[Snyk] Fix for 7 vulnerabilities #4

ryan-ally · 2021-03-15T21:40:32Z

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-ENGINEIO-1056749	Yes	Proof of Concept
479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	No Known Exploit
601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOCHA-561476	Yes	No Known Exploit
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Insecure Defaults SNYK-JS-SOCKETIO-1024859	Yes	Proof of Concept
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-SOCKETIOPARSER-1056752	Yes	Proof of Concept
601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: karma

The new version differs by 200 commits.

3653caf chore(release): 6.0.0 [skip ci]
04a811d fix(ci): abandon browserstack tests for Safari and IE (#3615)
4bf90f7 feat(client): update banner with connection, test status, ping times (#3611)
68c4a3a chore(test): run client tests without grunt wrapper (#3604)
fec972f fix(middleware): catch errors when loading a module (#3605)
3fca456 fix(server): clean up close-server logic (#3607)
1c9c2de fix(test): mark all second connections reconnects (#3598)
87f7e5e chore(license): Update copyright notice to 2020 [ci skip] (#3568)
e6b045f chore(deps): npm audit fix the package-lock.json (#3603)
3c649fa chore(build): remove obsolete Grunt tasks (#3602)
8997b74 fix(test): clear up clearContext (#3597)
fe0e24a chore(build): unify client bundling scripts (#3600)
1a65bf1 feat(server): remove deprecated static methods (#3595)
fb76ed6 chore(test): remove usage of deprecated buffer API (#3596)
35a5842 feat(server): print stack of unhandledrejections (#3593)
4a8178f fix(client): do not reset karmaNavigating in unload handler (#3591)
603bbc0 feat(cli): error out on unexpected options or parameters (#3589)
7a3bd55 feat: remove support for running dart code in the browser (#3592)
1b9e1de fix(deps): bump socket-io to v3 (#3586)
3fed0bc fix(cve): update yargs to 16.1.1 to fix cve-2020-7774 in y18n (#3578)
f819fa8 fix(cve): update ua-parser-js to 0.7.23 to fix CVE-2020-7793 (#3584)
05dc288 fix(context): do not error when karma is navigating (#3565)
e5086fc docs: clarify `browser_complete` vs `run_complete`
ead31cd chore(release): 5.2.3 [skip ci]

See the full diff

Package name: karma-mocha

The new version differs by 18 commits.

5828416 chore(release): 2.0.0 [skip ci]
4e35a55 chore(ci): semantic-release on success (Can I disable the time field? debug-js/debug#221)
00b24b6 chore(deps-dev): bump eslint from 2.13.1 to 4.18.2 ([Feature Request] Listing of registered keys, toggle debug-js/debug#220)
f7ec4e7 Merge pull request No output with iron-node debug-js/debug#218 from karma-runner/semanitic-release
5a5b6d5 feat(ci): enable semanitic-release
36404cf Merge pull request logs during test runs / jasmine-node compatability debug-js/debug#217 from franktopel/minimist-update
bab0416 updated minimum version of minimist dependency to ^1.2.3 instead of 1.2.0
3f9e4b7 Revert "updated minimum version of minimist dependency to ^1.2.3 instead of 1.2.0"
a9bfdf9 updated minimum version of minimist dependency to ^1.2.3 instead of 1.2.0
3dd7a56 Merge pull request move ms to the last place debug-js/debug#215 from mbaumgartl/update-node-versions
844939c Merge pull request zsh: no matches found debug-js/debug#213 from mbaumgartl/fix-travis-build
fd64f5b Update Node.js versions
6eb28de Fix Travis builds
c8feade Merge pull request How can I use debug in the browser with AngularJS and Bower? debug-js/debug#210 from elpddev/chore/align-node-support-same-as-karma
ea076c0 test(mock-fs): update mock-fs version
2fb6c93 ci(node versions): change running node verison the same as karma package
6c63662 Merge pull request Add support for multiple wildcards in namespaces debug-js/debug#122 from maksimr/karma-mocha-109
e847121 feat: Expose 'pending' status

See the full diff

Package name: mocha

The new version differs by 250 commits.

eb781e2 Release v6.2.3
10dbe94 update CHANGELOG for v6.2.3 [ci skip]
848d6fb security: update mkdirp, yargs, yargs-parser
843a322 6.2.2
aec8b02 update CHANGELOG for v6.2.2 [ci skip]
7a8b95a npm audit fixes
cebddf2 Improve reporter documentation for mocha in browser. (#4026)
3f7b987 uncaughtException: report more than one exception per test (#4033)
ee82d38 modify alt text of image from Backers to Sponsors inside Sponsors section in Readme (#4046)
e9c036c special-case parsing of "require" in unparseNodeArgs(); closes #4035 (#4063)
954cf0b Fix HTMLCollection iteration to make unhide function work as expected (#4051)
816dc27 uncaughtException: fix double EVENT_RUN_END events (#4025)
9650d3f add OpenJS Foundation logo to website (#4008)
f04b81d Adopt the OpenJSF Code of Conduct (#3971)
aca8895 Add link checking to docs build step (#3972)
ef6c820 Release v6.2.1
9524978 updated CHANGELOG for v6.2.1 [ci skip]
dfdb8b3 Update yargs to v13.3.0 (#3986)
18ad1c1 treat '--require esm' as Node option (#3983)
fcffd5a Update yargs-unparser to v1.6.0 (#3984)
ad4860e Remove extraGlobals() (#3970)
b269ad0 Clarify effect of .skip() (#3947)
1e6cf3b Add Matomo to website (#3765)
91b3a54 fix style on mochajs.org (#3886)

See the full diff

Package name: xo

The new version differs by 111 commits.

084e7a3 0.32.1
7d015ac Update devDependency ava from v1.1.0 to v3.9.0 (Merge debug-js/debug#490)
744090a Update meow from v5.0.0 to v7.0.1 (Disable colors in Edge and Internet Explorer debug-js/debug#489)
522d264 Test on Node.js 14 (Ability to suppress timestamps when useColors is false - maintains backwards compatibility debug-js/debug#488)
245f7d3 0.32.0
0dd4a9d Disable some problematic rules
d3abdb6 Add more extensions to `import/extensions` rule
aa8508b 0.31.0
32d96c3 Upgrade dependencies
1240dd2 Enable `import/no-anonymous-default-export` and `import/no-named-default` (Dependecy error: Cannot find module tty debug-js/debug#472)
6a05691 Add support for scoped shareable configs (Not working over ssh debug-js/debug#480)
ca21492 Add some eslint-plugin-node rules
bdc13e2 Fix Travis
c7d64de 0.30.0
ca31f1c Upgrade dependencies
07e2762 Prevent extraneous newline from `--stdin --fix` (Make it works on React Native debug-js/debug#460)
a592d3d 0.29.1
4783f26 Add `tap-snapshots/*.cjs` to default ignore list (window is not defined debug-js/debug#461)
967927d Temporarily disable the `unicorn/string-content` rule (Check for undefined on browser globals. debug-js/debug#462)
87e3615 0.29.0
f59ec7b Update dependencies
e05efc3 Upgrade to Prettier 2.0.4 (Fix Regular Expression Denial of Service (ReDoS) debug-js/debug#458)
f20f6d2 Allow `nodeVersion` in XO config to override `engines.node` (Fix browser detection debug-js/debug#457)
ec87ef3 0.28.3

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-ENGINEIO-1056749 - https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905 - https://snyk.io/vuln/SNYK-JS-MINIMIST-559764 - https://snyk.io/vuln/SNYK-JS-MOCHA-561476 - https://snyk.io/vuln/SNYK-JS-SOCKETIO-1024859 - https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-1056752 - https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381

ryan-ally self-assigned this Sep 20, 2021

ryan-ally merged commit 269c089 into master Sep 20, 2021

ryan-ally deleted the snyk-fix-b3ea2edf771643ff5ddf3d18077fa3c6 branch September 20, 2021 17:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Fix for 7 vulnerabilities #4

[Snyk] Fix for 7 vulnerabilities #4

ryan-ally commented Mar 15, 2021

[Snyk] Fix for 7 vulnerabilities #4

[Snyk] Fix for 7 vulnerabilities #4

Conversation

ryan-ally commented Mar 15, 2021

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade: