Skip to content

Comments

[Snyk] Security upgrade commitizen from 4.2.4 to 4.2.5#88

Open
snyk-bot wants to merge 1 commit intomasterfrom
snyk-fix-013da3bb1a9802f6b0b34c5cdff26d58
Open

[Snyk] Security upgrade commitizen from 4.2.4 to 4.2.5#88
snyk-bot wants to merge 1 commit intomasterfrom
snyk-fix-013da3bb1a9802f6b0b34c5cdff26d58

Conversation

@snyk-bot
Copy link
Contributor

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7
Prototype Pollution
SNYK-JS-MINIMIST-2429795
No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: commitizen The new version differs by 48 commits.
  • 0939910 ci(release): defined a github workflow to release with semantic-release (#923)
  • 757a806 chore(deps): update all non-major dependencies
  • 25dc80c fix: fix the "isFunction" utility to match both "asyncFunction"s and "Function"s (#927)
  • fc283fb chore(deps): update dependency semver to v7.3.7
  • c35a3c7 chore(deps): update all non-major dependencies
  • 69de704 fix(deps): update all non-major dependencies
  • e79f3ee chore(deps): update dependency @ babel/core to v7.17.8
  • 69689fb chore(deps): update all non-major dependencies to v7.17.7
  • 3c2553f fix(deps): update all non-major dependencies
  • 4118263 docs: add cz-git commitizen adapter (#905)
  • 70ca1f4 docs: adjust example to a valid husky prepare-commit-msg command (#908)
  • fcc85e5 docs(readme): match casing of tutorial's title
  • bcd9c73 docs(readme): fix dead link to tutorial
  • 941bf38 chore(deps): update all non-major dependencies
  • a3f4ffa chore(deps): update dependency @ babel/core to v7.17.2
  • 8f76acd chore(deps): update dependency node-fetch to 2.6.7 [security] (#902)
  • d4e39c6 chore(deps): update all non-major dependencies to v7.17.0
  • 056b0ed chore(deps): update all non-major dependencies (#891)
  • 5b2c458 chore: remove unused dev-dependency axios (#894)
  • 9c7e863 fix(deps): update dependency inquirer to v8 (#874)
  • 218d454 chore: remove unused Travis-CI config (#880)
  • f1cf649 chore(deps): update all non-major dependencies
  • dc7ac60 chore(deps): update all non-major dependencies
  • c6a2857 chore(deps): update dependency conventional-changelog-conventionalcommits to v4.6.2

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

@codecov
Copy link

codecov bot commented Jul 17, 2022

Codecov Report

Merging #88 (c2d8ea3) into master (08a2406) will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff            @@
##            master       #88   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines          207       207           
=========================================
  Hits           207       207           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0664d9c...c2d8ea3. Read the comment docs.

@sonarqubecloud
Copy link

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
No Duplication information No Duplication information

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant