Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 1 vulnerabilities #32

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #32

wants to merge 1 commit into from

Conversation

lasalasa
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • deps/npm/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: init-package-json The new version differs by 21 commits.

See the full diff

Package name: node-gyp The new version differs by 169 commits.

See the full diff

Package name: normalize-package-data The new version differs by 12 commits.

See the full diff

Package name: npm-install-checks The new version differs by 13 commits.
  • 9b68df3 4.0.0
  • d498feb allow engine if npm version not specified
  • f9cc89a update travis to only include live nodes
  • 0fc0126 auto-publish scripts
  • ca36bca update changelog for v4
  • a0d38b4 update docs for v4
  • 44b7124 Simplified functionality needed for npm v7
  • 1646fd7 remove unnecessary deps and metadata
  • d74d479 chore: project settings
  • d4463a3 chore(deps): update semver, tap, standard
  • 89937d4 minimal package
  • 893b181 fix: allow pre-release versions of npm and node
  • ab92033 chore: bump version of semver package

See the full diff

Package name: npm-package-arg The new version differs by 8 commits.
  • 26ffdd5 chore(release): 8.0.0
  • 17598ad chore: normalize settings, license, and update standard-version
  • ba85e68 drop support for node 6 and 8
  • 2c06e53 update tap
  • 9434f79 chore: update semver to v7
  • bf86221 chore(release): 7.0.0
  • 68a4fc3 deps: bump hosted-git-info to 3.0.2
  • ee44e84 chore: update deps

See the full diff

Package name: npm-pick-manifest The new version differs by 12 commits.
  • 3c8cb5d chore(release): 5.0.0
  • dc2e61c chore: normalize settings, drop old nodes, update deps
  • 661ba9d chore: bump version of semver package
  • 405d00b chore(release): 4.0.0
  • 42c76d8 deps: bump npm-package-arg to v7
  • 8e66272 chore(release): 3.0.2
  • 420fb8c chore: update repo links
  • 543da7c chore(release): 3.0.1
  • 003286e fix: throw 403 for forbidden major/minor versions
  • ed0fc29 chore(release): 3.0.0
  • 6ab64fd chore: remove node 4.0 from travis
  • ad2a962 feat: throw forbidden error when package is blocked by policy

See the full diff

Package name: npm-registry-fetch The new version differs by 28 commits.
  • d370dba chore(release): 6.0.0
  • 8c6622f chore: make-fetch-happen 7.1.0
  • 5813da6 fix: detect CI so our tests don't fail in CI
  • 3de1695 chore: replace nyc config with tap config
  • e18ed22 chore: bump make-fetch-happen to v7
  • 62f81a2 chore: bump ssri to v7
  • 8ccfa8a fix: Use WhatWG URLs instead of url.parse
  • 510b125 chore: normalize settings, drop old nodes, update deps
  • 622afb4 chore(release): 5.0.1
  • 7aa14fd deps: update all deps
  • 5764c15 deps: npm-package-arg@7
  • 786f092 chore(release): 5.0.0
  • 41ff216 chore: update travis config
  • 39e5cfe doc: fix badge url
  • 97c1208 chore: update tap, improve offline/prefer-offline tests
  • 82abf26 chore: Add missing tests and clean up dead code
  • 90ac7b1 fix: prefer const in getAuth function
  • e64702e fix: use minizlib instead of core zlib
  • 5cfe30b test: add string query example to test
  • e7286f7 fix!: Use native Promises
  • bb37f20 feat: refactor to use Minipass streams
  • b758555 chore(release): 4.0.2
  • e3a0186 fix: Add null check on body on 401 errors
  • ff5f990 test(check-response): Added missing tests

See the full diff

Package name: pacote The new version differs by 115 commits.
  • e88f844 10.3.0
  • b21dd92 update semver
  • d8ab8cf update npm-packlist
  • 361f0b3 update tap
  • c4bbf23 test: make the remote timeout test time out forever
  • b4ea91f npm-registry-fetch 6.0.0
  • 591edd8 @ npmcli/installed-package-contents@1.0.5
  • 5ce1093 test: make remote timeout test more reliably time out
  • 48fc9b8 use WhatWG URL instead of url.parse
  • e515bce Update deps, float patch for npm-registry-fetch
  • cf50f54 update @ npmcli/installed-package-contents, require node >=10
  • 698e996 Extract: rimraf dir contents, not dir itself
  • e568305 add @ npmcli/installed-package-contents module
  • e8a80d7 upgrade all deps
  • dfccb4f remove extraneous isNaN checking in git opts
  • e33c9ce 10.2.1
  • bad55cd fix: Do not drop perms in git when not root
  • ccc9e20 bin: only add log listener once
  • 8a8cd6a 10.2.0
  • e8c274c registry: verify integrity when loading manifest
  • f28888e bin: Only JSON.stringify by default if an object
  • 0018eda 10.1.6
  • fc1053f git: prefer git+https over git+ssh for hosted repo
  • 9d2ce90 10.1.5

See the full diff

Package name: read-package-json The new version differs by 8 commits.
  • 9f7049d chore(release): 3.0.0
  • 19d9fbe fix: check-in updated lockfile
  • eef46fa chore: add engines definition
  • 36b7ef7 chore: remove old .travis.yml envs
  • b3a8831 globa@7.1.6
  • fb3ceae json-parse-even-better-errors@2.3.1
  • 78add03 npm-normalize-package-bin@1.0.1
  • 7595d70 normalize-package-data@3.0.0

See the full diff

Package name: semver The new version differs by 168 commits.

See the full diff

Package name: update-notifier The new version differs by 42 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@lasalasa @snyk-bot