Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 26 vulnerabilities #109

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 26 vulnerabilities #109

wants to merge 1 commit into from

Conversation

rfxn
Copy link
Owner

@rfxn rfxn commented Nov 25, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
critical severity 679/1000
Why? Has a fix available, CVSS 9.3		 Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962463		 Yes No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Cross-site Scripting (XSS)
SNYK-JS-BOOTSTRAP-173700		 No No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Cross-site Scripting (XSS)
SNYK-JS-BOOTSTRAP-73560		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-COLORSTRING-1082939		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
medium severity 484/1000
Why? Has a fix available, CVSS 5.4		 Open Redirect
SNYK-JS-GOT-2932019		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HTTPCACHESEMANTICS-3248783		 No Proof of Concept
medium severity 641/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.4		 Prototype Pollution
SNYK-JS-JSON5-3182856		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 No Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 No Proof of Concept
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Information Exposure
SNYK-JS-NODEFETCH-2342118		 No No Known Exploit
medium severity 520/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service
SNYK-JS-NODEFETCH-674311		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1255640		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JS-POSTCSS-5926692		 Yes No Known Exploit
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831		 Yes Proof of Concept
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Cross-site Scripting (XSS)
SNYK-JS-SERIALIZEJAVASCRIPT-536840		 No No Known Exploit
high severity 706/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.7		 Arbitrary Code Injection
SNYK-JS-SERIALIZEJAVASCRIPT-570062		 No Proof of Concept
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Cross-site Scripting (XSS)
SNYK-JS-SERIALIZEJAVASCRIPT-6056521		 No No Known Exploit
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873		 Yes Proof of Concept
medium severity 596/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.5		 Arbitrary Code Injection
SNYK-JS-UNDERSCORE-1080984		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-UNSETVALUE-2400660		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-WS-1296835		 No Proof of Concept
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Cross-site Scripting (XSS)
npm:bootstrap:20180529		 No No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:braces:20180219		 Yes Proof of Concept
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:mime:20170907		 No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @slack/client The new version differs by 147 commits.

See the full diff

Package name: bitfinex-api-node The new version differs by 250 commits.

See the full diff

Package name: bootstrap The new version differs by 250 commits.
  • 8fa0d30 Release v4.3.1. (#28252)
  • dae20da Remove unneeded glob. (#28249)
  • 10b97f6 Fix npm package contents
  • 7bc4d2e Add sanitize template option for tooltip/popover plugins.
  • bf2515a Update RFS to v8.0.1 (#28245)
  • 45ced60 Update font size (#28232)
  • 1ded0d6 Release v4.3.0 (#28228)
  • 3aa0770 docs snippets: a few more minor tweaks (#28225)
  • adf16da toasts.md: Remove useless `div`s.
  • 2bfe581 Remove stray parameter from capture.
  • bbf8b76 Cosmetic changes in snippets.
  • 7a9a8db docs: remove `-ms-overflow-style: -ms-autohiding-scrollbar` (#28220)
  • 24253b1 migration.md: use https. (#28221)
  • 545f3fa Prevent text selection in placeholder images (#28218)
  • 94acdee Revert "Silence mkdir. (#28184)" (#28209)
  • 6c7dcc6 placeholder.svg: Partially revert the changes from c0e42cb. (#28216)
  • 1145365 Reword footer text.
  • bd328bf Use the `site.repo` variable.
  • a920429 Change footer link to point to the docs team page
  • c56b10c Offcanvas example: transition the transform (#28203)
  • 52e6ce4 Update devDependencies. (#28175)
  • 93dec4c Fix scrollable modal snippet
  • 51375ab Responsive font size implementation (#23816)
  • d250567 Remove `-ms-autohiding-scrollbar` to prevent overlapping the table content (#28153)

See the full diff

Package name: css-loader The new version differs by 80 commits.

See the full diff

Package name: lint-staged The new version differs by 250 commits.
  • 885a644 Merge pull request Refactor method for notification. DeviaVir/zenbot#852 from okonet/listr2
  • aba3421 fix: all lint-staged output respects the `quiet` option
  • b8df31a fix: do not show incorrect error when verbose and no output
  • eed6198 style: simplify eslint and prettier config
  • b746290 ci: replace Node.js 13 with 14, since 14 will be next LTS
  • 2c6f3ad docs: improve `verbose` description
  • e749a0b test: remove redundant, misbehaving test
  • 16848d8 fix: use test renderer during tests and when TERM=dumb
  • efffa22 test: cover `--verbose` option usage
  • 1b18550 test: restore variable in test output
  • 6aede38 test: add test for error during merge state restoration
  • b565481 test: integration test targets the full Node.js API instead of just `runAll`
  • a3bd9d7 feat: allow specifying `cwd` using the Node.js API
  • 85de3a3 feat: add `--verbose` to show output even when tasks succeed
  • d69c65b fix: log task output after running listr to keep everything
  • e95d1b0 refactor: move skip and enable cheks of listr tasks to separate file
  • 6da7667 refactor: move messages to separate file
  • 6392480 refactor: use symbols for errors
  • 8f32a3e feat: replace listr with listr2 and print errors inline
  • c9adca5 fix: use stash create/store to prevent files from disappearing from disk
  • e093b1d fix(deps): update dependencies
  • 6066b07 fix: pass correct path to unstaged patch during cleanup
  • 0bf1fb0 fix: allow lint-staged to run on empty git repo by disabling backup
  • 1ac6863 Merge pull request Is there a way to specify a period offset? DeviaVir/zenbot#837 from okonet/serial-git-add

See the full diff

Package name: node-sass The new version differs by 197 commits.
  • 3b556c1 7.0.2
  • c716359 Bump sass-graph@^4.0.1 (#3292)
  • 24741b3 docs(readme): fix docpad plugin link
  • 1523330 feat: Drop Node 12
  • 365d357 update https://registry.npm.taobao.org to https://registry.npmmirror.com
  • 1456114 build(deps): bump actions/upload-artifact from 2 to 3
  • b465b69 chore: bump GitHub Actions to Windows 2019 (#3254)
  • e6194b1 build(deps): bump make-fetch-happen from 9.1.0 to 10.0.4
  • 4edf594 build(deps): bump node-gyp from 8.4.1 to 9.0.0
  • 29e2344 build(deps): bump actions/checkout from 2 to 3
  • 85b0d22 build(deps): bump actions/setup-node from 2 to 3
  • 3bb51da Use make-fetch-happen instead of request (#3193)
  • adc2f8b build(deps): bump true-case-path from 1.0.3 to 2.2.1 (#3000)
  • 77d12f0 chore: disable Apline for Node 16/17 builds
  • 308d533 ci: use Python 3 for Node 12
  • c818907 ci: unpin actions/setup-node to v2
  • 99242d7 7.0.1
  • 77049d1 build(deps): bump sass-graph from 2.2.5 to 4.0.0 (#3224)
  • c929f25 build(deps): bump node-gyp from 7.1.2 to 8.4.1 (#3209)
  • 918dcb3 Lint fix
  • 0a21792 Set rejectUnauthorized to true by default (#3149)
  • e80d4af chore: Drop EOL Node 15 (#3122)
  • d753397 feat: Add Node 17 support (#3195)
  • dcf2e75 build(deps-dev): bump eslint from 7.32.0 to 8.0.0

See the full diff

Package name: node-telegram-bot-api The new version differs by 105 commits.

See the full diff

Package name: poloniex.js The new version differs by 4 commits.

See the full diff

Package name: pushbullet The new version differs by 26 commits.
  • 1f8c1fd Update to version 3.0.0
  • 9186bd9 Add `createChannel()`
  • ac2fe7e Deprecate `sendSMS()`
  • 9b7bcda Add support for the text API
  • 5f501c5 Fix some comments
  • 426de2b Remove old Travis CI yaml file
  • 6a0076c Update ESLint rules and apply fixes
  • ebdc39e Merge branch 'github-action-tests'
  • ffd626d Add GitHub action to run tests
  • f68187d Add tests using nock for mocking the API
  • 45a657f Remove tests for now
  • 72e856e Codestyle, modernisation, misc fixes
  • a899190 Update dependencies to latest versions
  • dca0e34 Merge branch 'node-fetch-migration'
  • 3f89158 Update changelog
  • 6508617 Update README
  • 6a83ef9 Replace request with node-fetch
  • 0f18e80 Switch CJS requires to ESM imports
  • 8b5eaef Update to version 2.4.0
  • c1581bb Update dependency requirements
  • eadb250 Reconnect to websocket stream if disconnected
  • 3ea3f0c Update version to 2.3.0
  • e662e3c Add fullResponses option to return response object
  • 7b78838 Switch to ws module for stream handling

See the full diff

Package name: tulind The new version differs by 31 commits.

See the full diff

Package name: webpack The new version differs by 250 commits.
  • 610f368 5.0.0
  • 5ce65c1 update examples
  • bbe1230 Merge pull request #11628 from webpack/bugfix/real-content-hash
  • 75ecff2 5.0.0-rc.6
  • bfc35d6 Merge pull request #11603 from MayaWolf/master
  • 76e8cbd Merge pull request #11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
  • 9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
  • 36bcfaa Merge pull request #11621 from webpack/bugfix/11619
  • 9130d10 fix called variables with ProvidePlugin
  • 3e42105 Merge pull request #11620 from webpack/bugfix/11617
  • 4709719 skip connections copied to concatenated module
  • 57b493f 5.0.0-rc.5
  • 1658e2f Merge pull request #11618 from webpack/bugfix/11615
  • a8fb45d fixes crash in SideEffectsFlagPlugin
  • 84b196d emit error instead of crashing when unexpected problem occurs
  • 5573fed Merge pull request #11601 from Hornwitser/improve-suggested-polyfill-config
  • 9b5cce9 Merge pull request #11609 from snitin315/export-types
  • 37c495c export type RuleSetUseItem
  • 39faf34 export type RuleSetUse
  • e5fd246 export type RuleSetConditionAbsolute
  • 660baad export RuleSetCondition types
  • 13e3ca5 Merge pull request #11602 from webpack/bugfix/shared-runtime-chunk
  • 9c0587e Merge pull request #11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
  • 502d166 Merge pull request #11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4

See the full diff

Package name: webpack-cli The new version differs by 37 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

[//]: # (snyk:metadata:{"prId":"29ed1731-1083-4f1e-82d4-2bd8ad996589","prPublicId":"29ed1731-1083-4f1e-82d4-2bd8ad996589","dependencies":[{"name":"@slack/client","from":"4.1.0","to":"4.5.0"},{"name":"bitfinex-api-node","from":"1.2.1","to":"6.0.0"},{"name":"bootstrap","from":"4.1.0","to":"4.3.1"},{"name":"ccxt","from":"1.13.32","to":"1.89.76"},{"name":"css-loader","from":"0.28.11","to":"2.0.0"},{"name":"lint-staged","from":"7.0.4","to":"10.2.0"},{"name":"node-sass","from":"4.8.3","to":"7.0.2"},{"name":"node-telegram-bot-api","from":"0.30.0","to":"0.64.0"},{"name":"poloniex.js","from":"0.0.8","to":"0.0.9"},{"name":"pushbullet","from":"2.2.0","to":"3.0.0"},{"name":"tulind","from":"0.8.10","to":"0.8.20"},{"name":"webpack","from":"4.6.0","to":"5.0.0"},{"name":"webpack-cli","from":"2.0.15","to":"3.0.0"}],"packageManager":"npm","projectPublicId":"49afd2ce-e7d4-4c5f-9cf6-c1d0b09da0d8","projectUrl":"https://app.snyk.io/org/rfxn/project/49afd2ce-e7d4-4c5f-9cf6-c1d0b09da0d8?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-ANSIREGEX-1583908","SNYK-JS-BABELTRAVERSE-5962463","SNYK-JS-BOOTSTRAP-173700","SNYK-JS-BOOTSTRAP-73560","npm:bootstrap:20180529","SNYK-JS-COLORSTRING-1082939","SNYK-JS-GLOBPARENT-1016905","SNYK-JS-GOT-2932019","SNYK-JS-HTTPCACHESEMANTICS-3248783","SNYK-JS-JSON5-3182856","SNYK-JS-MINIMIST-2429795","SNYK-JS-MINIMIST-559764","SNYK-JS-NODEFETCH-2342118","SNYK-JS-NODEFETCH-674311","SNYK-JS-POSTCSS-1255640","SNYK-JS-POSTCSS-5926692","SNYK-JS-REQUEST-3361831","SNYK-JS-SERIALIZEJAVASCRIPT-536840","SNYK-JS-SERIALIZEJAVASCRIPT-570062","SNYK-JS-SERIALIZEJAVASCRIPT-6056521","SNYK-JS-TOUGHCOOKIE-5672873","SNYK-JS-UNDERSCORE-1080984","SNYK-JS-UNSETVALUE-2400660","SNYK-JS-WS-1296835","npm:braces:20180219","npm:mime:20170907"],"upgrade":["SNYK-JS-ANSIREGEX-1583908","SNYK-JS-BABELTRAVERSE-5962463","SNYK-JS-BOOTSTRAP-173700","SNYK-JS-BOOTSTRAP-73560","SNYK-JS-COLORSTRING-1082939","SNYK-JS-GLOBPARENT-1016905","SNYK-JS-GOT-2932019","SNYK-JS-HTTPCACHESEMANTICS-3248783","SNYK-JS-JSON5-3182856","SNYK-JS-MINIMIST-2429795","SNYK-JS-MINIMIST-559764","SNYK-JS-NODEFETCH-2342118","SNYK-JS-NODEFETCH-674311","SNYK-JS-POSTCSS-1255640","SNYK-JS-POSTCSS-5926692","SNYK-JS-REQUEST-3361831","SNYK-JS-SERIALIZEJAVASCRIPT-536840","SNYK-JS-SERIALIZEJAVASCRIPT-570062","SNYK-JS-SERIALIZEJAVASCRIPT-6056521","SNYK-JS-TOUGHCOOKIE-5672873","SNYK-JS-UNDERSCORE-1080984","SNYK-JS-UNSETVALUE-2400660","SNYK-JS-WS-1296835","npm:bootstrap:20180529","npm:braces:20180219","npm:mime:2...

@snyk-bot
fix: package.json & package-lock.json to reduce vulnerabilities
7b7f3de 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962463
- https://snyk.io/vuln/SNYK-JS-BOOTSTRAP-173700
- https://snyk.io/vuln/SNYK-JS-BOOTSTRAP-73560
- https://snyk.io/vuln/SNYK-JS-COLORSTRING-1082939
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-GOT-2932019
- https://snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
- https://snyk.io/vuln/SNYK-JS-JSON5-3182856
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://snyk.io/vuln/SNYK-JS-POSTCSS-5926692
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-SERIALIZEJAVASCRIPT-536840
- https://snyk.io/vuln/SNYK-JS-SERIALIZEJAVASCRIPT-570062
- https://snyk.io/vuln/SNYK-JS-SERIALIZEJAVASCRIPT-6056521
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660
- https://snyk.io/vuln/SNYK-JS-WS-1296835
- https://snyk.io/vuln/npm:bootstrap:20180529
- https://snyk.io/vuln/npm:braces:20180219
- https://snyk.io/vuln/npm:mime:20170907
@rfxn rfxn mentioned this pull request Feb 3, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

FEATURE - Use TAKER after fails of xx MAKER attempts Idea: Configurable date range for back testing
2 participants
@rfxn @snyk-bot