Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 10 vulnerabilities #1

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 10 vulnerabilities #1

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Prototype Pollution
SNYK-JS-AJV-584908		 Yes No Known Exploit
medium severity 526/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.1		 Arbitrary Code Injection
SNYK-JS-EJS-1049328		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Remote Code Execution (RCE)
SNYK-JS-HANDLEBARS-1056767		 No Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-HANDLEBARS-1279029		 No Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Prototype Pollution
SNYK-JS-HANDLEBARS-567742		 No Proof of Concept
medium severity 520/1000
Why? Has a fix available, CVSS 5.9		 Regular Expression Denial of Service (ReDoS )
SNYK-JS-MARKED-584281		 Yes No Known Exploit
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-REDIS-1255645		 Yes No Known Exploit
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-YARGSPARSER-560381		 No Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:eslint:20180222		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: connect-redis The new version differs by 4 commits.

See the full diff

Package name: eslint The new version differs by 250 commits.
  • 22ff6f3 4.18.2
  • 817b84b Build: changelog update for 4.18.2
  • 6b71fd0 Fix: [email protected], because 4.0.3 needs "ajv": "^6.0.1" (#10022)
  • 3c697de Chore: fix incorrect comment about linter.verify return value (#10030)
  • 9df8653 Chore: refactor parser-loading out of linter.verify (#10028)
  • f6901d0 Fix: remove catastrophic backtracking vulnerability (fixes #10002) (#10019)
  • e4f52ce Chore: Simplify dataflow in linter.verify (#10020)
  • 33177cd Chore: make library files non-executable (#10021)
  • 558ccba Chore: refactor directive comment processing (#10007)
  • 18e15d9 Chore: avoid useless catch clauses that just rethrow errors (#10010)
  • a1c3759 Chore: refactor populating configs with defaults in linter (#10006)
  • aea07dc Fix: Make max-len ignoreStrings ignore JSXText (fixes #9954) (#9985)
  • 8c237d8 4.18.1
  • 537b5c3 Build: changelog update for 4.18.1
  • f417506 Fix: ensure no-await-in-loop reports the correct node (fixes #9992) (#9993)
  • 3e99363 Docs: Fixed typo in key-spacing rule doc (#9987)
  • 7c2cd70 Docs: deprecate experimentalObjectRestSpread (#9986)
  • 883a2a2 4.18.0
  • 89d55ca Build: changelog update for 4.18.0
  • 70f22f3 Chore: Apply memoization to config creation within glob utils (#9944)
  • 0e4ae22 Update: fix indent bug with binary operators/ignoredNodes (fixes #9882) (#9951)
  • 47ac478 Update: add named imports and exports for object-curly-newline (#9876)
  • e8efdd0 Fix: support Rest/Spread Properties (fixes #9885) (#9943)
  • f012b8c Fix: support Async iteration (fixes #9891) (#9957)

See the full diff

Package name: hbs The new version differs by 56 commits.

See the full diff

Package name: marked The new version differs by 250 commits.

See the full diff

Package name: mocha The new version differs by 16 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

@pull-request-quantifier-deprecated
Copy link

This PR has 12 quantified lines of changes. In general, a change size of upto 200 lines is ideal for the best PR experience!

Quantification details 

Label      : Extra Small
Size       : +6 -6
Percentile : 4.8%

Total files changed: 1

Change summary by file extension:
.json : +6 -6

Change counts above are quantified counts, based on the PullRequestQuantifier customizations.

Why proper sizing of changes matters

Optimal pull request sizes drive a better predictable PR flow as they strike a
balance between between PR complexity and PR review overhead. PRs within the
optimal size (typical small, or medium sized PRs) mean:

  • Fast and predictable releases to production:
    • Optimal size changes are more likely to be reviewed faster with fewer
      iterations.
    • Similarity in low PR complexity drives similar review times.
  • Review quality is likely higher as complexity is lower:
    • Bugs are more likely to be detected.
    • Code inconsistencies are more likely to be detetcted.
  • Knowledge sharing is improved within the participants:
    • Small portions can be assimilated better.
  • Better engineering practices are exercised:
    • Solving big problems by dividing them in well contained, smaller problems.
    • Exercising separation of concerns within the code changes.

What can I do to optimize my changes

  • Use the PullRequestQuantifier to quantify your PR accurately
    • Create a context profile for your repo using the context generator
    • Exclude files that are not necessary to be reviewed or do not increase the review complexity. Example: Autogenerated code, docs, project IDE setting files, binaries, etc. Check out the Excluded section from your prquantifier.yaml context profile.
    • Understand your typical change complexity, drive towards the desired complexity by adjusting the label mapping in your prquantifier.yaml context profile.
    • Only use the labels that matter to you, see context specification to customize your prquantifier.yaml context profile.
  • Change your engineering behaviors
    • For PRs that fall outside of the desired spectrum, review the details and check if:
      • Your PR could be split in smaller, self-contained PRs instead
      • Your PR only solves one particular issue. (For example, don't refactor and code new features in the same PR).

How to interpret the change counts in git diff output

  • One line was added: +1 -0
  • One line was deleted: +0 -1
  • One line was modified: +1 -1 (git diff doesn't know about modified, it will
    interpret that line like one addition plus one deletion)
  • Change percentiles: Change characteristics (addition, deletion, modification)
    of this PR in relation to all other PRs within the repository.

Was this comment helpful? 👍  :ok_hand:  :thumbsdown: (Email)
Customize PullRequestQuantifier for this repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
Extra Small
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@snyk-bot