New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 5 vulnerabilities #38

Closed

snyk-bot wants to merge 1 commit into master from snyk-fix-2fc66226f7562324f8c1f4e7d67c4d56

snyk-bot commented Jan 13, 2020

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json
Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
Find out more.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Issue	Breaking Change
	Arbitrary File Write via Archive Extraction (Zip Slip) npm:adm-zip:20180415	No
	Prototype Pollution npm:hoek:20180212	Yes
	Regular Expression Denial of Service (DoS) npm:negotiator:20160616	Yes
	Uninitialized Memory Exposure npm:npmconf:20180512	Yes

Commit messages

Package name: adm-zip

The new version differs by 50 commits.

80d259f Version bump
3f00a03 Fixed [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#176
650e752 Fixed wrong date on files (issue [Snyk-dev Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#203)
d01fa8c Fixed bugs introduced with 0.4.9
c0cc85d Merge pull request [Snyk Update] New fixes for 2 vulnerable dependency paths snyk-labs/nodejs-goof#219 from jontore/master
39c83a2 Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#209 from poshta1900/fix
b94c5dd Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#227 from hhaidar/master
c95c553 Merge pull request [Snyk Update] New fixes for 16 vulnerable dependency paths snyk-labs/nodejs-goof#228 from jmcollin78/patch-1
cda668c Fix issue [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#218
0f2cb41 Fix octal literals so they work in strict mode
888931d To support strict mode use 0o prefix to octal numbers
89b6f67 Update package.json
9592298 Update README.md
ce59e5a Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#215 from grnd/master
38cb4a4 fix: resolve both target and entry path
18c3d31 Update package.json
666adec Update package.json
499d59b Update package.json
62f6400 Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#212 from aviadatsnyk/master
6f4dfeb fix: prevent extracting archived files outside of target path
ef0abe6 add try-catch around fs.writeSync
e116bc1 Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#208 from pmuens/patch-1
12d2099 Fix data accessing example in README
032566b Merge pull request [Snyk-dev Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#204 from BridgeAR/master

See the full diff

Package name: errorhandler

The new version differs by 85 commits.

c41e9aa 1.4.3
ffce329 build: [email protected]
90a8777 build: [email protected]
38b745b deps: accepts@~1.3.0
80aea51 deps: escape-html@~1.0.3
b0be93a docs: fix typo in readme
2f688d0 build: support Node.js 5.x
1238ed4 build: [email protected]
fdeb13c build: [email protected]
cc6fd1f build: support Node.js 4.x
3a2117a build: support io.js 3.x
75b9ee1 build: reduce runtime versions to one per major
6797752 tests: add test for util.inspect in HTML response
b6e53d7 docs: add more documentation regarding util.inspect
88b9a58 deps: accepts@~1.2.13
ac75d3f build: [email protected]
5ee62b7 deps: [email protected]
1e89ae7 build: [email protected]
ef1e8f1 build: [email protected]
a7a6dce 1.4.2
692e2e7 deps: accepts@~1.2.12
6f2e8d2 build: [email protected]
564c117 build: fix running Node.js 0.8 tests on Travis CI
2dfd872 1.4.1

See the full diff

Package name: express

The new version differs by 151 commits.

9375a9a 4.14.0
14cf9c5 deps: update example dependencies
605983f build: [email protected]
e06766c deps: [email protected]
76eaa32 Encode URL in res.location/res.redirect if not already encoded
c12cc88 build: support Node.js 6.x
23c22ce build: support Node.js 5.x
791cabf deps: serve-static@~1.11.1
fc40702 deps: [email protected]
c762b16 Improve error with invalid arguments to req.get()
5d642af Add "options" argument to req.range
7fcf1d7 docs: update the req.range jsdoc comment
7ee41cc deps: range-parser@~1.2.0
8ddab69 build: [email protected]
d038689 build: [email protected]
c9531ac build: [email protected]
98224d2 build: [email protected]
2e1284b Fix Windows absolute path check using forward slashes
999546d deps: [email protected]
cc25a04 deps: type-is@~1.6.13
f90f9dd Improve performance for res.json/res.jsonp in most cases
b69b760 perf: use strict equality when possible
c6039af deps: proxy-addr@~1.1.2
bdf604a deps: [email protected]

See the full diff

Package name: tap

The new version differs by 250 commits.

fe8158e 11.1.3
b17542d Upgrade deps (changing semver requirements)
bc3ba17 update deps
bd4de92 Clean up nyc output so Travis passes on node 6
2292432 Add hexagonal-lambda to the tap 100 list
fed62c9 Merge remote-tracking branch 'origin/master'
3cdf1c7 11.1.2
ddf938b Only ship files we want to ship
5b5e2ee docs: add unique page titles
2323c3b Merge tag 'v11.1.1'
95faf6c 11.1.1
283c8e6 Handle EPIPE better in exceptional edge cases
b727234 Fix obscure edge case when this.results is not set
1699eb9 process: update docs on the master branch
ac366a0 docs: fix typo ('heirarchical' -> 'hierarchical')
13073a7 docs: correct 100 PR link
b95ee22 v11.1.0
fcf70aa Add support for disabling autoend
94be0a7 v11.0.1
6c3f019 remove badges that are no longer accurate or in use
ae562a7 don't ignore coverage doc
9fcfd52 Migrate docs into main repository
f189c50 v11.0.0
5cde128 Merge branch 'v11'

See the full diff

With a Snyk patch:

Severity	Issue
	Timing Attack npm:http-signature:20150122

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:

🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


          fix: package.json, package-lock.json & .snyk to reduce vulnerabilities

ea78726

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/npm:adm-zip:20180415
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:negotiator:20160616
- https://snyk.io/vuln/npm:npmconf:20180512


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/npm:http-signature:20150122

pstember closed this

pstember closed this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet