[Snyk] Upgrade: core-js, , axios, react-router-bootstrap, sass #1510

macpro-snyk-service-account · 2024-09-20T04:47:07Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

core-js
from 3.35.0 to 3.38.1 | 7 versions ahead of your current version | a month ago
on 2024-08-20
@react-spring/web
from 9.7.3 to 9.7.4 | 1 version ahead of your current version | 2 months ago
on 2024-07-21
axios
from 1.5.1 to 1.7.5 | 18 versions ahead of your current version | a month ago
on 2024-08-23
react-router-bootstrap
from 0.26.2 to 0.26.3 | 1 version ahead of your current version | 3 months ago
on 2024-06-27
sass
from 1.69.7 to 1.77.8 | 16 versions ahead of your current version | 2 months ago
on 2024-07-11

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Prototype Pollution SNYK-JS-AXIOS-6144788	159	No Known Exploit
Server-side Request Forgery (SSRF) SNYK-JS-AXIOS-7361793	159	Proof of Concept
Information Exposure SNYK-JS-FOLLOWREDIRECTS-6444610	159	Proof of Concept

Release notes

Package name: core-js

3.38.1 - 2024-08-20
- Changes v3.38.0...v3.38.1
- Fixed some cases of URLSearchParams percent decoding, #1357, #1361, thanks @ slowcheetah
- Some stylistic changes and minor optimizations
- Compat data improvements:
  - Iterator helpers proposal methods marked as shipped from FF131
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } marked as shipped from Bun 1.1.23
  - RegExp.escape marked as shipped from Bun 1.1.22
  - Promise.try marked as shipped from Bun 1.1.22
  - Uint8Array to / from base64 and hex proposal methods marked as shipped from Bun 1.1.22
  - Added Hermes 0.13 compat data, similar to React Native 0.75 Hermes
  - Added Opera Android 84 compat data mapping
3.38.0 - 2024-08-04
- Changes v3.37.1...v3.38.0
- RegExp.escape proposal:
  - Built-ins:
    - RegExp.escape
  - Moved to stage 3, June 2024 and July 2024 TC39 meetings
  - Updated the way of escaping, regex-escaping/77
  - Throw an error on non-strings, regex-escaping/58
  - Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
- Promise.try proposal:
  - Built-ins:
    - Promise.try
  - Moved to stage 3, June 2024 TC39 meeting
  - Added /actual/ namespace entries, unconditional forced replacement changed to feature detection
- Uint8Array to / from base64 and hex stage 3 proposal:
  - Built-ins:
    - Uint8Array.fromBase64
    - Uint8Array.fromHex
    - Uint8Array.prototype.setFromBase64
    - Uint8Array.prototype.setFromHex
    - Uint8Array.prototype.toBase64
    - Uint8Array.prototype.toHex
  - Added Uint8Array.prototype.{ setFromBase64, setFromHex } methods
  - Added Uint8Array.fromBase64 and Uint8Array.prototype.setFromBase64 lastChunkHandling option, proposal-arraybuffer-base64/33
  - Added Uint8Array.prototype.toBase64 omitPadding option, proposal-arraybuffer-base64/60
  - Added throwing a TypeError on arrays backed by detached buffers
  - Unconditional forced replacement changed to feature detection
- Fixed RegExp named capture groups polyfill in combination with non-capturing groups, #1352, thanks @ Ulop
- Improved some cases of environment detection
- Uses process.getBuiltinModule for getting built-in NodeJS modules where it's available
- Uses https instead of http in URL constructor feature detection to avoid extra notifications from some overly vigilant security scanners, #1345
- Some minor optimizations
- Updated browserslist in core-js-compat dependencies that fixes an upstream issue with incorrect interpretation of some browserslist queries, #1344, browserslist/829, browserslist/836
- Compat data improvements:
  - Added Safari 18.0 compat data:
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } marked as shipped from FF129
  - Symbol.asyncDispose added and marked as supported from V8 ~ Chromium 127
  - Promise.try added and marked as supported from V8 ~ Chromium 128
  - Added Deno 1.44 and 1.45 compat data mapping
  - self descriptor is broken in Deno 1.45.3 (again)
  - Added Electron 32 and 33 compat data mapping
  - Added Opera Android 83 compat data mapping
  - Added Samsung Internet 27 compat data mapping
  - Added Oculus Quest Browser 34 compat data mapping
3.37.1 - 2024-05-14
- Changes v3.37.0...v3.37.1
- Fixed URL.parse feature detection for some specific cases
- Compat data improvements:
  - Set methods proposal added and marked as supported from FF 127
  - Symbol.dispose added and marked as supported from V8 ~ Chromium 125
  - Math.f16round and DataView.prototype.{ getFloat16, setFloat16 } added and marked as supported from Deno 1.43
  - URL.parse added and marked as supported from Chromium 126
  - URL.parse added and marked as supported from NodeJS 22.0
  - URL.parse added and marked as supported from Deno 1.43
  - Added Rhino 1.7.15 compat data, many features marked as supported
  - Added NodeJS 22.0 compat data mapping
  - Added Deno 1.43 compat data mapping
  - Added Electron 31 compat data mapping
  - Updated Opera Android 82 compat data mapping
  - Added Samsung Internet 26 compat data mapping
  - Added Oculus Quest Browser 33 compat data mapping
3.37.0 - 2024-04-16
- Changes v3.36.1...v3.37.0
- New Set methods proposal:
  - Built-ins:
    - Set.prototype.intersection
    - Set.prototype.union
    - Set.prototype.difference
    - Set.prototype.symmetricDifference
    - Set.prototype.isSubsetOf
    - Set.prototype.isSupersetOf
    - Set.prototype.isDisjointFrom
  - Moved to stable ES, April 2024 TC39 meeting
  - Added es. namespace modules, /es/ and /stable/ namespaces entries
- Explicit Resource Management stage 3 proposal
  - Some minor updates like explicit-resource-management/217
- Added Math.sumPrecise stage 2.7 proposal:
  - Built-ins:
    - Math.sumPrecise
- Promise.try proposal:
  - Built-ins:
    - Promise.try
  - Added optional arguments support, promise-try/16
  - Moved to stage 2.7, April 2024 TC39 meeting
- RegExp.escape stage 2 proposal:
  - Moved to hex-escape semantics, regex-escaping/67
    - It's not the final change of the way of escaping, waiting for regex-escaping/77 soon
- Pattern matching stage 1 proposal:
  - Built-ins:
    - Symbol.customMatcher
  - Once again, the used well-known symbol was renamed
  - Added new entries for that
- Added Extractors stage 1 proposal:
  - Built-ins:
    - Symbol.customMatcher
  - Since the Symbol.customMatcher well-known symbol from the pattern matching proposal is also used in the exactors proposal, added an entry also for this proposal
- Added URL.parse, url/825
- Engines bugs fixes:
  - Added a fix of Safari { Object, Map }.groupBy bug that does not support iterable primitives
  - Added a fix of Safari bug with double call of constructor in Array.fromAsync
- Compat data improvements:
  - URL.parse added and marked as supported from FF 126
  - URL.parse added and marked as supported from Bun 1.1.4
  - URL.canParse fixed and marked as supported from Bun 1.1.0
  - New Set methods fixed in JavaScriptCore and marked as supported from Bun 1.1.1
  - Added Opera Android 82 compat data mapping
3.36.1 - 2024-03-19
- Changes v3.36.0...v3.36.1
- Fixed some validation cases in Object.setPrototypeOf, #1329, thanks @ minseok-choe
- Fixed the order of validations in Array.from, #1331, thanks @ minseok-choe
- Added a fix of Bun queueMicrotask arity
- Added a fix of Bun URL.canParse arity
- Added a fix of Bun SuppressedError extra arguments support and arity
- Compat data improvements:
  - value argument of URLSearchParams.prototype.{ has, delete } marked as supported from Bun 1.0.31
  - Added React Native 0.74 Hermes compat data, Array.prototype.{ toSpliced, toReversed, with } and atob marked as supported
  - Added Deno 1.41.3 compat data mapping
  - Added Opera Android 81 compat data mapping
  - Added Samsung Internet 25 compat data mapping
  - Added Oculus Quest Browser 32 compat data mapping
  - Updated Electron 30 compat data mapping
3.36.0 - 2024-02-14
- ArrayBuffer.prototype.transfer and friends proposal:
  - Built-ins:
    - ArrayBuffer.prototype.detached
    - ArrayBuffer.prototype.transfer
    - ArrayBuffer.prototype.transferToFixedLength
  - Moved to stable ES, Febrary 2024 TC39 meeting
  - Added es. namespace modules, /es/ and /stable/ namespaces entries
- Uint8Array to / from base64 and hex proposal:
  - Methods:
    - Uint8Array.fromBase64
    - Uint8Array.fromHex
    - Uint8Array.prototype.toBase64
    - Uint8Array.prototype.toHex
  - Moved to stage 3, Febrary 2024 TC39 meeting
  - Added /actual/ namespace entries
  - Skipped adding new methods of writing to existing arrays to clarification some moments
- Promise.try proposal has been resurrected and moved to stage 2, Febrary 2024 TC39 meeting
- Added an entry point for the new TC39 proposals stage - core-js/stage/2.7 - still empty
- Fixed regression in Set.prototype.intersection feature detection
- Fixed a missed check in Array.prototype.{ indexOf, lastIndexOf, includes }, #1325, thanks @ minseok-choe
- Fixed a missed check in Array.prototype.{ reduce, reduceRight }, #1327, thanks @ minseok-choe
- Fixed Array.from and some other methods with proxy targets, #1322, thanks @ minseok-choe
- Fixed dependencies loading for modules from ArrayBuffer.prototype.transfer and friends proposal in some specific cases in IE10-
- Dropped context workaround from collection static methods entries since with current methods semantic it's no longer required
- Added instance methods polyfills to entries of collections static methods that produce collection instances
- Added missed Date.prototype.toJSON to JSON.stringify entries dependencies
- Added debugging info in some missed cases
- Compat data improvements:
  - { Map, Object }.groupBy, Promise.withResolvers, ArrayBuffer.prototype.transfer and friends marked as supported from Safari 17.4
  - New Set methods fixed and marked as supported from V8 ~ Chrome 123
  - Added Deno 1.40 compat data mapping
  - Symbol.metadata marked as supported from Deno 1.40.4
  - Updated Electron 30 compat data mapping
3.35.1 - 2024-01-20
- Fixed internal ToLength operation with bigints, #1318
- Removed significant redundant code from String#split polyfill
- Fixed setting names of methods with symbol keys in some old engines
- Minor fix of prototype methods export logic in the pure version
- Compat data improvements:
  - Iterator helpers proposal methods marked as supported from V8 ~ Chrome 122
  - Note that V8 ~ Chrome 122 add Set methods, but they have a bug similar to Safari
  - self marked as fixed from Bun 1.0.22
  - SuppressedError and Symbol.{ dispose, asyncDispose } marked as supported from Bun 1.0.23
  - Added Oculus Quest Browser 31 compat data mapping
  - Updated Electron 29 and added Electron 30 compat data mapping
3.35.0 - 2023-12-28
- { Map, Set, WeakMap, WeakSet }.{ from, of } became non-generic, following this and some other notes. Now they can be invoked without this, but no longer return subclass instances
- Fixed handling some cases of non-enumerable symbol keys from Symbol polyfill
- Removed unneeded NodeJS domains-related logic from queueMicrotask polyfill
- Fixed subclassing of wrapped ArrayBuffer
- Refactoring, many different minor optimizations
- Compat data improvements:
  - Array.fromAsync marked as supported from V8 ~ Chrome 121
  - It seems that the ancient Array.prototype.push bug is fixed in V8 ~ Chrome 122 (Hallelujah!)
  - ArrayBuffer.prototype.transfer and friends proposal features marked as supported from FF 122 and Bun 1.0.19
  - Object.groupBy and Map.groupBy marked as supported from Bun 1.0.19
  - Since Iterator helpers proposal methods are still not disabled in Deno, the web compatibility issue why it was disabled in Chromium makes no sense for Deno and fixed in the spec, they marked as supported from Deno 1.37
  - Added Opera Android 80 and updated Opera Android 79 compat data mapping
  - Added Samsung Internet 24 compat data mapping

from core-js GitHub release notes

Package name: @react-spring/web

9.7.4 - 2024-07-21
What's Changed
- chore(deps): update dependency @ types/jest to v29 by @ renovate in #2160
- chore(deps): update dependency @ types/node to v18 by @ renovate in #2161
- Update interpolation.mdx by @ enahsor in #2191
- docs: typo infact fix by @ dominik-stumpf in #2196
- chore(deps): update dependency @ vitejs/plugin-react to v4 by @ renovate in #2194
- chore(deps): update actions/checkout action to v4 by @ renovate in #2205
- Update animated-elements.mdx by @ jazsouf in #2209
- chore: update codebase to TS 5 by @ joshuaellis in #2210
- chore(deps): update actions/setup-node action to v4 by @ renovate in #2216
- chore(deps): update commitlint monorepo to v18 (major) - autoclosed by @ renovate in #2217
- chore(deps): update dependency konva to v9 by @ renovate in #2224
- chore(deps): update dependency resolve-esm to v2 by @ renovate in #2227
- docs: fix typo in testing guidelines by @ romain-trotard in #2201
- chore: update cypress by @ joshuaellis in #2211
- chore(deps): update dependency prettier to v3 by @ renovate in #2226
- chore(deps): update dependency @ testing-library/jest-dom to v6 by @ renovate in #2193
- chore: update tooling deps by @ joshuaellis in #2230
- Type Error in docs: /docs/concepts/imperative-api#comparison by @ muhammadtalha242 in #2240
- fix: update useTransition docs to show correct tooltips for the enter, update, and leave props. by @ dibenso in #2239
- chore: update docs to use remix v2 by @ joshuaellis in #2238
- minor docs improvements by @ btoo in #2279
- docs: fix link by @ revolunet in #2256
- Docs: Improve grammar on animated-elements.mdx by @ lordofthelake in #2249
- Typo error in fixtures.tsx by @ sivaprasadev in #2223
- chore(deps): update commitlint monorepo to v19 (major) by @ renovate in #2259
- docs: added link for intersection observer api by @ vCiKv in #2126
- chore(deps): update dependency @ testing-library/react to v15 by @ renovate in #2275
- chore(deps): update testing deps by @ joshuaellis in #2282
- chore(deps): update github artifact actions to v4 (major) by @ renovate in #2262
- chore: make deps absolute by @ joshuaellis in #2283
- chore(deps): update dependency tsx to v4 by @ renovate in #2260
- chore(deps): update dependency remark-mdx-frontmatter to v5 by @ renovate in #2298
- fix: add useReducedMotion compatibility for Safari 13 and older by @ BenHodgsonR2R in #2300
New Contributors
- @ enahsor made their first contribution in #2191
- @ dominik-stumpf made their first contribution in #2196
- @ jazsouf made their first contribution in #2209
- @ romain-trotard made their first contribution in #2201
- @ muhammadtalha242 made their first contribution in #2240
- @ dibenso made their first contribution in #2239
- @ btoo made their first contribution in #2279
- @ revolunet made their first contribution in #2256
- @ lordofthelake made their first contribution in #2249
- @ sivaprasadev made their first contribution in #2223
- @ vCiKv made their first contribution in #2126
- @ BenHodgsonR2R made their first contribution in #2300
Full Changelog: v9.7.3...v9.7.4
9.7.3 - 2023-06-26

from @react-spring/web GitHub release notes

Package name: axios

1.7.5 - 2024-08-23
Release notes:

Bug Fixes
- adapter: fix undefined reference to hasBrowserEnv (#6572) (7004707)
- core: add the missed implementation of AxiosError#status property; (#6573) (6700a8a)
- core: fix ReferenceError: navigator is not defined for custom environments; (#6567) (fed1a4b)
- fetch: fix credentials handling in Cloudflare workers (#6533) (550d885)
Contributors to this release
1.7.4 - 2024-08-13
Release notes:

Bug Fixes
- sec: CVE-2024-39338 (#6539) (#6543) (6b6b605)
- sec: disregard protocol-relative URL to remediate SSRF (#6539) (07a661a)
Contributors to this release
- Lev Pachmanov

Snyk has created this PR to upgrade: - core-js from 3.35.0 to 3.38.1. See this package in npm: https://www.npmjs.com/package/core-js - @react-spring/web from 9.7.3 to 9.7.4. See this package in npm: https://www.npmjs.com/package/@react-spring/web - axios from 1.5.1 to 1.7.5. See this package in npm: https://www.npmjs.com/package/axios - react-router-bootstrap from 0.26.2 to 0.26.3. See this package in npm: https://www.npmjs.com/package/react-router-bootstrap - sass from 1.69.7 to 1.77.8. See this package in npm: https://www.npmjs.com/package/sass See this project in Snyk: https://app.snyk.io/org/macpro-macpro/project/788fb002-e88d-4269-9791-4b794ddb9b72?utm_source=github&utm_medium=referral&page=upgrade-pr

github-actions · 2024-09-20T04:47:24Z

Endpoint URL - Environment not yet deployed, delete this comment and run the Pull Request workflow again after deploy is complete

macpro-snyk-service-account requested review from Dark-Knight-1313, kristin-at-theta and bflynn-cms as code owners September 20, 2024 04:47

macpro-snyk-service-account had a problem deploying to snyk September 20, 2024 04:55 — with GitHub Actions Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: core-js, , axios, react-router-bootstrap, sass #1510

[Snyk] Upgrade: core-js, , axios, react-router-bootstrap, sass #1510

macpro-snyk-service-account commented Sep 20, 2024

What's Changed

New Contributors

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

github-actions bot commented Sep 20, 2024

[Snyk] Upgrade: core-js, , axios, react-router-bootstrap, sass #1510

Are you sure you want to change the base?

[Snyk] Upgrade: core-js, , axios, react-router-bootstrap, sass #1510

Conversation

macpro-snyk-service-account commented Sep 20, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

What's Changed

New Contributors

Release notes:

Bug Fixes

Contributors to this release

Release notes:

Bug Fixes

Contributors to this release

github-actions bot commented Sep 20, 2024