Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 31 vulnerabilities #7

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 31 vulnerabilities #7

wants to merge 1 commit into from

Conversation

claytonbrown
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

    • package.json

  • Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
    Find out more.

Vulnerabilities that will be fixed

With an upgrade:
Severity Issue Breaking Change Exploit Maturity
medium severity Arbitrary Code Injection
SNYK-JS-EJS-1049328		 No Proof of Concept
high severity Remote Code Execution (RCE)
SNYK-JS-EJS-2803307		 No Proof of Concept
medium severity Prototype Pollution
SNYK-JS-FIREBASEUTIL-1038324		 Yes Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
medium severity Open Redirect
SNYK-JS-GOT-2932019		 Yes No Known Exploit
medium severity Improper Authentication
SNYK-JS-JSONWEBTOKEN-3180022		 Yes No Known Exploit
medium severity Improper Restriction of Security Token Assignment
SNYK-JS-JSONWEBTOKEN-3180024		 Yes No Known Exploit
medium severity Use of a Broken or Risky Cryptographic Algorithm
SNYK-JS-JSONWEBTOKEN-3180026		 Yes No Known Exploit
high severity SQL Injection
SNYK-JS-KNEX-3175610		 Yes Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 No Proof of Concept
high severity Command Injection
SNYK-JS-LODASH-1040724		 No Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-567746		 No Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-608086		 No Proof of Concept
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795		 No Proof of Concept
medium severity Prototype Pollution
SNYK-JS-MINIMIST-559764		 No Proof of Concept
medium severity Information Exposure
SNYK-JS-NODEFETCH-2342118		 Yes No Known Exploit
medium severity Denial of Service
SNYK-JS-NODEFETCH-674311		 Yes No Known Exploit
medium severity Open Redirect
SNYK-JS-NODEFORGE-2330875		 Yes Proof of Concept
medium severity Prototype Pollution
SNYK-JS-NODEFORGE-2331908		 Yes No Known Exploit
medium severity Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430337		 Yes No Known Exploit
high severity Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430339		 Yes No Known Exploit
medium severity Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430341		 Yes No Known Exploit
high severity Prototype Pollution
SNYK-JS-NODEFORGE-598677		 Yes Proof of Concept
medium severity Session Fixation
SNYK-JS-PASSPORT-2840631		 No No Known Exploit
high severity Prototype Poisoning
SNYK-JS-QS-3153490		 No Proof of Concept
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 Yes Proof of Concept
high severity Arbitrary Code Injection
SNYK-JS-SERIALIZEJAVASCRIPT-570062		 Yes Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090599		 Yes Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090600		 Yes Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090601		 Yes Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090602		 Yes Proof of Concept
Commit messages
Package name: body-parser The new version differs by 101 commits.

See the full diff

Package name: express The new version differs by 117 commits.

See the full diff

Package name: firebase-functions The new version differs by 38 commits.

See the full diff

Package name: got The new version differs by 250 commits.
  • 5e17bb7 11.8.5
  • bce8ce7 Backport 861ccd9ac2237df762a9e2beed7edd88c60782dc
  • 8ced192 Fix build
  • 670eb04 11.8.4
  • 20f29fe Backport #1543: Initialize globalResponse in case of ignored HTTPError (#2017)
  • 0da732f 11.8.3
  • 9463bb6 Bump cacheable-request dependency (#1921)
  • 0e167b8 HTTPError code set to 'HTTPError' #1711 (#1739)
  • f896aa5 11.8.2
  • 3bd245f Instantiate CacheableLookup only when needed (#1529)
  • a72ed84 11.8.1
  • 4c815c3 Do not throw on custom stack traces (#1491)
  • e0cb820 11.8.0
  • f65c9ef Upgrade dependencies
  • 7acd380 Fix for sending files with size `0` on `stat` (#1488)
  • 6aa86f2 Fix indentation in the readme
  • 3dd2273 `beforeRetry` allows stream body if different from original (#1501)
  • b1afa2b Fix readme example comment (#1505)
  • 390b145 Set default value for an options object (#1495)
  • 87dadd5 Fixed documentation example for `responseType` (#1494)
  • 3bf3e3b Add `lookup` option documentation (#1483)
  • c31366b Add a test for #1438 (#1469)
  • 5d62958 11.7.0
  • 88b32ea Fix a regression where body was sent after redirect

See the full diff

Package name: jsonwebtoken The new version differs by 17 commits.

See the full diff

Package name: knex The new version differs by 250 commits.
  • 3475d81 Prepare to release 2.4.0
  • e97f922 Bump tsd from 0.24.1 to 0.25.0 (#5396)
  • e145322 1227: add assertion for basic where clause values (#5417)
  • 962bb0a Bump sinon from 14.0.2 to 15.0.1 (#5413)
  • ab45314 Add JSDoc (TS Flavour) to mjs stub file (#5390)
  • 72bd1f7 Fix: orWhereJson (#5361)
  • 4fc939a Fixes unexpected max acquire-timeout (#5377)
  • 5c4837c Fix lib/.gitignore path separator on Windows. (#5325)
  • 7dbbd00 Bump actions/setup-node from 3.4.1 to 3.5.1 (#5356)
  • d39051f fix: add missing type for 'expirationChecker' on PgConnectionConfig (#5334)
  • f7ccde8 Make compiling SQL in error message optional (#5282)
  • 82610ca Bump tsd from 0.23.0 to 0.24.1 (#5329)
  • cb5be88 Bump typescript from 4.8.2 to 4.8.3 (#5324)
  • dc6dbbf fix: insert array into json column (#5321)
  • 864530c feat: support partial unique indexes (#5316)
  • 6bed5e9 Fix changing the default value of a boolean column in SQLite (#5319)
  • f52b2c5 Merge remote-tracking branch 'origin/master'
  • 05c4707 Prepare to release 2.3.0
  • 13b61c0 Update dependencies (#5317)
  • 97fccdf Explicit jsonb support for custom pg clients (#5201)
  • 1cc1df9 chore: remove bindingHolder for proper scoping (#5235)
  • e0c0fa9 Implement mapBinding mssql dialect option (#5292)
  • 29283a1 Bump tsd from 0.22.0 to 0.23.0 (#5314)
  • 57692d3 Infer specific column value type in aggregations (#5297)

See the full diff

Package name: minimist The new version differs by 21 commits.

See the full diff

Package name: passport The new version differs by 100 commits.

See the full diff

Package name: pg The new version differs by 213 commits.
  • 7ffe68e Publish
  • 125a268 Update changelog
  • da2bb85 Bump node-fetch from 2.6.0 to 2.6.1
  • 7649890 Update SPONSORS.md
  • c5445f0 Fix metadata for pg-connection-string
  • a02dfac Replace semver with optional peer dependencies
  • 5825843 Public export of DatabaseError
  • e421167 Add ssl=true into the test
  • 9cbea21 Solve issues caused by config.ssl = true
  • 6be3b90 Add support for ?sslmode connection string param
  • f0fc470 Update README.md (#2330)
  • 95b5daa Publish
  • 1f0d3d5 Add test for pgpass check function scope
  • 0758b76 Fix context (this) in _checkPgPass.
  • acfbafa Publish
  • 07ee1ba Bump version
  • 65156e7 Small readme updates & auto-formatting
  • 61e4b7f Merge pull request #2309 from chris--young/ssl-err
  • f4d123b Prevents bad ssl credentials from causing a crash
  • 316bec3 Merge pull request #2294 from charmander/test-fixes
  • 3edcbb7 Fix most SSL negotiation packet tests being ignored
  • 1b022f8 Remove accidentally duplicated methods
  • b8773ce Merge pull request #2289 from brianc/dependabot/npm_and_yarn/lodash-4.17.19
  • 692e418 Fix documenation typo in README (#2291)

See the full diff

Package name: serialize-javascript The new version differs by 17 commits.

See the full diff

Package name: validator The new version differs by 250 commits.
  • 47ee5ad 13.7.0
  • 496fc8b fix(rtrim): remove regex to prevent ReDOS attack (#1738)
  • 45901ec Merge pull request #1851 from validatorjs/chore/fix-merge-conflicts
  • 83cb7f8 chore: merge conflict clean-up
  • f17e220 feat(isMobilePhone): add El Salvador es-SV locale
  • 5b06703 feat(isMobilePhone): add Palestine ar-PS locale
  • a3faa83 feat(isMobilePhone): add Botswana en-BW locale
  • 26605f9 feat(isMobilePhone): add Turkmenistan tk-TM
  • 0e5d5d4 feat(isMobilePhone): add Guyana en-GY locale
  • f7ff349 feat(isMobilePhone): add Frech Polynesia fr-PF locale
  • 8627e48 feat(isMobilePhone): add Kiribati en-KI locale
  • ed60123 feat(isMobilePhone): add Tajikistan tg-TJ locale (#1846)
  • c96d805 feat(isMobilePhone): add Maldives dv-MV locale
  • 5c2d69e feat(isMobilePhone): regex for Burkina Faso fr-BF and Namibia en-NA locales
  • fc0fefc feat(isMobilePhone): add Bhutan dz-BT locale (#1770)
  • 01d3da3 feat(isMobilePhone): add Tajikistan tg-TJ locale (#1846)
  • af2b43c feat(isUUID): add support for validation of version v1 and v2 (#1848)
  • 769f6d5 feat(contains): add possibility to check that string contains seed multiple times (#1836)
  • f2381e0 feat: (isMobilePhone): add Cameroon fr-CM locale (#1772)
  • 5773869 feat(isVAT): add dutch NL locale (#1825)
  • de1cb29 fix: Russian passport number regex (#1810)
  • 7bee611 add CDN use option with unpkg (#1844)
  • 57cc14e feat(isIdentityCard): add finnish locale (#1838)
  • 2201869 feat: added finnish locale to isAlpha and isAlphanumeric (#1837)

See the full diff

With a Snyk patch:
Severity Issue Exploit Maturity
high severity Prototype Pollution
SNYK-JS-LODASH-567746		 Proof of Concept

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Arbitrary Code Injection
🦉 Prototype Pollution
🦉 Regular Expression Denial of Service (ReDoS)
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json & .snyk to reduce vulnerabilities
4656dd2 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-EJS-1049328
- https://snyk.io/vuln/SNYK-JS-EJS-2803307
- https://snyk.io/vuln/SNYK-JS-FIREBASEUTIL-1038324
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-GOT-2932019
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180022
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180024
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180026
- https://snyk.io/vuln/SNYK-JS-KNEX-3175610
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2330875
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2331908
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430337
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430339
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430341
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677
- https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-SERIALIZEJAVASCRIPT-570062
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090599
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090600
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090601
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090602


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@claytonbrown @snyk-bot