Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[Snyk] Security upgrade gatsby-plugin-sharp from 2.3.10 to 2.6.31 #364

Closed
wants to merge 1 commit into from
Closed

[Snyk] Security upgrade gatsby-plugin-sharp from 2.3.10 to 2.6.31 #364

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

@snyk-bot snyk-bot commented Apr 8, 2022

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • deps/npm/docs/package.json
    • deps/npm/docs/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-ASYNC-2441827		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: gatsby-plugin-sharp The new version differs by 250 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

@snyk-bot
fix: deps/npm/docs/package.json & deps/npm/docs/package-lock.json to …
b2f9390 
…reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ASYNC-2441827
@mistaken-pull-closer
Copy link

Thanks for your submission.

It appears that you've created a pull request using one of our repository's branches. Since this is
almost always a mistake, we're going to go ahead and close this. If it was intentional, please
let us know what you were intending and we can see about reopening it.

Thanks again!

@pull-dog
Copy link

pull-dog bot commented Apr 8, 2022

*Ruff* 🐶 I wasn't able to find any Docker Compose files in your repository at any of the given paths in the pull-dog.json configuration file, or the default docker-compose.yml file 😩 Make sure the given paths are correct.

Files checked:

  • docker-compose.yml
What is this?

Pull Dog is a GitHub app that makes test environments for your pull requests using Docker, from a docker-compose.yml file you specify. It takes 19 seconds to set up (we counted!) and there's a free plan available.

Visit our website to learn more.

Commands
  • @pull-dog up to reprovision or provision the server.
  • @pull-dog down to delete the provisioned server.
Troubleshooting

Need help? Don't hesitate to file an issue in our repository

Configuration

{
  "isLazy": false,
  "dockerComposeYmlFilePaths": [
    "docker-compose.yml"
  ],
  "expiry": "00:00:00",
  "conversationMode": "singleComment"
}

Trace ID
d20b0ba0-b762-11ec-8059-8e641593c1d6

@mistaken-pull-closer mistaken-pull-closer bot added the invalid This doesn't seem right label Apr 8, 2022
@guardrails
Copy link

guardrails bot commented Apr 8, 2022

⚠️ We detected 31 security issues in this pull request:

Mode: paranoid | Total findings: 31 | Considered vulnerability: 31

Vulnerable Libraries (31)
Severity Details
High acorn@7.1.0 (t) - no patch available
Medium bl@3.0.0 (t) - no patch available
Critical decompress@4.2.0 (t) - no patch available
High ini@1.3.5 (t) - no patch available
Medium hosted-git-info@2.8.5 (t) - no patch available
High glob-parent@5.1.0 (t) - no patch available
High jszip@3.5.0 (t) - no patch available
High kind-of@6.0.2 (t) - no patch available
Medium ajv@6.10.2 (t) upgrade to: >=6.12.3
Medium ansi-regex@5.0.0 (t) upgrade to: 3.0.0 || >4.1.0 || 5.0.0
High bl@3.0.0 (t) upgrade to: >=1.2.3 || =3.0.0
Medium browserslist@4.8.3 (t) upgrade to: >4.16.4
Medium cheerio@1.0.0-rc.3 (t) upgrade to: >1.0.0-rc.3
Medium color-string@1.5.3 (t) upgrade to: >=1.5.5
Critical decompress@4.2.0 (t) upgrade to: >=4.2.1
High dot-prop@4.2.0 (t) upgrade to: >=4.2.1
Medium gatsby-plugin-sharp@2.6.31 upgrade to: >=2.0.30
High get-urls@8.0.0 (t) upgrade to: >9.2.1
Medium hosted-git-info@2.8.5 (t) upgrade to: >=2.8.9 || >=3.0.8
High ini@1.3.5 (t) upgrade to: >=1.3.6
High kind-of@6.0.2 (t) upgrade to: >6.0.2
High lodash@4.17.15 (t) upgrade to: >4.17.20
High mdast-util-to-hast@3.0.4 (t) upgrade to: >6.0.2
Critical mkdirp@0.5.1 (t) upgrade to: >0.5.1
High normalize-url@4.5.0 (t) upgrade to: >4.5.0
Medium path-parse@1.0.6 (t) upgrade to: >=1.0.7
Medium postcss@7.0.26 (t) upgrade to: >7.0.35
High postcss-svgo@4.0.2 (t) upgrade to: >5.0.0-rc.2
High remark@10.0.1 (t) upgrade to: >12.0.1
High simple-get@3.1.0 (t) upgrade to: >3.1.0
High tar@5.0.5 (t) upgrade to: >5.0.9

More info on how to fix Vulnerable Libraries in General and JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

# for free to join this conversation on GitHub. Already have an account? # to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
invalid This doesn't seem right
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@snyk-bot