Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

[Snyk] Security upgrade semantic-release from 16.0.0-beta.18 to 17.0.1 #2176

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

aliscco
Copy link
Owner

@aliscco aliscco commented May 22, 2024

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • node_modules/propagate/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5
Uncontrolled resource consumption
SNYK-JS-BRACES-6838727
Yes Proof of Concept
high severity 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5
Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: semantic-release The new version differs by 212 commits.
  • 45695b9 fix(package): update @ semantic-release/commit-analyzer to version 8.0.0
  • 3c7b114 fix(package): update @ semantic-release/release-notes-generator to version 9.0.0
  • f2b5826 fix(package): update @ semantic-release/npm to version 7.0.0
  • c48bd3a fix(package): update @ semantic-release/github to version 7.0.0
  • bc97537 test: fix copy/paste typo in test titles
  • c7e461d docs: add `@ saithodev/semantic-release-gitea` to community plugins
  • ef1b8a0 chore(package): update ava to version 3.1.0
  • bec57cd chore: require Node.js >=10.18
  • c6b1076 fix: correct error when remote repository has no branches
  • b54b20d fix: use `--no-verify` when testing the Git permissions
  • 88fe819 docs: fix typo
  • 559c152 docs(README): update minimal required Node version / FAQ link ([Snyk] Security upgrade jest from 25.5.4 to 27.0.0 #1422)
  • 31e7876 docs(travis): build on all branches by default
  • 8c0490d docs: replacing firefox plugin in the list ([Snyk] Security upgrade jest from 25.5.4 to 27.0.0 #1416)
  • 6b5b02e fix: fetch tags on repo cached by the CI
  • 28b5480 docs: correct plugin execution order
  • 3739ab5 fix(package): update env-ci to version 5.0.0
  • 11665b2 chore(package): update dependencies
  • 0785a84 fix: update plugin versions
  • 152bf45 Merge remote-tracking branch 'origin/beta'
  • 3ba8f2a Merge remote-tracking branch 'origin/master' into beta
  • a8c747d feat: pass `envi-ci` values to plugins context
  • fc70726 chore: add Mockserver generated file to gitignore
  • fc7205d fix: correctly display command that errored out in logs

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Note: This is a default PR template raised by Snyk. Find out more about how you can customise Snyk PRs in our documentation.

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled resource consumption

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants