Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 34 vulnerabilities #77

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 34 vulnerabilities #77

wants to merge 1 commit into from

Conversation

cstephanos
Copy link

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIHTML-1296849		 No Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ASYNCVALIDATOR-2311201		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-BROWSERSLIST-1090194		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-D3COLOR-1076592		 Yes Proof of Concept
medium severity 526/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.1		 Arbitrary Code Injection
SNYK-JS-EJS-1049328		 Yes Proof of Concept
high severity 726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1		 Remote Code Execution (RCE)
SNYK-JS-EJS-2803307		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
medium severity 504/1000
Why? Has a fix available, CVSS 5.8		 Prototype Pollution
SNYK-JS-HIGHLIGHTJS-1045326		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HIGHLIGHTJS-1048676		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-IMMER-1019369		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-IMMER-1540542		 Yes Proof of Concept
medium severity 429/1000
Why? Has a fix available, CVSS 4.3		 Reverse Tabnabbing
SNYK-JS-ISTANBULREPORTS-2328088		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Denial of Service (DoS)
SNYK-JS-JSZIP-1251497		 No Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Directory Traversal
SNYK-JS-MOMENT-2440688		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOMENT-2944238		 No Proof of Concept
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Information Exposure
SNYK-JS-NODEFETCH-2342118		 Yes No Known Exploit
medium severity 520/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service
SNYK-JS-NODEFETCH-674311		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-NTHCHECK-1586032		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-PRISMJS-1076581		 Yes Proof of Concept
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-PRISMJS-1314893		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-PRISMJS-1585202		 Yes Proof of Concept
medium severity 484/1000
Why? Has a fix available, CVSS 5.4		 Cross-site Scripting (XSS)
SNYK-JS-PRISMJS-2404333		 Yes No Known Exploit
high severity 629/1000
Why? Has a fix available, CVSS 8.3		 Cross-site Scripting (XSS)
SNYK-JS-PRISMJS-597628		 Yes No Known Exploit
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Command Injection
SNYK-JS-REACTDEVUTILS-1083268		 Yes Proof of Concept
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Remote Code Execution (RCE)
SNYK-JS-SHELLQUOTE-1766506		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-STYLELINT-1585622		 Yes No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-STYLELINT-460283		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TRIM-1017038		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-TRIMNEWLINES-1298042		 Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-UGLIFYJS-1727251		 Yes No Known Exploit
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-YARGSPARSER-560381		 Yes Proof of Concept
medium severity 469/1000
Why? Has a fix available, CVSS 5.1		 Prototype Pollution
SNYK-JS-ZRENDER-1586253		 Yes No Known Exploit
medium severity 469/1000
Why? Has a fix available, CVSS 5.1		 Denial of Service (DoS)
npm:mem:20180117		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @gen3/guppy The new version differs by 1 commits.

See the full diff

Package name: @gen3/ui-component The new version differs by 3 commits.

See the full diff

Package name: @storybook/addon-actions The new version differs by 250 commits.
  • e89e51a v6.1.0
  • d004d19 Update root, peer deps, version.ts/json to 6.1.0
  • 1d07f01 6.1.0 changelog
  • 178e9bd 6.1.0-rc.6 next.json version file
  • 971eccd Update git head to 6.1.0-rc.6
  • 9009e53 v6.1.0-rc.6
  • eaceece Update root, peer deps, version.ts/json to 6.1.0-rc.6
  • 5c0049b 6.1.0-rc.6 changelog
  • 76d53b5 Merge pull request #13165 from storybookjs/13156-fix-cached-manager
  • 4747fea Merge pull request #12845 from Tomastomaslol/12324_zoom_buttons_in_docs_do_not_work
  • 74693f4 Drop the cache prop from managerConfig to make caching work on the 2nd run.
  • 428b6e0 6.1.0-rc.5 next.json version file
  • a72852d Update git head to 6.1.0-rc.5
  • a8822ed v6.1.0-rc.5
  • 6deb946 Update root, peer deps, version.ts/json to 6.1.0-rc.5
  • 06b55c8 update 6.1-rc.5
  • 875b933 Merge branch 'next' of github.com:storybookjs/storybook into next
  • f701930 Merge pull request #13141 from ThibaudAV/update-angular-ex
  • c8a819d Merge pull request #13162 from S1ngS1ng/patch-1
  • cd7766e 6.1.0-rc.5 changelog addition
  • 45ddc0c Merge pull request #13159 from storybookjs/12386-ie11-layout-centered
  • f2123da 6.1.0-rc.5 changelog
  • 30c5e98 fix incorrect component reference
  • f6d4f0a Merge pull request #13155 from storybookjs/feature/sidebarClassNames

See the full diff

Package name: @storybook/cli The new version differs by 250 commits.
  • 7d4d6ab v6.4.0
  • 86e2d61 Update root, peer deps, version.ts/json to 6.4.0 [ci skip]
  • ec6fd3b 6.4.0 changelog
  • b88d2d9 6.4.0-rc.11 next.json version file
  • 2d78019 Update git head to 6.4.0-rc.11, update yarn.lock
  • 77eb43c v6.4.0-rc.11
  • ca91e77 Update root, peer deps, version.ts/json to 6.4.0-rc.11 [ci skip]
  • 52ed4b0 6.4.0-rc.11 changelog
  • 4f23295 Merge pull request #16795 from SebastienGllmt/patch-1
  • d443c73 Fix breaking changing process/browser
  • 16678e0 6.4.0-rc.10 next.json version file
  • 0e8f1c2 Update git head to 6.4.0-rc.10, update yarn.lock
  • 5ae60fc v6.4.0-rc.10
  • 135ca93 Update root, peer deps, version.ts/json to 6.4.0-rc.10 [ci skip]
  • a89d8e9 6.4.0-rc.10 changelog
  • 68c4086 Merge pull request #16791 from storybookjs/16756-argTypes-storiesOf
  • 0a03181 Merge pull request #16788 from storybookjs/16767-sort-stories-index
  • 8b4b8fc Merge pull request #16783 from storybookjs/remove-missing-console-error
  • 465a4be Merge branch 'next' into 16756-argTypes-storiesOf
  • 1799997 Merge pull request #16792 from storybookjs/16745-fix-docs-story-rendered
  • 38aadfc Merge pull request #16790 from storybookjs/16743-argTypeTargets-no-args
  • 068ee39 Fix typo
  • 809b59e Remove console log
  • 1636334 Wait for the story component to render before emitting

See the full diff

Package name: @storybook/react The new version differs by 250 commits.
  • 829c72e v6.2.0
  • f8bfee0 Update root, peer deps, version.ts/json to 6.2.0
  • 2814acc CLI: Don't update versions.json on CLI prepare
  • 637daa1 Update 6.2 changelog
  • c760793 6.2 release
  • 5595b1e Merge pull request #14348 from gabiseabra/fix/issue_13771
  • a686a99 6.2.0-rc.13 next.json version file
  • 6be8b92 Update git head to 6.2.0-rc.13
  • c1dfd5b v6.2.0-rc.13
  • 4ef7b5a Update root, peer deps, version.ts/json to 6.2.0-rc.13
  • d954d50 6.2.0-rc.13 changelog
  • 1913c92 Merge pull request #14390 from YozhEzhi/patch-1
  • ee98e0e Merge branch 'next' of github.com:storybookjs/storybook into next
  • a8aadc4 Update CHANGELOG.md
  • 44eca58 Merge pull request #14392 from storybookjs/fix-raw-toggle
  • f10ef90 Merge pull request #14391 from YozhEzhi/patch-3
  • b1ee5e9 Prevent invalid initial color to be accepted as preset
  • 2c6b796 Color picker can't deal with 'transparent' keyword
  • 6951762 Don't show RAW toggle when data isn't representable by REJT
  • 259b12a Update my-component-story-use-globaltype.js.mdx
  • a8a846b Update my-component-story-use-globaltype.mdx.mdx
  • 57fc3cd 6.2.0-rc.12 next.json version file
  • ba0f535 Fix changelog
  • 6ec5750 Update git head to 6.2.0-rc.12

See the full diff

Package name: antd The new version differs by 250 commits.
  • 870b72a docs: 4.17.0 changelog (#32859)
  • 3a5b6b8 chore(deps-dev): bump stylelint-config-standard from 23.0.0 to 24.0.0 (#32866)
  • 7e2dc80 chore(.gitignore):add ignore for pnpm (#32860)
  • 491cc4f fix: borderLeftRadius error for Input.Search #32808 (#32812)
  • 958df3d docs: add demo for Input.Group (#32837)
  • ce006bd docs: Version Robin (#32830)
  • 3f495bb chore: Upgrade react router v6 (#32821)
  • 43569b9 docs: update customize-theme-variable.zh-CN.md
  • 7ed7c60 style: fix Tree icon align bug (#32822)
  • 01887b4 fix: if breadcrumbRender return false, breadcrumb will hidden (#32738)
  • 5f642cb fix: tag animation demo (#32804)
  • 852a451 chore(Tag): update tween-one (#32800)
  • 90aff3a docs: fix Spin API ts description (#32786)
  • 8a3b5d9 fix: Form horizontal broken style when select item is too long (#32778)
  • a73f4a3 docs: Fix the link in Table's API doc (#32779)
  • ecc54dd fix: codepen demo error using hooks (#32766)
  • cf15379 docs: add 4.17.0-alpha.10 changelog (#32775)
  • f7380b7 chore(deps-dev): bump eslint-plugin-unicorn from 37.0.1 to 38.0.0 (#32765)
  • b1ea2e4 fix: opening animation of the bottom drawer (#32761)
  • 10a8578 fix: Spin tip can be react node (#32733)
  • fa65cd3 chore(deps-dev): bump @ types/gtag.js from 0.0.7 to 0.0.8 (#32746)
  • f88bd4d refactor: Move part mixins less to theme instead (#32763)
  • 5360722 chore: update form demo
  • ea52572 chore(💄): fix issue template

See the full diff

Package name: d3-scale The new version differs by 168 commits.

See the full diff

Package name: d3-transition The new version differs by 39 commits.

See the full diff

Package name: d3-zoom The new version differs by 36 commits.

See the full diff

Package name: echarts The new version differs by 250 commits.
  • 1c70026 Merge pull request #15745 from apache/release-dev
  • 21d6317 release 5.2.1
  • 5ff6216 Merge pull request #15735 from apache/series-type-register
  • a11d9af feat(type): provide ability to extend series option
  • b29726d Merge pull request #15732 from apache/master
  • 6384acf Merge pull request #15731 from apache/fix-line-animation
  • 4824ada fix(line): fix animation is not stopped when direct update points.
  • 26e9a95 Merge pull request #15720 from apache/fix-legend-symbol-keep-aspect
  • 5d667ec Merge pull request #15722 from williamorim/ptBRlang
  • add3f76 chaging double quotes for single quotes
  • b98affc Adding pt-BR lang file
  • 6641951 Merge pull request #15683 from apache/fix-tooltip
  • 35e3511 fix(legend): add back symbolKeepAspect. optimize code logic.
  • 233d2a1 Merge pull request #15715 from apache/fix-test
  • 3bea75a test: optimize test cases for visual regression test
  • bdafcbc Merge pull request #15711 from apache/fix-line-gradient
  • fde66ec Merge pull request #15589 from apache/fix-polar
  • fc507c0 test(polar): update test case
  • d88f7cb Merge pull request #15712 from apache/axis-hide-overlap
  • 7dbf36c fix(time): add `axisLabel.hideOverlap`
  • 344b648 fix(line): soft clipping gradient.
  • 01bf5f1 Merge pull request #15706 from apache/fix-sunburst
  • dd1890b fix(sunburst): improve code
  • c5fcf82 fix(sunburst): radius in levels

See the full diff

Package name: html-webpack-plugin The new version differs by 250 commits.
  • 873d75b chore(release): 5.5.0
  • ddeb774 chore: update examples
  • 1e42625 feat: Support type=module via scriptLoading option
  • 7d3645b Bump pretty-error to 4.0.0 to fix transitive vuln for ansi-regex CVE-2021-3807
  • 79be779 [chore] changes actions to run on pull_requests
  • b7e5859 [chore] fixes CI to avoid race conditions
  • 48131d3 chore(release): 5.4.0
  • 16a841a [chore] rebuild examples
  • 3bb7c17 Update index.js
  • e38ac97 Update index.js
  • f08bd02 [chore] updates fixtures
  • d62a10f [chore] upgrades [email protected] -> 6.0.2
  • 2f5de7a Remove archived plugin
  • 8f8f7c5 chore(release): 5.3.2
  • 053c6e6 chore: update snapshot tests for webpack 5.4.0
  • 9c7fba0 Fix security vulnerabilities
  • b98fbeb Fix security vulnerabilities
  • 25cdfc7 Added inject-body-webpack-plugin to readme
  • 0e4c1fb Update README to document actual behavior
  • 0a6568d chore(release): 5.3.1
  • 82d0ee8 fix: remove loader-utils from plugin core
  • 6f39192 chore(release): 5.3.0
  • d654f5b feat: allow to modify the interpolation options in webpack config
  • 41d7a50 feat: drop loader-utils dependency

See the full diff

Package name: isomorphic-fetch The new version differs by 12 commits.

See the full diff

Package name: jest The new version differs by 22 commits.
  • ff9269b chore: bump most dated deps (#8850)
  • 7594141 chore: upgrade to eslint@6 (#8855)
  • b33ce0d chore: upgrade to micromatch v4 (#8852)
  • d6ff72a chore: add node 12 to CI (#8411)
  • 7e9b4ea chore: upgrade jsdom (#8851)
  • 4bb7a2d Use `weak-napi` instead of `weak` in `jest-leak-detector`
  • ce47c6c Get rid of Node 6 support (#8455)
  • bc5c3c7 jest-snapshot: Remove only the added newlines in multiline snapshots (#8859)
  • d523fa8 bug.md: highlights placeholder should be removed (#8836)
  • 08f109c expect: Display expectedDiff more carefully in toBeCloseTo (#8389)
  • b09de2d chore: bump node-notifier for node v6 support
  • 557a39f fix(linter): Fix linting failure introduced in #8847 😓 (#8849)
  • 012472b fix(docs): Update broken links in docs. (#8847)
  • ee2bea1 chore: sort member in imports (#8846)
  • 9ba4594 add Chinese Jest work with AngularJS tutorial (#8828)
  • 0e5b363 chore: reduce reliance on esModuleInterop (#8842)
  • d69f8d3 getTimerCount will not include cancelled immediates (#8764)
  • b4bd77b Fix grammar: "your jest's config"->"your Jest..." (#8843)
  • 54b3dcf Fix grammar: "a known issues"->"a known issue" (#8844)
  • e76c7da docs: update matchMedia methods (#8835)
  • 23b9860 chore: roll new version of docs
  • 3cdbd55 Release 24.9.0

See the full diff

Package name: jszip The new version differs by 9 commits.

See the full diff

Package name: node-fetch The new version differs by 2 commits.

See the full diff

Package name: recharts The new version differs by 25 commits.
  • 3115b4d build 2.1.3
  • 6f2551e fix: Customized component has no key (#2637)
  • f5b8414 Fix XAxis scale propery type (#2641)
  • ae02a4d Update README.md (#2649)
  • 9aba237 build 2.1.2
  • 300f726 Fix fragment children (#2481)
  • 2805e0b fixes undefined field reference when optional variables not supplied (#2630)
  • 89f3232 build 2.1.1
  • c3381af fix: responsive container (#2622)
  • 213d4a9 fix: fix format
  • 8da1b74 build 2.1.0

@snyk-bot
fix: package.json & package-lock.json to reduce vulnerabilities
15d4cdf 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIHTML-1296849
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-ASYNCVALIDATOR-2311201
- https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194
- https://snyk.io/vuln/SNYK-JS-D3COLOR-1076592
- https://snyk.io/vuln/SNYK-JS-EJS-1049328
- https://snyk.io/vuln/SNYK-JS-EJS-2803307
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-HIGHLIGHTJS-1045326
- https://snyk.io/vuln/SNYK-JS-HIGHLIGHTJS-1048676
- https://snyk.io/vuln/SNYK-JS-IMMER-1019369
- https://snyk.io/vuln/SNYK-JS-IMMER-1540542
- https://snyk.io/vuln/SNYK-JS-ISTANBULREPORTS-2328088
- https://snyk.io/vuln/SNYK-JS-JSZIP-1251497
- https://snyk.io/vuln/SNYK-JS-MOMENT-2440688
- https://snyk.io/vuln/SNYK-JS-MOMENT-2944238
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-NTHCHECK-1586032
- https://snyk.io/vuln/SNYK-JS-PRISMJS-1076581
- https://snyk.io/vuln/SNYK-JS-PRISMJS-1314893
- https://snyk.io/vuln/SNYK-JS-PRISMJS-1585202
- https://snyk.io/vuln/SNYK-JS-PRISMJS-2404333
- https://snyk.io/vuln/SNYK-JS-PRISMJS-597628
- https://snyk.io/vuln/SNYK-JS-REACTDEVUTILS-1083268
- https://snyk.io/vuln/SNYK-JS-SHELLQUOTE-1766506
- https://snyk.io/vuln/SNYK-JS-STYLELINT-1585622
- https://snyk.io/vuln/SNYK-JS-STYLELINT-460283
- https://snyk.io/vuln/SNYK-JS-TRIM-1017038
- https://snyk.io/vuln/SNYK-JS-TRIMNEWLINES-1298042
- https://snyk.io/vuln/SNYK-JS-UGLIFYJS-1727251
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
- https://snyk.io/vuln/SNYK-JS-ZRENDER-1586253
- https://snyk.io/vuln/npm:mem:20180117
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@cstephanos @snyk-bot