New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 6 vulnerabilities #16

Open

Matthelonianxl wants to merge 1 commit into master from snyk-fix-b407949f5a8937b0b140742dd308c196

Owner

Matthelonianxl commented Nov 26, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	554/1000 Why? Has a fix available, CVSS 6.8	Cryptographic Issues SNYK-JS-ELLIPTIC-1064899	Yes	No Known Exploit
	509/1000 Why? Has a fix available, CVSS 5.9	Timing Attack SNYK-JS-ELLIPTIC-511941	Yes	No Known Exploit
	706/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.7	Cryptographic Issues SNYK-JS-ELLIPTIC-571484	Yes	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	Yes	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: eth-json-rpc-filters

The new version differs by 60 commits.

fb41e0f 5.1.0 (Upgrade to solc 0.4.2 MetaMask/web3-provider-engine#86)
0f6cf7f chore: update eth-json-rpc-middleware to ^9 (estimateGas OOG - needs higher default gasLimit? MetaMask/web3-provider-engine#76)
2c5667d Bump express from 4.17.1 to 4.18.2 (Respect eth_newFilter requests that have a fromBlock set. MetaMask/web3-provider-engine#79)
982cd39 Bump decode-uri-component from 0.2.0 to 0.2.2 (Fix double 0x prefix on filter ids. MetaMask/web3-provider-engine#77)
987a0ca Update index.js (Parity compliance MetaMask/web3-provider-engine#84) (License of provider-engine MetaMask/web3-provider-engine#85)
74e1f23 Bump @ metamask/auto-changelog from 2.6.0 to 3.1.0 (Cache subprovider should return a clone of the response MetaMask/web3-provider-engine#73)
dd96273 Fix for null reference exception when normalizing the block (ES6 Module Consumption MetaMask/web3-provider-engine#83)
5cbea30 Bump qs from 6.5.2 to 6.5.3 (Make sure all values are hex no matter what is sent. MetaMask/web3-provider-engine#78)
b1c6e40 Bump minimatch from 3.0.4 to 3.1.2 (Still getting out of gas with some testrpc examples MetaMask/web3-provider-engine#75)
78a99cc chore: update nodejs version (Add repository to package.json MetaMask/web3-provider-engine#74)
21ab9bb Bump @ metamask/auto-changelog from 2.5.0 to 2.6.0 (subp - hooked wallet - autofail if tx.from doesnt match MetaMask/web3-provider-engine#66)
0449732 5.0.0 (Adding tests for etherscan MetaMask/web3-provider-engine#65)
881eb93 Use GitHub Actions instead of CircleCI for automation (Add 0x prefix to the LogFilter.address MetaMask/web3-provider-engine#64)
c8179db Bump minimist from 1.2.5 to 1.2.6 (Add two methods to etherscan subprovider MetaMask/web3-provider-engine#59)
28a35cb Bump cross-fetch from 2.2.3 to 2.2.6 (add network option for EtherScan subprovider MetaMask/web3-provider-engine#62)
abc85c7 Bump simple-get from 2.8.1 to 2.8.2 (Browserify cmds and dist MetaMask/web3-provider-engine#63)
42e0209 Adding handling for null block in getBlocksForRange (Enable homestead featureset in the vm subprovider. MetaMask/web3-provider-engine#61)
078f840 Bump tar from 4.4.15 to 4.4.19 (Add three methods to etherscan subprovider MetaMask/web3-provider-engine#56)
3f21a4b Bump path-parse from 1.0.6 to 1.0.7 (Overreporting from filters MetaMask/web3-provider-engine#55)
915dce8 Bump tar from 4.4.13 to 4.4.15 (Support POST method for Etherscan.io MetaMask/web3-provider-engine#54)
0ace305 Bump normalize-url from 4.5.0 to 4.5.1 (Use super call for cleaner code in hooked-wallet-ethtx MetaMask/web3-provider-engine#53)
d2276f1 Repo standardization (Support selecting which methods to override when adding a provider to the chain MetaMask/web3-provider-engine#50)
2ffc584 v4.2.2 (Solidity compiler subprovider MetaMask/web3-provider-engine#47)
1614d12 Remove `engines` field (Cache: do not fail when block.number = 0 MetaMask/web3-provider-engine#48)

See the full diff

Package name: eth-json-rpc-infura

The new version differs by 23 commits.

2d38ad6 5.1.0 (Make nonce/gas/gasPrice lookups optional in hooked-wallet MetaMask/web3-provider-engine#41)
69b3d37 [email protected], [email protected] (Implement hooked-wallet-ethtx to support signing with ethereumjs-tx MetaMask/web3-provider-engine#40)
1d44f59 Bump node-fetch from 2.6.0 to 2.6.1 (Zen and the art of provider engine maintenance MetaMask/web3-provider-engine#39)
866c28e v5.0.0 (DB Provider MetaMask/web3-provider-engine#36)
978f76c Update package metadata (Use runCall() instead of runTx() in the VMSubprovider MetaMask/web3-provider-engine#38)
b305099 Remove Babel (VM Subprovider Squelching errors MetaMask/web3-provider-engine#37)
80560f3 Use Infura API v3 (wallet subp - track pending nonce MetaMask/web3-provider-engine#32)
34d0cd2 Add files pattern to package.json
303036f Fix CHANGELOG.md links
5ed7f89 v4.1.0 (refactor - provider-subprovider parity MetaMask/web3-provider-engine#31)
24a1d0e Use shared ESLint config (Double announce of block MetaMask/web3-provider-engine#30)
f2c3929 Use node-fetch in place of cross-fetch (cache - address blockchain reorgs MetaMask/web3-provider-engine#29)
bafc9ef Use [email protected] (Caching - handle in-flight caching MetaMask/web3-provider-engine#28)
b0407f8 Use [email protected] ([Snyk] Security upgrade eth-json-rpc-filters from 4.1.0 to 5.1.0 #15)
8d0588c Add CODEOWNERS file (strategy and api for sync method support MetaMask/web3-provider-engine#26)
f7d4c1a Add nvmrc and CircleCI config (filter race condition MetaMask/web3-provider-engine#27)
c6d0080 yarn import ([Snyk] Fix for 3 vulnerabilities #25)
68603e0 Add LICENSE file ([Snyk] Fix for 3 vulnerabilities #23)
77df395 Bump elliptic from 6.5.0 to 6.5.3 ([Snyk] Fix for 1 vulnerabilities #22)
5ceb8f9 Bump lodash from 4.17.15 to 4.17.19 ([Snyk] Fix for 1 vulnerabilities #20)
c1b1550 Bump minimist from 1.2.0 to 1.2.5 ([Snyk] Fix for 6 vulnerabilities #16)
d452be3 4.0.2
43c7349 deps - move tape to devDeps

See the full diff

Package name: eth-json-rpc-middleware

The new version differs by 106 commits.

c4d0bf8 9.0.1 (Filters - uninstall does not remove block handler MetaMask/web3-provider-engine#155)
7060750 Bump @ metamask/eth-sig-util to 5.0.0 (Filter Subprovider Adds Redundant Filters MetaMask/web3-provider-engine#150)
34c0d73 Align/refactor `retryOnEmpty` & `block-ref` tests (Inflight cache MetaMask/web3-provider-engine#154)
0c31e01 Update block-ref to not make duplicate request (Allow filter subprovider to return existing filters MetaMask/web3-provider-engine#151)
c969a6f Apply standardizations from module template (deps - drop unused web3 MetaMask/web3-provider-engine#145)
13d055e Fix bugs in `retryOnEmpty` middleware (subp - filters - fix block number hex encoding MetaMask/web3-provider-engine#147)
53c7361 Upgrade to @ metamask/eth-sig-util v4 and remove unused deps (support signTransaction hooked wallet MetaMask/web3-provider-engine#133)
41c54f9 9.0.0 (SyntaxError Found MetaMask/web3-provider-engine#141)
147090e Add logging (Feature: Add support for eth_protocolVersion MetaMask/web3-provider-engine#140)
9e305fe Bump Node to v14 (Bump block tracker to 1.0.8 to not use es7 features MetaMask/web3-provider-engine#137)
25a7c4b 8.1.0 (Add specific error message for gateway timeouts MetaMask/web3-provider-engine#129)
1f8f264 Expose SafeEventEmitterProvider type (Uncompiled ES6 MetaMask/web3-provider-engine#127)
75b4aef Move eth-block-tracker to dependencies (Missing parenthesis in readme sample MetaMask/web3-provider-engine#125)
27a9327 Fix prepublishOnly script (Feature Request: Dynamic Polling Interval MetaMask/web3-provider-engine#124)
fa67ae6 8.0.2 (Make RPC errors more JSON-RPC spec compliant MetaMask/web3-provider-engine#122)
86915dc Added getAccounts suppressUnauthorized param (Coerce addreses to lower case before storing in nonceCache object MetaMask/web3-provider-engine#116)
daa426d Bump async from 2.6.0 to 2.6.4 (Cache subprovider should ignore empty future block responses MetaMask/web3-provider-engine#121)
946ebc4 Changed tests to jest + ts (Fix personal recover MetaMask/web3-provider-engine#118)
4ed0deb Bump ajv from 6.10.2 to 6.12.6 (eth.call fails with ‘Invalid Signature’ MetaMask/web3-provider-engine#114)
aaeccc4 Bump simple-get from 2.8.1 to 2.8.2 (Error object not properly filled out when submitting eth_subscribe request. MetaMask/web3-provider-engine#120)
f4ad893 Bump minimist from 1.2.5 to 1.2.6 (Add react native support MetaMask/web3-provider-engine#117)
9c24f60 Update node-fetch minimum (Nonce does not increment MetaMask/web3-provider-engine#115)
eb649a8 8.0.1 (Support React Native MetaMask/web3-provider-engine#110)
ce69943 fix: add query parameters to normalized url (Update browserify to the latest version 🚀 MetaMask/web3-provider-engine#109)

See the full diff

Package name: eth-sig-util

The new version differs by 95 commits.

cc8c301 v2.5.4 release (Check for global fetch before requiring ponyfill MetaMask/web3-provider-engine#126)
942a086 Add CHANGELOG.md (Missing parenthesis in readme sample MetaMask/web3-provider-engine#125)
cdf7e00 Update minimum `tweetnacl` to latest version (Feature Request: Dynamic Polling Interval MetaMask/web3-provider-engine#124)
311ab5c Migrate from deprecated `sha3` method to `keccak` (Make RPC errors more JSON-RPC spec compliant MetaMask/web3-provider-engine#122)
6a21db3 Remove unused dependencies (Error object not properly filled out when submitting eth_subscribe request. MetaMask/web3-provider-engine#120)
99f7fed Update `ethereumjs-abi` (Cache subprovider should ignore empty future block responses MetaMask/web3-provider-engine#121)
32b60bc Remove `eccrypto-lite` module (Implement binary search gasEstimation MetaMask/web3-provider-engine#119)
740ff46 Add ESLint config (eth.call fails with ‘Invalid Signature’ MetaMask/web3-provider-engine#114)
b1fdd26 Update package manifest and metadata (Revert "Support React Native" MetaMask/web3-provider-engine#112)
aeba06d Migrate from npm to yarn (Feature: add eth_submitTransaction MetaMask/web3-provider-engine#113)
e38ed31 Remove Greenkeeper badge from README (Make sure all values are hex no matter what is sent. MetaMask/web3-provider-engine#78)
5fec9aa Update CircleCI image to use Node 10 & npm ci (vm suprovider - estimateGas MetaMask/web3-provider-engine#80)
2320ccb Add .nvmrc file (Fix double 0x prefix on filter ids. MetaMask/web3-provider-engine#77)
dc3f010 Remove Circle CI 1.0 config (estimateGas OOG - needs higher default gasLimit? MetaMask/web3-provider-engine#76)
10ee19c Merge pull request middleware api proposal MetaMask/web3-provider-engine#69 from MetaMask/Version-2.5.2
4e50485 Version 2.5.2
a284348 Remove buggy declaration file.
dccc4dc Version 2.5.1
ea2b1f8 Merge pull request support eth_sign MetaMask/web3-provider-engine#67 from chentschel/patch-1
bdb03e0 Make EIP712Domain non optional. Fix: Add two methods to etherscan subprovider MetaMask/web3-provider-engine#59
ac9e63b Merge pull request Enable homestead featureset in the vm subprovider. MetaMask/web3-provider-engine#61 from MetaMask/CreateGenericTypedSignMethods
9959c05 Linted
47c6748 Version 2.5.0
7210d58 Add generic entrypoint for typed signature handling

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cryptographic Issues
🦉 Denial of Service


          fix: package.json & package-lock.json to reduce vulnerabilities

fbcb9eb

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899
- https://snyk.io/vuln/SNYK-JS-ELLIPTIC-511941
- https://snyk.io/vuln/SNYK-JS-ELLIPTIC-571484
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

Matthelonianxl mentioned this pull request

[Snyk] Fix for 19 vulnerabilities #19

Open

Matthelonianxl mentioned this pull request

[Snyk] Fix for 1 vulnerabilities #20

Open

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet