Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

[Snyk] Security upgrade gatsby from 5.12.4 to 5.14.0 #286

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

svcsnyksanity
Copy link

snyk-top-banner

Snyk has created this PR to fix 9 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • examples/cdrs/package.json
  • examples/cdrs/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795
  696  
high severity Path Traversal
SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555
  691  
high severity Improper Handling of Extra Parameters
SNYK-JS-FOLLOWREDIRECTS-6141137
  686  
high severity Cross-site Request Forgery (CSRF)
SNYK-JS-AXIOS-6032459
  676  
medium severity Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116
  631  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-AXIOS-6124857
  586  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-HTTPCACHESEMANTICS-3248783
  586  
medium severity Asymmetric Resource Consumption (Amplification)
SNYK-JS-BODYPARSER-7926860
  514  
medium severity Denial of Service (DoS)
SNYK-JS-MSGPACKR-6140431
  509  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Request Forgery (CSRF)
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Path Traversal

Copy link

vercel bot commented Nov 7, 2024

The latest updates on your projects. Learn more about Vercel for Git ↗︎

1 Skipped Deployment
Name Status Preview Comments Updated (UTC)
gatsby-source-sanity ⬜️ Skipped (Inspect) Nov 7, 2024 1:00am

Copy link

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
npm/babel-preset-gatsby@3.14.0 environment Transitive: eval, filesystem, network, shell, unsafe +283 53.7 MB serhalp-netlify
npm/gatsby@5.14.0 environment, filesystem Transitive: eval, network, shell, unsafe +1192 457 MB serhalp-netlify

🚮 Removed packages: npm/gatsby@5.12.4

View full report↗︎

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants