[Snyk] Upgrade ioredis from 4.19.4 to 4.28.2

[snyk-bot]

Snyk has created this PR to upgrade ioredis from 4.19.4 to 4.28.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 29 versions ahead of your current version.
• The recommended version was released a month ago, on 2021-12-01.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Prototype Pollution SNYK-JS-IOREDIS-1567196	531/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.2	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: ioredis

• 4.28.2 - 2021-12-01
  

  4.28.2 (2021-12-01)

  Bug Fixes

  • add Redis campaign (#1475) (3f3d8e9)
  • fix a memory leak with autopipelining. (#1470) (f5d8b73)
  • unhandled Promise rejections in pipeline.exec [skip ci] (#1466) (e5615da)
• 4.28.1 - 2021-11-23
  

  4.28.1 (2021-11-23)

  Bug Fixes

  • handle possible unhandled promise rejection with autopipelining+cluster (#1467) (6ad285a), closes #1466
• 4.28.0 - 2021-10-13
  

  4.28.0 (2021-10-13)

  Features

  • tls: add TLS profiles for easier configuration (#1441) (4680211)
• 4.27.11 - 2021-10-11
  

  4.27.11 (2021-10-11)

  Bug Fixes

  • make export interface compatible with jest (#1445) (2728dbe)
• 4.27.10 - 2021-10-04
  

  4.27.10 (2021-10-04)

  Bug Fixes

  • cluster: lazyConnect with pipeline (#1408) (b798107)
• 4.27.9 - 2021-08-30
  

  4.27.9 (2021-08-30)

  Bug Fixes

  • Fix undefined property warning in executeAutoPipeline (#1425) (f898672)
  • improve proto checking for hgetall [skip ci] (#1418) (cba83cb)
• 4.27.8 - 2021-08-18
  

  4.27.8 (2021-08-18)

  Bug Fixes

  • handle malicious keys for hgetall (#1416) (7d73b9d), closes #1267
• 4.27.7 - 2021-08-01
  

  4.27.7 (2021-08-01)

  Bug Fixes

  • cluster: fix autopipeline with keyPrefix or arg array (#1391) (d7477aa), closes #1264 #1248 #1392
• 4.27.6 - 2021-06-13
  

  4.27.6 (2021-06-13)

  Bug Fixes

  • fixed autopipeline performances. (#1226) (42f1ee1)
• 4.27.5 - 2021-06-05
  

  4.27.5 (2021-06-05)

  Bug Fixes

  • SENTINEL: actively failover detection under an option (#1363) (f02e383)
• 4.27.4 - 2021-06-04
• 4.27.3 - 2021-05-22
• 4.27.2 - 2021-05-04
• 4.27.1 - 2021-04-24
• 4.27.0 - 2021-04-24
• 4.26.0 - 2021-04-08
• 4.25.0 - 2021-04-02
• 4.24.6 - 2021-03-31
• 4.24.5 - 2021-03-27
• 4.24.4 - 2021-03-24
• 4.24.3 - 2021-03-21
• 4.24.2 - 2021-03-14
• 4.24.1 - 2021-03-14
• 4.24.0 - 2021-03-14
• 4.23.1 - 2021-03-14
• 4.23.0 - 2021-02-25
• 4.22.0 - 2021-02-06
• 4.21.0 - 2021-02-06
• 4.20.0 - 2021-02-05
• 4.19.4 - 2020-12-13

from ioredis GitHub release notes

Commit messages

Package name: ioredis

• 61e98b4 chore(release): 4.28.2 [skip ci]
• a9059be chore: disable interface prefix check
• 3030eee docs(README): update Redis title
• 3f3d8e9 fix: add Redis campaign (Bitcion github/docs#1475)
• d1ead14 chore: scanStream TYPE test requires redis 6 (repo sync github/docs#1469)
• b817747 chore: add a few typescript types (repo sync github/docs#1471)
• f5d8b73 fix: fix a memory leak with autopipelining. (repo sync github/docs#1470)
• e5615da fix: unhandled Promise rejections in pipeline.exec [skip ci] (My slack channel  github/docs#1466)
• 2ee877e chore(release): 4.28.1 [skip ci]
• 6ad285a fix: handle possible unhandled promise rejection with autopipelining+cluster (PCI Compliance  github/docs#1467)
• 77ad094 docs: Document enableTLSForSentinelMode Option (https://github.com/github/docs/issues?q=is%3Aissue+is%3A github/docs#1448)
• cfb470d docs(README): add Upstash
• aaf2fe6 chore(release): 4.28.0 [skip ci]
• 4680211 feat(tls): add TLS profiles for easier configuration (Update fork-a-repo.md. github/docs#1441)
• 7a3f78c chore(release): 4.27.11 [skip ci]
• 2728dbe fix: make export interface compatible with jest (Bitcoin signed message github/docs#1445)
• 72f31b2 chore(release): 4.27.10 [skip ci]
• cb0493c chore: use Node.js 14 for releasing
• b798107 fix(cluster): lazyConnect with pipeline (Something somewhere should describe the top right corner icons and how they work (notifications, repository menu, user menu) github/docs#1408)
• ccd381a chore: update package-lock.json (Update and rename content/github/setting-up-and-managing-your-enterpr… github/docs#1440)
• f6d7777 chore(deps): bump semver-regex from 3.1.2 to 3.1.3 (Update getting-started-with-github-pages.md github/docs#1435)
• 225c6e4 docs(README): minor fix in readme (funding  github/docs#1426)
• a765848 chore(release): 4.27.9 [skip ci]
• f898672 fix: Fix undefined property warning in executeAutoPipeline (Improve double table of contents github/docs#1425)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs