New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 9 vulnerabilities #33

Open

eddiephoen123 wants to merge 1 commit into develop from snyk-fix-812937c0ac39f95c5e0818f6aac678c8

Owner

eddiephoen123 commented Dec 19, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-COOKIEJAR-3149984	No	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	Yes	Proof of Concept
	554/1000 Why? Has a fix available, CVSS 6.8	Cryptographic Issues SNYK-JS-ELLIPTIC-1064899	No	No Known Exploit
	706/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.7	Cryptographic Issues SNYK-JS-ELLIPTIC-571484	No	Proof of Concept
	644/1000 Why? Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Poisoning SNYK-JS-QS-3153490	Yes	Proof of Concept
	761/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.8	Information Exposure SNYK-JS-SIMPLEGET-2361683	No	Proof of Concept
	596/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.5	Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @toruslabs/torus-embed

The new version differs by 250 commits.

8594e89 Updating iframe integrity and publish 1.36.0
37e7e47 Updating embed with new hash
205b6d1 Merge pull request Use getUrl from snapshot.js utils for _ipfsUrl snapshot-labs/snapshot#488 from torusresearch/develop
6dfeabe Merge pull request Ranked Choice Voting Results Broken snapshot-labs/snapshot#483 from torusresearch/update-readme
bd10992 Merge pull request Refactor Modal and Block components with <script setup> snapshot-labs/snapshot#486 from torusresearch/master
4cdbccd use api for lookup
b9d2047 Updating iframe integrity and publish 1.35.8
f8c7749 Updating embed with new hash
e34d708 Updating iframe integrity and publish 1.35.7
f664472 Updating embed with new hash
ead0ac4 add bnb & polygon networks
5cdaa93 Update README.md
3ce38f3 suggested fixes
27b5aff Updating iframe integrity and publish 1.35.6
126d2d7 Updating embed with new hash
e979909 update link
06bb146 Updating iframe integrity and publish 1.35.5
e67f65a Updating embed with new hash
3efebaf Updating iframe integrity and publish 1.35.4
31959a9 Updating embed with new hash
655497f Updating iframe integrity and publish 1.35.3
11c34e3 Updating embed with new hash
28c5bb1 Updating iframe integrity and publish 1.35.2
4616de9 Updating embed with new hash

See the full diff

Package name: @vue/cli-plugin-typescript

The new version differs by 250 commits.

c913cdc v5.0.0
e75a288 chore: pre release sync
e7f07d8 docs: remove `@ next` [skip ci]
80bbf38 test: skip nightwatch --parallel test for now
9be19f0 test: fix tsx import
5cf0e13 feat: bump default typescript version to 4.5
22a4a53 chore: dependency maintenance
9577cf5 chore: Merge branch 'master' into dev
8b5ab22 fix: remove --skip-plugin from arguments passed to the plugins (#6972)
ff035c6 chore(deps): bump follow-redirects from 1.14.7 to 1.14.8 (#6993)
d302581 fix: update mini-css-extract-plugin to ^2.5.3 (#6987)
2d8fa26 test(nightwatch): skip selenium test for now
7a17d98 chore: replace eslint-plugin-graphql with @ graphl-eslint/eslint-plugin
75a6d69 v5.0.0-rc.3
c214c3a chore: pre release sync
42fc8d4 docs: add cache-loader and nightwatch breaking changes [skip ci]
926855f feat!: make `cache-loader` optional (#6985)
342c386 fix: there's a command response format change in nightwatch v2
b78a003 chore: update web drivers
6c91e1a chore: update lockfile
37bdc0e chore: remove the console log completely and fix lint error
1c1f1ef chore: fix typo (#6964)
a2b6409 feat: add build stats hash support (#6980)
0cbdf5f fix: specify vue version in the web component demo html

See the full diff

Package name: @vue/cli-service

The new version differs by 250 commits.

92d80a8 v5.0.1
c913cdc v5.0.0
e75a288 chore: pre release sync
e7f07d8 docs: remove `@ next` [skip ci]
80bbf38 test: skip nightwatch --parallel test for now
9be19f0 test: fix tsx import
5cf0e13 feat: bump default typescript version to 4.5
22a4a53 chore: dependency maintenance
9577cf5 chore: Merge branch 'master' into dev
8b5ab22 fix: remove --skip-plugin from arguments passed to the plugins (#6972)
ff035c6 chore(deps): bump follow-redirects from 1.14.7 to 1.14.8 (#6993)
d302581 fix: update mini-css-extract-plugin to ^2.5.3 (#6987)
2d8fa26 test(nightwatch): skip selenium test for now
7a17d98 chore: replace eslint-plugin-graphql with @ graphl-eslint/eslint-plugin
75a6d69 v5.0.0-rc.3
c214c3a chore: pre release sync
42fc8d4 docs: add cache-loader and nightwatch breaking changes [skip ci]
926855f feat!: make `cache-loader` optional (#6985)
342c386 fix: there's a command response format change in nightwatch v2
b78a003 chore: update web drivers
6c91e1a chore: update lockfile
37bdc0e chore: remove the console log completely and fix lint error
1c1f1ef chore: fix typo (#6964)
a2b6409 feat: add build stats hash support (#6980)

See the full diff

Package name: stylus

The new version differs by 22 commits.

9cb7635 chore: add new npm ugnore config (Fix create date start and end snapshot-labs/snapshot#2631)
dde9868 0.55.0 (Bump snapshot-spaces from 084e02f to 31cc7c9 snapshot-labs/snapshot#2630)
fe5bde1 Replace dependency css-parse with css (New Crowdin updates snapshot-labs/snapshot#2554)
7334567 Add deg and fr as exceptions for 0 value unit omission (Remove strategies from proposal message snapshot-labs/snapshot#2578)
57480a4 chore: update history.md and readme.md (Handle boolean and array types in InputObject snapshot-labs/snapshot#2628)
f5a02e8 chore: add macos platform test (Bump @vue/test-utils from 2.0.0 to 2.0.1 snapshot-labs/snapshot#2624)
1f7f419 fix yaml front matter (Bump happy-dom from 5.2.0 to 5.3.0 snapshot-labs/snapshot#2617)
6a96c0f [skip ci]chore: update reademe.md content (New Crowdin updates snapshot-labs/snapshot#2602)
99b05a9 chore: add issue and pull request template (Fix stamp snapshot-labs/snapshot#2606)
ae9d267 chore: add github actions ci and improve test (Use brovider snapshot-labs/snapshot#2601)
11a0735 Bump lodash from 4.17.19 to 4.17.21 (⬆️ deps: Bump @snapshot-labs/snapshot.js from 0.3.92 to 0.3.95 snapshot-labs/snapshot#2589)
7a8e777 Bump glob-parent from 5.1.1 to 5.1.2 (New Crowdin updates snapshot-labs/snapshot#2592)
23d3295 Merge pull request ⬆️ subs: Bump snapshot-spaces from 862f765 to 2099bfb snapshot-labs/snapshot#2571 from dthadi3/ppc64le
f546669 Travis-ci: Updated nodejs versions 10, 12, 14
5b90e45 Travis-ci: added support for ppc64le
59bc665 Merge pull request Update Snapshot packages snapshot-labs/snapshot#2549 from mockee/dev
96c02de Bug fixes of encoding png image in `url` lib function.
8f42760 Merge pull request Various bugs snapshot-labs/snapshot#2186 from royels/1567
775537b Create SECURITY.md
21d0cc8 Changed the exponent function for rounding
83c410b Merge branch 'dev' of https://github.com/royels/stylus into 1567
81d8659 Primary commit, preliminary tests pass

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Cryptographic Issues
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn


          fix: package.json & package-lock.json to reduce vulnerabilities

188387b

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-COOKIEJAR-3149984
- https://snyk.io/vuln/SNYK-JS-DECODEURICOMPONENT-3149970
- https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899
- https://snyk.io/vuln/SNYK-JS-ELLIPTIC-571484
- https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-SIMPLEGET-2361683
- https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet