Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 11 vulnerabilities #50

Merged
merged 1 commit into from
Feb 14, 2023
Merged

[Snyk] Fix for 11 vulnerabilities #50

merged 1 commit into from
Feb 14, 2023

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-EXPRESSFILEUPLOAD-473997		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-EXPRESSFILEUPLOAD-595969		 Yes Proof of Concept
medium severity 701/1000
Why? Mature exploit, Has a fix available, CVSS 6.3		 Cross-site Scripting (XSS)
SNYK-JS-JQUERY-565129		 Yes Mature
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Arbitrary Code Execution
SNYK-JS-JSYAML-174129		 Yes No Known Exploit
high severity 741/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.4		 DLL Injection
SNYK-JS-KERBEROS-568900		 No Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:fresh:20170908		 No No Known Exploit
high severity 654/1000
Why? Has a fix available, CVSS 8.8		 Cross-site Scripting (XSS)
npm:marked:20150520		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Cross-site Scripting (XSS)
npm:marked:20170112		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Cross-site Scripting (XSS)
npm:marked:20170815		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:marked:20170907		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:marked:20180225		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: express The new version differs by 250 commits.

See the full diff

Package name: express-fileupload The new version differs by 250 commits.

See the full diff

Package name: marked The new version differs by 250 commits.

See the full diff

Package name: mongoose The new version differs by 35 commits.
  • de88912 release 4.2.5
  • fae7c94 fix; correctly handle changes in update hook (Fix #3549)
  • 5e58d83 repro; #3549
  • 68e394d fix; dont flatten empty arrays in updateValidators (Fix #3554)
  • f0b0f61 repro; #3554
  • 73de49c fix; proper support for .update(doc) (Fix #3221)
  • b5329a1 repro; #3221
  • 932cdbe upgrade; node driver -> 2.0.48 (re: #3544)
  • 6ff39ef fix; unhandled rejection using Query.then() (Fix #3543)
  • 8cccafb Merge pull request #3548 from ChristianMurphy/node-5
  • 2ff09cc Merge pull request #3547 from ChristianMurphy/eslint-update
  • 6d0df2f Test against Node 4 LTS and Node 5 Stable
  • fc3f645 update ESLint and add a lint script to the package.json
  • aac346a Update README examples to comma last style
  • 352d80d fix; ability to use mongos for standalones (Fix #3537)
  • 043c958 repro; #3537
  • 4023f12 docs; fix bad connection string example
  • a55fba7 fix; allow undefined for min/max validators (Fix #3539)
  • cfc3194 repro; #3539
  • a2a3b8b fix; issue with fix for #3535
  • 171e694 docs; deep populate docs (Fix #3528)
  • 0922d78 fix; call toObject() when setting single embedded schema to doc (Fix #3535)
  • ce11be0 repro; #3535
  • b3472ac fix; apply methods to single embedded schemas (Fix #3534)

See the full diff

Package name: tap The new version differs by 250 commits.
  • fe8158e 11.1.3
  • b17542d Upgrade deps (changing semver requirements)
  • bc3ba17 update deps
  • bd4de92 Clean up nyc output so Travis passes on node 6
  • 2292432 Add hexagonal-lambda to the tap 100 list
  • fed62c9 Merge remote-tracking branch 'origin/master'
  • 3cdf1c7 11.1.2
  • ddf938b Only ship files we want to ship
  • 5b5e2ee docs: add unique page titles
  • 2323c3b Merge tag 'v11.1.1'
  • 95faf6c 11.1.1
  • 283c8e6 Handle EPIPE better in exceptional edge cases
  • b727234 Fix obscure edge case when this.results is not set
  • 1699eb9 process: update docs on the master branch
  • ac366a0 docs: fix typo ('heirarchical' -> 'hierarchical')
  • 13073a7 docs: correct 100 PR link
  • b95ee22 v11.1.0
  • fcf70aa Add support for disabling autoend
  • 94be0a7 v11.0.1
  • 6c3f019 remove badges that are no longer accurate or in use
  • ae562a7 don't ignore coverage doc
  • 9fcfd52 Migrate docs into main repository
  • f189c50 v11.0.0
  • 5cde128 Merge branch 'v11'

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Prototype Pollution
🦉 Cross-site Scripting (XSS)
🦉 More lessons are available in Snyk Learn

@brianbresnahan brianbresnahan merged commit 81f0c3e into master Feb 14, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@snyk-bot @brianbresnahan