Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[Snyk] Fix for 1 vulnerabilities #955

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #955

wants to merge 1 commit into from

Conversation

aliscco
Copy link
Owner

@aliscco aliscco commented Dec 1, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • deps/npm/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @npmcli/run-script The new version differs by 116 commits.

See the full diff

Package name: glob The new version differs by 114 commits.
  • a68703e 9.0.0
  • 58159ca test: cwd can be a url
  • a547a9c more docs
  • 42a3ac7 link to bash manual for Pattern Matching
  • 474172d update readme with cwd URL support
  • ad3904d update readme with posix class support
  • b22fc7d minimatch@7.3.0
  • cdd1627 update all the things, remove unused mkdirp types
  • 75c6416 Merge branch 'v9'
  • fa0cd77 cwd can be a file:// url
  • d03ed0a typedoc github action
  • 9a5a45a put bench results in readme
  • 20b2f88 docs, fix benchmark script
  • 4829c88 upgrade ci actions
  • 5cbacdd minimatch@7.2.0
  • 210310b omit symlinks on windows
  • d34c8d5 full test coverage, clean up signals and remove extranous code
  • 5f21b46 adding lots of tests, clean up types
  • b12e6ba slashes on nodir test
  • 75f74b0 more windows test slashes
  • 3aa1abd more windows test affordances
  • 3e68a7b some windows test affordances
  • 8c2e082 feature complete and tests passing
  • c3be35a correct ** vs ./** behavior

See the full diff

Package name: init-package-json The new version differs by 37 commits.

See the full diff

Package name: licensee The new version differs by 30 commits.

See the full diff

Package name: make-fetch-happen The new version differs by 108 commits.

See the full diff

Package name: node-gyp The new version differs by 219 commits.

See the full diff

Package name: npm-profile The new version differs by 55 commits.

See the full diff

Package name: npm-registry-fetch The new version differs by 76 commits.

See the full diff

Package name: pacote The new version differs by 197 commits.
  • 18e760f chore: release 17.0.4
  • ba8f790 deps: bump @ npmcli/promise-spawn from 6.0.2 to 7.0.0
  • 2c0d3ae deps: bump @ npmcli/run-script from 6.0.2 to 7.0.0
  • 7aa2062 chore: release 17.0.3
  • ace7c28 deps: bump npm-packlist from 7.0.4 to 8.0.0
  • f1efd0c chore: release 17.0.2
  • c3b892d deps: bump sigstore from 1.3.0 to 2.0.0
  • c75d7d5 chore: release 17.0.1
  • 6ddae13 deps: bump npm-registry-fetch from 15.0.0 to 16.0.0
  • 42bf787 deps: bump npm-pick-manifest from 8.0.2 to 9.0.0
  • 9fa2de9 chore: release 17.0.0
  • e9e964b deps: bump read-package-json from 6.0.4 to 7.0.0
  • f69d844 chore: hosted-git-info@7.0.0
  • 5d26500 deps: bump npm-package-arg from 10.1.0 to 11.0.0
  • d13bb9c deps: bump @ npmcli/git from 4.1.0 to 5.0.0
  • 7a25e39 deps: bump cacache from 17.1.4 to 18.0.0
  • 2db2fb5 fix: drop node 16.13.x support
  • 5cdbfd1 chore: release 16.0.0
  • 8dc6a32 deps: bump minipass from 5.0.0 to 7.0.2
  • 7cebf19 deps: bump npm-registry-fetch from 14.0.5 to 15.0.0
  • 73b6297 fix: drop node14 support ([Snyk] Fix for 20 vulnerabilities #290)
  • 53cf17e chore: postinstall for dependabot template-oss PR
  • 865d5c7 chore: bump @ npmcli/template-oss from 4.17.0 to 4.18.0
  • 040add9 chore: postinstall for dependabot template-oss PR

See the full diff

Package name: rimraf The new version differs by 40 commits.
  • 3b6b098 4.0.0
  • e0cffea ci: reduce workload even more
  • 0e6646d ci: remove unnecessary lint filter
  • 546e017 update action versions
  • 6d88a65 tone down benchmark intensity
  • 842a8d2 fix benchmark workflow yaml
  • 1b91697 chore: add copyright year to license
  • 08bbb06 rewrite in TS, export hybrid, update changelog, docs
  • 1b3f46e drop support for node versions below 14
  • 2e1f003 gh actions workflow for benchmarks
  • 52f9370 tests for retry-busy behavior
  • 188e3ed don't test on very old node versions
  • d1d5495 test for fix-eperm
  • e7501cd prettier formatting
  • 40f64ec windows: only fall back to move-remove when absolutely necessary
  • b6f7819 update tap
  • 99496cd test: run posix test on windows, why not?
  • 51d43c1 benchmarks
  • 6b8aa29 doc: correct os.tmp default
  • 4b228c9 do not ever actually try to rmdir /
  • 2442655 consolidate all the spellings of 'opt' into one
  • d4eec2e add cli script
  • 0c82d74 accept strings, arrays of strings, and no other types
  • ad4f2db Do not rimraf /, override with preserveRoot:false

See the full diff

Package name: tap The new version differs by 250 commits.
  • 793c1c0 update versions
  • 47a2289 add missing @ tapjs/mock service key polyfill
  • 6622dca snapshot: update snapshot
  • 556e520 mock: actually be resilient against multiple instances
  • 2c135b0 Add `t.mockAll` method
  • d7e7e4f clean process.cwd() out of snapshots by default
  • 4c0dc72 use the released version of tshy
  • c858f37 need to check in .tshy configs for typedoc to work
  • 82f48cd update versions
  • 0f27f73 TypeScript 5.2, use tshy for hybrid builds
  • de09096 remove my home directory from parser snapshots
  • 46e2bbb repl: mkdirp the .tap dir if missing
  • acfae01 link typedocs to main website
  • 2ece1da core spawn test even less flaky
  • a7a12d2 update typedoc to latest, ts-node to temporary fork
  • a5c0e0c some changelog updates
  • caf8d81 document repl
  • a5dc854 Store t.testdir() fixtures in .tap/fixtures
  • 6914d23 remove docs from source control
  • 1dcc6a7 exclude test files themselves from coverage
  • aff25fc update versions
  • c5972e7 core: make spawn timeout test less flaky
  • 1c11b37 stack: properly parse ErrnoException errors
  • 1280a55 parser: remove node v12 skip check

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

# for free to join this conversation on GitHub. Already have an account? # to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@aliscco @snyk-bot