[Snyk] Upgrade: common-tags, iso-639-1, pg, pg-hstore, sequelize, sqlite3, webhook-discord #27

0xhaaaash · 2024-09-18T10:15:41Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

common-tags
from 1.8.0 to 1.8.2 | 2 versions ahead of your current version | 3 years ago
on 2021-11-16
iso-639-1
from 2.1.9 to 2.1.15 | 6 versions ahead of your current version | 2 years ago
on 2022-06-10
pg
from 8.6.0 to 8.12.0 | 14 versions ahead of your current version | 3 months ago
on 2024-06-04
pg-hstore
from 2.3.3 to 2.3.4 | 1 version ahead of your current version | 3 years ago
on 2021-06-09
sequelize
from 6.6.2 to 6.37.3 | 79 versions ahead of your current version | 5 months ago
on 2024-04-13
sqlite3
from 5.0.2 to 5.1.7 | 18 versions ahead of your current version | 8 months ago
on 2024-01-05
webhook-discord
from 3.7.7 to 3.7.8 | 1 version ahead of your current version | 3 years ago
on 2021-07-27

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Improper Filtering of Special Elements SNYK-JS-SEQUELIZE-3324088	586	No Known Exploit
Denial of Service (DoS) SNYK-JS-SQLITE3-2388645	586	Proof of Concept
Arbitrary Code Execution SNYK-JS-SQLITE3-3358947	586	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536528	586	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	586	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579147	586	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	586	No Known Exploit
Prototype Pollution SNYK-JS-DOTTIE-3332763	586	Proof of Concept
Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	586	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579155	586	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536528	586	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	586	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579147	586	No Known Exploit
Prototype Poisoning SNYK-JS-QS-3153490	586	Proof of Concept
SQL Injection SNYK-JS-SEQUELIZE-2959225	586	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	586	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579155	586	No Known Exploit
Directory Traversal SNYK-JS-MOMENT-2440688	586	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	586	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-VALIDATOR-1090599	586	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-VALIDATOR-1090601	586	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-VALIDATOR-1090602	586	Proof of Concept
Information Exposure SNYK-JS-SEQUELIZE-3324089	586	No Known Exploit
Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-SEQUELIZE-3324090	586	No Known Exploit
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	586	Proof of Concept
Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	586	Proof of Concept
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	586	Proof of Concept
Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	586	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	586	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	586	No Known Exploit
SQL Injection SNYK-JS-SEQUELIZE-2932027	586	Proof of Concept

Release notes

Package name: common-tags

1.8.2 - 2021-11-16
This release is based on the same code that v1.8.1, but it fixes a regression caused by forgetting to run the build before publishing. Thanks @ alumni for the hint!
1.8.1 - 2021-11-11
The creator of the package changed the handle from declandewet to zspecza, and for a while GitHub was redirecting from the old repo to the new one. This changed with the "takeover" of the original user handle by a random person, and so in this release all the links in package.json are updated to include the new handle.
1.8.0 - 2018-05-27
Bug Fixes
- Previously valueOf was called on objects in templates before toString - now the order is in line with the spec (#144)
Plumbing
- babel-plugin-transform-runtime was removed as a dependency and as a result babel-runtime is not necessary to use common-tags any more (that means common-tags is dependency-free!) (#148)
- common-tags is now rolling up into a neat bundle that you can get at unpkg. This makes it even easier to get started with this library! (#150)
- Dev dependencies were updated (no changes to the actual code) (#149)

from common-tags GitHub release notes

Package name: iso-639-1

2.1.15 - 2022-06-10
2.1.15
2.1.14 - 2022-06-01
2.1.14
2.1.13 - 2022-02-08
2.1.13
2.1.12 - 2022-01-20
2.1.12
2.1.11 - 2021-12-07
2.1.11
2.1.10 - 2021-10-30
2.1.10
2.1.9 - 2021-03-24
2.1.9

from iso-639-1 GitHub release notes

Package name: pg

8.12.0 - 2024-06-04
8.11.6 - 2024-06-04
8.11.5 - 2024-04-02
8.11.4 - 2024-03-30
8.11.3 - 2023-08-16
8.11.2 - 2023-08-01
8.11.1 - 2023-06-26
8.11.0 - 2023-05-15
8.10.0 - 2023-03-06
8.9.0 - 2023-01-27
8.8.0 - 2022-08-23
8.7.3 - 2022-02-04
8.7.1 - 2021-07-27
8.7.0 - 2021-07-27
8.6.0 - 2021-04-13

from pg GitHub release notes

Package name: pg-hstore

2.3.4 - 2021-06-09
2.3.4
2.3.3 - 2019-06-03
2.3.3

from pg-hstore GitHub release notes

Package name: sequelize

6.37.3 - 2024-04-13
6.37.3 (2024-04-13)

Bug Fixes
- postgres: use schema for foreign key constrains of a table (#17099) (6aba382)
6.37.2 - 2024-03-29
6.37.2 (2024-03-29)

Bug Fixes
- add readOnly to the transaction options types and docs (#17226) (7c8972f)
6.37.1 - 2024-02-18
6.37.1 (2024-02-18)

Bug Fixes
- types: Add definition of returning in SaveOptions. (#16954) (505467b)
6.37.0 - 2024-02-11
6.37.0 (2024-02-11)

Features
- postgres: support connectionTimeoutMillis dialectOption (#14119) (e81200e)
6.36.0 - 2024-02-02
6.35.2 - 2023-12-11
6.35.1 - 2023-11-19
6.35.0 - 2023-11-12
6.34.0 - 2023-11-03
6.33.0 - 2023-09-08
6.32.1 - 2023-06-17
6.32.0 - 2023-06-01
6.31.1 - 2023-05-01
6.31.0 - 2023-04-09
6.30.0 - 2023-03-24
6.29.3 - 2023-03-10
6.29.2 - 2023-03-09
6.29.1 - 2023-03-07
6.29.0 - 2023-02-23
6.28.2 - 2023-02-22
6.28.1 - 2023-02-21
6.28.0 - 2022-12-20
6.27.0 - 2022-12-12
6.26.0 - 2022-11-29
6.25.8 - 2022-11-22
6.25.7 - 2022-11-19
6.25.6 - 2022-11-15
6.25.5 - 2022-11-07
6.25.4 - 2022-11-05
6.25.3 - 2022-10-19
6.25.2 - 2022-10-15
6.25.1 - 2022-10-13
6.25.0 - 2022-10-11
6.24.0 - 2022-10-04
6.23.2 - 2022-09-27
6.23.1 - 2022-09-22
6.23.0 - 2022-09-17
6.22.1 - 2022-09-16
6.22.0 - 2022-09-15
6.21.6 - 2022-09-09
6.21.5 - 2022-09-08
6.21.4 - 2022-08-18
6.21.3 - 2022-07-11
6.21.2 - 2022-06-28
6.21.1 - 2022-06-25
6.21.0 - 2022-06-16
6.20.1 - 2022-05-27
6.20.0 - 2022-05-23
6.19.2 - 2022-05-18
6.19.1 - 2022-05-17
6.19.0 - 2022-04-12
6.18.0 - 2022-04-03
6.17.0 - 2022-02-25
6.16.3 - 2022-02-24
6.16.2 - 2022-02-18
6.16.1 - 2022-02-09
6.16.0 - 2022-02-08
6.15.1 - 2022-02-06
6.15.0 - 2022-01-29
6.14.1 - 2022-01-25
6.14.0 - 2022-01-22
6.13.0 - 2022-01-10
6.12.5 - 2022-01-04
6.12.4 - 2021-12-28
6.12.3 - 2021-12-27
6.12.2 - 2021-12-22
6.12.1 - 2021-12-21
6.12.0 - 2021-12-17
6.12.0-beta.3 - 2021-12-12
6.12.0-beta.2 - 2021-12-10
6.12.0-beta.1 - 2021-12-04
6.12.0-alpha.1 - 2021-11-19
6.11.0 - 2021-11-18
6.10.0 - 2021-11-18
6.9.0 - 2021-11-01
6.8.0 - 2021-10-24
6.7.0 - 2021-10-09
6.6.5 - 2021-07-06
6.6.4 - 2021-06-26
6.6.2 - 2021-03-23

from sequelize GitHub release notes

Package name: sqlite3

5.1.7 - 2024-01-05
What's Changed
- Updated bundled SQLite to v3.44.2 by @ daniellockyer
- Replaced @ mapbox/node-pre-gyp with prebuild + prebuild-install (605c7f9) by @ daniellockyer
  - this should fix a lot of bundling issues reported by the community
- Improved RowToJS performance by removing Napi::String::New instantiation by @ daniellockyer
- Various minor code refactors and improvements (thanks @ zenon8adams!)
New Contributors
- @ zenon8adams made their first contribution in #1701
Full Changelog: v5.1.6...v5.1.7
5.1.7-rc.0 - 2023-12-29
Please install v5.1.7 instead.

Full Changelog: v5.1.6...v5.1.7-rc.0
5.1.6 - 2023-03-14
What's Changed
- Fixed glibc compatibility by hardcoding lower version for log2 by @ daniellockyer
- Add generic type annotations for Statement and Database get/all/each methods callback rows by @ stevescruz in #1686
New Contributors
- @ stevescruz made their first contribution in #1686
Full Changelog: v5.1.5...v5.1.6
5.1.5 - 2023-03-13
What's Changed
- 🔒 Fixed code execution vulnerability due to Object coercion by @ daniellockyer
- Updated bundled SQLite to v3.41.1 by @ daniellockyer
- Fixed rpath linker option when using a custom sqlite by @ jeromew in #1654
Full Changelog: v5.1.4...v5.1.5
5.1.4 - 2022-12-12
What's Changed
- Fixed glibc compatibility by downgrading CI to Ubuntu 20 by @ daniellockyer in #1664
Full Changelog: v5.1.3...v5.1.4
5.1.3 - 2022-12-12
What's Changed
- Updated bundled SQLite to v3.40.0 by @ daniellockyer
Full Changelog: v5.1.2...v5.1.3
5.1.2 - 2022-10-03
What's Changed
- Updated bundled SQLite to v3.39.4 by @ daniellockyer
Full Changelog: v5.1.1...v5.1.2
5.1.1 - 2022-09-15
What's Changed
- Added Darwin ARM64 binaries by @ daniellockyer in #1594
A huge thanks to MacStadium for providing an M1 Mac Mini so we can offer ARM64 binaries.

Full Changelog: v5.1.0...v5.1.1
5.1.0 - 2022-09-14
✨ We're very excited to announce node-sqlite3's first minor release of v5, packed with features and improvements.

If you encounter any problems, please open a detailed issue using the templates.

What's Changed
- Updated bundled SQLite to v3.39.3 by @ daniellockyer
- Added ability to receive updates from sqlite3_update_hook by @ soukand in #1267
- Added support for setting SQLite limits by @ paulfitz in #1548
- Added library types file by @ bpasero in #1527
- Added package-lock.json to .gitignore by @ JoelEinbinder in #1628
- Fixed remaining method declarations by @ alexanderfloh in #1633
- Fixed importing sqlite3#verbose using destructuring syntax by @ mahdi-farnia in #1632
New Contributors
- @ JoelEinbinder made their first contribution in #1628
- @ mahdi-farnia made their first contribution in #1632
- @ soukand made their first contribution in #1267
Full Changelog: v5.0.11...v5.1.0
5.0.11 - 2022-07-31
What's Changed
- Restored compatibility for Alpine 3.15 by @ daniellockyer in #1626
Full Changelog: v5.0.10...v5.0.11
5.0.10 - 2022-07-22
5.0.9 - 2022-07-14
5.0.8 - 2022-05-06
5.0.7 - 2022-05-05
5.0.6 - 2022-04-27
5.0.5 - 2022-04-22
5.0.4 - 2022-04-18
5.0.3 - 2022-04-13
5.0.2 - 2021-02-15

from sqlite3 GitHub release notes

Package name: webhook-discord

3.7.8 - 2021-07-27
3.7.7 - 2020-09-28
3.7.7

from webhook-discord GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"common-tags","from":"1.8.0","to":"1.8.2"},{"name":"iso-639-1","from":"2.1.9","to":"2.1.15"},{"name":"pg","from":"8.6.0","to":"8.12.0"},{"name":"pg-hstore","from":"2.3.3","to":"2.3.4"},{"name":"sequelize","from":"6.6.2","to":"6.37.3"},{"name":"sqlite3","from":"5.0.2","to":"5.1.7"},{"name":"webhook-discord","from":"3.7.7","to":"3.7.8"}],"env":"prod","hasFixes":true,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SEQUELIZE-3324088","issue_id":"SNYK-JS-SEQUELIZE-3324088","priority_score":629,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.3","score":415},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Improper Filtering of Special Elements"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-SQLITE3-2388645","issue_id":"SNYK-JS-SQLITE3-2388645","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SQLITE3-3358947","issue_id":"SNYK-JS-SQLITE3-3358947","priority_score":619,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary Code Execution"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1536528","issue_id":"SNYK-JS-TAR-1536528","priority_score":624,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Overwrite"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1536531","issue_id":"SNYK-JS-TAR-1536531","priority_score":624,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Overwrite"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1579147","issue_id":"SNYK-JS-TAR-1579147","priority_score":639,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.5","score":425},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Write"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1579152","issue_id":"SNYK-JS-TAR-1579152","priority_score":639,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.5","score":425},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Write"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-DOTTIE-3332763","issue_id":"SNYK-JS-DOTTIE-3332763","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-JSONSCHEMA-1920922","issue_id":"SNYK-JS-JSONSCHEMA-1920922","priority_score":644,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.6","score":430},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1579155","issue_id":"SNYK-JS-TAR-1579155","priority_score":639,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.5","score":425},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Write"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1536528","issue_id":"SNYK-JS-TAR-1536528","priority_score":624,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Overwrite"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1536531","issue_id":"SNYK-JS-TAR-1536531","priority_score":624,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Overwrite"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1579147","issue_id":"SNYK-JS-TAR-1579147","priority_score":639,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.5","score":425},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Write"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-QS-3153490","issue_id":"SNYK-JS-QS-3153490","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Poisoning"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SEQUELIZE-2959225","issue_id":"SNYK-JS-SEQUELIZE-2959225","priority_score":564,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7","score":350},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"SQL Injection"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1579152","issue_id":"SNYK-JS-TAR-1579152","priority_score":639,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.5","score":425},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Write"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1579155","issue_id":"SNYK-JS-TAR-1579155","priority_score":639,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.5","score":425},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Write"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-MOMENT-2440688","issue_id":"SNYK-JS-MOMENT-2440688","priority_score":589,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Directory Traversal"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-MOMENT-2944238","issue_id":"SNYK-JS-MOMENT-2944238","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-VALIDATOR-1090599","issue_id":"SNYK-JS-VALIDATOR-1090599","priority_score":586,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-VALIDATOR-1090601","issue_id":"SNYK-JS-VALIDATOR-1090601","priority_score":586,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-VALIDATOR-1090602","issue_id":"SNYK-JS-VALIDATOR-1090602","priority_score":586,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SEQUELIZE-3324089","issue_id":"SNYK-JS-SEQUELIZE-3324089","priority_score":479,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Information Exposure"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-SEQUELIZE-3324090","issue_id":"SNYK-JS-SEQUELIZE-3324090","priority_score":529,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.3","score":315},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Access of Resource Using Incompatible Type ('Type Confusion')"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-TAR-6476909","issue_id":"SNYK-JS-TAR-6476909","priority_score":646,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Uncontrolled Resource Consumption ('Resource Exhaustion')"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-REQUEST-3361831","issue_id":"SNYK-JS-REQUEST-3361831","priority_score":646,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Server-side Request Forgery (SSRF)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-TAR-6476909","issue_id":"SNYK-JS-TAR-6476909","priority_score":646,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Uncontrolled Resource Consumption ('Resource Exhaustion')"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-TOUGHCOOKIE-5672873","issue_id":"SNYK-JS-TOUGHCOOKIE-5672873","priority_score":646,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Prototype Pollution"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1536758","issue_id":"SNYK-JS-TAR-1536758","priority_score":410,"priority_score_factors":[{"type":"exploit","label":"Unproven","score":11},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"3.7","score":185},{"type":"scoreVersion","label":"v1","score":1}],"severity":"low","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1536758","issue_id":"SNYK-JS-TAR-1536758","priority_score":410,"priority_score_factors":[{"type":"exploit","label":"Unproven","score":11},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"3.7","score":185},{"type":"scoreVersion","label":"v1","score":1}],"severity":"low","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-SEQUELIZE-2932027","issue_id":"SNYK-JS-SEQUELIZE-2932027","priority_score":791,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"9.4","score":470},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"SQL Injection"}],"prId":"7d346f50-b6f9-42c4-9031-a4d866a6fcac","prPublicId":"7d346f50-b6f9-42c4-9031-a4d866a6fcac","packageManager":"npm","priorityScoreList":[629,696,619,624,624,639,639,696,644,639,696,564,589,696,586,586,586,479,529,646,646,646,410,791],"projectPublicId":"778fd27a-abca-4734-8ff3-ac309b9fe8bd","projectUrl":"https://app.snyk.io/org/c0r2a-hub/project/778fd27a-abca-4734-8ff3-ac309b9fe8bd?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["priorityScore"],"type":"auto","upgrade":["SNYK-JS-SEQUELIZE-3324088","SNYK-JS-SQLITE3-2388645","SNYK-JS-SQLITE3-3358947","SNYK-JS-TAR-1536528","SNYK-JS-TAR-1536531","SNYK-JS-TAR-1579147","SNYK-JS-TAR-1579152","SNYK-JS-DOTTIE-3332763","SNYK-JS-JSONSCHEMA-1920922","SNYK-JS-TAR-1579155","SNYK-JS-TAR-1536528","SNYK-JS-TAR-1536531","SNYK-JS-TAR-1579147","SNYK-JS-QS-3153490","SNYK-JS-SEQUELIZE-2959225","SNYK-JS-TAR-1579152","SNYK-JS-TAR-1579155","SNYK-JS-MOMENT-2440688","SNYK-JS-MOMENT-2944238","SNYK-JS-VALIDATOR-1090599","SNYK-JS-VALIDATOR-1090601","SNYK-JS-VALIDATOR-1090602","SNYK-JS-SEQUELIZE-3324089","SNYK-JS-SEQUELIZE-3324090","SNYK-JS-TAR-6476909","SNYK-JS-REQUEST-3361831","SNYK-JS-TAR-6476909","SNYK-JS-TOUGHCOOKIE-5672873","SNYK-JS-TAR-1536758","SNYK-JS-TAR-1536758","SNYK-JS-SEQUELIZE-2932027"],"upgradeInfo":{"versionsDiff":2,"publishedDate":"2021-11-16T20:07:41.248Z"},"vulns":["SNYK-JS-SEQUELIZE-3324088","SNYK-JS-SQLITE3-2388645","SNYK-JS-SQLITE3-3358947","SNYK-JS-TAR-1536528","SNYK-JS-TAR-1536531","SNYK-JS-TAR-1579147","SNYK-JS-TAR-1579152","SNYK-JS-DOTTIE-3332763","SNYK-JS-JSONSCHEMA-1920922","SNYK-JS-TAR-1579155","SNYK-JS-TAR-1536528","SNYK-JS-TAR-1536531","SNYK-JS-TAR-1579147","SNYK-JS-QS-3153490","SNYK-JS-SEQUELIZE-2959225","SNYK-JS-TAR-1579152","SNYK-JS-TAR-1579155","SNYK-JS-MOMENT-2440688","SNYK-JS-MOMENT-2944238","SNYK-JS-VALIDATOR-1090599","SNYK-JS-VALIDATOR-1090601","SNYK-JS-VALIDATOR-1090602","SNYK-JS-SEQUELIZE-3324089","SNYK-JS-SEQUELIZE-3324090","SNYK-JS-TAR-6476909","SNYK-JS-REQUEST-3361831","SNYK-JS-TAR-6476909","SNYK-JS-TOUGHCOOKIE-5672873","SNYK-JS-TAR-1536758","SNYK-JS-TAR-1536758","SNYK-JS-SEQUELIZE-2932027"]}'

Snyk has created this PR to upgrade: - common-tags from 1.8.0 to 1.8.2. See this package in npm: https://www.npmjs.com/package/common-tags - iso-639-1 from 2.1.9 to 2.1.15. See this package in npm: https://www.npmjs.com/package/iso-639-1 - pg from 8.6.0 to 8.12.0. See this package in npm: https://www.npmjs.com/package/pg - pg-hstore from 2.3.3 to 2.3.4. See this package in npm: https://www.npmjs.com/package/pg-hstore - sequelize from 6.6.2 to 6.37.3. See this package in npm: https://www.npmjs.com/package/sequelize - sqlite3 from 5.0.2 to 5.1.7. See this package in npm: https://www.npmjs.com/package/sqlite3 - webhook-discord from 3.7.7 to 3.7.8. See this package in npm: https://www.npmjs.com/package/webhook-discord See this project in Snyk: https://app.snyk.io/org/c0r2a-hub/project/778fd27a-abca-4734-8ff3-ac309b9fe8bd?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: common-tags, iso-639-1, pg, pg-hstore, sequelize, sqlite3, webhook-discord #27

[Snyk] Upgrade: common-tags, iso-639-1, pg, pg-hstore, sequelize, sqlite3, webhook-discord #27

0xhaaaash commented Sep 18, 2024

Bug Fixes

Plumbing

6.37.3 (2024-04-13)

Bug Fixes

6.37.2 (2024-03-29)

Bug Fixes

6.37.1 (2024-02-18)

Bug Fixes

6.37.0 (2024-02-11)

Features

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed

[Snyk] Upgrade: common-tags, iso-639-1, pg, pg-hstore, sequelize, sqlite3, webhook-discord #27

Are you sure you want to change the base?

[Snyk] Upgrade: common-tags, iso-639-1, pg, pg-hstore, sequelize, sqlite3, webhook-discord #27

Conversation

0xhaaaash commented Sep 18, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

Bug Fixes

Plumbing

6.37.3 (2024-04-13)

Bug Fixes

6.37.2 (2024-03-29)

Bug Fixes

6.37.1 (2024-02-18)

Bug Fixes

6.37.0 (2024-02-11)

Features

What's Changed

New Contributors

What's Changed

New Contributors

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

What's Changed

New Contributors

What's Changed