New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 9 vulnerabilities #1

Open

janhellevik wants to merge 1 commit into master from snyk-fix-6e66c268ce09a67181480255d12a8e5a

Owner

janhellevik commented Apr 4, 2024

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

⚠️

Warning

Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:

Severity	Issue	Breaking Change	Exploit Maturity
	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	No	Proof of Concept
	Command Injection SNYK-JS-LODASH-1040724	No	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-450202	No	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-567746	No	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-608086	No	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-73638	No	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	No	Proof of Concept
	Prototype Pollution npm:lodash:20180130	No	Proof of Concept

Commit messages

Package name: jshint

The new version differs by 113 commits.

d5c1a00 v2.9.6
ab3ab85 [[FIX]] Do not warn about non-ambiguous linebreaks
eaca85b [[CHORE]] Improve test coverage for ASI warning
0a66710 [[FIX]] Relax restriction on asgnmnt to arguments
3aa02db [[FIX]] Tolerate division following closing brace
55aa54e [[FIX]] Correct restriction on function name
ff71d3c [[FIX]] Remove warning W100
bcb3b23 [[CHORE]] Complete Lodash update (#3283)
030713d [[DOCS]] Introduce administration e-mail address
7993101 [[FIX]] Fix "is is" message typos
578575d Merge pull request #3254 from mathiasbynens/unicode-10
d763e70 Use old Unicode version for ES5 identifiers
77414e8 Update to Unicode v11
5995a9f [[FIX]] Restrict IdentifierNames in ES5 code
f2ce8fe [[TEST]] Add regression test
8df4a32 [[FIX]] Correct spelling of Uint8ClampedArray
274d2be [[DOCS]] Add a code of conduct
e0b4e91 [[CHORE]] Update to latest version of Lodash
6b7feae Merge branch 'master' into unicode-10
5276788 [[TEST]] Use `test262-stream`
98316fe [[TEST]] Extend Test262 "expectations" file
32aa96a [[TEST]] Reformat Test262 "expectations" file
3b125e5 Update identifier data to ES2015+ and Unicode 10
157a508 [[CHORE]] Correct linting violation

See the full diff

Package name: update-notifier

The new version differs by 50 commits.

311557e 6.0.0
9183541 Require Node.js 14 and move to ESM
3fdb218 5.1.0
73c391b Upgrade dependencies
0a6027e Move to GitHub Actions
d8fa601 Rename `master` branch to `main`
f63b2eb 5.0.1
9e2b772 Update dependencies
da7c464 5.0.0
5b440c2 Require Node.js 10
3dfe42d Don't suggest to upgrade to lower version (Unclear suffix naming convention with duplicate operation ID's wcandillon/swagger-js-codegen#192)
132b7ce Remove a project from "Users" section (Linted and cleaned up code, added write ability, renamed bin file and updated deps. wcandillon/swagger-js-codegen#191)
c9d2166 4.1.1
f42fc8f Improve vertical alignment of the notifier output (Added support for accessing the typescript types for a successful response in the mustache templates wcandillon/swagger-js-codegen#183)
71a3f19 Use HTTPS links
64c5236 Fix Travis
9d9f4ff 4.1.0
4062f12 Update dependencies
adbeb6e Add template support for the `message` option (Test on node 4.x wcandillon/swagger-js-codegen#175)
adf7803 4.0.0
fb5161c Remove the `callback` option (Add modern license to package.json. wcandillon/swagger-js-codegen#158)
39682de Rename `boxenOpts` option to `boxenOptions`
bc1721a Avoid showing notification if current version is the latest (Update package.json wcandillon/swagger-js-codegen#174)
ccaf686 Update dependencies

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Open Redirect
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Command Injection
🦉 More lessons are available in Snyk Learn


          fix: package.json to reduce vulnerabilities

427f30a

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-GOT-2932019
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/npm:lodash:20180130

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment