New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 4 vulnerabilities #3557

Open

snyk-bot wants to merge 1 commit into master from snyk-fix-d2ac04c45e6927507d893d377011fc7e

snyk-bot commented Mar 3, 2023

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- examples/using-drupal/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gatsby

The new version differs by 250 commits.

0c6cd61 chore(release): Publish
5e8e621 chore: Update main README (chore: Update main README gatsbyjs/gatsby#36954)
7130cd4 test(gatsby): Slices API integration tests (test(gatsby): Slices API integration tests gatsbyjs/gatsby#36747)
6496eed chore(release): Publish next
bc7ac84 chore: preserve previous webpack stats derived values, even if we restart webpack itself (chore: preserve previous webpack stats derived values, even if we restart webpack itself gatsbyjs/gatsby#36980)
2b5af32 fix: drop `__renderedByLocation` prop when calculating slice props hashes and don't expose it to slice component (fix: drop __renderedByLocation prop when calculating slice props hashes and don't expose it to slice component gatsbyjs/gatsby#36979)
cc1ee9b chore(release): Publish next
6a53861 chore(gatsby-link): Correct type export (chore(gatsby-link): Correct type export gatsbyjs/gatsby#36968)
0ad6314 fix(gatsby-graphiql-explorer): Use upstream exporter package (fix(gatsby-graphiql-explorer): Use upstream exporter package gatsbyjs/gatsby#36966)
964265c chore(release): Publish next
b624442 chore: Update peerDeps (chore: Update peerDeps gatsbyjs/gatsby#36965)
b2ab092 chore(release): Publish next
e2a14bf feat(gatsby): Slices <> partial hydration interop (feat(gatsby): Slices <> partial hydration interop gatsbyjs/gatsby#36960)
0083e62 fix(deps): update starters and examples gatsby packages to ^4.24.7 (fix(deps): update starters and examples gatsby packages to ^4.24.7 gatsbyjs/gatsby#36957)
68e9cab chore(changelogs): update changelogs (chore(changelogs): update changelogs gatsbyjs/gatsby#36958)
b9eb8d2 chore(deps): update dependency autoprefixer to ^10.4.13 for gatsby-plugin-sass (chore(deps): update dependency autoprefixer to ^10.4.13 for gatsby-plugin-sass gatsbyjs/gatsby#36934)
58c37ea chore(deps): update dependency @ jridgewell/trace-mapping to ^0.3.17 for gatsby-legacy-polyfills (chore(deps): update dependency @jridgewell/trace-mapping to ^0.3.17 for gatsby-legacy-polyfills gatsbyjs/gatsby#36933)
a5e4c47 fix(deps): update dependency body-parser to ^1.20.1 for gatsby-source-drupal (fix(deps): update dependency body-parser to ^1.20.1 for gatsby-source-drupal gatsbyjs/gatsby#36940)
c86aa7e chore(docs): Add clarification for Pro Tip on Part 4 of tutorial (chore(docs): Add clarification for Pro Tip on Part 4 of tutorial gatsbyjs/gatsby#36918)
d5c775a feat(gatsby): handle graphql-import-node bundling (feat(gatsby): handle graphql-import-node bundling gatsbyjs/gatsby#36951)
59e2976 feat(gatsby-remark-embed-snippet): added csproj to language map so it will be recognized as xml (feat(gatsby-remark-embed-snippet): added csproj to language map so it will be recognized as xml gatsbyjs/gatsby#36919)
c8a7dda chore(docs): Valhalla Content Hub Reference Guide (chore(docs): Valhalla Content Hub Reference Guide gatsbyjs/gatsby#36949)
3044280 fix(gatsby): stitch slices if just page html was regenerating without any of used slices regenerating (fix(gatsby): stitch slices if just page html was regenerating without any of used slices regenerating gatsbyjs/gatsby#36950)
10abdcb chore(release): Publish next

See the full diff

Package name: gatsby-plugin-google-analytics

The new version differs by 250 commits.

2cfb64b chore(release): Publish
c132f2d feat(gatsby-plugin-google-gtag): Add `delayOnRouteUpdate` option (feat(gatsby-plugin-google-gtag): Add delayOnRouteUpdate option gatsbyjs/gatsby#37017)
3032a1b fix(gatsby): Use xstate `predictableActionArguments` & update to 4.34 (fix(gatsby): Use xstate predictableActionArguments & update to 4.34 gatsbyjs/gatsby#36342)
aca64b7 chore: Add constraints to renovate (chore: Add constraints to renovate gatsbyjs/gatsby#37047)
f94db78 fix(gatsby-transformer-csv): Fix high memory consumption (fix(gatsby-transformer-csv): Fix high memory consumption gatsbyjs/gatsby#36610)
f158930 test: e2e tests for Slices API (test: e2e tests for Slices API gatsbyjs/gatsby#36746)
9d67c13 chore(docs): Google Analytics: use gtag.js plugin (chore(docs): Google Analytics: use gtag.js plugin gatsbyjs/gatsby#36984)
8569655 chore(gatsby-plugin-google-analytics): Update `minimatch` (chore(gatsby-plugin-google-analytics): Update minimatch gatsbyjs/gatsby#37029)
086c862 fix(gatsby-core-utils): decode uri-encode filename for remote file (fix(gatsby-core-utils): decode uri-encode filename for remote file gatsbyjs/gatsby#35637)
ccf56d5 chore: Add npm "engines" (chore: Add npm "engines" gatsbyjs/gatsby#37046)
5772595 fix(gatsby-source-wordpress) pass store for auth (fix(gatsby-source-wordpress) pass store for auth gatsbyjs/gatsby#37006)
c411d69 chore(docs): Add `--` to quick start flags (chore(docs): Add -- to quick start flags gatsbyjs/gatsby#37041)
2a06fff chore(docs): Deployment Updates & Cleanup (chore(docs): Deployment Updates & Cleanup gatsbyjs/gatsby#37038)
0fb0390 chore: Repository Cleanup (chore: Repository Cleanup gatsbyjs/gatsby#37035)
88b9dc5 chore(gatsby-source-wordpress): remove runApisInSteps and call runApiSteps for each gatsby-node api (chore(gatsby-source-wordpress): remove runApisInSteps and call runApiSteps for each gatsby-node api gatsbyjs/gatsby#37039)
b69709c build: include e2e tests in renovate config (build: include e2e tests in renovate config gatsbyjs/gatsby#37005)
8fc95f5 chore(docs): Clarify language in v4 to v5 migration guide (chore(docs): Clarify language in v4 to v5 migration guide gatsbyjs/gatsby#37007)
1cfd9b8 chore(e2e-tests): Wait for route change on back/forward (chore(e2e-tests): Wait for route change on back/forward gatsbyjs/gatsby#37033)
4842417 chore(docs): Add IE 11 note to v2 to v3 migration guide (chore(docs): Add IE 11 note to v2 to v3 migration guide gatsbyjs/gatsby#37022)
19dd1c4 fix(graphiql-explorer): Adjust env var truthiness logic (fix(graphiql-explorer): Adjust env var truthiness logic gatsbyjs/gatsby#37032)
57b37ae chore(changelogs): update changelogs (chore(changelogs): update changelogs gatsbyjs/gatsby#37030)
58197a0 fix(docs): update forEach to use map (fix(docs): update forEach to use map gatsbyjs/gatsby#37008)
3a4d333 chore: migrate from express-graphql to graphql-http (chore: migrate from express-graphql to graphql-http gatsbyjs/gatsby#37001)
5766694 chore(docs): Add overview video to release notes (+ other misc) (chore(docs): Add overview video to release notes (+ other misc) gatsbyjs/gatsby#37003)

See the full diff

Package name: gatsby-plugin-sharp

The new version differs by 250 commits.

f3f1bbc chore(release): Publish
c410082 fix(gatsby-source-drupal): check relationships type exists on node before filtering (fix(gatsby-source-drupal): check relationships type exists on node before filtering gatsbyjs/gatsby#33181) (fix(gatsby-source-drupal): check relationships type exists on node before filtering (#33181) gatsbyjs/gatsby#33228)
f3f2834 fix(gatsby-source-wordpress): fix failing test docker setup (fix(gatsby-source-wordpress): fix failing test docker setup gatsbyjs/gatsby#33163)
fe2f09b feat(gatsby): let serve use getServerData headers (feat(gatsby): let serve use getServerData headers gatsbyjs/gatsby#33159)
fc66250 fix(gatsby): Assign parentSpan to activities that were missing them (fix(gatsby): Assign parentSpan to activities that were missing them gatsbyjs/gatsby#33122)
91187da feat(gatsby-source-drupal): Add tracing for full/delta fetches and http requests (feat(gatsby-source-drupal): Add tracing for full/delta fetches and http requests gatsbyjs/gatsby#33142)
d31645c chore(gatsby): add webpack file to export same version (chore(gatsby): add webpack file to export same version gatsbyjs/gatsby#33126)
44afaf5 fix(gatsby): fix hydration flicker on initial render of ssr page (fix(gatsby): fix hydration flicker on initial render of ssr page gatsbyjs/gatsby#33134)
f1141a0 docs: Fix broken link on Getting Started with MDX page (docs: Fix broken link on Getting Started with MDX page gatsbyjs/gatsby#33148)
f921277 chore(release): Publish next
b1168af chore(gatsby-plugin-gatsby-cloud): fix copy type file (chore(gatsby-plugin-gatsby-cloud): fix copy type file gatsbyjs/gatsby#33156)
14059da Remove <title> from inside <main> (Remove <title> from inside <main> gatsbyjs/gatsby#33150)
85645cd chore(release): Publish next
1720988 feat(gatsby-transformer-documentationjs): move createTypes to createSchemaCustomization (feat(gatsby-transformer-documentationjs): move createTypes to createSchemaCustomization gatsbyjs/gatsby#33149)
3d05986 feat(gatsby-plugin-styled-components): Add ability to disable vendor prefixes (feat(gatsby-plugin-styled-components): Add ability to disable vendor prefixes gatsbyjs/gatsby#33147)
323920d chore(gatsby): add environment variable for setting tracing config file (chore(gatsby): add environment variable for setting tracing config file gatsbyjs/gatsby#32513)
425b8f5 chore(release): Publish next
2f2880e fix(gatsby-source-drupal): handle edge case with deleting nodes (fix(gatsby-source-drupal): handle edge case with deleting nodes gatsbyjs/gatsby#33143)
eb552d1 chore(docs): Add note to Storybook guide about StaticImage (chore(docs): Add note to Storybook guide about StaticImage gatsbyjs/gatsby#33127)
4ff5026 docs: fix typo (Update index.mdx gatsbyjs/gatsby#33137)
81f35ff docs(gatsby-plugin-gatsby-cloud): fix typo: asterix -> asterisk (Fix typo: asterix -> asterisk gatsbyjs/gatsby#33135)
4837b72 feat(gatsby-plugin-page-creator): Fix gatsby plugin page creator v4 (feat(gatsby-plugin-page-creator): Fix gatsby plugin page creator v4 gatsbyjs/gatsby#33120)
3401149 feat(gatsby): Deprecate schema-related APIs in sourceNodes (fix(gatsby): Deprecate schema-related APIs in sourceNodes gatsbyjs/gatsby#32291)
62683f5 fix(gatsby-plugin-gatsby-cloud): Emit CREATE_FILE_NODE in onPostBootstrap (fix(gatsby-plugin-gatsby-cloud): Emit CREATE_FILE_NODE in onPostBootstrap gatsbyjs/gatsby#33136)

See the full diff

Package name: gatsby-source-drupal

The new version differs by 250 commits.

8d07242 chore(release): Publish
0790895 chore(gatsby): Update README (chore(gatsby): Update README gatsbyjs/gatsby#33615)
06760d7 chore(gatsby): Change comment format in actions/public (chore(gatsby): Change comment format in actions/public gatsbyjs/gatsby#33592)
7d66a23 feat(gatsby): capture number of ssg,dsg,ssr pages in telemetry (feat(gatsby): capture number of ssg,dsg,ssr pages in telemetry gatsbyjs/gatsby#33337)
98a843c fix(gatsby): use lmdb.removeSync so getNode can't return deleted nodes (fix(gatsby): use lmdb.removeSync so getNode can't return deleted nodes gatsbyjs/gatsby#33554)
4d8e40b fix(gatsby-source-wordpress): Add steps for `refetch_ALL` (fix(gatsby-source-wordpress): Add steps for refetch_ALL gatsbyjs/gatsby#33264)
4761dc3 fix(gatsby): restore onPreBuild to being called right after bootstrap finishes (fix(gatsby): restore onPreBuild to being called right after bootstrap finishes gatsbyjs/gatsby#33591)
1cdbab6 fix(deps): update starters and examples gatsby packages to ^3.14.3 (fix(deps): update starters and examples gatsby packages to ^3.14.3 gatsbyjs/gatsby#33553)
0f421db chore(release): Publish next
7d6a0aa fix(gatsby): fix page-tree in ink-cli (fix(gatsby): fix page-tree in ink-cli gatsbyjs/gatsby#33579)
3993819 chore(gatsby): Add `assetPrefix` to `IGatsbyConfig` (chore(gatsby): Add assetPrefix to IGatsbyConfig gatsbyjs/gatsby#33575)
6cc964a fix(gatsby-source-wordpress): restore PQR support (fix(gatsby-source-wordpress): restore PQR support gatsbyjs/gatsby#33590)
9eef270 specifying what actually changed (specifying what actually changed gatsbyjs/gatsby#33452)
2975c4d feat(gatsby,gatsby-link): add queue to prefetch (feat(gatsby,gatsby-link): add queue to prefetch gatsbyjs/gatsby#33530)
68fe836 fix(gatsby): temporary workaround for stale jobs cache (fix(gatsby): temporary workaround for stale jobs cache gatsbyjs/gatsby#33586)
a800d9d fix(gatsby): Update internal usage of .runQuery (fix(gatsby): Update internal usage of .runQuery gatsbyjs/gatsby#33571)
677760c chore(docs): Clarify SEO component guide (chore(docs): Clarify SEO component guide gatsbyjs/gatsby#33451)
ccca4b3 fix(gatsby): only remove unused code when apis got removed (fix(gatsby): only remove unused code when apis got removed gatsbyjs/gatsby#33527)
8dbf550 fix(gatsby): assign correct parentSpans to PQR activities (fix(gatsby): assign correct parentSpans to PQR activities gatsbyjs/gatsby#33568)
31d5a5e fix(gatsby-dev-cli): resolve correct versions of packages with unpkg (fix(gatsby-dev-cli): resolve correct versions of packages with unpkg gatsbyjs/gatsby#33551)
5110074 fix(gatsby-plugin-gatsby-cloud): emit file nodes after source updates (fix(gatsby-plugin-gatsby-cloud): emit file nodes after source updates gatsbyjs/gatsby#33548)
d2329df fix(gatsby): make sure 404 and 500 page inherit stateful status from original page (fix(gatsby): make sure 404 and 500 pages inherit stateful status from original page gatsbyjs/gatsby#33544)
68e5b90 chore(docs): Update query var in part-7 tutorial (chore(docs): Update query var in part-7 tutorial gatsbyjs/gatsby#33559)
a8cab55 chore(gatsby-plugin-react-helmet): Update Examples (chore(gatsby-plugin-react-helmet): Update Examples gatsbyjs/gatsby#33552)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect
🦉 Regular Expression Denial of Service (ReDoS)
🦉 More lessons are available in Snyk Learn


          fix: examples/using-drupal/package.json to reduce vulnerabilities

05a9267

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-GOT-2932019
- https://snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet