Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 1 vulnerabilities #2688

Open
wants to merge 290 commits into
base: main
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #2688

wants to merge 290 commits into from

Conversation

snyk-bot
Copy link
Contributor

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • twake/backend/node/package.json
    • twake/backend/node/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 663/1000
Why? Currently trending on Twitter, Has a fix available, CVSS 7.7		 Improper Input Validation
SNYK-JS-JSONWEBTOKEN-3180020		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: fastify-jwt The new version differs by 35 commits.

See the full diff

Package name: jsonwebtoken The new version differs by 17 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

stephanevieira75 and others added 30 commits February 21, 2022 23:22
@stephanevieira75 @RomaricMourgues
#1934 Implement channel members state in frontend (#1940)
2905aed 
* #1934 Move channel members types in features/channel-members/types

* #1934 Update channel-members-api-client.ts

* #1934 Add channel members state in features/channel-members

* #1934 Add use channel members hook in features/channel-members

* #1934 Implement channel members and pending emails state

* #1934 Add use channel guests hook

* #1927 Upgrade antd from 4.16.13 to 4.18.3

* #1928 Upgrade react-i18next from 11.12.0 to 11.15.3

* #1934 Implement Channel Members real time

Co-authored-by: Romaric Mourgues <rmourgues@linagora.com>
@RomaricMourgues
🛠 Multiple QA fixes (#1980)
3869ec9 
* Fix issues

* Fix #1976
@RomaricMourgues
🛠 Fix magic link and user invite limit notice
7923bd4 
* Fix translation and limit value

* Fix how we manage active features

* Fix join error 500

* Fix set request_url

* Add link to go to the console see all the company members

* Disable elasticsearch source
@RomaricMourgues
🛠 Fix invite token error (#1983)
cdbc69b 
* Fix err 500 on join

* Fix useless call to backend

* Improve mentions test
@schneik80
🐳 Update start.sh (#1989)
f03a721 
add more verbose messages to start.sh
@RomaricMourgues
🛠 Fix downloading chunk from url on onlyoffice OVH server (#1993)
48f2aaf
@RomaricMourgues
🛠 Fix redis adapter version (#1987)
28cd040 
* Finaly, do not change all the versions

* Get back to master versions

* Types are magically ok now

* Update amqplib

* Update lock

* Add redis to the list

* Retry new versions

* Add logs

* Correctly init fastify and socket.io

* Fix duplicated io

* Try to see readyness issue

* Put back code

* Put back code

* Fastify init before

* Test 2

* Add a onReady function

* Add binding

* Not undefined

* Add allowEIO3: true

* Add some logs

* Fix auth process

* Execute all the tests
@RomaricMourgues
🛠 Multiple fixes (#2000)
1dd64f5 
* Send mobile configuration from backend

* Fix #1985

* Implements #1929

* Fix #1997

* Fix removing users

* Fix #1969

* Fix #1999

* Remove console log
@RomaricMourgues
⬆️ Update libs (#2002)
a90bf75 
* Update dependancies

* Update sass

* Fix new types in Antd
@RomaricMourgues
🛠 Db update config (#1986)
1d832c7 
* Set consistency level to quorum

* Fix test configuration

* Create utilities to fix db broken repair

* Add fix thread tool

* Prepare cluster migrator

* Soon it will work

* Fix import

* Select only the dest columns

* Add more fixes

* Fix and add emojis

* Add forceUpdateAll parameter

* WIP

* Add counters table ignored

* Remove logs forgotten in #1987

* Add special fields handlers

* Fixes from server tests

* Add a script to copy messages specifically
@RomaricMourgues
🛠 Channel + search changes (#2006)
8898eee 
* Channel + search changes

* Add logs when es index is droped

* Add option to reindex messages, also add options to the search endpoint

* Add files in message searchable content

* Fix addUsersToChannel in tests

* Fix other stuff

* Is this stuff used in tests ?

* Fix search messages

* Fix search prefixes

* Fix tests for mongo too
@RomaricMourgues
🛠 Multiple fixes (#2009)
75d200d 
* Avoid sending "members" in api response for non direct channels

* Fix mobile redirection again

* Fix css

* Fix bug

* Fix snake case / camel case

* Fix tests for applications
@RomaricMourgues
🛠 Fix missing pinned messages (#2010)
55bd41f
@RomaricMourgues
🛠 Fix previews not generated (#2011)
f6a8df1
@romanesko
🛠 Search improve (#2012)
c7bdb5e 
* search impove

* fix tests for casandra

* fixed cache stuff

* sender and has_files impl

* some small last fixes

* some small last fixes
@RomaricMourgues
🛠 Fix 200 for well-known (#2018)
261f082
@stephanevieira75
🌟 #1960 Implement users list search in frontend (#1996)
0abae68 
* #1960 Implement users list search in frontend

* #1960 Implement workspace list in user object

* #1960 Add missing translations in workspace members table

* #1960 Filter results in channel participants popup

* #1960 Add guests in user list state

* #1960 Allow mentions to use user list state

* #1960 Add ellipsis in member channel row

* #1960 Resolve threads
@RomaricMourgues
🌟 Cool improvements and last minute fixes (#2022)
9c31d08 
* Fix is writing css

* Re-implement mentions highlighting

* Typo + prepare large version of files

* Update popup page view

* Finish large view of files

* Fix typo

* Fix css for isWriting

* Back to previous yarn.lock

* FIx download route using findOne

* Fix sending message before upload finishes

* Update changelog.md
@RomaricMourgues @weblate
⬆️ Prepare version 2022.Q2.910 (#2025)
e932875 
* 🌍Translated using Weblate (French)

Currently translated at 100.0% (872 of 872 strings)

🌍Translated using Weblate (German)

Currently translated at 97.3% (849 of 872 strings)

Merge remote-tracking branch 'origin/develop' into develop

Merge remote-tracking branch 'origin/develop' into develop

Merge remote-tracking branch 'origin/develop' into develop

🌍Translated using Weblate (German)

Currently translated at 97.3% (849 of 872 strings)

🌍Translated using Weblate (French)

Currently translated at 100.0% (872 of 872 strings)

🌍Translated using Weblate (Esperanto)

Currently translated at 0.0% (0 of 872 strings)

🌍Translated using Weblate (Italian)

Currently translated at 99.1% (865 of 872 strings)

🌍Translated using Weblate (Sinhala)

Currently translated at 95.8% (836 of 872 strings)

🌍Translated using Weblate (Chinese (Simplified))

Currently translated at 95.9% (837 of 872 strings)

🌍Translated using Weblate (Norwegian Bokmål)

Currently translated at 95.9% (837 of 872 strings)

🌍Translated using Weblate (Turkish)

Currently translated at 95.9% (837 of 872 strings)

🌍Translated using Weblate (Finnish)

Currently translated at 95.9% (837 of 872 strings)

🌍Translated using Weblate (Basque)

Currently translated at 96.4% (841 of 872 strings)

🌍Translated using Weblate (Vietnamese)

Currently translated at 99.0% (864 of 872 strings)

🌍Translated using Weblate (Russian)

Currently translated at 99.8% (871 of 872 strings)

🌍Translated using Weblate (Japanese)

Currently translated at 95.9% (837 of 872 strings)

🌍Translated using Weblate (Spanish)

Currently translated at 97.3% (849 of 872 strings)

Co-authored-by: Anonymous <noreply@weblate.org>
Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: J. Lavoie <j.lavoie@net-c.ca>
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/de/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/eo/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/es/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/eu/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/fi/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/fr/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/it/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/ja/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/nb_NO/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/ru/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/si/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/tr/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/vi/
Translate-URL: https://hosted.weblate.org/projects/linagora/twake-chat-web/zh_Hans/
Translation: Linagora/Twake Chat Web

* Fix missing pinned messages

* Update version

Co-authored-by: Hosted Weblate <hosted@weblate.org>
Co-authored-by: Anonymous <noreply@weblate.org>
Co-authored-by: J. Lavoie <j.lavoie@net-c.ca>
@stephanevieira75
🛠 #2022 Fix popup content height (#2027)
99252b2
@RomaricMourgues
🛠 Fix width for not large pictures (#2026)
868c632 
* Start cleanup

* Fix width for not large pictures

* Improve preview generation, jwt cleaning, apps command

* Make channels menus async loaded to have faster channels

* Fixing state management bugs

* FIx openDiscussion

* Fix direct channels list not everywhere

* Remove channels.js deprecated service

* Put back auto select channel

* Fix preview file before send + load bar

* Add ascii folding

* Update pinned view API and add flat option

* Update dockers

* Fix the dockers

* Fix package.json and backend build

* Fix docker

* Add logs

* Fix mongo search test

* FIx typo in elasticsearch

* Add logs for ES

* Try to show the log

* Fix #2031

* Fix #2031

* Fix direct chat not reordered automatically

* Fix "Bar" channel is empty and won't load

* Show the logs in es tests

* Fix to locale lower case

* Remove useless logs

* Make sure users are deleted from where they should be deleted

* Update comment + rm console.log
@stephanevieira75
🛠 #2026 Fix error 'Concat is not a function' in UserAPIClient (#2044)
f49d2e8
@RomaricMourgues
🛠 Fix 500 error on badge recovery (#2050)
3f54a1e 
* Fix 500 error on ensureBadgesAreReachable

* Fix error

* Fix indexing command error
@RomaricMourgues
🛠 Fix another 500 error for badges (#2053)
31af948
@stephanevieira75 @romanesko @RomaricMourgues
🌟 Refacto application management in frontend (#2028)
584ab81 
* app management

* #2001 Refacto application management in frontend part 1

* #2001 Refacto application management in frontend part 2

* #2001 Fix backend applications schema

* #2001 Add translations part 1

* Add options to run-all.js

* Fix create application schema

* Fix request auth on apps

* Fix response code for tests

* #2001 Add missing translations

Co-authored-by: romka <8026787@gmail.com>
Co-authored-by: Romaric Mourgues <rmourgues@linagora.com>
@RomaricMourgues
🛠 Put back minimal stuff for search (#2054)
253526d 
* Put back minimal stuff for search

* Fix mention search with accents

* Fix mention search with accents
@RomaricMourgues
🛠 Fix include users (#2063)
0f7cd72 
* Fix include_users for flat=1 api

* Debug

* Fix tests
@tissarni @RomaricMourgues
🌟 #2020 : Move main connectors to node + create new connectors contai…
2a1bed6 
…ner (#2021)

* Little fixs to create an applications and send message as an application

* Implement hooks from Twake to app

* Fix app company access

* Add checks when sending hooks

* Try to fix missing thread in notifyApp

* Add thread in notify apps

* Make sure object is null when thread isn't defined

* Make sure object is null when thread isn't defined

* Bootstraping plugins server

* Add install command

* Fix build

* Fix tests

* Fix for integations

Co-authored-by: Romaric Mourgues <rmourgues@linagora.com>

* update package-lock

* Frontend button fix

Co-authored-by: tissarni <tissarni>
Co-authored-by: Romaric Mourgues <rmourgues@linagora.com>
@RomaricMourgues
🛠 Include user in FlatFileFromMessage | FlatPinnedFromMessage (#2064)
002bfde 
* Include user in FlatFileFromMessage | FlatPinnedFromMessage

* Fix stuff on applications side

* Fix closing ephemeral in direct channel
@RomaricMourgues
🛠 Send as app and fix ephemeral (#2067)
2da3520
RomaricMourgues and others added 27 commits September 27, 2022 10:41
@RomaricMourgues
🛠 Fix other bugs (#2543)
3823c1f 
* Fix notifications preferences, add realtime update of channel counter

* Fix participants not loading

* Improving #2488
@RomaricMourgues
Fix migration tool
0c25172
@rezk2ll
Merge pull request #2534 from rezk2ll/#2521
2c33d9c 
🌟 added migration command to set every old messages as seen by everyone in public channels
@rezk2ll
🛠 fixed channels having ncorrect Read status (#2545)
348e04a
@RomaricMourgues
🛠 Update knowledge graph (#2548)
393db0a 
* Update knowledge graph

* Fix #2546

* Fix #2527
@RomaricMourgues
🌟 Add sound type notification (#2544)
10f63be 
* 🌟 Add sound type notification

* 🌟 Add sound in push desktop notification

* Try to find test error origin

* Fixing frontend tests

Co-authored-by: Romaric Mourgues <rmourgues@linagora.com>
@RomaricMourgues
⬆️ Go to version 1120
a8150d4
@RomaricMourgues
🛠 Fix potential not set cache (#2554)
4de02a9 
* Fix potential not set cache

* Fix minor frontend bug

* Fix old mention stuff
@RomaricMourgues
🛠 Minor badge fix
ec9a12b
@RomaricMourgues
🔎 Increase thumbnails size (#2556)
818dd4a
@RomaricMourgues
🛠Fix quote reply css (#2563)
a1c0b7a
@RomaricMourgues
🛠 Fix online service typo (#2575)
6643640 
* 🛠 Fix online service typo

* Remove code
@RomaricMourgues
Update README.md
efe62df
@RomaricMourgues
🛠 Fix focus on quoted messages
bd9b4ca
@RomaricMourgues
📚 Update changelog.md (#2587)
09142bc
@RomaricMourgues
🛠 Do not return files that doesn't exists anymore (#2592)
ffd60b4 
* Do not return files that doesn't exists anymore

* Fix filter
@RomaricMourgues
🛠 Fix scrollbar on Documents (#2599)
34395b1 
* 🛠 Fix scrollbar on documents

* Fix helpbar
@RomaricMourgues
🛠 Fix missing notifications (#2614)
9f4bedc
@tk-nguyen
Added symlinks for docker log collector (#2627)
78c4eb9
@tk-nguyen
🐳 Rebasing Dockerfiles changes to develop branch. (#2639)
d73da3c 
* Refactored Dockerfiles to reduce excessive RUNs

This will make docker builds use less layers for building images.
Build time will also be increased (due to caching for fewer layers)
Moved nginx images to multi-stage build and restructured the build steps

* Readded missing slash

* Modified the compose for local development

* Changed to latest LTS and force legacy peer deps
@RomaricMourgues
🩹 Fix unix() is not a function (#2663)
fd3de79
@RomaricMourgues
🔒 Security update (#2678) (#2681)
295f5ca 
* Fix https://huntr.dev/bounties/bfd935f4-2d1d-4d3f-8b59-522abe7dd065/

* Fix access control over posting messages to channels / threads

* Fix typo

* Fix some tests

* Fix one of the tests

* Fix test

* Fix another test

* Still fixing the search one

* Fix 2 tests cases

* Fixed some stuff

* Fixed some stuff

* Finished fixing tests
@RomaricMourgues
Update our license to AGPL v3
a13ee80 
🎉 Yesterday we decided to change our software licenses to AGPL v3.

We will adopt the AGPL v3 (without any modification) for Twake. It concerns 100% of the source code of the software.
This approach is part of our plan to clarify LINAGORA's positioning and also to facilitate stronger links with our ecosystem.
@dependabot
Bump cacheable-request and nodemon in /twake/backend/node
54c88d0 
Removes [cacheable-request](https://github.com/jaredwray/cacheable-request). It's no longer used after updating ancestor dependency [nodemon](https://github.com/remy/nodemon). These dependencies need to be updated together.


Removes `cacheable-request`

Updates `nodemon` from 2.0.4 to 2.0.20
- [Release notes](https://github.com/remy/nodemon/releases)
- [Commits](remy/nodemon@v2.0.4...v2.0.20)

---
updated-dependencies:
- dependency-name: cacheable-request
  dependency-type: indirect
- dependency-name: nodemon
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@guimard
Merge pull request #2736 from linagora/dependabot/npm_and_yarn/twake/…
1f144a0 
…backend/node/cacheable-request-and-nodemon--removed

Bump cacheable-request and nodemon in /twake/backend/node
@snyk-bot @guimard
fix: twake/backend/node/package.json & twake/backend/node/package-loc…
b24f3ea 
…k.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180020
@guimard
Add dev dependency to @types/jsonwebtoken
1596048
@guimard guimard force-pushed the snyk-fix-e43150a4cfe129946e079747eaaafe2f branch from 40fc2bd to 1596048 Compare February 12, 2023 04:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet