[Snyk] Fix for 6 vulnerabilities #3

snyk-bot · 2020-12-05T23:13:36Z

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

✨ Snyk has automatically assigned this pull request, set who gets assigned.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- packages/benchmarks/package.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
509/1000 Why? Has a fix available, CVSS 5.9	Denial of Service (DoS) SNYK-JS-JSYAML-173999	Yes	No Known Exploit
619/1000 Why? Has a fix available, CVSS 8.1	Arbitrary Code Execution SNYK-JS-JSYAML-174129	Yes	No Known Exploit
529/1000 Why? Has a fix available, CVSS 6.3	Cross-site Scripting (XSS) SNYK-JS-WEBPACKBUNDLEANALYZER-174190	Yes	No Known Exploit
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-Y18N-1021887	Yes	Proof of Concept
601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
469/1000 Why? Has a fix available, CVSS 5.1	Denial of Service (DoS) npm:mem:20180117	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: css-loader

The new version differs by 9 commits.

43179a8 chore(release): 1.0.0
3d53968 Merge remote-tracking branch 'origin/master'
240db53 version 1.0 (make a readme Awesome React Native Web necolas/react-native-web#742)
1b7acf7 Merge remote-tracking branch 'origin/master'
1703721 docs(README): add more context to `localIdentName` ([WIP] Add Modal necolas/react-native-web#711)
1c51265 docs(README): fix malformed emoji (PanResponder: 'move' is called before mouse is pressed necolas/react-native-web#701)
50f8ec0 Merge remote-tracking branch 'origin/master'
07444ad tests: css custom variables (ScrollViewBase is missing setNativeProps necolas/react-native-web#709)
3de8aa7 tests: css custom variables (ScrollViewBase is missing setNativeProps necolas/react-native-web#709)

See the full diff

Package name: webpack

The new version differs by 250 commits.

213226e 4.0.0
fde0183 Merge pull request #6081 from webpack/formating/prettier
b6396e7 update stats
f32bd41 fix linting
5238159 run prettier on existing code
518d1e0 replace js-beautify with prettier
4c25bfb 4.0.0-beta.3
dd93716 Merge pull request #6296 from shellscape/fix/hmr-before-node-stuff
7a07901 Merge pull request #6563 from webpack/performance/assign-depth
c7eb895 Merge pull request #6452 from webpack/update_acorn
9179980 Merge pull request #6551 from nveenjain/fix/templatemd
e52f323 optimize performance of assignDepth
6bf5df5 Fixed template.md
90ab23a Merge branch 'master' into fix/hmr-before-node-stuff
b0949cb add integration test for spread operator
39438c7 unittest now also walks the ast
15ab027 Merge pull request #6536 from jevan0307/sideEffects-selectors
1611ce1 Merge pull request #6561 from joshunger/patch-1
6e175bc Merge pull request #6549 from webpack/md4_hash
0637531 Add a hyperlink to create a new issue
0e1f9c6 Merge pull request #6554 from webpack/deps/end-of-beta
72477f4 upgrade versions to stable versions
ed30285 Merge pull request #6546 from webpack/bot/review-permission
40ee8c7 Use MD4 for hashing

See the full diff

Package name: webpack-bundle-analyzer

The new version differs by 132 commits.

345c3f5 v3.3.2
a615815 Merge pull request Initial update to ListView functionality necolas/react-native-web#264 from webpack-contrib/fix-escape-regression
20f2b4c Fix regression with escaping internal assets
9836649 v3.3.1
d1db526 Remove outdated item from troubleshooting section
ca34279 Merge pull request Touchable Opacity props warnings necolas/react-native-web#261 from webpack-contrib/relative-links-to-assets
99818f9 Fix changelog
21722d2 Add changelog entry
ed99c32 Use relative links for serving internal assets
3ce1b8c Merge pull request Button component: Add to web support necolas/react-native-web#262 from webpack-contrib/proper-js-escape
5385936 Add changelog entry
e5091ce Properly escape embedded JS/JSON
81ec8b3 Update changelog
5f80d17 Merge pull request ListView implementation necolas/react-native-web#260 from webpack-contrib/fix-help-command
0404322 Fix showing help message on `-h`
30786eb Fix link to PR
838fef4 v3.3.0
26a1474 Merge pull request Touchable not working necolas/react-native-web#257 from webpack-contrib/fix-context-menu-positioning
b22015a Fix positioning of the context menu when sidebar is pinned
49ce234 Merge pull request Provide source files (allow npm install via git with a building step) necolas/react-native-web#256 from webpack-contrib/update-dev-deps
fe3c71e Update dev dependencies
4a232f0 Merge pull request [fix] NetInfo event handler registration necolas/react-native-web#246 from bregenspan/add-context-menu
2b53d43 Document event type
83adbbb Re-open context menu immediately when different bundle is selected