New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 7 vulnerabilities #17

Open

snyk-bot wants to merge 1 commit into master from snyk-fix-ffc3ea5d314192f71b7ff87200aeec26

snyk-bot commented Apr 16, 2023

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- examples/using-styled-components/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIHTML-1296849	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-ENGINEIO-3136336	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gatsby

The new version differs by 250 commits.

0c6cd61 chore(release): Publish
5e8e621 chore: Update main README (chore: Update main README gatsbyjs/gatsby#36954)
7130cd4 test(gatsby): Slices API integration tests (test(gatsby): Slices API integration tests gatsbyjs/gatsby#36747)
6496eed chore(release): Publish next
bc7ac84 chore: preserve previous webpack stats derived values, even if we restart webpack itself (chore: preserve previous webpack stats derived values, even if we restart webpack itself gatsbyjs/gatsby#36980)
2b5af32 fix: drop `__renderedByLocation` prop when calculating slice props hashes and don't expose it to slice component (fix: drop __renderedByLocation prop when calculating slice props hashes and don't expose it to slice component gatsbyjs/gatsby#36979)
cc1ee9b chore(release): Publish next
6a53861 chore(gatsby-link): Correct type export (chore(gatsby-link): Correct type export gatsbyjs/gatsby#36968)
0ad6314 fix(gatsby-graphiql-explorer): Use upstream exporter package (fix(gatsby-graphiql-explorer): Use upstream exporter package gatsbyjs/gatsby#36966)
964265c chore(release): Publish next
b624442 chore: Update peerDeps (chore: Update peerDeps gatsbyjs/gatsby#36965)
b2ab092 chore(release): Publish next
e2a14bf feat(gatsby): Slices <> partial hydration interop (feat(gatsby): Slices <> partial hydration interop gatsbyjs/gatsby#36960)
0083e62 fix(deps): update starters and examples gatsby packages to ^4.24.7 (fix(deps): update starters and examples gatsby packages to ^4.24.7 gatsbyjs/gatsby#36957)
68e9cab chore(changelogs): update changelogs (chore(changelogs): update changelogs gatsbyjs/gatsby#36958)
b9eb8d2 chore(deps): update dependency autoprefixer to ^10.4.13 for gatsby-plugin-sass (chore(deps): update dependency autoprefixer to ^10.4.13 for gatsby-plugin-sass gatsbyjs/gatsby#36934)
58c37ea chore(deps): update dependency @ jridgewell/trace-mapping to ^0.3.17 for gatsby-legacy-polyfills (chore(deps): update dependency @jridgewell/trace-mapping to ^0.3.17 for gatsby-legacy-polyfills gatsbyjs/gatsby#36933)
a5e4c47 fix(deps): update dependency body-parser to ^1.20.1 for gatsby-source-drupal (fix(deps): update dependency body-parser to ^1.20.1 for gatsby-source-drupal gatsbyjs/gatsby#36940)
c86aa7e chore(docs): Add clarification for Pro Tip on Part 4 of tutorial (chore(docs): Add clarification for Pro Tip on Part 4 of tutorial gatsbyjs/gatsby#36918)
d5c775a feat(gatsby): handle graphql-import-node bundling (feat(gatsby): handle graphql-import-node bundling gatsbyjs/gatsby#36951)
59e2976 feat(gatsby-remark-embed-snippet): added csproj to language map so it will be recognized as xml (feat(gatsby-remark-embed-snippet): added csproj to language map so it will be recognized as xml gatsbyjs/gatsby#36919)
c8a7dda chore(docs): Valhalla Content Hub Reference Guide (chore(docs): Valhalla Content Hub Reference Guide gatsbyjs/gatsby#36949)
3044280 fix(gatsby): stitch slices if just page html was regenerating without any of used slices regenerating (fix(gatsby): stitch slices if just page html was regenerating without any of used slices regenerating gatsbyjs/gatsby#36950)
10abdcb chore(release): Publish next

See the full diff

Package name: gatsby-plugin-google-analytics

The new version differs by 250 commits.

2cfb64b chore(release): Publish
c132f2d feat(gatsby-plugin-google-gtag): Add `delayOnRouteUpdate` option (feat(gatsby-plugin-google-gtag): Add delayOnRouteUpdate option gatsbyjs/gatsby#37017)
3032a1b fix(gatsby): Use xstate `predictableActionArguments` & update to 4.34 (fix(gatsby): Use xstate predictableActionArguments & update to 4.34 gatsbyjs/gatsby#36342)
aca64b7 chore: Add constraints to renovate (chore: Add constraints to renovate gatsbyjs/gatsby#37047)
f94db78 fix(gatsby-transformer-csv): Fix high memory consumption (fix(gatsby-transformer-csv): Fix high memory consumption gatsbyjs/gatsby#36610)
f158930 test: e2e tests for Slices API (test: e2e tests for Slices API gatsbyjs/gatsby#36746)
9d67c13 chore(docs): Google Analytics: use gtag.js plugin (chore(docs): Google Analytics: use gtag.js plugin gatsbyjs/gatsby#36984)
8569655 chore(gatsby-plugin-google-analytics): Update `minimatch` (chore(gatsby-plugin-google-analytics): Update minimatch gatsbyjs/gatsby#37029)
086c862 fix(gatsby-core-utils): decode uri-encode filename for remote file (fix(gatsby-core-utils): decode uri-encode filename for remote file gatsbyjs/gatsby#35637)
ccf56d5 chore: Add npm "engines" (chore: Add npm "engines" gatsbyjs/gatsby#37046)
5772595 fix(gatsby-source-wordpress) pass store for auth (fix(gatsby-source-wordpress) pass store for auth gatsbyjs/gatsby#37006)
c411d69 chore(docs): Add `--` to quick start flags (chore(docs): Add -- to quick start flags gatsbyjs/gatsby#37041)
2a06fff chore(docs): Deployment Updates & Cleanup (chore(docs): Deployment Updates & Cleanup gatsbyjs/gatsby#37038)
0fb0390 chore: Repository Cleanup (chore: Repository Cleanup gatsbyjs/gatsby#37035)
88b9dc5 chore(gatsby-source-wordpress): remove runApisInSteps and call runApiSteps for each gatsby-node api (chore(gatsby-source-wordpress): remove runApisInSteps and call runApiSteps for each gatsby-node api gatsbyjs/gatsby#37039)
b69709c build: include e2e tests in renovate config (build: include e2e tests in renovate config gatsbyjs/gatsby#37005)
8fc95f5 chore(docs): Clarify language in v4 to v5 migration guide (chore(docs): Clarify language in v4 to v5 migration guide gatsbyjs/gatsby#37007)
1cfd9b8 chore(e2e-tests): Wait for route change on back/forward (chore(e2e-tests): Wait for route change on back/forward gatsbyjs/gatsby#37033)
4842417 chore(docs): Add IE 11 note to v2 to v3 migration guide (chore(docs): Add IE 11 note to v2 to v3 migration guide gatsbyjs/gatsby#37022)
19dd1c4 fix(graphiql-explorer): Adjust env var truthiness logic (fix(graphiql-explorer): Adjust env var truthiness logic gatsbyjs/gatsby#37032)
57b37ae chore(changelogs): update changelogs (chore(changelogs): update changelogs gatsbyjs/gatsby#37030)
58197a0 fix(docs): update forEach to use map (fix(docs): update forEach to use map gatsbyjs/gatsby#37008)
3a4d333 chore: migrate from express-graphql to graphql-http (chore: migrate from express-graphql to graphql-http gatsbyjs/gatsby#37001)
5766694 chore(docs): Add overview video to release notes (+ other misc) (chore(docs): Add overview video to release notes (+ other misc) gatsbyjs/gatsby#37003)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect


          fix: examples/using-styled-components/package.json to reduce vulnerab…

b49d716

…ilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIHTML-1296849
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-ENGINEIO-3136336
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-GOT-2932019
- https://snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet