New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade webpack-dev-server from 3.11.3 to 4.7.3 #22

Open

MarcelRaschke wants to merge 1 commit into master from snyk-fix-f4016b6f1008a55a8e5a95a2ae64d868

Member

MarcelRaschke commented Aug 19, 2022

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- examples/browser-sharing-node-across-tabs/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: webpack-dev-server

The new version differs by 250 commits.

5280ee7 docs: fix typo
d834582 chore(release): 4.7.3
7b8c85b chore(deps): update `selfsigned` (Updating Docs in accordance with error #4130 ipfs/js-ipfs#4170)
d598325 chore: fix lint
c1907f1 refactor: remove redundant `if` statements (chore: houseclean interface-ipfs-core/README ipfs/js-ipfs#4158)
e535f25 ci: debug (chore: update changelogs ipfs/js-ipfs#4144)
75999bb chore(release): 4.7.2
90a96f7 ci: fix (chore: release master ipfs/js-ipfs#4143)
f6bc644 fix: compatible with `onAfterSetupMiddleware`
317e4b9 docs: fix testing instructions (chore(deps): bump hapi-pino from 8.5.0 to 10.1.0 ipfs/js-ipfs#4133)
ff4550e test: remove redundant test cases related to 3rd party code (fix: onMessage assignment should be undefined not null ipfs/js-ipfs#4131)
0dd1ee6 test: add e2e tests for `setupExitSignals` option (ERR_PACKAGE_PATH_NOT_EXPORTED with ipfs-http-client and typescript. Suggested fixes do not work. ipfs/js-ipfs#4130)
afe4975 chore(release): 4.1.7
4e5d8ea fix: droped `url` package (chore: release master ipfs/js-ipfs#4132)
b0c98f0 chore(release): 4.7.0
3138213 chore(deps): update (ERR_PACKAGE_PATH_NOT_EXPORTED ipfs/js-ipfs#4127)
8f02c3f feat: added types
f4fb15f fix: update description of `onAfterSetupMiddleware` and `onBeforeSetupMiddleware` options (chore(deps): bump did-jwt from 5.12.4 to 6.1.2 ipfs/js-ipfs#4126)
37b73d5 test: add e2e test for `WEBPACK_SERVE` env variable (ERR_PACKAGE_PATH_NOT_EXPORTED for ipfs-core ipfs/js-ipfs#4125)
f5a9d05 chore(deps-dev): bump eslint from 8.4.1 to 8.5.0 (chore: release master ipfs/js-ipfs#4121)
c9b959f chore(deps): bump ws from 8.3.0 to 8.4.0 (docs: update block api documentation ipfs/js-ipfs#4124)
42208aa chore(deps-dev): bump lint-staged from 12.1.2 to 12.1.3 (57.0.1 Breaks a BUNCH of stuff ipfs/js-ipfs#4122)
f440f84 chore(deps): bump express from 4.17.1 to 4.17.2 (fix: export ipfs-http-client types ipfs/js-ipfs#4120)
c13aa56 feat: added the `setupMiddlewares` option (chore(deps-dev): bump @types/yargs from 16.0.4 to 17.0.10 ipfs/js-ipfs#4068)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Open Redirect
🦉 Prototype Pollution


          fix: examples/browser-sharing-node-across-tabs/package.json to reduce…

b28f0e3

… vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2330875
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2331908
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430337
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430339
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430341

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet