From 1acee1a1ffcb3524327f52f4da70f02bc91c8673 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Sun, 8 Nov 2020 14:49:01 +0000 Subject: [PATCH] fix: package.json & .snyk to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-473997 - https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969 - https://snyk.io/vuln/SNYK-JS-JQUERY-174006 - https://snyk.io/vuln/SNYK-JS-JQUERY-565129 - https://snyk.io/vuln/SNYK-JS-JQUERY-567880 - https://snyk.io/vuln/SNYK-JS-KERBEROS-568900 - https://snyk.io/vuln/SNYK-JS-LODASH-450202 - https://snyk.io/vuln/SNYK-JS-LODASH-567746 - https://snyk.io/vuln/SNYK-JS-LODASH-590103 - https://snyk.io/vuln/SNYK-JS-LODASH-608086 - https://snyk.io/vuln/SNYK-JS-LODASH-73638 - https://snyk.io/vuln/SNYK-JS-LODASH-73639 - https://snyk.io/vuln/SNYK-JS-MARKED-174116 - https://snyk.io/vuln/SNYK-JS-MARKED-451540 - https://snyk.io/vuln/SNYK-JS-MARKED-584281 - https://snyk.io/vuln/SNYK-JS-MONGODB-473855 - https://snyk.io/vuln/SNYK-JS-MONGOOSE-472486 - https://snyk.io/vuln/SNYK-JS-TYPEORM-590152 - https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381 - https://snyk.io/vuln/npm:adm-zip:20180415 - https://snyk.io/vuln/npm:debug:20170905 - https://snyk.io/vuln/npm:dustjs-linkedin:20160819 - https://snyk.io/vuln/npm:ejs:20161128 - https://snyk.io/vuln/npm:ejs:20161130 - https://snyk.io/vuln/npm:ejs:20161130-1 - https://snyk.io/vuln/npm:fresh:20170908 - https://snyk.io/vuln/npm:jquery:20150627 - https://snyk.io/vuln/npm:lodash:20180130 - https://snyk.io/vuln/npm:marked:20150520 - https://snyk.io/vuln/npm:marked:20170112 - https://snyk.io/vuln/npm:marked:20170815 - https://snyk.io/vuln/npm:marked:20170815-1 - https://snyk.io/vuln/npm:marked:20170907 - https://snyk.io/vuln/npm:marked:20180225 - https://snyk.io/vuln/npm:mem:20180117 - https://snyk.io/vuln/npm:mime:20170907 - https://snyk.io/vuln/npm:moment:20161019 - https://snyk.io/vuln/npm:moment:20170905 - https://snyk.io/vuln/npm:mongoose:20160116 - https://snyk.io/vuln/npm:ms:20170412 - https://snyk.io/vuln/npm:negotiator:20160616 - https://snyk.io/vuln/npm:npmconf:20180512 - https://snyk.io/vuln/npm:qs:20170213 - https://snyk.io/vuln/npm:semver:20150403 - https://snyk.io/vuln/npm:st:20140206 - https://snyk.io/vuln/npm:st:20171013 The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/SNYK-JS-LODASH-567746 - https://snyk.io/vuln/npm:ms:20151024 --- .snyk | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++ package.json | 45 ++++++++++++++++++++------------------ 2 files changed, 85 insertions(+), 21 deletions(-) create mode 100644 .snyk diff --git a/.snyk b/.snyk new file mode 100644 index 0000000000..ba700ef96d --- /dev/null +++ b/.snyk @@ -0,0 +1,61 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.19.0 +ignore: {} +# patches apply the minimum changes required to fix a vulnerability +patch: + SNYK-JS-LODASH-567746: + - snyk > @snyk/dep-graph > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > @snyk/snyk-cocoapods-plugin > @snyk/dep-graph > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > @snyk/snyk-cocoapods-plugin > @snyk/cocoapods-lockfile-parser > @snyk/dep-graph > lodash: + patched: '2020-11-08T14:48:57.662Z' + - tap > nyc > istanbul-lib-instrument > babel-types > lodash: + patched: '2020-11-08T14:48:57.662Z' + - tap > nyc > istanbul-lib-instrument > babel-generator > lodash: + patched: '2020-11-08T14:48:57.662Z' + - tap > nyc > istanbul-lib-instrument > babel-traverse > lodash: + patched: '2020-11-08T14:48:57.662Z' + - tap > nyc > istanbul-lib-instrument > babel-template > lodash: + patched: '2020-11-08T14:48:57.662Z' + - tap > nyc > istanbul-lib-instrument > babel-generator > babel-types > lodash: + patched: '2020-11-08T14:48:57.662Z' + - tap > nyc > istanbul-lib-instrument > babel-traverse > babel-types > lodash: + patched: '2020-11-08T14:48:57.662Z' + - tap > nyc > istanbul-lib-instrument > babel-template > babel-types > lodash: + patched: '2020-11-08T14:48:57.662Z' + - tap > nyc > istanbul-lib-instrument > babel-template > babel-traverse > lodash: + patched: '2020-11-08T14:48:57.662Z' + - tap > nyc > istanbul-lib-instrument > babel-template > babel-traverse > babel-types > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > inquirer > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > snyk-config > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > snyk-mvn-plugin > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > snyk-nodejs-lockfile-parser > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > snyk-nuget-plugin > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > @snyk/dep-graph > graphlib > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > snyk-go-plugin > graphlib > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > snyk-nodejs-lockfile-parser > graphlib > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > snyk-nuget-plugin > dotnet-deps-parser > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > snyk-php-plugin > @snyk/composer-lockfile-parser > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > @snyk/snyk-cocoapods-plugin > @snyk/dep-graph > graphlib > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > @snyk/snyk-cocoapods-plugin > @snyk/cocoapods-lockfile-parser > @snyk/ruby-semver > lodash: + patched: '2020-11-08T14:48:57.662Z' + - snyk > @snyk/snyk-cocoapods-plugin > @snyk/cocoapods-lockfile-parser > @snyk/dep-graph > graphlib > lodash: + patched: '2020-11-08T14:48:57.662Z' + 'npm:ms:20151024': + - humanize-ms > ms: + patched: '2020-11-08T14:48:57.662Z' diff --git a/package.json b/package.json index da13bc85d2..5eebba0ec3 100644 --- a/package.json +++ b/package.json @@ -11,43 +11,46 @@ "start": "node app.js", "build": "browserify -r jquery > public/js/bundle.js", "cleanup": "mongo express-todo --eval 'db.todos.remove({});'", - "test": "snyk test" + "test": "snyk test", + "snyk-protect": "snyk protect", + "prepublish": "npm run snyk-protect" }, "dependencies": { - "adm-zip": "0.4.7", - "body-parser": "1.9.0", + "adm-zip": "0.4.11", + "body-parser": "1.17.1", "cfenv": "^1.0.4", "consolidate": "0.14.5", "cookie-parser": "1.3.3", "dustjs-helpers": "1.5.0", - "dustjs-linkedin": "2.5.0", - "ejs": "1.0.0", + "dustjs-linkedin": "2.6.0", + "ejs": "2.5.5", "ejs-locals": "1.0.2", - "errorhandler": "1.2.0", - "express": "4.12.4", - "express-fileupload": "0.0.5", + "errorhandler": "1.4.3", + "express": "4.16.0", + "express-fileupload": "1.1.10", "file-type": "^8.1.0", "humanize-ms": "1.0.1", - "jquery": "^2.2.4", - "lodash": "4.17.4", - "marked": "0.3.5", + "jquery": "^3.5.0", + "lodash": "4.17.20", + "marked": "1.1.1", "method-override": "latest", - "moment": "2.15.1", + "moment": "2.19.3", "mongodb": "^3.5.9", - "mongoose": "4.2.4", + "mongoose": "5.4.10", "morgan": "latest", - "ms": "^0.7.1", + "ms": "^2.0.0", "mysql": "^2.18.1", - "npmconf": "0.0.24", + "npmconf": "2.1.3", "optional": "^0.1.3", - "st": "0.2.4", + "st": "1.2.2", "stream-buffers": "^3.0.1", - "tap": "^11.1.3", - "typeorm": "^0.2.24" + "tap": "^12.6.2", + "typeorm": "^0.2.25", + "snyk": "^1.424.4" }, "devDependencies": { - "browserify": "^13.1.1", - "snyk": "^1.244.0" + "browserify": "^13.1.1" }, - "license": "Apache-2.0" + "license": "Apache-2.0", + "snyk": true }