New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 8 vulnerabilities #18

Open

snyk-io wants to merge 1 commit into master from snyk-fix-614507a74c7050fb7909a6d616fb36ec

snyk-io bot commented Sep 5, 2024

Snyk has created this PR to fix 8 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

package.json
package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Code Injection SNYK-JS-LODASH-1040724	239
	Code Injection SNYK-JS-LODASHES-2434284	239
	Prototype Pollution SNYK-JS-LODASHES-2434283	189
	Regular Expression Denial of Service (ReDoS) SNYK-JS-UAPARSERJS-1023599	159
	Prototype Pollution SNYK-JS-LODASHES-2434285	150
	Regular Expression Denial of Service (ReDoS) SNYK-JS-UAPARSERJS-1072471	146
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	63
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASHES-2434289	63

Important

Check the changes in this PR to ensure they won't cause issues with your project.
Max score is 1000. Note that the real score may have changed since the PR was raised.
This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Code Injection
🦉 Prototype Pollution


          fix: package.json & package-lock.json to reduce vulnerabilities

36a0fee

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASHES-2434284
- https://snyk.io/vuln/SNYK-JS-LODASHES-2434283
- https://snyk.io/vuln/SNYK-JS-UAPARSERJS-1023599
- https://snyk.io/vuln/SNYK-JS-LODASHES-2434285
- https://snyk.io/vuln/SNYK-JS-UAPARSERJS-1072471
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASHES-2434289

socket-security bot commented Sep 5, 2024

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/[email protected]	None	`0`	4.27 kB	jdalton
npm/[email protected]	None	`0`	3.84 kB	jdalton

🚮 Removed packages: npm/[email protected]), npm/[email protected])

View full report↗︎

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet