • e5fd246 export type RuleSetConditionAbsolute
  • 660baad export RuleSetCondition types
  • 13e3ca5 Merge pull request #11602 from webpack/bugfix/shared-runtime-chunk
  • 9c0587e Merge pull request #11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
  • 502d166 Merge pull request #11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)
🦉 Regular Expression Denial of Service (ReDoS)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@lili2311 @snyk-bot