[Snyk] Upgrade: ethereumjs-util, source-map-support, ganache-core, sha3, webpack, webpack-cli, yargs #45

satoshinakamoto007 · 2024-09-08T17:29:34Z

Snyk has created this PR to upgrade multiple dependencies.

👯‍♂ The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

ethereumjs-util
from 6.1.0 to 6.2.1 | 2 versions ahead of your current version | 4 years ago
on 2020-07-16
source-map-support
from 0.5.12 to 0.5.21 | 9 versions ahead of your current version | 3 years ago
on 2021-11-19
ganache-core
from 2.10.2 to 2.13.2 | 33 versions ahead of your current version | 4 years ago
on 2021-01-12
sha3
from 1.2.2 to 1.2.6 | 4 versions ahead of your current version | 5 years ago
on 2019-12-05
webpack
from 4.35.3 to 4.47.0 | 28 versions ahead of your current version | a year ago
on 2023-09-06
webpack-cli
from 3.1.0 to 3.3.12 | 19 versions ahead of your current version | 4 years ago
on 2020-06-18
yargs
from 13.2.4 to 13.3.2 | 2 versions ahead of your current version | 4 years ago
on 2020-03-13

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Arbitrary File Overwrite SNYK-JS-TAR-1536531	624	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	624	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579155	624	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-ACORN-559469	624	No Known Exploit
Prototype Pollution SNYK-JS-AJV-584908	624	No Known Exploit
Prototype Pollution SNYK-JS-AJV-584908	624	No Known Exploit
Prototype Pollution SNYK-JS-Y18N-1021887	624	Proof of Concept
Cryptographic Issues SNYK-JS-ELLIPTIC-571484	624	Proof of Concept
Improper Verification of Cryptographic Signature SNYK-JS-BROWSERIFYSIGN-6037026	624	No Known Exploit
Prototype Pollution SNYK-JS-COPYPROPS-1082870	624	Proof of Concept
Denial of Service (DoS) SNYK-JS-DECODEURICOMPONENT-3149970	624	Proof of Concept
Cryptographic Issues SNYK-JS-ELLIPTIC-571484	624	Proof of Concept
Arbitrary Code Injection SNYK-JS-SERIALIZEJAVASCRIPT-570062	624	Proof of Concept
Arbitrary File Write SNYK-JS-TAR-1579147	624	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579152	624	No Known Exploit
Arbitrary File Write SNYK-JS-TAR-1579155	624	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536528	624	No Known Exploit
Arbitrary File Overwrite SNYK-JS-TAR-1536531	624	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-NORMALIZEURL-1296539	624	No Known Exploit
Prototype Poisoning SNYK-JS-QS-3153490	624	Proof of Concept
Prototype Poisoning SNYK-JS-QS-3153490	624	Proof of Concept
Prototype Pollution SNYK-JS-LODASH-567746	624	Proof of Concept
Prototype Pollution SNYK-JS-LODASH-608086	624	Proof of Concept
Arbitrary File Write SNYK-JS-TAR-1579147	624	No Known Exploit
Information Exposure SNYK-JS-SIMPLEGET-2361683	624	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SSRI-1246392	624	Proof of Concept
Prototype Pollution SNYK-JS-LODASH-6139239	624	Proof of Concept
Arbitrary File Overwrite SNYK-JS-TAR-1536528	624	No Known Exploit
Remote Memory Exposure SNYK-JS-BL-608877	624	Proof of Concept
Cryptographic Issues SNYK-JS-ELLIPTIC-571484	624	Proof of Concept
Prototype Pollution SNYK-JS-INI-1048974	624	Proof of Concept
Prototype Pollution SNYK-JS-JSONSCHEMA-1920922	624	No Known Exploit
Prototype Pollution SNYK-JS-LOADERUTILS-3043105	624	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-ES5EXT-6095076	624	Proof of Concept
Command Injection SNYK-JS-GLOBALMODULESPATH-3167973	624	Proof of Concept
Prototype Pollution SNYK-JS-Y18N-1021887	624	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-HOSTEDGITINFO-1088355	624	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	624	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-COOKIEJAR-3149984	624	Proof of Concept
Arbitrary File Write via Archive Extraction (Zip Slip) SNYK-JS-DECOMPRESS-557358	624	Proof of Concept
Arbitrary File Write via Archive Extraction (Zip Slip) SNYK-JS-DECOMPRESSTAR-559095	624	Proof of Concept
Cryptographic Issues SNYK-JS-ELLIPTIC-1064899	624	No Known Exploit
Cryptographic Issues SNYK-JS-ELLIPTIC-1064899	624	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-559764	624	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-PATHPARSE-1077067	624	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-LOADERUTILS-3105943	624	No Known Exploit
Cryptographic Issues SNYK-JS-ELLIPTIC-1064899	624	No Known Exploit
Timing Attack SNYK-JS-ELLIPTIC-511941	624	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	624	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-559764	624	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-TERSER-2806366	624	No Known Exploit
Timing Attack SNYK-JS-ELLIPTIC-511941	624	No Known Exploit
Regular Expression Denial of Service (ReDoS) SNYK-JS-LOADERUTILS-3042992	624	No Known Exploit
Open Redirect SNYK-JS-EXPRESS-6474509	624	No Known Exploit
Prototype Pollution SNYK-JS-YARGSPARSER-560381	624	Proof of Concept
Prototype Pollution SNYK-JS-YARGSPARSER-560381	624	Proof of Concept
Prototype Pollution SNYK-JS-YARGSPARSER-560381	624	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	624	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-2429795	624	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	624	No Known Exploit
Prototype Pollution SNYK-JS-MINIMIST-2429795	624	Proof of Concept
Validation Bypass SNYK-JS-KINDOF-537849	624	Proof of Concept

Release notes

Package name: ethereumjs-util

6.2.1 - 2020-07-16
Other Features
- Stricter prefixed hex typing, PRs #3348, #3427 and #3357 (some changes removed in PR #3382 for backwards compatibility reasons, will be reintroduced along upcoming breaking releases)
Bugfixes
- Fixes an issue in the delete operation used for unhashed tries and pruning activated which resulted in a wrong state root (bad!), PR #3333
6.2.0 - 2019-11-07
6.1.0 - 2019-02-12

from ethereumjs-util GitHub release notes

Package name: source-map-support

0.5.21 - 2021-11-19
0.5.21
0.5.20 - 2021-09-09
0.5.20
0.5.19 - 2020-04-24
0.5.19
0.5.18 - 2020-04-21
0.5.18
0.5.17 - 2020-04-19
0.5.17
0.5.16 - 2019-10-29
- 🐛 Fix "cannot read property 'name' of undefined" error
0.5.15 - 2019-10-28
- 🐛 Adapt to node's removal of the module header
0.5.14 - 2019-10-28
- 🐛 Fix extraction of function name from next frame’s position
0.5.13 - 2019-07-31
0.5.13
0.5.12 - 2019-04-08
0.5.12

from source-map-support GitHub release notes

Package name: ganache-core

2.13.2 - 2021-01-12

Highlights How to Upgrade Changelog Related Releases

We're moving to a beta › latest release pipeline, where all non-hotfix changes are first released in a beta before being promoted to a stable release.

We'd love it if you'd start using the latest betas and let us know early and often if you find any bugs or regressions!

Highlights

v2.13.2 – Taco Tuesday 🌮

It's Tuesday. And you know what that means, don't you? Tacos! And tacos are delicious. And do you know what else is delicious? This release! It's got a couple of new bug fixes you'll want to check out, especially if you use the forking feature.

Bon appetit!

How to Upgrade

Upgrade to the latest version of ganache-core by running:

npm
```
npm uninstall ganache-core
npm install ganache-core@latest
```
yarn
```
yarn remove ganache-core
yarn add ganache-core@latest
```
Changelog

Fixes:
- fix: add removed field to Log JSON (#651)
- fix: storage value encoding in forked trie. (#658)
- fix: handle failure to retrieve net_version when forking (#676)
Chores:
- chore: update eth-sig-util to v3.0.0 (#711)
Related Releases
- ganache-cli v6.12.2
💖 The Truffle Team
2.13.2-tezos.2 - 2021-02-16
2.13.2-tezos.0 - 2021-02-03
2.13.1 - 2020-10-26

Highlights How to Upgrade Changelog Related Releases

We're moving to a beta › latest release pipeline, where all non-hotfix changes are first released in a beta before being promoted to a stable release.

We'd love it if you'd start using the latest betas and let us know early and often if you find any bugs or regressions!

Highlights

v2.13.1 – Johnnycake Cobblers 2 🎂

This release is exactly like the last one, but it works around an npm bug that causes installations to sometimes fail in Node v12 with npm v6. The rest of these notes are the same as the last release's.

Johnnycake Cobblers: another dessert with a weird name. Someone really should cook up all the release names we've used for us Trufflers to try one day! 😋

This release brings Node v14 compatibility and a new feature!

How to Upgrade

Upgrade to the latest version of ganache-core by running:

npm
```
npm uninstall ganache-core
npm install ganache-core@latest
```
yarn
```
yarn remove ganache-core
yarn add ganache-core@latest
```
Changelog

Features:
- feat: add ability to use blockHash with eth_getLogs (#639) Thanks, @ tynes!
Fixes:
- fix: update merkle-patricia-tree to v3.0.0 to support Node v14 (#636)
- fix: fix snapshots for forking (#627) Thanks, @ seesemichaelj!
- fix: remove dev dependencies from published package's shrinkwrap (#640)
- fix: patch keccak to prevent Node v14 segfault (c26ba24)
- fix: bundle patched version of keccak (c5e6db6)
Misc:
- test: throw if test contracts fail compilation (#633)
- chore: simply release process (#638)
- test: increase infura test timeouts so they stop failing in CI (#642)
- chore: update CI's Node version to 14.13.0 (#641)
- try npm 7 to see if it can prune --production and shrinkwrap without creating an invalid shrinkwrap file (4b3f588)
- update to npm v7.0.0-rc.0 (2af3122)
- chore: fix prepublish script for npm 7 (b30a886)
Related Releases
- ganache-cli v6.12.0
- Ganache UI v2.5.4
💖 The Truffle Team
2.13.1-beta.1 - 2020-10-26
2.13.1-beta.1
2.13.1-beta.0 - 2020-10-19
2.13.1-beta.0
2.13.1-alpha.4 - 2020-10-19
2.13.1-alpha.4
2.13.1-alpha.2 - 2020-10-19
2.13.1-alpha.2
2.13.1-alpha.1 - 2020-10-19
2.13.1-alpha.1
2.13.1-alpha.0 - 2020-10-19
2.13.1-alpha.0
2.13.0 - 2020-10-09
2.13.0-rc.0 - 2020-10-09
2.13.0-beta.1 - 2020-10-07
2.13.0-beta.0 - 2020-10-06
2.13.0-alpha.2 - 2020-10-01
2.13.0-alpha.1 - 2020-10-01
2.13.0-alpha.0 - 2020-10-01
2.12.2-beta.0 - 2020-09-29
2.12.1 - 2020-09-28
2.12.0 - 2020-09-28
2.12.0-tezos.0 - 2020-12-03
2.12.0-tezos.0
2.12.0-beta.0 - 2020-09-15
2.11.3 - 2020-09-08
2.11.3-forking.0 - 2020-08-18
2.11.3-filecoin-alpha - 2020-08-06
2.11.3-beta.0 - 2020-08-25
2.11.2 - 2020-08-05
2.11.1 - 2020-08-05
2.11.0 - 2020-08-05
2.11.0-tezos.2 - 2020-06-10
2.11.0-tezos.1 - 2020-05-29
2.11.0-tezos.0 - 2020-05-28
2.11.0-beta.0 - 2020-06-24
2.10.2 - 2020-02-13

from ganache-core GitHub release notes

Package name: sha3

1.2.6 - 2019-12-05
This administrative release is identical to v1.2.5.
When v1.2.5 was published, the native tag was not set. Due to package version immutability in npm registry, applying this tag required a version increment.
1.2.5 - 2019-12-05
This is a bugfix release for older Linux versions.
- 🐛 Fix compatibility with gcc 4.8 (the default version provided with Ubuntu Trusty LTS).
1.2.4 - 2019-12-01
- 🐛 Fix compatibility with Node.js 13.x.
1.2.3 - 2019-05-08
This is a maintenance release, to address compatibility issues with Node.js 12.x, which removed some deprecated functions from the V8 add-on API used by the 1.x branch of this library. No functional changes are included in this release.
1.2.2 - 2018-04-30

from sha3 GitHub release notes

Package name: webpack

4.47.0 - 2023-09-06
New Features
- [Security] - Add support for md4 in Node >=18. by @ iclanton in #17628
New Contributors
- @ iclanton made their first contribution in #17628
Full Changelog: v4.46.0...v4.47.0
4.46.0 - 2021-01-11
4.45.0 - 2021-01-08
4.44.2 - 2020-09-17
4.44.1 - 2020-07-30
4.44.0 - 2020-07-24
4.43.0 - 2020-04-21
4.42.1 - 2020-03-24
4.42.0 - 2020-03-02
4.41.6 - 2020-02-11
4.41.5 - 2019-12-27
4.41.4 - 2019-12-19
4.41.3 - 2019-12-16
4.41.2 - 2019-10-15
4.41.1 - 2019-10-11
4.41.0 - 2019-09-24
4.40.3 - 2019-09-24
4.40.2 - 2019-09-13
4.40.1 - 2019-09-13
4.40.0 - 2019-09-12
4.39.3 - 2019-08-27
4.39.2 - 2019-08-13
4.39.1 - 2019-08-02
4.39.0 - 2019-08-01
4.38.0 - 2019-07-26
4.37.0 - 2019-07-23
4.36.1 - 2019-07-17
4.36.0 - 2019-07-17
4.35.3 - 2019-07-08

from webpack GitHub release notes

Package name: webpack-cli

3.3.12 - 2020-06-18
chore(release): 3.3.12
3.3.11 - 2020-02-11
3.3.10 - 2019-10-31
3.3.9 - 2019-09-17
3.3.8 - 2019-09-05
3.3.7 - 2019-08-18
3.3.6 - 2019-07-14
3.3.5 - 2019-06-23
3.3.4 - 2019-06-11
3.3.3 - 2019-06-07
3.3.2 - 2019-05-04
3.3.1 - 2019-04-21
3.3.0 - 2019-03-15
3.2.3 - 2019-02-05
3.2.2 - 2019-02-05
3.2.1 - 2019-01-07
3.2.0 - 2019-01-03
3.1.2 - 2018-09-29
3.1.1 - 2018-09-23
3.1.0 - 2018-07-18

from webpack-cli GitHub release notes

Package name: yargs

13.3.2 - 2020-03-13
13.3.0 - 2019-06-10
Bug Fixes
- deps: yargs-parser update addressing several parsing bugs (#1357) (e230d5b)
Features
- i18n: swap out os-locale dependency for simple inline implementation (#1356) (4dfa19b)
- support defaultDescription for positional arguments (812048c)
13.2.4 - 2019-05-13

from yargs GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"ethereumjs-util","from":"6.1.0","to":"6.2.1"},{"name":"source-map-support","from":"0.5.12","to":"0.5.21"},{"name":"ganache-core","from":"2.10.2","to":"2.13.2"},{"name":"sha3","from":"1.2.2","to":"1.2.6"},{"name":"webpack","from":"4.35.3","to":"4.47.0"},{"name":"webpack-cli","from":"3.1.0","to":"3.3.12"},{"name":"yargs","from":"13.2.4","to":"13.3.2"}],"env":"prod","hasFixes":true,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1536531","issue_id":"SNYK-JS-TAR-1536531","priority_score":624,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Overwrite"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1579152","issue_id":"SNYK-JS-TAR-1579152","priority_score":639,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.5","score":425},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Write"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1579155","issue_id":"SNYK-JS-TAR-1579155","priority_score":639,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.5","score":425},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Write"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-ACORN-559469","issue_id":"SNYK-JS-ACORN-559469","priority_score":589,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-AJV-584908","issue_id":"SNYK-JS-AJV-584908","priority_score":405,"priority_score_factors":[{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-AJV-584908","issue_id":"SNYK-JS-AJV-584908","priority_score":619,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-Y18N-1021887","issue_id":"SNYK-JS-Y18N-1021887","priority_score":686,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.3","score":365},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-ELLIPTIC-571484","issue_id":"SNYK-JS-ELLIPTIC-571484","priority_score":706,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.7","score":385},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Cryptographic Issues"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-BROWSERIFYSIGN-6037026","issue_id":"SNYK-JS-BROWSERIFYSIGN-6037026","priority_score":589,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Improper Verification of Cryptographic Signature"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-COPYPROPS-1082870","issue_id":"SNYK-JS-COPYPROPS-1082870","priority_score":686,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.3","score":365},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-DECODEURICOMPONENT-3149970","issue_id":"SNYK-JS-DECODEURICOMPONENT-3149970","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Denial of Service (DoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-ELLIPTIC-571484","issue_id":"SNYK-JS-ELLIPTIC-571484","priority_score":706,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.7","score":385},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Cryptographic Issues"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-SERIALIZEJAVASCRIPT-570062","issue_id":"SNYK-JS-SERIALIZEJAVASCRIPT-570062","priority_score":706,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.7","score":385},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary Code Injection"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1579147","issue_id":"SNYK-JS-TAR-1579147","priority_score":639,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.5","score":425},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Write"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1579152","issue_id":"SNYK-JS-TAR-1579152","priority_score":639,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.5","score":425},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Write"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1579155","issue_id":"SNYK-JS-TAR-1579155","priority_score":639,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.5","score":425},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Write"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1536528","issue_id":"SNYK-JS-TAR-1536528","priority_score":624,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Overwrite"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1536531","issue_id":"SNYK-JS-TAR-1536531","priority_score":624,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Overwrite"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-NORMALIZEURL-1296539","issue_id":"SNYK-JS-NORMALIZEURL-1296539","priority_score":375,"priority_score_factors":[{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-QS-3153490","issue_id":"SNYK-JS-QS-3153490","priority_score":482,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Poisoning"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-QS-3153490","issue_id":"SNYK-JS-QS-3153490","priority_score":482,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Poisoning"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-LODASH-567746","issue_id":"SNYK-JS-LODASH-567746","priority_score":731,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-LODASH-608086","issue_id":"SNYK-JS-LODASH-608086","priority_score":686,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.3","score":365},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1579147","issue_id":"SNYK-JS-TAR-1579147","priority_score":639,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.5","score":425},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Write"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-SIMPLEGET-2361683","issue_id":"SNYK-JS-SIMPLEGET-2361683","priority_score":761,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.8","score":440},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Information Exposure"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-SSRI-1246392","issue_id":"SNYK-JS-SSRI-1246392","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-LODASH-6139239","issue_id":"SNYK-JS-LODASH-6139239","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-TAR-1536528","issue_id":"SNYK-JS-TAR-1536528","priority_score":624,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Arbitrary File Overwrite"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-BL-608877","issue_id":"SNYK-JS-BL-608877","priority_score":706,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.7","score":385},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Remote Memory Exposure"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-ELLIPTIC-571484","issue_id":"SNYK-JS-ELLIPTIC-571484","priority_score":706,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.7","score":385},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Cryptographic Issues"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-INI-1048974","issue_id":"SNYK-JS-INI-1048974","priority_score":686,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.3","score":365},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-JSONSCHEMA-1920922","issue_id":"SNYK-JS-JSONSCHEMA-1920922","priority_score":430,"priority_score_factors":[{"type":"cvssScore","label":"8.6","score":430},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-LOADERUTILS-3043105","issue_id":"SNYK-JS-LOADERUTILS-3043105","priority_score":589,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-ES5EXT-6095076","issue_id":"SNYK-JS-ES5EXT-6095076","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-GLOBALMODULESPATH-3167973","issue_id":"SNYK-JS-GLOBALMODULESPATH-3167973","priority_score":691,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.4","score":370},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Command Injection"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-Y18N-1021887","issue_id":"SNYK-JS-Y18N-1021887","priority_score":686,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.3","score":365},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-HOSTEDGITINFO-1088355","issue_id":"SNYK-JS-HOSTEDGITINFO-1088355","priority_score":586,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-HTTPCACHESEMANTICS-3248783","issue_id":"SNYK-JS-HTTPCACHESEMANTICS-3248783","priority_score":372,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-COOKIEJAR-3149984","issue_id":"SNYK-JS-COOKIEJAR-3149984","priority_score":372,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"pr...

Snyk has created this PR to upgrade: - ethereumjs-util from 6.1.0 to 6.2.1. See this package in npm: https://www.npmjs.com/package/ethereumjs-util - source-map-support from 0.5.12 to 0.5.21. See this package in npm: https://www.npmjs.com/package/source-map-support - ganache-core from 2.10.2 to 2.13.2. See this package in npm: https://www.npmjs.com/package/ganache-core - sha3 from 1.2.2 to 1.2.6. See this package in npm: https://www.npmjs.com/package/sha3 - webpack from 4.35.3 to 4.47.0. See this package in npm: https://www.npmjs.com/package/webpack - webpack-cli from 3.1.0 to 3.3.12. See this package in npm: https://www.npmjs.com/package/webpack-cli - yargs from 13.2.4 to 13.3.2. See this package in npm: https://www.npmjs.com/package/yargs See this project in Snyk: https://app.snyk.io/org/bram00767/project/e6427225-36da-46ef-b72e-b065692aa7ea?utm_source=github&utm_medium=referral&page=upgrade-pr

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Upgrade: ethereumjs-util, source-map-support, ganache-core, sha3, webpack, webpack-cli, yargs #45

[Snyk] Upgrade: ethereumjs-util, source-map-support, ganache-core, sha3, webpack, webpack-cli, yargs #45

satoshinakamoto007 commented Sep 8, 2024

Other Features

Bugfixes

`Highlights` `How to Upgrade` `Changelog` `Related Releases`

Highlights

How to Upgrade

npm

yarn

Changelog

Fixes:

Chores:

Related Releases

`Highlights` `How to Upgrade` `Changelog` `Related Releases`

Highlights

How to Upgrade

npm

yarn

Changelog

Features:

Fixes:

Misc:

Related Releases

New Features

New Contributors

Bug Fixes

Features

[Snyk] Upgrade: ethereumjs-util, source-map-support, ganache-core, sha3, webpack, webpack-cli, yargs #45

Are you sure you want to change the base?

[Snyk] Upgrade: ethereumjs-util, source-map-support, ganache-core, sha3, webpack, webpack-cli, yargs #45

Conversation

satoshinakamoto007 commented Sep 8, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

Other Features

Bugfixes

Highlights How to Upgrade Changelog Related Releases

Highlights

How to Upgrade

npm

yarn

Changelog

Fixes:

Chores:

Related Releases

Highlights How to Upgrade Changelog Related Releases

Highlights

How to Upgrade

npm

yarn

Changelog

Features:

Fixes:

Misc:

Related Releases

New Features

New Contributors

Bug Fixes

Features

`Highlights` `How to Upgrade` `Changelog` `Related Releases`

`Highlights` `How to Upgrade` `Changelog` `Related Releases`