Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade log4js from 2.11.0 to 3.0.0 #25

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ximanta
Copy link
Owner

@ximanta ximanta commented Dec 15, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-JS-AXIOS-6124857
Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: log4js The new version differs by 71 commits.
  • 45eca69 3.0.0
  • 7597c52 Merge pull request #755 from log4js-node/inspect-deprecated
  • 16b8754 fix: removed semver dep, not needed
  • 20a6b29 fix: removed the custom inspect thing as it was only need for node < 6
  • 58cd7d2 chore: added node v10 to the travis builds, removed v7
  • 7f2b1c2 docs: fixed references to external appenders
  • dcdf2ad Merge pull request #754 from log4js-node/version-3.x
  • 24d2663 Merge pull request #753 from log4js-node/remove-logfaces-udp
  • 467f670 chore: removed the logFaces-UDP appender
  • 2db6bb0 Merge branch 'master' into version-3.x
  • 6031257 Merge pull request #748 from log4js-node/remove-logFaces-HTTP
  • 3a56566 chore: removed logFaces-HTTP appender
  • 06c56b4 chore: turned off unused locals complaint for types (caused by levels)
  • 5618fdb Merge branch 'master' into version-3.x
  • 6b60cd9 Merge pull request #742 from log4js-node/remove-logstash-http
  • 16603ca chore: removed logstash-http appender
  • e9ebd31 Merge branch 'master' into version-3.x
  • 5a3aef1 Merge pull request #739 from log4js-node/remove-rabbitmq
  • a7349e2 chore: remove rabbitmq appender
  • 9944a01 chore: merged from master
  • 77e29dc Merge pull request #732 from log4js-node/remove-slack
  • 4d05450 chore: removed slack appender
  • 568aa40 Merge branch 'master' into version-3.x
  • 5a32e57 Merge pull request #727 from log4js-node/remove-redis

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AXIOS-6124857
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants