Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 50 vulnerabilities #57

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 50 vulnerabilities #57

wants to merge 1 commit into from

Conversation

wmurphysnyk
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 482/1000
Why? Proof of Concept exploit, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 No Proof of Concept
high severity /1000
Why?		 Use of Weak Hash
SNYK-JS-CRYPTOJS-6028119		 No No Known Exploit
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-DOTTIE-3332763		 No Proof of Concept
high severity /1000
Why?		 Denial of Service (DoS)
SNYK-JS-ENGINEIO-3136336		 No No Known Exploit
medium severity /1000
Why?		 Directory Traversal
SNYK-JS-GRUNT-2635969		 No Proof of Concept
medium severity /1000
Why?		 Race Condition
SNYK-JS-GRUNT-2813632		 No Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 No Proof of Concept
high severity /1000
Why?		 Command Injection
SNYK-JS-LODASH-1040724		 No Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-LODASH-450202		 No Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-LODASH-608086		 No Proof of Concept
high severity /1000
Why?		 Prototype Pollution
SNYK-JS-LODASH-73638		 No Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		 No Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 No No Known Exploit
high severity /1000
Why?		 Directory Traversal
SNYK-JS-MOMENT-2440688		 No No Known Exploit
high severity /1000
Why?		 Prototype Poisoning
SNYK-JS-QS-3153490		 No Proof of Concept
medium severity /1000
Why?		 Validation Bypass
SNYK-JS-SANITIZEHTML-1070780		 Yes Proof of Concept
medium severity /1000
Why?		 Access Restriction Bypass
SNYK-JS-SANITIZEHTML-1070786		 Yes No Known Exploit
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SANITIZEHTML-2957526		 Yes No Known Exploit
critical severity /1000
Why?		 Arbitrary Code Execution
SNYK-JS-SANITIZEHTML-585892		 Yes No Known Exploit
high severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 No Proof of Concept
critical severity /1000
Why?		 SQL Injection
SNYK-JS-SEQUELIZE-2932027		 Yes Proof of Concept
high severity /1000
Why?		 SQL Injection
SNYK-JS-SEQUELIZE-2959225		 Yes No Known Exploit
high severity /1000
Why?		 Improper Filtering of Special Elements
SNYK-JS-SEQUELIZE-3324088		 Yes No Known Exploit
medium severity /1000
Why?		 Information Exposure
SNYK-JS-SEQUELIZE-3324089		 Yes No Known Exploit
medium severity /1000
Why?		 Access of Resource Using Incompatible Type ('Type Confusion')
SNYK-JS-SEQUELIZE-3324090		 Yes No Known Exploit
high severity /1000
Why?		 Denial of Service (DoS)
SNYK-JS-SQLITE3-2388645		 No Proof of Concept
high severity /1000
Why?		 Arbitrary Code Execution
SNYK-JS-SQLITE3-3358947		 No No Known Exploit
high severity /1000
Why?		 Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 No No Known Exploit
high severity /1000
Why?		 Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 No No Known Exploit
low severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 No No Known Exploit
high severity /1000
Why?		 Arbitrary File Write
SNYK-JS-TAR-1579147		 No No Known Exploit
high severity /1000
Why?		 Arbitrary File Write
SNYK-JS-TAR-1579152		 No No Known Exploit
high severity /1000
Why?		 Arbitrary File Write
SNYK-JS-TAR-1579155		 No No Known Exploit
critical severity /1000
Why?		 Sandbox Bypass
SNYK-JS-VM2-1585918		 No Proof of Concept
critical severity /1000
Why?		 Sandbox Bypass
SNYK-JS-VM2-2309905		 No Proof of Concept
critical severity /1000
Why?		 Arbitrary Code Execution
SNYK-JS-VM2-2990237		 No Proof of Concept
critical severity /1000
Why?		 Sandbox Bypass
SNYK-JS-VM2-3018201		 No Proof of Concept
critical severity /1000
Why?		 Sandbox Escape
SNYK-JS-VM2-5415299		 No Proof of Concept
critical severity /1000
Why?		 Sandbox Escape
SNYK-JS-VM2-5422057		 No Proof of Concept
critical severity /1000
Why?		 Improper Handling of Exceptional Conditions
SNYK-JS-VM2-5426093		 No No Known Exploit
high severity /1000
Why?		 Uninitialized Memory Exposure
npm:base64url:20180511		 Yes Mature
high severity /1000
Why?		 Authentication Bypass
npm:jsonwebtoken:20150331		 Yes Proof of Concept
high severity /1000
Why?		 Forgeable Public/Private Tokens
npm:jws:20160726		 Yes No Known Exploit
medium severity /1000
Why?		 Prototype Pollution
npm:lodash:20180130		 No Proof of Concept
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
npm:moment:20160126		 No No Known Exploit
medium severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
npm:moment:20161019		 No No Known Exploit
low severity /1000
Why?		 Regular Expression Denial of Service (ReDoS)
npm:moment:20170905		 No No Known Exploit
medium severity /1000
Why?		 Cross-site Scripting (XSS)
npm:sanitize-html:20141024		 No No Known Exploit
medium severity /1000
Why?		 Cross-site Scripting (XSS)
npm:sanitize-html:20160801		 No No Known Exploit
medium severity /1000
Why?		 Cross-site Scripting (XSS)
npm:sanitize-html:20161026		 No Mature

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: body-parser The new version differs by 16 commits.

See the full diff

Package name: dottie The new version differs by 6 commits.

See the full diff

Package name: express The new version differs by 30 commits.

See the full diff

Package name: grunt The new version differs by 21 commits.

See the full diff

Package name: juicy-chat-bot The new version differs by 13 commits.

See the full diff

Package name: semver The new version differs by 82 commits.

See the full diff

Package name: sequelize The new version differs by 250 commits.
  • d3f5b5a feat: throw an error if attribute includes parentheses (fixes CVE-2023-22578) (#15710)
  • 53bd9b7 meta: fix null test getWhereConditions (#15705)
  • 13f2e89 fix: accept undefined in where (#15703)
  • d9e0728 fix: throw if where receives an invalid value (#15699)
  • 48d6193 fix: update moment-timezone version (#15685)
  • fd4afa6 feat(types): use retry-as-promised types for retry options to match documentation (#15484)
  • 1247c01 feat: add support for bigints (backport of #14485) (#15413)
  • 94beace feat(postgres): add support for lock_timeout [#15345] (#15355)
  • 7885000 fix(oracle): remove hardcoded maxRows value (#15323)
  • bc39fd6 fix: fix parameters not being replaced when after $$ strings (#15307)
  • a205765 fix(postgres): invalidate connection after client-side timeout (#15283)
  • 67e69cd fix: remove options.model overwrite on bulkUpdate (#15252)
  • 00c6da3 fix(types): add instance.dataValues property to model.d.ts (#15240)
  • bf98d7c meta: swap Slack links (#15159)
  • 7990095 fix: don't treat \ as escape in standard strings, support E-strings, support vars after ->> operator, treat lowercase e as valid e-string prefix (#15139)
  • 851daaf fix(types): fix TS 4.9 excessive depth error on `InferAttributes` (v6) (#15135)
  • 9dd93b8 fix(types): expose legacy "types" folder in export alias ( #15123)
  • 06ad05d feat(oracle): add support for `dialectOptions.connectString` (#15042)
  • a44772e feat(snowflake): Add support for `QueryGenerator#tableExistsQuery` (#15087)
  • 55051d0 docs: add missing ssl options for sequelize instance (v6) (#15049)
  • 5c88734 docs(model): Added paranoid option for Model.BelongsToMany.through (#15065)
  • 7203b66 fix(postgres): add custom order direction to subQuery ordering with minified alias (#15056)
  • 5f621d7 fix(oracle): add support for Oracle DB 18c CI (#15016)
  • 3468378 feat(types): add typescript 4.8 compatibility (#14990)

See the full diff

Package name: socket.io The new version differs by 6 commits.
  • baa6804 chore(release): 2.5.0
  • f223178 fix: prevent the socket from joining a room after disconnection
  • 226cc16 fix: only set 'connected' to true after middleware execution
  • 05e1278 fix: fix race condition in dynamic namespaces
  • 22d4bdf fix: ignore packet received after disconnection
  • dfded53 chore: update engine.io version to 3.6.0

See the full diff

Package name: sqlite3 The new version differs by 129 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Use of Weak Hash
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json & package-lock.json to reduce vulnerabilities
4c9dfd6 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-CRYPTOJS-6028119
- https://snyk.io/vuln/SNYK-JS-DOTTIE-3332763
- https://snyk.io/vuln/SNYK-JS-ENGINEIO-3136336
- https://snyk.io/vuln/SNYK-JS-GRUNT-2635969
- https://snyk.io/vuln/SNYK-JS-GRUNT-2813632
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-MOMENT-2440688
- https://snyk.io/vuln/SNYK-JS-QS-3153490
- https://snyk.io/vuln/SNYK-JS-SANITIZEHTML-1070780
- https://snyk.io/vuln/SNYK-JS-SANITIZEHTML-1070786
- https://snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526
- https://snyk.io/vuln/SNYK-JS-SANITIZEHTML-585892
- https://snyk.io/vuln/SNYK-JS-SEMVER-3247795
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-2932027
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-2959225
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-3324088
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-3324089
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-3324090
- https://snyk.io/vuln/SNYK-JS-SQLITE3-2388645
- https://snyk.io/vuln/SNYK-JS-SQLITE3-3358947
- https://snyk.io/vuln/SNYK-JS-TAR-1536528
- https://snyk.io/vuln/SNYK-JS-TAR-1536531
- https://snyk.io/vuln/SNYK-JS-TAR-1536758
- https://snyk.io/vuln/SNYK-JS-TAR-1579147
- https://snyk.io/vuln/SNYK-JS-TAR-1579152
- https://snyk.io/vuln/SNYK-JS-TAR-1579155
- https://snyk.io/vuln/SNYK-JS-VM2-1585918
- https://snyk.io/vuln/SNYK-JS-VM2-2309905
- https://snyk.io/vuln/SNYK-JS-VM2-2990237
- https://snyk.io/vuln/SNYK-JS-VM2-3018201
- https://snyk.io/vuln/SNYK-JS-VM2-5415299
- https://snyk.io/vuln/SNYK-JS-VM2-5422057
- https://snyk.io/vuln/SNYK-JS-VM2-5426093
- https://snyk.io/vuln/npm:base64url:20180511
- https://snyk.io/vuln/npm:jsonwebtoken:20150331
- https://snyk.io/vuln/npm:jws:20160726
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:moment:20160126
- https://snyk.io/vuln/npm:moment:20161019
- https://snyk.io/vuln/npm:moment:20170905
- https://snyk.io/vuln/npm:sanitize-html:20141024
- https://snyk.io/vuln/npm:sanitize-html:20160801
- https://snyk.io/vuln/npm:sanitize-html:20161026
This was referenced Dec 19, 2023
Open
Open
@wmurphysnyk wmurphysnyk mentioned this pull request Jan 8, 2024
Open
@wmurphysnyk wmurphysnyk mentioned this pull request Apr 11, 2024
Open
@wmurphysnyk wmurphysnyk mentioned this pull request May 13, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@wmurphysnyk @snyk-bot