New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade karma from 0.13.22 to 5.0.0 #275

Open

BitcoinOutput wants to merge 1 commit into master from snyk-fix-e59e01d56ac333e4e2a3e230565dfd50

Owner

BitcoinOutput commented Nov 29, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- samples/client/petstore/javascript-closure-angular/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-1056752	Yes	Proof of Concept
	704/1000 Why? Has a fix available, CVSS 9.8	Improper Input Validation SNYK-JS-SOCKETIOPARSER-3091012	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-USERAGENT-174737	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	Yes	Proof of Concept
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:parsejson:20170908	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: karma

The new version differs by 250 commits.

1b48637 chore(release): 5.0.0 [skip ci]
a5dbe89 Update issue templates ([BUG] [typescript-angular] Angular 8: generated package.json includes @angular/http dependency OpenAPITools/openapi-generator#3460)
1074f38 chore(ci): rely on karma-runnre/integration-tests for saucelabs config ([REQ] [cpprestsdk] ApiException is not used in the way it is generated OpenAPITools/openapi-generator#3462)
4d45cf0 chore(ci): remove more old connection security stuffs ([BUG] [haskell-http-client] Incorrectly generated query strings OpenAPITools/openapi-generator#3459)
be76fcc chore(ci): use travis UI for sauce config (Revert "qt5 client: use openapi 3 spec" OpenAPITools/openapi-generator#3458)
a04a542 chore(ci): remove secure encryption var ([BUG] Qt5 client PetStore example doesn't compile when using openapi 3 specification OpenAPITools/openapi-generator#3457)
1eaf35e fix: install semantic-release as a regular dev dependency ([Java] Replace "useNullForUnknownEnumValue" option with the nullable attribute OpenAPITools/openapi-generator#3455)
0647109 docs: Fix simple typo, overriden -> overridden ([Java] add nullable support to the clients OpenAPITools/openapi-generator#3453)
ec1e69a fix(server): replace optimist on yargs lib ([REQ][typescript-*] String Enums OpenAPITools/openapi-generator#3451)
ffad7fa refactor(launcher): use class syntax ([typescript-rxjs]: support reponseType blob OpenAPITools/openapi-generator#3437)
7166ce2 fix(server): detection new MS Edge Chromium (Fix remote spec handling and hash calculation OpenAPITools/openapi-generator#3440)
b8b2ed8 fix(ci): echo travis env that gates release after_success ([OCaml] new client generator OpenAPITools/openapi-generator#3446)
33a069f refactor: use native Promise instead of Bluebird ([Java] Fix numeric field names OpenAPITools/openapi-generator#3436)
131d154 refactor: drop safe-buffer dependency in favor of native Buffer ([REQ] [Java] Add JsonIgnoreProperties to model OpenAPITools/openapi-generator#3438)
cb1bcbf fix(server): cleanup import of the removed method ([BUG][CLI][GENERATOR] NullPointer when not setting outputDir OpenAPITools/openapi-generator#3439)
5c334f5 fix(server): createPreprocessor was removed ([BUG][Java][client] Erroneous support for nullable attributes OpenAPITools/openapi-generator#3435)
d7128d4 refactor(server): remove PromiseContainer class (Mvn repo OpenAPITools/openapi-generator#3416)
057d527 feat(docs): document `DEFAULT_LISTEN_ADDR` constant (Add GoDaddy as domain name sponsor OpenAPITools/openapi-generator#3443)
a673aa8 ci: drop node 8, adopt node 12 ([BUG][ANDROID] java.util.concurrent.TimeoutException OpenAPITools/openapi-generator#3430)
9eb6436 chore(server): Convert PromiseContainer to object and remove ([REQ] OAS3 Tag/template to define external-components URL OpenAPITools/openapi-generator#3401)
0856234 chore(travis): release on node 10 success ([BUG] Python generator incorrectly renames valid model names OpenAPITools/openapi-generator#3428)
708ae13 feat(preprocessor): obey Pattern.isBinary when set ([BUG] [qt5] cppNamespace argument doesn't work OpenAPITools/openapi-generator#3422)
00d536f chore(test): logLevel debug in proxy test ([BUG] Python generator incorrectly renames non-reserved model objects OpenAPITools/openapi-generator#3427)
da9d8bd chore(docs): delete PULL_REQUEST_TEMPLATE.md

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Improper Input Validation


          fix: samples/client/petstore/javascript-closure-angular/package.json …

…to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-1056752
- https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-3091012
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660
- https://snyk.io/vuln/SNYK-JS-USERAGENT-174737
- https://snyk.io/vuln/npm:braces:20180219
- https://snyk.io/vuln/npm:debug:20170905
- https://snyk.io/vuln/npm:ms:20170412
- https://snyk.io/vuln/npm:parsejson:20170908

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet