Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[Snyk] Security upgrade prismjs from 1.21.0 to 1.25.0 #340

Closed
wants to merge 1 commit into from
Closed

[Snyk] Security upgrade prismjs from 1.21.0 to 1.25.0 #340

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • deps/npm/docs/package.json
    • deps/npm/docs/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-PRISMJS-1585202		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: prismjs The new version differs by 250 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

@snyk-bot
fix: deps/npm/docs/package.json & deps/npm/docs/package-lock.json to …
8aa5f0f 
…reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-PRISMJS-1585202
@mistaken-pull-closer
Copy link

Thanks for your submission.

It appears that you've created a pull request using one of our repository's branches. Since this is
almost always a mistake, we're going to go ahead and close this. If it was intentional, please
let us know what you were intending and we can see about reopening it.

Thanks again!

@mistaken-pull-closer mistaken-pull-closer bot added the invalid This doesn't seem right label Sep 18, 2021
@pull-dog
Copy link

pull-dog bot commented Sep 18, 2021

*Ruff* 🐶 I wasn't able to find any Docker Compose files in your repository at any of the given paths in the pull-dog.json configuration file, or the default docker-compose.yml file 😩 Make sure the given paths are correct.

Files checked:

  • docker-compose.yml
What is this?

Pull Dog is a GitHub app that makes test environments for your pull requests using Docker, from a docker-compose.yml file you specify. It takes 19 seconds to set up (we counted!) and there's a free plan available.

Visit our website to learn more.

Commands
  • @pull-dog up to reprovision or provision the server.
  • @pull-dog down to delete the provisioned server.
Troubleshooting

Need help? Don't hesitate to file an issue in our repository

Configuration

{
  "isLazy": false,
  "dockerComposeYmlFilePaths": [
    "docker-compose.yml"
  ],
  "expiry": "00:00:00",
  "conversationMode": "singleComment"
}

Trace ID
09ff8b20-18cc-11ec-986a-f2c3f75a3361

@guardrails
Copy link

guardrails bot commented Sep 18, 2021

⚠️ We detected 14 security issues in this pull request:

Mode: paranoid | Total findings: 14 | Considered vulnerability: 14

Vulnerable Libraries (14)
Severity Details
Medium acorn@7.1.0 (t) upgrade to: >5.7.3 || >6.4.0 || >7.1.0
High bl@3.0.0 (t) upgrade to: >1.2.2 || >2.2.0 || 3.0.0 || >4.0.2
Medium browserslist@4.8.3 (t) upgrade to: >4.16.4
High decompress@4.2.0 (t) upgrade to: >=4.2.1
High dot-prop@4.2.0 (t) upgrade to: >=4.2.1 || >=5.1.1
High get-urls@8.0.0 (t) upgrade to: >9.2.1
Medium hosted-git-info@2.8.5 (t) upgrade to: >=2.8.9 || >=3.0.8
High lodash@4.17.15 (t) upgrade to: >4.17.20
High meow@3.7.0 (t) upgrade to: >5.0.0
High normalize-url@4.5.0 (t) upgrade to: >4.5.0 || >5.3.0 || 6.0.0
Medium path-parse@1.0.6 (t) upgrade to: >=1.0.7
Medium postcss@7.0.26 (t) upgrade to: >7.0.35 || >8.2.9
High remark@10.0.1 (t) upgrade to: >12.0.1
High tar@5.0.5 (t) upgrade to: >4.4.17 || >5.0.9 || >6.1.8

More info on how to fix Vulnerable Libraries in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

# for free to join this conversation on GitHub. Already have an account? # to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
invalid This doesn't seem right
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@snyk-bot