New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 8 vulnerabilities #12

Open

snyk-bot wants to merge 1 commit into master from snyk-fix-2cc41ecaa1561a298e73f433177f5a06

snyk-bot commented Jun 28, 2022

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	No	Proof of Concept
	526/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.1	Arbitrary Code Injection SNYK-JS-EJS-1049328	Yes	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-EJS-2803307	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Denial of Service (DoS) SNYK-JS-JSZIP-1251497	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	No	Proof of Concept
	681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	No	Proof of Concept
	726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-PACRESOLVER-1564857	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: dustjs-linkedin

The new version differs by 36 commits.

5cd5529 Release v3.0.1
0d72e0b Merge pull request Circleci project setup snyk-labs/nodejs-goof#808 from sumeetkakkar/topic/update-deps
b2aaa47 Merge branch 'master' into topic/update-deps
bd397ea Update tests.yaml: add --legacy-peer-deps to support npm 8 restrictions
115f78c dependency update: chokidar
d951a90 Update tests.yml
ea9ae70 Create tests.yml
2e8795c Release v3.0.0
6f98371 merge from 2.7
db6d8b9 Merge pull request build(deps): bump bl from 2.2.0 to 2.2.1 snyk-labs/nodejs-goof#805 from sumeetkakkar/fix/proto-pollution
ddb6523 fix for prototype pollution vulnerability
e0e25f7 Merge pull request build(deps): bump jquery from 2.2.4 to 3.5.0 snyk-labs/nodejs-goof#756 from danactive/master
eeb1c17 Decrease security vulnerabilities by upgrading cli dependency ([Snyk-local] Fix for 2 vulnerabilities snyk-labs/nodejs-goof#754 [Snyk] Upgrade morgan from 1.9.1 to 1.10.0 snyk-labs/nodejs-goof#748)
d485a72 {?exists} and {^exists} resolve Promises and check if the result exists ([Snyk-dev] Security upgrade jquery from 2.2.4 to 3.5.0 snyk-labs/nodejs-goof#753)
43c0831 place location provided by peg 0.9 onto the AST
07b73b3 Merge pull request [Snyk-local] Fix for 3 vulnerabilities snyk-labs/nodejs-goof#744 from sethkinast/is-context
ae69314 Don't use instanceof to determine if a Context is a Context
dc1e1dc Merge pull request build(deps): bump acorn from 5.7.1 to 5.7.4 snyk-labs/nodejs-goof#736 from brianmhunt/master
6f6c49f Prioritize .then on thenable functios ([Snyk-local] Fix for 4 vulnerabilities snyk-labs/nodejs-goof#735)
487da8d Merge pull request [Snyk] Security upgrade browserify from 13.3.0 to 15.0.0 snyk-labs/nodejs-goof#734 from sethkinast/master
a671ebd Bump deps
7bc3b77 Update streaming-incremental example to work with newer q
3fc12ef Merge pull request [Snyk] Fix for 8 vulnerabilities snyk-labs/nodejs-goof#703 from sethkinast/peg-0.9
c1d9e21 Merge pull request [Snyk-onprem] Fix for 3 vulnerabilities snyk-labs/nodejs-goof#705 from sethkinast/context-templatename

See the full diff

Package name: lodash

The new version differs by 1 commits.

c6e281b Bump to v4.17.21

See the full diff

Package name: snyk

The new version differs by 250 commits.

8387aed Merge pull request #2111 from snyk/fix/update-jszip
e686299 fix: update plugins package versions
7f0b32e Merge pull request #2108 from snyk/smoke/binary-cdn
e974b9d test: use binary from cdn for smoke tests
64e3fe8 Merge pull request #2107 from snyk/refactor/analytics-tests
0f2a7e3 refactor: call anaytics module the right way
0b833f6 refactor: use await syntax rather than callbacks
fce83d5 Merge pull request #2096 from snyk/feat/iac-tracking
f7f2961 feat: track IaC local execution tests [CC-972]
9e7f79a Merge pull request #2104 from snyk/feat/centralize-colors
3292ffb feat: Centralize icons and err messages by theme
e3c3ac0 feat: central colors theme
2aecd40 Merge pull request #2074 from snyk/docs/update-protect-readme
0203c6c Merge pull request #2100 from snyk/fix/propagate-error-message
7416bc9 docs: update protect readme
42288e0 fix: propagate userMessage to 404 errors
77336a0 Merge pull request #2099 from snyk/test/migrate-trust-policies-jest
e2106f1 test: migrate trust-policies to jest
b227f78 Merge pull request #2095 from snyk/protect/smoke-tests
20b05d0 Merge pull request #2087 from snyk/chore/async-test-with-polling
d7f23e0 Merge pull request #2098 from snyk/fix/bump-docker-plugin
cb2ecf1 fix: bump docker plugin version with fixes
697f81f chore(protect): fix production test caching
d21cff7 chore: init support async test with polling

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Arbitrary Code Injection
🦉 Remote Code Execution (RCE)
🦉 Remote Code Execution (RCE)


          fix: package.json & package-lock.json to reduce vulnerabilities

e7140eb

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-EJS-1049328
- https://snyk.io/vuln/SNYK-JS-EJS-2803307
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-JSZIP-1251497
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-PACRESOLVER-1564857

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet