New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 6 vulnerabilities #14

Open

snyk-bot wants to merge 1 commit into unstable from snyk-fix-1f0123fb11205df2047336c51668e654

snyk-bot commented Mar 7, 2020

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Issue	Breaking Change	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-ACORN-559469	No	No Known Exploit
	Insecure Randomness SNYK-JS-CRYPTOJS-548472	No	No Known Exploit
	Timing Attack SNYK-JS-ELLIPTIC-511941	No	No Known Exploit
	Insecure Randomness npm:cryptiles:20180710	No	No Known Exploit
	Prototype Pollution npm:extend:20180424	No	No Known Exploit
	Uninitialized Memory Exposure npm:stringstream:20180511	No	Mature

Commit messages

Package name: ccxt

The new version differs by 250 commits.

310d123 1.18.609
8e50b4d Merge branch 'frosty00-vendor-cryptojs' #4875 fix #5180
8ca3989 Merge branch 'vendor-cryptojs' of https://github.com/frosty00/ccxt into frosty00-vendor-cryptojs
325cbca 1.18.608
ebdca74 removed a reference to node 'constants' from Node-RSA.js
4a02c13 oceanex py/php files
281c710 remove a reference to node 'constants' from node-rsa pkcs1.js
dbc66b6 Update pkcs1.js
7a6c56d revert .travis.yml
c2f5ce6 cleanup .travis.yml cache
fbfa5dc 1.18.607
ede89d7 bx.in.th minor edit
e8b5e75 Merge branch 'master' of github.com:ccxt/ccxt
662ff7a 1.18.606
8ebd879 Merge pull request #5219 from npomfret/master
a2b09c6 quotes in Exchange.js
31e92dd livecoin LEO → LeoCoin fix #5226
f877a0a bx.in.th LEO → LeoCoin fix #5226
98a43f3 bittrex parseTransaction minor edit
79952d0 Update bittrex.js
2b7977f bittrex v3 hostname support
2e6c547 bittrex fetchClosedOrdersV3 cleanup
eedc5c1 bittrex parseOrderV3 minor edits
f5866ce bittrex v3 minor edits

See the full diff

Package name: lint-staged

The new version differs by 11 commits.

3d0ccb2 fix(package): Update jest-validate to version 23.0.0 (Bitfinex WebSockets API + Fix postonly not triggering re-buy DeviaVir/zenbot#458)
a8816f5 ci: Update CI scripts to test against current Node release (Update package.json DeviaVir/zenbot#453)
9e27620 fix: Add .lintstagedrc.js to list of config files to search
a56d7c9 fix(package): Update listr to version 0.14.1 (Add support for Gemini exchange platform DeviaVir/zenbot#445)
2fc7aa3 fix(package): Update cosmiconfig to version 5.0.2 (Bittrex has inverted values DeviaVir/zenbot#444)
ec4f4f2 chore: Use npm as script runner (Error running under WebStorm DeviaVir/zenbot#456)
9823d26 fix(cli): Correct value for FORCE_COLOR env var (Unhandled AddOrder error, Invalid arguments:volume DeviaVir/zenbot#451)
1601c02 feat: Chunked execution of linters on Windows only (: No such file or directoryenv: node on docker DeviaVir/zenbot#439)
0924e78 docs: Mention npx mrm lint-staged template (Update exchange products for BCH support DeviaVir/zenbot#438)
b9d84ce fix: Update "please-upgrade-node" to version 3.0.2 (btce/update-products.sh: Error: non-200 status: 400 DeviaVir/zenbot#434)
5fba40d docs: Link to AgentConf talk by @okonet (Charting strategy performance DeviaVir/zenbot#431)

See the full diff

Package name: webpack

The new version differs by 250 commits.

25bccd4 4.29.0
6389e41 Merge pull request #8642 from webpack/memory/future-emit-assets
6e383cf make test for Source.buffer more strict
aaf85db add output.futureEmitAssets
03ffa48 Merge pull request #8639 from webpack/memory/limit-parallelism
2b2c17f Merge pull request #8598 from kiliancs/acorn6
fdb6b13 4.28.4
80514cc Add ts declarations
78abf04 Use eachLimit instead even though forEachLimit apears to be an alias...
9cb4225 forEach to forEachLimit
ef67132 Upgrade acorn to v6
3e147e6 Merge pull request #8588 from hulkish/faster-statement-type-check
2a04dee added ExportAllDeclaration, fixed fn signature
baf0aa1 Merge pull request #8581 from DanielRuf/tests/increase-jest-timeout
41b6887 use faster statement type check
af01643 Increase Jest timeout for profiling plugin test
ccc7db7 Merge pull request #8401 from shahkashani/fix-for-issue-8398
2e3e2a0 Merge pull request #8544 from chuckdumont/work
69dea22 Merge pull request #8573 from hulkish/fix-minimizer-fn
983c261 4.28.3
6240cf6 added config test case for optimization.minimizer
d8ab512 Merge pull request #8565 from NaviMarella/ProfilingPlugin_8503
510abf7 Merge pull request #8565 from NaviMarella/ProfilingPlugin_8503
0128118 Modified Tests as suggested.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:

🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


          fix: package.json & package-lock.json to reduce vulnerabilities

c239773

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ACORN-559469
- https://snyk.io/vuln/SNYK-JS-CRYPTOJS-548472
- https://snyk.io/vuln/SNYK-JS-ELLIPTIC-511941
- https://snyk.io/vuln/npm:cryptiles:20180710
- https://snyk.io/vuln/npm:extend:20180424
- https://snyk.io/vuln/npm:stringstream:20180511

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet