Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[Snyk] Fix for 21 vulnerabilities #31

Open
wants to merge 1 commit into
base: latest
Choose a base branch
from
Open

[Snyk] Fix for 21 vulnerabilities #31

wants to merge 1 commit into from

Conversation

bumplzz69
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:

    • package.json
    • package-lock.json

  • Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches.
    Find out more.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
high severity 726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1		 Arbitrary File Overwrite
SNYK-JS-BINLINKS-537608		 No Proof of Concept
low severity 451/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 2.6		 Unauthorized File Access
SNYK-JS-BINLINKS-537609		 No Proof of Concept
high severity 726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1		 Arbitrary File Write
SNYK-JS-BINLINKS-537610		 No Proof of Concept
medium severity 484/1000
Why? Has a fix available, CVSS 5.4		 Open Redirect
SNYK-JS-GOT-2932019		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HOSTEDGITINFO-1088355		 No Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-INI-1048974		 No Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 No Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Insertion of Sensitive Information into Log File
SNYK-JS-NPMREGISTRYFETCH-575432		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-NPMUSERVALIDATE-1019352		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SSRI-1246392		 Yes Proof of Concept
high severity 624/1000
Why? Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 Yes No Known Exploit
high severity 624/1000
Why? Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 Yes No Known Exploit
low severity 410/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 Yes No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579147		 Yes No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579152		 Yes No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579155		 Yes No Known Exploit
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-YARGSPARSER-560381		 No Proof of Concept
medium severity 434/1000
Why? Has a fix available, CVSS 4.4		 Time of Check Time of Use (TOCTOU)
npm:chownr:20180731		 No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: bin-links The new version differs by 14 commits.
  • f315830 chore(release): 1.1.6
  • 642cd18 fix: prevent improper clobbering of man/bin links
  • bc69419 update travis
  • 52e6525 chore(release): 1.1.5
  • b3cfd2e fix: don't filter out ./ man references
  • 181e36d github settings
  • fe39e10 chore(release): 1.1.4
  • 25a34f9 fix: sanitize and validate bin and man link targets
  • 02bb9e1 chore(deps): add npm-normalize-package-bin module
  • 24324d3 chore(release): 1.1.3
  • 5640f35 deps: cmd-shim@3.0.0
  • cfd146b test: updating CI config to match current Node LTS
  • 67351fa deps: bump devDeps
  • 9d4127b deps: bump deps

See the full diff

Package name: chownr The new version differs by 9 commits.
  • 76c21fa 1.1.0
  • e8f0dc7 auto-publish scripts
  • b196e0e add tests for old readdir support
  • e06dd8a Avoid unnecessary stats on node v10.10 and above
  • 36a93e3 use lchown to address part 1 of TOCTOU issue
  • a631d84 use lchown instead of chown, if available
  • cdd4ce7 use modern JavaScript
  • d548650 update tap
  • 924de1e update travis

See the full diff

Package name: cli-columns The new version differs by 4 commits.
  • 89eaa84 drop travis and coveralls from readme
  • 5da2489 upgrade deps, drop heavy dev deps, github actions, node 10+
  • b9e986b Update readme.md
  • ed6df24 Update copyright info

See the full diff

Package name: columnify The new version differs by 34 commits.

See the full diff

Package name: hosted-git-info The new version differs by 43 commits.

See the full diff

Package name: ini The new version differs by 3 commits.
  • 2da9039 1.3.6
  • cfea636 better git push script, before publish instead of after
  • 56d2805 do not allow invalid hazardous string as section name

See the full diff

Package name: libnpx The new version differs by 15 commits.
  • 84eeb54 chore(release): 10.2.4
  • 7a03da5 test: patch child.js test
  • 122ed5c deps: update yargs
  • fa6a282 chore(release): 10.2.3
  • 7d90a71 chore: update project settings, remove weall* stuff
  • 26a8394 chore(release): 10.2.2
  • e0eb3cb fix: install latest npm on travis for node 6
  • e8b4a7e chore: put node 6 back in travis set
  • 9a23db1 fix: correct Kat's github url
  • 3733137 fix: Update changelog to fix old issue links
  • 3192e0f v10.2.1
  • 40df81c fix: point repo at proper git remote
  • 43d68c8 fix: spurious test failure
  • f51a8d3 travis: only test on supported node versions
  • b7c8b9f fix(platform): drop node 4 and 7, add 9 and 10

See the full diff

Package name: mkdirp The new version differs by 4 commits.
  • b2e7ba0 0.5.2
  • c5b97d1 bump minimist to 1.2 to fix security issue
  • f2003bb test: add v4 and v5 to travis
  • b8629ff tools: update tap + mock-fs. Fix broken test

See the full diff

Package name: node-gyp The new version differs by 250 commits.

See the full diff

Package name: npm-lifecycle The new version differs by 7 commits.
  • cf5f5ca chore(release): 2.1.1
  • dbbfe27 deps: bump deps to fix security advisories
  • e96f550 deps: update node-gyp to v4.0.0
  • f6cef1c chore: update CI for current Node LTS
  • c137ac7 deps: bump devDeps
  • 62c07d3 deps: bump deps
  • 220cd70 fix(test): update postinstall script for fixture

See the full diff

Package name: npm-registry-fetch The new version differs by 61 commits.
  • 62ce833 chore(release): 4.0.5
  • 43a5d84 chore: remove basic auth data from logs
  • 71ab0e7 chore(release): 4.0.4
  • fc5d94c Put default timeout back to zero
  • 2e0c446 chore(release): 4.0.3
  • d7d8c58 chore: publish as latest-v4
  • 69c2977 fix: use 30s default for timeout as per README
  • fe7b129 chore(doc): document the effect of ?write=true on caching
  • ba8b4fe fix: always bypass cache when ?write=true
  • b758555 chore(release): 4.0.2
  • e3a0186 fix: Add null check on body on 401 errors
  • ff5f990 test(check-response): Added missing tests
  • 49059f0 chore(release): 4.0.1
  • 8eae5f0 fix(deps): Add explicit dependency on safe-buffer
  • 5dbd1d7 chore(release): 4.0.0
  • 0c4f060 cacache@12.0.0, infer uid from cache folder
  • 4b62980 chore(release): 3.9.1
  • 7878bbe deps: make-fetch-happen@4.0.2
  • e064215 deps: lru-cache@5.1.1
  • 4491843 chore(release): 3.9.0
  • a91f90c feat(auth): support username:password encoded legacy _auth
  • fc0e119 chore(release): 3.8.0
  • 0600986 feat(mapJson): add support for passing in json stream mapper
  • 9eb0095 chore(release): 3.7.0

See the full diff

Package name: npm-user-validate The new version differs by 2 commits.

See the full diff

Package name: npmlog The new version differs by 7 commits.

See the full diff

Package name: ssri The new version differs by 5 commits.
  • b7c8c7c chore(release): 6.0.2
  • b30dfdb fix: backport regex change from 8.0.1
  • a4337cd chore(release): 6.0.1
  • cf86553 fix(opts): use figgy-pudding to specify consumed opts
  • 97b032d deps: npm6ify pkglock

See the full diff

Package name: tar The new version differs by 59 commits.
  • 3e35515 4.4.18
  • 52b09e3 fix: prevent path escape using drive-relative paths
  • bb93ba2 fix: reserve paths properly for unicode, windows
  • 2f1bca0 fix: prune dirCache properly for unicode, windows
  • 9bf70a8 4.4.17
  • 6aafff0 fix: skip extract if linkpath is stripped entirely
  • 5c5059a fix: reserve paths case-insensitively
  • fd6accb 4.4.16
  • 53cea6e tests: run (and pass) on windows
  • 166cfc0 fix: refactoring to pass tests on Windows
  • ce5148e fix: refactoring to pass tests on Windows
  • 3f2e2da fix: normalize paths on Windows systems
  • e29a665 fix: properly prefix hard links
  • fd2a38d chore: WriteEntry cleaner write() handling
  • 7b2acc5 update deps
  • 83bb22c WriteEntry backpressure
  • 0dcc5b2 chore: track fs state on WriteEntry class, not in arguments
  • adf3511 Avoid an unlikely but theoretically possible redos
  • d688cad fix: properly handle top-level files when using strip
  • ea6f254 unpack: keep path reservations longer
  • b2a97e1 Address unpack race conditions using path reservations
  • f0fe3aa basic path reservation system
  • 843c897 4.4.15
  • 46fe350 Remove paths from dirCache when no longer dirs

See the full diff

Package name: update-notifier The new version differs by 42 commits.

See the full diff

With a Snyk patch:
Severity Priority Score (*) Issue Exploit Maturity
medium severity 626/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.1		 Man-in-the-Middle (MitM)
SNYK-JS-HTTPSPROXYAGENT-469131		 Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Arbitrary File Write
🦉 Arbitrary File Write
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json, package-lock.json & .snyk to reduce vulnerabilities
365fe96 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-BINLINKS-537608
- https://snyk.io/vuln/SNYK-JS-BINLINKS-537609
- https://snyk.io/vuln/SNYK-JS-BINLINKS-537610
- https://snyk.io/vuln/SNYK-JS-GOT-2932019
- https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-NPMREGISTRYFETCH-575432
- https://snyk.io/vuln/SNYK-JS-NPMUSERVALIDATE-1019352
- https://snyk.io/vuln/SNYK-JS-SSRI-1246392
- https://snyk.io/vuln/SNYK-JS-TAR-1536528
- https://snyk.io/vuln/SNYK-JS-TAR-1536531
- https://snyk.io/vuln/SNYK-JS-TAR-1536758
- https://snyk.io/vuln/SNYK-JS-TAR-1579147
- https://snyk.io/vuln/SNYK-JS-TAR-1579152
- https://snyk.io/vuln/SNYK-JS-TAR-1579155
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
- https://snyk.io/vuln/npm:chownr:20180731


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-HTTPSPROXYAGENT-469131
# for free to join this conversation on GitHub. Already have an account? # to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@bumplzz69 @snyk-bot