New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 10 vulnerabilities #250

Open

adrianblynch wants to merge 1 commit into master from snyk-fix-741b99e26c015125f7188e50c3990265

Owner

adrianblynch commented Nov 27, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- app/vue/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	679/1000 Why? Has a fix available, CVSS 9.3	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962463	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-BROWSERSLIST-1090194	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-COLORSTRING-1082939	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	Yes	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-POSTCSS-1255640	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-POSTCSS-5926692	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: css-loader

The new version differs by 80 commits.

634ab49 chore(release): 2.0.0
6ade2d0 refactor: remove unused file (Doesn't work on Windows if launched from a shell with lowercase drive letter storybookjs/storybook#860)
e7525c9 test: nested url (Add a suite of tests to check with new versions of React Native storybookjs/storybook#859)
7259faa test: css hacks (Is there a way to get this working with Exponent? storybookjs/storybook#858)
5e6034c feat: allow to filter import at-rules (Co-locate stories with components. storybookjs/storybook#857)
5e702e7 feat: allow filtering urls (Reconnect websocket connection on close storybookjs/storybook#856)
9642aa5 test: css stuff (Storybook webapp preview area is blank storybookjs/storybook#855)
3338656 fix: reduce number of require for url (Decorators may get applied multiple times storybookjs/storybook#854)
533abbe test: issue 636 (Support modules storybookjs/storybook#853)
08c551c refactor: better warning on invalid url resolution (Write a contributor guide storybookjs/storybook#852)
b0aa159 test: issue react-native peer dependency warning storybookjs/storybook#589 (Write unit tests storybookjs/storybook#851)
f599c70 fix: broken unucode characters (Can only use one device at a time storybookjs/storybook#850)
1e551f3 test: issue 286 (Support RN 0.43.x storybookjs/storybook#849)
419d27b docs: improve readme (how to debug app storybookjs/storybook#848)
d94a698 refactor: webpack-default (RelayQL: Unexpected invocation ... storybookjs/storybook#847)
b97d997 feat: schema options
453248f fix: support module resolution in composes (Hook on leaveing a story storybookjs/storybook#845)
8a6ea10 refactor: postcss plugins (Don't work if Debug server host is setted: websocket: connection error", "Failed to connect to localhost/127.0.0.1:7007 storybookjs/storybook#844)
fdcf687 fix: url resolving logic (Doesn't work on Windows if launched from a shell with lowercase drive letter storybookjs/storybook#843)
889dc7f feat: allow to disable css modules and disable their by default (Add a suite of tests to check with new versions of React Native storybookjs/storybook#842)
ee2d253 test: importLoaders option (Is there a way to get this working with Exponent? storybookjs/storybook#841)
1dad1fb feat: reuse postcss ast from other loaders (i.e `postcss-loader`) (Merge channel-postmsg into this repo storybookjs/storybook#840)
fe94ebc test: icss reserved keywords (Is there a way to get this working with Exponent? storybookjs/storybook#839)
9eaba66 refactor: migrate on message api for postcss-icss-plugin (Co-locate stories with components. storybookjs/storybook#838)

See the full diff

Package name: webpack

The new version differs by 250 commits.

610f368 5.0.0
5ce65c1 update examples
bbe1230 Merge pull request Core: Change react deps to normal deps storybookjs/storybook#11628 from webpack/bugfix/real-content-hash
75ecff2 5.0.0-rc.6
bfc35d6 Merge pull request Addon-docs: Fix Vue defaultValue in props table storybookjs/storybook#11603 from MayaWolf/master
76e8cbd Merge pull request CLI: Generate docs:json command dynamically for Angular project storybookjs/storybook#11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
36bcfaa Merge pull request #11621 from webpack/bugfix/11619
9130d10 fix called variables with ProvidePlugin
3e42105 Merge pull request [Security] Bump codecov from 3.7.0 to 3.7.1 storybookjs/storybook#11620 from webpack/bugfix/11617
4709719 skip connections copied to concatenated module
57b493f 5.0.0-rc.5
1658e2f Merge pull request All parameters are added and merged to all groups + roots in storiesHash storybookjs/storybook#11618 from webpack/bugfix/11615
a8fb45d fixes crash in SideEffectsFlagPlugin
84b196d emit error instead of crashing when unexpected problem occurs
5573fed Merge pull request Addon-docs: Automatic source selection based on story type storybookjs/storybook#11601 from Hornwitser/improve-suggested-polyfill-config
9b5cce9 Merge pull request CLI: Generate compodoc command based on user's setup storybookjs/storybook#11609 from snitin315/export-types
37c495c export type RuleSetUseItem
39faf34 export type RuleSetUse
e5fd246 export type RuleSetConditionAbsolute
660baad export RuleSetCondition types
13e3ca5 Merge pull request Webpack Hot Reload not working in react Storybook 6.0-rc.9 storybookjs/storybook#11602 from webpack/bugfix/shared-runtime-chunk
9c0587e Merge pull request Addon-controls: Expose presetColors for the color control storybookjs/storybook#11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
502d166 Merge pull request [Feature request] Ink Storybook storybookjs/storybook#11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Improper Input Validation
🦉 Prototype Pollution


          fix: app/vue/package.json to reduce vulnerabilities

e7da703

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962463
- https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194
- https://snyk.io/vuln/SNYK-JS-COLORSTRING-1082939
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://snyk.io/vuln/SNYK-JS-POSTCSS-5926692
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet