Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 46 vulnerabilities #9

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 46 vulnerabilities #9

wants to merge 4 commits into from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

    • package.json
    • package-lock.json

  • Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
    Find out more.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 599/1000
Why? Has a fix available, CVSS 7.7		 Remote Memory Exposure
SNYK-JS-BL-608877		 No No Known Exploit
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-450202		 No Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
SNYK-JS-LODASH-567746		 No Proof of Concept
high severity 490/1000
Why? CVSS 9.8		 Prototype Pollution
SNYK-JS-LODASH-590103		 No No Known Exploit
high severity 472/1000
Why? Proof of Concept exploit, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-608086		 No Proof of Concept
high severity 365/1000
Why? CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-73638		 No No Known Exploit
medium severity 220/1000
Why? CVSS 4.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-174116		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-451540		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-1019388		 Yes No Known Exploit
medium severity 387/1000
Why? Proof of Concept exploit, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 No Proof of Concept
medium severity 550/1000
Why? Has a fix available, CVSS 6.5		 Out-of-bounds Read
SNYK-JS-NODESASS-535499		 Yes No Known Exploit
high severity 665/1000
Why? Has a fix available, CVSS 8.8		 NULL Pointer Dereference
SNYK-JS-NODESASS-535500		 Yes No Known Exploit
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Out-of-bounds Read
SNYK-JS-NODESASS-535501		 Yes No Known Exploit
high severity 600/1000
Why? Has a fix available, CVSS 7.5		 Uncontrolled Recursion
SNYK-JS-NODESASS-535503		 Yes No Known Exploit
medium severity 550/1000
Why? Has a fix available, CVSS 6.5		 Resource Exhaustion
SNYK-JS-NODESASS-535504		 Yes No Known Exploit
high severity 665/1000
Why? Has a fix available, CVSS 8.8		 NULL Pointer Dereference
SNYK-JS-NODESASS-535505		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Uncontrolled Recursion
SNYK-JS-NODESASS-540960		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Out-of-bounds Read
SNYK-JS-NODESASS-540962		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Improper Input Validation
SNYK-JS-NODESASS-540966		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Improper Input Validation
SNYK-JS-NODESASS-540968		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Uncontrolled Recursion
SNYK-JS-NODESASS-540970		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Out-of-bounds Read
SNYK-JS-NODESASS-540972		 Yes No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Denial of Service (DoS)
SNYK-JS-NODESASS-540982		 Yes No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Out-of-bounds Read
SNYK-JS-NODESASS-540984		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Out-of-bounds Read
SNYK-JS-NODESASS-540986		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-NODESASS-540988		 Yes No Known Exploit
medium severity 295/1000
Why? CVSS 5.9		 Denial of Service (DoS)
SNYK-JS-NODESASS-542662		 Yes No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8		 Arbitrary Code Injection
SNYK-JS-OPEN-174041		 Yes No Known Exploit
medium severity 387/1000
Why? Proof of Concept exploit, CVSS 5.6		 Prototype Pollution
SNYK-JS-YARGSPARSER-560381		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:clean-css:20180306		 No Proof of Concept
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:fresh:20170908		 No No Known Exploit
high severity 704/1000
Why? Has a fix available, CVSS 9.8		 Arbitrary Code Injection
npm:growl:20160721		 No No Known Exploit
medium severity 529/1000
Why? Has a fix available, CVSS 6.3		 Prototype Pollution
npm:hoek:20180212		 No No Known Exploit
low severity 292/1000
Why? Proof of Concept exploit, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:jasmine-core:20180216		 Yes Proof of Concept
medium severity 315/1000
Why? CVSS 6.3		 Prototype Pollution
npm:lodash:20180130		 No No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:mime:20170907		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:minimatch:20160620		 Yes No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 No No Known Exploit
high severity 741/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.4		 Arbitrary Command Injection
npm:open:20180512		 Yes Proof of Concept
high severity 375/1000
Why? CVSS 7.5		 Prototype Override Protection Bypass
npm:qs:20170213		 No No Known Exploit
medium severity 576/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.1		 Uninitialized Memory Exposure
npm:tunnel-agent:20170305		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: connect The new version differs by 59 commits.

See the full diff

Package name: dgeni-packages The new version differs by 12 commits.
  • 344cfb0 chore: release 0.28.0
  • 18a1c0b fix(*): remove `shelljs` dependency
  • 16ceb9c fix(nunjucks): upgrade `marked` to avoid vulnerability
  • 5de821c chore: release 0.27.5
  • 15ecab0 chore(post-process-html): ensure built files are published to npm
  • 647ada0 chore: release 0.27.4
  • aac5e8e refactor(post-process-html): rewrite in TypeScript
  • 9798f22 feat(post-process-html): add initial package
  • 8e8a6a8 chore: release 0.27.3
  • d6c288d chore: update dependencies
  • 14063a1 chore(*): release 0.27.2
  • a3ef5ff chore(*): update dependencies

See the full diff

Package name: gulp The new version differs by 134 commits.
  • 55eb23a Release: 4.0.0
  • 173a532 Docs: Fix the installation instructions
  • ec54d09 Docs: Improve note about out-of-date docs
  • 03b7c98 Docs: Update recipes to install gulp@next
  • 2eba29e Docs: Remove run-sequence from recipes
  • 76eb4d6 Docs: Add installation instructions & update badges
  • fbc162f Docs: Remove references to gulp-util
  • 3011cf9 Scaffold: Normalize repository
  • f27be05 Update: Remove graceful-fs from test suite
  • 361ab63 Upgrade: Update glob-watcher
  • 064d100 Build: Avoid broken node 9
  • 057df59 Release: 4.0.0-alpha.3
  • c1ba80c Breaking: Upgrade major versions of glob-watcher, gulp-cli & vinyl-fs
  • 89acc5c Docs: Improve ES2015 task exporting examples (#1999)
  • 0ac9e04 Docs: Add "Project structure" section to CONTRIBUTING.md (#1859)
  • 723cbc4 Docs: Fix syntax in recipe example (#1715)
  • d420a6a Docs: Have gulp.lastRun take a function to avoid task registration (#1828)
  • 29ece6f Upgrade: Update undertaker
  • e931cb0 Docs: Fix changelog typos (#1696)
  • 477db84 Docs: Add a "BrowserSync with Gulp 4" recipe (#1659)
  • d4ed3c7 Docs: Add options.cwd for gulp.src API (#1645)
  • 5dc3b07 Docs: Update gulp.watch API to align with glob-watcher
  • 0c66069 Breaking: Replace chokidar as gulp.watch with glob-watcher wrapper
  • c3dbc10 Docs: Clarify incremental builds example (#1609)

See the full diff

Package name: gulp-clean-css The new version differs by 23 commits.

See the full diff

Package name: gulp-connect The new version differs by 37 commits.

See the full diff

Package name: gulp-open The new version differs by 6 commits.

See the full diff

Package name: gulp-sass The new version differs by 2 commits.

See the full diff

Package name: jasmine-core The new version differs by 250 commits.
  • 557fb4e proper links in release notes
  • ee52023 Bump version to 3.1
  • 91296a4 Remove Safari 7 from Travis matrix
  • 1923461 Ignore more browser fields when formatting Errors
  • 71116d3 don't lock to 2.99 in dev
  • 63cc7ca Use Jasmine's arrayContains, instead of includes for better support
  • fdecf02 Merge branch 'print_exception_properties' of https://github.com/jbunton-atlassian/jasmine into jbunton-atlassian-print_exception_properties
  • 11f4d89 Merge branch 'node-load-errors'
  • 1149d4e Use j$.pp instead of JSON.stringify() for pretty printing
  • 9ee85c3 Remove duplicate ignored property
  • 0367ca5 Merge branch 'patch-closing-statement' of https://github.com/Sylhare/jasmine
  • 763a83c Display error properties for failed specs
  • 7fb53dc Fixing missing semi-colons
  • a9a112e Fixed release notes link
  • 0184808 Updated README for 3.0
  • 1ac2a6f Allow node to report load time errors
  • 785f62c Fix naming and check functions for empty/notEmpty specs
  • d8c154a Update empty and notEmpty specs for better IE11 support
  • c974c47 Merge branch 'master' of https://github.com/sjolicoeur/jasmine into sjolicoeur-master
  • 2b27bd3 Add API docs for async reporters
  • 3b77f38 Return <anonymous> for functions that have no actual words between keyword and (
  • 1182757 Moved toHaveClass matcher into core so that it can be used in Karma
  • 8326ecf Merge branch 'deprecation-object' of https://github.com/UziTech/jasmine into UziTech-deprecation-object
  • cd6a0de Merge pull request #1505 from codetriage-readme-bot/codetriage-badge

See the full diff

Package name: karma-coverage The new version differs by 12 commits.

See the full diff

Package name: mkdirp The new version differs by 4 commits.
  • b2e7ba0 0.5.2
  • c5b97d1 bump minimist to 1.2 to fix security issue
  • f2003bb test: add v4 and v5 to travis
  • b8629ff tools: update tap + mock-fs. Fix broken test

See the full diff

Package name: remap-istanbul The new version differs by 13 commits.

See the full diff

Package name: request The new version differs by 130 commits.
  • 0ab5c36 2.82.0
  • ffdf0d3 Updating deps.
  • 4386836 Merge branch 'master' of github.com:request/request
  • 1527407 Merge pull request #2703 from ryysud/add-nodejs-v8-to-travis
  • 3afcbf8 Merge branch 'master' of github.com:request/request
  • 479143d Update of hawk and qs to latest version (#2751)
  • 169be11 Add Node.js v8 to Travis CI
  • 643c43a Fixed some text in README.md (#2658)
  • e8fca51 chore(package): update aws-sign2 to version 0.7.0 (#2635)
  • e999203 Update README to simplify & update convenience methods (#2641)
  • 6f286c8 lint fix, PR from pre-standard was merged with passing tests
  • a765593 Add convenience method for HTTP OPTIONS (#2541)
  • 52d6945 Add promise support section to README (#2605)
  • b12a624 refactor(lint): replace eslint with standard (#2579)
  • 29a0b17 Merge pull request #2598 from request/greenkeeper-codecov-2.0.2
  • e7b4a88 Merge pull request #2590 from nicjansma/timings-tests
  • dd5c02c Updated comment
  • 087de94 Merge pull request #2589 from odykyi/fix-tabulation
  • 3d5e50d Merge pull request #2594 from ahmadnassri/patch-1
  • 0951f47 chore(package): update codecov to version 2.0.2
  • baf9c1f chore(dependencies): har-validator -> 5.0.2
  • 21b1112 chore(dependencies): har-validator -> 5.0.1
  • 51806f8 chore(dependencies): har-validator to 5.x [removes babel dep]
  • c57fb72 2.81.1

See the full diff

Package name: serve-static The new version differs by 52 commits.

See the full diff

Package name: yargs The new version differs by 250 commits.
  • 706fc7a chore(release): 13.1.0
  • 95700d6 test: add tests for alias behavior, based on conversations today (#1291)
  • f45a817 chore: slight refactor of approach being used, add support for per-command
  • 5be206a feat: add applyBeforeValidation, for applying sync middleware before validation
  • cc8af76 chore(release): 13.0.0
  • e9dc3aa feat: options/positionals with leading '+' and '0' no longer parse as numbers (#1286)
  • ef16792 chore: drop Node 6 from testing matrix (#1287)
  • f25de4f chore: update dependencies (#1284)
  • 6916ce9 feat: adds config option for sorting command output (#1256)
  • 7b200d2 chore: increase test timeout for windows
  • 64af518 fix: middleware added multiple times due to reference bug (#1282)
  • 61f1b25 doc: update docs to reflect new parserConfiguration method (#1280)
  • 3c6869a feat: Add `.parserConfiguration()` method, deprecating package.json config (#1262)
  • da75ea2 fix: better bash path completion (#1272)
  • e0c62c8 doc: edit help example to align with actual output (#1271)
  • bc0ee40 chore: address @aorinevo's code review so that we can land
  • f3a4e4f feat: support promises in middleware
  • 64a0d7e docs: Testing command modules (#1267)
  • 0510fe6 fix(validation): Use the error as a message when none exists otherwise (#1268)
  • 27bf739 fix(deps): Update os-locale to avoid security vulnerability (#1270)
  • 54e165d docs(advanced): document non-singleton use, .exit() and parsed (#1251)
  • 8789bf4 chore(release): 12.0.5
  • dc8d63f chore: explicit update to yargs-parser
  • eacc035 fix: allows camel-case, variadic arguments, and strict mode to be combined (#1247)

See the full diff

With a Snyk patch:
Severity Priority Score (*) Issue Exploit Maturity
medium severity 626/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.1		 Man-in-the-Middle (MitM)
SNYK-JS-HTTPSPROXYAGENT-469131		 Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
SNYK-JS-LODASH-567746		 Proof of Concept
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 No Known Exploit
medium severity 529/1000
Why? Has a fix available, CVSS 6.3		 Prototype Pollution
npm:hoek:20180212		 No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:mime:20170907		 No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:minimatch:20160620		 No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:negotiator:20160616		 No Known Exploit
medium severity 576/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.1		 Uninitialized Memory Exposure
npm:tunnel-agent:20170305		 Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
npm:uglify-js:20151024		 No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Jankyboy and others added 2 commits September 11, 2020 00:19
@Jankyboy
Create azure.yml
8204955
@snyk-bot
fix: package.json, package-lock.json & .snyk to reduce vulnerabilities
49e3442 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-BL-608877
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-590103
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/SNYK-JS-MARKED-174116
- https://snyk.io/vuln/SNYK-JS-MARKED-451540
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-1019388
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-NODESASS-535499
- https://snyk.io/vuln/SNYK-JS-NODESASS-535500
- https://snyk.io/vuln/SNYK-JS-NODESASS-535501
- https://snyk.io/vuln/SNYK-JS-NODESASS-535503
- https://snyk.io/vuln/SNYK-JS-NODESASS-535504
- https://snyk.io/vuln/SNYK-JS-NODESASS-535505
- https://snyk.io/vuln/SNYK-JS-NODESASS-540960
- https://snyk.io/vuln/SNYK-JS-NODESASS-540962
- https://snyk.io/vuln/SNYK-JS-NODESASS-540966
- https://snyk.io/vuln/SNYK-JS-NODESASS-540968
- https://snyk.io/vuln/SNYK-JS-NODESASS-540970
- https://snyk.io/vuln/SNYK-JS-NODESASS-540972
- https://snyk.io/vuln/SNYK-JS-NODESASS-540982
- https://snyk.io/vuln/SNYK-JS-NODESASS-540984
- https://snyk.io/vuln/SNYK-JS-NODESASS-540986
- https://snyk.io/vuln/SNYK-JS-NODESASS-540988
- https://snyk.io/vuln/SNYK-JS-NODESASS-542662
- https://snyk.io/vuln/SNYK-JS-OPEN-174041
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
- https://snyk.io/vuln/npm:clean-css:20180306
- https://snyk.io/vuln/npm:debug:20170905
- https://snyk.io/vuln/npm:fresh:20170908
- https://snyk.io/vuln/npm:growl:20160721
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:jasmine-core:20180216
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:mime:20170907
- https://snyk.io/vuln/npm:minimatch:20160620
- https://snyk.io/vuln/npm:ms:20170412
- https://snyk.io/vuln/npm:open:20180512
- https://snyk.io/vuln/npm:qs:20170213
- https://snyk.io/vuln/npm:tunnel-agent:20170305


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-HTTPSPROXYAGENT-469131
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/npm:debug:20170905
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:mime:20170907
- https://snyk.io/vuln/npm:minimatch:20160620
- https://snyk.io/vuln/npm:ms:20170412
- https://snyk.io/vuln/npm:negotiator:20160616
- https://snyk.io/vuln/npm:tunnel-agent:20170305
- https://snyk.io/vuln/npm:uglify-js:20151024
@rtd-helper
Copy link

rtd-helper bot commented Oct 21, 2020

The rtd-bot is activated, but no .github/config.yml found in this repository.
Make sure that you have it in your default branch.

@rtd-helper
Copy link

rtd-helper bot commented Oct 21, 2020

The rtd-bot is activated, but no .github/config.yml found in this repository.
Make sure that you have it in your default branch.

1 similar comment
@rtd-helper
Copy link

rtd-helper bot commented Oct 21, 2020

The rtd-bot is activated, but no .github/config.yml found in this repository.
Make sure that you have it in your default branch.

@rtd-helper
Copy link

rtd-helper bot commented Oct 21, 2020

The rtd-bot is activated, but no .github/config.yml found in this repository.
Make sure that you have it in your default branch.

@Jankyboy Jankyboy mentioned this pull request Mar 7, 2021
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
PR: unreviewed
Projects
None yet
Milestone
No milestone
2 participants
@snyk-bot @Jankyboy