Skip to content
This repository was archived by the owner on Dec 5, 2023. It is now read-only.

[Snyk] Fix for 17 vulnerabilities#8

Open
cbrand wants to merge 1 commit into
masterfrom
snyk-fix-f7c7fa461eff289f6d94146404d0dbbe
Open

[Snyk] Fix for 17 vulnerabilities#8
cbrand wants to merge 1 commit into
masterfrom
snyk-fix-f7c7fa461eff289f6d94146404d0dbbe

Conversation

@cbrand

@cbrand cbrand commented Nov 27, 2023

Copy link
Copy Markdown
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Prototype Pollution
SNYK-JS-AJV-584908		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HAWK-2808852		 No No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 No Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 No Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-NODESTATIC-1297183		 No Proof of Concept
medium severity 495/1000
Why? Has a fix available, CVSS 5.4		 Open Redirect
SNYK-JS-NODESTATIC-1297184		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Directory Traversal
SNYK-JS-NODESTATIC-3149928		 No Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831		 Yes Proof of Concept
high severity 624/1000
Why? Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 Yes No Known Exploit
high severity 624/1000
Why? Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 Yes No Known Exploit
low severity 410/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 Yes No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579147		 Yes No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579152		 Yes No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579155		 Yes No Known Exploit
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873		 Yes Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:hoek:20180212		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: sqlite3 The new version differs by 250 commits.
  • 573784b v5.0.3
  • e5a24fd Deleted `examples/` folder
  • b05f459 Added note about GitHub Releases to CHANGELOG.md
  • 33d0656 Modernised Usage example in README
  • 9d05c55 Fixed up more README nits
  • 08d6319 Fixed link to API docs
  • 0e2235a Altered wording in README
  • 76b6c56 Altered README header
  • e3df365 Updated README
  • 426930f Enabled CI to run when pushing tags
  • a21d41f Fixed uploading binaries to commit artifacts
  • bc978c7 Fixed CI step wording
  • 7f744a1 Added prebuilt binaries via GitHub Releases
  • b4b3c3a Deleted `scripts/` directory
  • 71bbdea Pinned dev dependencies (#1558)
  • a597383 Updated badges in README
  • 0eb4a0f Deleted Travis and Appveyor configs
  • b58d341 Downgraded `mocha` and `eslint`
  • f39b10d Added missing Node versions to CI
  • 8db96d4 Replaced Python extraction script with JS (#1570)
  • 11c988c Fixed Windows build architecture in CI
  • 8e63848 Updated Windows CI runner to `windows-latest`
  • d9e7d8b Fixed building on MacOS Monterey 12.3
  • 859b95b Updated `node-gyp` to v8.x

See the full diff

Package name: wrtc The new version differs by 250 commits.
  • 85cfe5a [publish binary] wrtc@0.2.0
  • e75ce17 Fix memory leaks in PeerConnection
  • f22bb0c Fix WPT tests with latest Mocha
  • d79016c - Updated package dependencies to fix security vulnerability
  • ca68b0b Dropped support for Node 4, 5 and 7 (#414)
  • a871094 fix make format
  • b309a5f fix race during close
  • 6dd8482 Fix typo in README.md
  • 3b902da [publish binary] wrtc@0.1.6
  • f3b4df1 Update CHANGELOG.md and package.json for 0.1.6
  • a41cbab Fix failing ArrayBuffer test
  • a6744c9 Add failing ArrayBuffer test
  • bc8ebb2 Remove #if statements for Node.js <= 0.11.7
  • 4165d6c [publish binary] wrtc@0.1.5
  • ca38b42 Workaround Windows issue
  • 8550c10 Add FakeAudioDevice and ZeroCapturer
  • 30bb7df Add MediaStream loopback example
  • 655351a Prepare for v0.1.5
  • d0a75eb Don't AddRef/RemoveRef in MediaStream
  • 226fe6d Add RTCRtpSender destructor test
  • 3bbf36c MediaStream calls AddRef/RemoveRef on MediaStreamTrack
  • 6e37097 Fix NewInstance calls
  • a39d01b Remove unused macros from src/common.h
  • e5be9ad Add RTCRtpSender

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json to reduce vulnerabilities
607dfc3 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-HAWK-2808852
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-NODESTATIC-1297183
- https://snyk.io/vuln/SNYK-JS-NODESTATIC-1297184
- https://snyk.io/vuln/SNYK-JS-NODESTATIC-3149928
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-TAR-1536528
- https://snyk.io/vuln/SNYK-JS-TAR-1536531
- https://snyk.io/vuln/SNYK-JS-TAR-1536758
- https://snyk.io/vuln/SNYK-JS-TAR-1579147
- https://snyk.io/vuln/SNYK-JS-TAR-1579152
- https://snyk.io/vuln/SNYK-JS-TAR-1579155
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://snyk.io/vuln/npm:hoek:20180212
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@cbrand @snyk-bot