New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 8 vulnerabilities #2051

Open

saurabharch wants to merge 1 commit into master from snyk-fix-f7d7bf4d91169ebd523a5aa1ea5cba66

Owner

saurabharch commented Apr 28, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- packages/gatsby/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	619/1000 Why? Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-AJV-584908	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-BROWSERSLIST-1090194	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-ENGINEIO-1056749	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-EVENTSOURCE-2823375	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: chokidar

The new version differs by 113 commits.

7b8e02a Release 3.0.0.
e7bfe2f Move stuff.
df7f22e Remove changelog from npm, move to hidden dir.
3df7692 Improve naming.
6e94ca2 Clean-up.
2de2f9c test: Add testing of Node.js v12 in Travis pipeline. ([Snyk] Security upgrade gatsby from 2.32.13 to 3.13.0 #833)
9e0965a Fix Windows tests in Travis CI ([Snyk] Security upgrade gatsby from 2.32.13 to 3.13.0 #832)
c95a98f Update stuff.
187ff2b test: Trying to fix blinked tests for Travis CI. ([Snyk] Security upgrade gatsby from 2.32.13 to 3.13.0 #825)
db99076 fix(Windows): Add converting from windows to unix path for all ignored paths. ([Snyk] Security upgrade gatsby from 2.32.13 to 3.13.0 #824)
41f8782 fix(FsEvents): Remove situation with NaN depth. ([Snyk] Security upgrade gatsby from 2.32.13 to 3.13.0 #823)
7cf3f7e Update readdirp to stable.
0927a62 Bump packages.
11cd857 Update nyc.
99c14d7 Uncomment fsevents.
cf330a5 Update fsevents.
0e4fca5 Fix deps.
9c575d4 Fix Windows version ([Snyk] Security upgrade gatsby from 2.32.13 to 3.13.0 #821)
3323d59 fix(Linux): Make event loop hack for keep testing valid. ([Snyk] Security upgrade gatsby from 2.32.13 to 3.13.0 #820)
06214c5 Update to latest readdirp.
793639f Rename osxfswatch.
078bc2d Refactor and fix freaking tests.
2b9bb41 Try node 11.
3fe3d4e Test travis.

See the full diff

Package name: eslint

The new version differs by 148 commits.

36ced0a 5.0.0
5fd5632 Build: changelog update for 5.0.0
0feedfd New: Added max-lines-per-function rule (fixes [gatsby-plugin-google-gtag] Disable default pageview tracking gatsbyjs/gatsby#9842) (Consider make code example more clear in "Adding analytics" gatsbyjs/gatsby#10188)
daefbdb Upgrade: eslint-scope and espree to 4.0.0 (refs Images are not loading (are still blurred) and network requests fail. gatsbyjs/gatsby#10458) (Emotion update gatsbyjs/gatsby#10500)
077358b Docs: no-process-exit: recommend process.exitCode ([RFC] Add standard frontmatter transforms to netlify cms plugin gatsbyjs/gatsby#10478)
f93d6ff Fix: do not fail on unknown operators from custom parsers (fixes Fonts best practice for loading fonts gatsbyjs/gatsby#10475) (feat(blog): Add "Gatsby scales with expertise & scope" blog post gatsbyjs/gatsby#10476)
05343fd Fix: add parens for yield statement (fixes feat(gatsby-plugin-offline): reload when missing resources and SW was updated + add "onServiceWorkerUpdateReady" API gatsbyjs/gatsby#10432) (How to use jss insertion point with gatsby? gatsbyjs/gatsby#10468)
d477c5e Fix: check destructuring for "no-shadow-restricted-names" (fixes Images scale, query and <Img /> gatsbyjs/gatsby#10467) (Improvements of pull request templates gatsbyjs/gatsby#10470)
7a7580b Update: Add considerPropertyDescriptor option to func-name-matching (Add a note about gif compatibility gatsbyjs/gatsby#9078)
e0a0418 Fix: crash on optional catch binding (Fix link to node-tracking.js file gatsbyjs/gatsby#10429)
de4dba9 Docs: styling team members (Set maxWidth of fluid image to avoid them stretching to match div width gatsbyjs/gatsby#10460)
5e453a3 Docs: display team members in tables. (Use correct function in example code gatsbyjs/gatsby#10433)
b1895eb Docs: Restore intentional spelling mistake (fix(docs): window.reload => window.location.reload gatsbyjs/gatsby#10459)
a9da57d 5.0.0-rc.0
3ac3df6 Build: changelog update for 5.0.0-rc.0
abf400d Update: Add ignoreDestructing option to camelcase rule (fixes custom webpack config fails / how to mini-css-extract? gatsbyjs/gatsby#9807) (Document stub node "Client data fetching" with relevant information gatsbyjs/gatsby#10373)
e2b394d Upgrade: espree and eslint-scope to rc versions ( Building static HTML for pageserror: Error: ENOENT: no such file or directory gatsbyjs/gatsby#10457)
a370da2 Chore: small opt to improve readability ([Site Showcase] Adding Dan Abramov's personal blog gatsbyjs/gatsby#10241)
640bf07 Update: Fixes multiline no-warning-comments rule. (fixes Why graphql returns undefined whereas GraphiQL returns something? gatsbyjs/gatsby#9884) ([Gatsby-plugin-contentful] excerpt returns an empty string gatsbyjs/gatsby#10381)
831c39a Build: Adding rc release script to package.json (First time expereince: WebpackError: ./.cache/develop-static-entry.js gatsbyjs/gatsby#10456)
dc4075e Update: fix false negative in no-use-before-define (fixes gatsby-plugin-create-client-paths remounts the root on every page transition gatsbyjs/gatsby#10227) (Test issue - ignore gatsbyjs/gatsby#10396)
3721841 Docs: Add new experimental syntax policy to README (fixes [gatsby-image] [gatsby-transformer-sharp] Emulate <img srcSet> behavior (restrict 2x images to 1x width) gatsbyjs/gatsby#9804) (404 for XHR request in IE11 gatsbyjs/gatsby#10408)
d0aae3c Docs: Create docs landing page (fix(www) Fix query for plugin links always ?=undefined gatsbyjs/gatsby#10453)
fe8bec3 Fix: fix writing config file when `source` is `prompt` (Scroll to top on page refresh gatsbyjs/gatsby#10422)

See the full diff

Package name: gatsby-cli

The new version differs by 250 commits.

0c6cd61 chore(release): Publish
5e8e621 chore: Update main README (chore: Update main README gatsbyjs/gatsby#36954)
7130cd4 test(gatsby): Slices API integration tests (test(gatsby): Slices API integration tests gatsbyjs/gatsby#36747)
6496eed chore(release): Publish next
bc7ac84 chore: preserve previous webpack stats derived values, even if we restart webpack itself (chore: preserve previous webpack stats derived values, even if we restart webpack itself gatsbyjs/gatsby#36980)
2b5af32 fix: drop `__renderedByLocation` prop when calculating slice props hashes and don't expose it to slice component (fix: drop __renderedByLocation prop when calculating slice props hashes and don't expose it to slice component gatsbyjs/gatsby#36979)
cc1ee9b chore(release): Publish next
6a53861 chore(gatsby-link): Correct type export (chore(gatsby-link): Correct type export gatsbyjs/gatsby#36968)
0ad6314 fix(gatsby-graphiql-explorer): Use upstream exporter package (fix(gatsby-graphiql-explorer): Use upstream exporter package gatsbyjs/gatsby#36966)
964265c chore(release): Publish next
b624442 chore: Update peerDeps (chore: Update peerDeps gatsbyjs/gatsby#36965)
b2ab092 chore(release): Publish next
e2a14bf feat(gatsby): Slices <> partial hydration interop (feat(gatsby): Slices <> partial hydration interop gatsbyjs/gatsby#36960)
0083e62 fix(deps): update starters and examples gatsby packages to ^4.24.7 (fix(deps): update starters and examples gatsby packages to ^4.24.7 gatsbyjs/gatsby#36957)
68e9cab chore(changelogs): update changelogs (chore(changelogs): update changelogs gatsbyjs/gatsby#36958)
b9eb8d2 chore(deps): update dependency autoprefixer to ^10.4.13 for gatsby-plugin-sass (chore(deps): update dependency autoprefixer to ^10.4.13 for gatsby-plugin-sass gatsbyjs/gatsby#36934)
58c37ea chore(deps): update dependency @ jridgewell/trace-mapping to ^0.3.17 for gatsby-legacy-polyfills (chore(deps): update dependency @jridgewell/trace-mapping to ^0.3.17 for gatsby-legacy-polyfills gatsbyjs/gatsby#36933)
a5e4c47 fix(deps): update dependency body-parser to ^1.20.1 for gatsby-source-drupal (fix(deps): update dependency body-parser to ^1.20.1 for gatsby-source-drupal gatsbyjs/gatsby#36940)
c86aa7e chore(docs): Add clarification for Pro Tip on Part 4 of tutorial (chore(docs): Add clarification for Pro Tip on Part 4 of tutorial gatsbyjs/gatsby#36918)
d5c775a feat(gatsby): handle graphql-import-node bundling (feat(gatsby): handle graphql-import-node bundling gatsbyjs/gatsby#36951)
59e2976 feat(gatsby-remark-embed-snippet): added csproj to language map so it will be recognized as xml (feat(gatsby-remark-embed-snippet): added csproj to language map so it will be recognized as xml gatsbyjs/gatsby#36919)
c8a7dda chore(docs): Valhalla Content Hub Reference Guide (chore(docs): Valhalla Content Hub Reference Guide gatsbyjs/gatsby#36949)
3044280 fix(gatsby): stitch slices if just page html was regenerating without any of used slices regenerating (fix(gatsby): stitch slices if just page html was regenerating without any of used slices regenerating gatsbyjs/gatsby#36950)
10abdcb chore(release): Publish next

See the full diff

Package name: socket.io

The new version differs by 57 commits.

1af3267 chore(release): 3.0.0
02951c4 chore(release): 3.0.0-rc4
54bf4a4 feat: emit an Error object upon middleware error
aa7574f feat: serve msgpack bundle
64056d6 docs(examples): update TypeScript example
cacad70 chore(release): 3.0.0-rc3
d16c035 refactor: rename ERROR to CONNECT_ERROR
5c73733 feat: add support for catch-all listeners
129c641 feat: make Socket#join() and Socket#leave() synchronous
0d74f29 refactor(typings): export Socket class
7603da7 feat: remove prod dependency to socket.io-client
a81b9f3 docs(examples): add example with TypeScript
20ea6bd docs(examples): add example with ES modules
0ce5b4c chore(release): 3.0.0-rc2
8a5db7f refactor: remove duplicate _sockets map
2a05042 refactor: add additional typings
91cd255 fix: close clients with no namespace
58b66f8 refactor: hide internal methods and properties
669592d feat: move binary detection back to the parser
2d2a31e chore: publish the wrapper.mjs file
ebb0575 chore(release): 3.0.0-rc1
c0d171f test: use the reconnect event of the Manager
9c7a48d test: use the complete export name
4bd5b23 feat: throw upon reserved event names

See the full diff

Package name: webpack-dev-server

The new version differs by 250 commits.

c9271b9 chore(release): 4.0.0
18bf369 test: fix stability (Lighter data-explorer command gatsbyjs/gatsby#3676)
cdcabb2 fix: respect protocol from browser for manual setup (Update to sharp v19 gatsbyjs/gatsby#3675)
1768d6b fix: initial reloading for lazy compilation ([www] add search input to home page gatsbyjs/gatsby#3662)
4f5bab1 docs: improve examples (Add a podcast website/player to the showcase gatsbyjs/gatsby#3672)
f2d87fb fix: improve https CLI output (Can't remove default plugins via webpack-configurator gatsbyjs/gatsby#3673)
0277c5e chore: remove redundant console statements ([v2] Topics/peer dependencies gatsbyjs/gatsby#3671)
16fcdbc docs: add `ipc` example (Fix gatsby-starter-portfolio-emilia PR gatsbyjs/gatsby#3667)
8915fb8 test: add e2e tests for built in routes ([gatsby-source-filesystem] add publicURL field gatsbyjs/gatsby#3669)
4d1cbe1 docs: ask `version` information in issue template (Show help and recommend when the command is wrong gatsbyjs/gatsby#3668)
b6c1881 chore(deps-dev): bump core-js from 3.16.1 to 3.16.2 (Add Flooring Factories Outlets to Showcase gatsbyjs/gatsby#3666)
ffa8cc5 chore(deps-dev): bump supertest from 6.1.5 to 6.1.6 (gatsby-plugin-sass not working with imported sass files that have a property with "url(...)" gatsbyjs/gatsby#3665)
f1fdaa7 chore(release): 4.0.0-rc.1
c4678bc fix: legacy API (Add images in Strapi tutorial gatsbyjs/gatsby#3660)
d8bdd03 test: fix stability (README showcase update gatsbyjs/gatsby#3661)
22b1414 refactor: remove `killable` ([v2] move glamor to peerDependencies gatsbyjs/gatsby#3657)
75bafbf test: add e2e tests for module federation (Missing 'filter' keyword for operation gatsbyjs/gatsby#3658)
493ccbd chore(deps): update `ws` (fix extract-text--webpack-plugin instance reuse errors gatsbyjs/gatsby#3652)
ae8c523 test: add e2e test for universal compiler (Add documentation about service workers gatsbyjs/gatsby#3656)
f94b84f chore(deps): update (Remove note about their being more parts to the tutorial gatsbyjs/gatsby#3655)
1923132 test: fix cli
2adfd01 test: fix todo (Update building-apps-with-gatsby.md gatsbyjs/gatsby#3653)
6e2cbde fix: proxy logging and allow to pass options without the `target` option (All the author info for Pierre gatsbyjs/gatsby#3651)
c9ccc96 fix: respect infastructureLogging.level for client.logging (Revert "Enable filtering on linked nodes" gatsbyjs/gatsby#3613)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect


          fix: packages/gatsby/package.json to reduce vulnerabilities

688ab54

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194
- https://snyk.io/vuln/SNYK-JS-ENGINEIO-1056749
- https://snyk.io/vuln/SNYK-JS-EVENTSOURCE-2823375
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-GOT-2932019
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment