New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 14 vulnerabilities #148

Open

bumplzz69 wants to merge 1 commit into master from snyk-fix-2990dc1080c8fad32d5e652e5aecaa99

Owner

bumplzz69 commented Aug 31, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	919/1000 Why? Mature exploit, Has a fix available, CVSS 9.8	Exposure of Resource to Wrong Sphere SNYK-JS-FSEVENTS-5487987	Yes	Mature
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-INI-1048974	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536528	Yes	No Known Exploit
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536531	Yes	No Known Exploit
	410/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579147	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: jest

The new version differs by 152 commits.

634e5a5 expect: fix regression in toThrow for message prop and asymmetric matchers (Problems with React dependency on 0.26.1 facebook/react-native#7697)
6081f7a [jest-each] Add primitive pretty printing ([Push notifications] Add error event facebook/react-native#7694)
57aeaa2 chore: bump flow
28971c5 Ensure mocks get resolved too (Top of Text cut off when lineHeight < fontSize facebook/react-native#7687)
1d1c3f9 chore: upgrade docusaurus ([0.25.1][Android][Picker][BUG] On build release facebook/react-native#7691)
9cfcd81 make worker_threads opt-in, not opt-out (added .babelrc file facebook/react-native#7693)
6de22dd Update lerna configuration
1256f76 Fix toHaveProperty matcher for inherited properties (react-native.js: Unable to find this module in its module map or any of the node_modules directories facebook/react-native#7686)
967b335 fix: add option to disable `worker_threads` in `jest-worker` (react-native init <ProjectName> hangs on windows facebook/react-native#7681)
0e1855e chore: bump write-file-atomic again
0f94162 fix: upgrade `write-atomic-file` to support worker_threads (Geolocation API automatically reverts to 100m accuracy on iOS facebook/react-native#7680)
3e3d405 docs: using Babel 6 with Jest 24 (Add Epic Fail Videos app to Showcase section facebook/react-native#7677)
a551b19 chore: upgrade fsevents
89b2f1b chore: upgrade to prettier 1.16 (New global property are no longer writable facebook/react-native#7658)
05e8ac0 chore: leave single 22.x in versioned docs (Make Getting Started labels a bit more clear facebook/react-native#7674)
71b47cf add twitter links (Fix TextInput autocorrect (#7496) facebook/react-native#7676)
312b42a sync doc versions on jsdom configuration (Failed to build DependencyGraph: Watchman error facebook/react-native#7675)
c70afe2 document how to get a newer version of jsdom (Map annotations on iOS are not always centered facebook/react-native#7673)
1124953 Update SnapshotTesting.md (Correctly reference cwd instead of __dirname facebook/react-native#7671)
fbd4f53 Website: Styling of backers avatars, preserve avatars proportions. (cherry-pick NavigationPropTypes.SceneRenderer bugfix facebook/react-native#7665)
2434d47 fix: Pass `watchPathIgnorePatterns` to Haste instance (Fix tab in Examples/UIExplorer/SwitchExample.js facebook/react-native#7585)
6880611 Correctly bundle up for browser globals ([NavigationExperimental] Android support? facebook/react-native#7661)
6c3d998 chore: Add performance benchmark to `diff-sequences` package (Vertically center iOS text if lineHeight is set facebook/react-native#7603)
f4cf46a Dmitrii Abramov is now Aaron Abramov (require function without full commonjs leads to footguns facebook/react-native#7663)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Arbitrary File Overwrite


          fix: package.json to reduce vulnerabilities

6bafa82

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-FSEVENTS-5487987
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-TAR-1536528
- https://snyk.io/vuln/SNYK-JS-TAR-1536531
- https://snyk.io/vuln/SNYK-JS-TAR-1536758
- https://snyk.io/vuln/SNYK-JS-TAR-1579147
- https://snyk.io/vuln/SNYK-JS-TAR-1579152
- https://snyk.io/vuln/SNYK-JS-TAR-1579155
- https://snyk.io/vuln/SNYK-JS-UGLIFYJS-1727251

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet