Skip to content
This repository was archived by the owner on Aug 22, 2024. It is now read-only.

[Snyk] Fix for 58 vulnerabilities#22

Open
jake-shobin wants to merge 1 commit intomasterfrom
snyk-fix-4b9ba7931ed9d24c512bcdc0aa4a4ca5
Open

[Snyk] Fix for 58 vulnerabilities#22
jake-shobin wants to merge 1 commit intomasterfrom
snyk-fix-4b9ba7931ed9d24c512bcdc0aa4a4ca5

Conversation

@jake-shobin
Copy link
Copy Markdown
Owner

@jake-shobin jake-shobin commented Apr 30, 2024

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Issue Breaking Change Exploit Maturity
high severity Use of Weak Hash
SNYK-JS-CRYPTOJS-6028119		 No No Known Exploit
high severity Denial of Service (DoS)
SNYK-JS-ECSTATIC-540354		 No Proof of Concept
high severity Denial of Service (DoS)
SNYK-JS-ENGINEIO-1056749		 Yes Proof of Concept
high severity Authorization Bypass
SNYK-JS-EXPRESSJWT-575022		 Yes No Known Exploit
medium severity Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116		 Yes Proof of Concept
medium severity Improper Authentication
SNYK-JS-JSONWEBTOKEN-3180022		 Yes No Known Exploit
medium severity Improper Restriction of Security Token Assignment
SNYK-JS-JSONWEBTOKEN-3180024		 Yes No Known Exploit
medium severity Use of a Broken or Risky Cryptographic Algorithm
SNYK-JS-JSONWEBTOKEN-3180026		 Yes No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 No Proof of Concept
high severity Command Injection
SNYK-JS-LODASH-1040724		 No Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-450202		 No Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-608086		 No Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-6139239		 No Proof of Concept
high severity Prototype Pollution
SNYK-JS-LODASH-73638		 No Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		 No Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		 Yes No Known Exploit
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOCHA-2863123		 Yes No Known Exploit
high severity Directory Traversal
SNYK-JS-MOMENT-2440688		 Yes No Known Exploit
medium severity Information Exposure
SNYK-JS-NANOID-2332193		 Yes Proof of Concept
medium severity Information Exposure
SNYK-JS-NODEFETCH-2342118		 No No Known Exploit
medium severity Denial of Service
SNYK-JS-NODEFETCH-674311		 No No Known Exploit
medium severity Validation Bypass
SNYK-JS-SANITIZEHTML-1070780		 Yes Proof of Concept
medium severity Access Restriction Bypass
SNYK-JS-SANITIZEHTML-1070786		 Yes No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-SANITIZEHTML-2957526		 Yes No Known Exploit
critical severity Arbitrary Code Execution
SNYK-JS-SANITIZEHTML-585892		 Yes No Known Exploit
medium severity Information Exposure
SNYK-JS-SANITIZEHTML-6256334		 Yes Proof of Concept
high severity SQL Injection
SNYK-JS-SEQUELIZE-2959225		 Yes No Known Exploit
high severity Improper Filtering of Special Elements
SNYK-JS-SEQUELIZE-3324088		 Yes No Known Exploit
medium severity Information Exposure
SNYK-JS-SEQUELIZE-3324089		 Yes No Known Exploit
medium severity Access of Resource Using Incompatible Type ('Type Confusion')
SNYK-JS-SEQUELIZE-3324090		 Yes No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-TINYMCE-1056408		 Yes No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-TINYMCE-1298037		 Yes No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-TINYMCE-1766967		 Yes No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-TINYMCE-1910225		 Yes No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-TINYMCE-3166281		 Yes No Known Exploit
high severity Cross-site Scripting (XSS)
SNYK-JS-TINYMCE-543825		 No No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-TINYMCE-568922		 No Proof of Concept
critical severity Cross-site Scripting (XSS)
SNYK-JS-TINYMCE-598223		 No No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-TINYMCE-6016276		 Yes No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-TINYMCE-6016290		 Yes No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-TINYMCE-6062167		 Yes No Known Exploit
medium severity Cross-Site Scripting (XSS)
SNYK-JS-TINYMCE-6501006		 Yes No Known Exploit
medium severity Cross-site Scripting (XSS)
SNYK-JS-TINYMCE-6501605		 Yes No Known Exploit
high severity Prototype Pollution
SNYK-JS-UNSETVALUE-2400660		 Yes No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 Yes Proof of Concept
high severity Authentication Bypass
npm:jsonwebtoken:20150331		 Yes Proof of Concept
high severity Forgeable Public/Private Tokens
npm:jws:20160726		 Yes No Known Exploit
medium severity Prototype Pollution
npm:lodash:20180130		 No Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
npm:moment:20160126		 Yes No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
npm:moment:20161019		 Yes No Known Exploit
low severity Regular Expression Denial of Service (ReDoS)
npm:moment:20170905		 Yes No Known Exploit
medium severity Cross-site Scripting (XSS)
npm:sanitize-html:20141024		 No No Known Exploit
medium severity Cross-site Scripting (XSS)
npm:sanitize-html:20160801		 No No Known Exploit
medium severity Cross-site Scripting (XSS)
npm:sanitize-html:20161026		 No Mature
high severity Cross-site Scripting (XSS)
npm:tinymce:20150610		 No No Known Exploit
high severity Cross-site Scripting (XSS)
npm:tinymce:20150813		 No No Known Exploit
high severity Cross-site Scripting (XSS)
npm:tinymce:20170613		 No No Known Exploit
medium severity Cross-site Scripting (XSS)
npm:tinymce:20180522		 No No Known Exploit
Commit messages
Package name: check-dependencies The new version differs by 55 commits.

See the full diff

Package name: glob The new version differs by 114 commits.

See the full diff

Package name: grunt-contrib-compress The new version differs by 5 commits.

See the full diff

Package name: http-server The new version differs by 71 commits.

See the full diff

Package name: jasmine The new version differs by 163 commits.
  • 51b60d2 Bump version to 5.0.0
  • 04c4bfe Fixed handling of special Glob syntax in project base dirs
  • e7f5fbd Bump version to 5.0.0-beta.0
  • 9118835 Parallel: Removed redundant cluster disconnect
  • 447408e Parallel: Report unhandled exceptions/rejections between spec files
  • fd6381a Updated to Glob 10
  • 0fc3a2d Parallel: take care of pending specs
  • 2d8ff6c --parallel=auto option
  • 81462c5 Merge branch 'main' into 5.0
  • 0aeb009 Dropped support for Node 16
  • 4fae3bd Parallel: Support use without globals
  • f00c76a Added Node 20 to supported environments
  • cd50d8d Bump version to 5.0.0-alpha.1
  • fd31a42 Parallel: handle reporter errors
  • 5592089 Revert "Revert "Include the underlying exception in ESM import exceptions""
  • 3f36187 Merge branch 'main' into 5.0
  • 5d542df Revert "Include the underlying exception in ESM import exceptions"
  • 2dcd739 Include the underlying exception in ESM import exceptions
  • ef8d05f Breaking: Treat unknown args of the form --foo=bar as errors, not env vars
  • 9ef7f0d Breaking: Treat --parallel=1 as an error rather than running in sequential mode
  • e53c593 Update to Glob 9
  • 1171314 Updated dev dependencies
  • ff30975 Bump version to 5.0.0-alpha.0
  • e0c8cd8 Cleaned up redundant jsdocs

See the full diff

Package name: jest The new version differs by 250 commits.
  • 75006e4 v29.0.0
  • 7c82a9f chore: update jest-watch-typeahead again
  • 352ff29 chore: update changelog for release
  • 33ad8c3 docs: Jest 29 blog post (#13103)
  • dda77e5 docs: collapse 28.0 and 28.1 docs (#13104)
  • c0dc84c chore: update jest-watch-typeahead
  • 05f6217 fix: support deep CJS re-exports when using ESM (#13170)
  • 490fd88 chore: update yarn (#13169)
  • 98936a2 docs: Update Enzyme links to use new URL (#13166)
  • 187566a feat(pretty-format): allow to opt out from sorting object keys with `compareKeys: null` (#12443)
  • ae2bed7 chore: tweak regex used in e2e tests (#13129)
  • 8c56d74 docs: Update Configuration.md for added special notes on usage scenarios for pnpm. (#13115)
  • fb1c53d feat(jest-config)!: remove undocumented `collectCoverageOnlyFrom` option (#13156)
  • 075b489 fix: ignore `EISDIR` when resolving symlinks (#13157)
  • 3bef02e feat(@ jest/test-result, @ jest/types)!: replace `Bytes` and `Milliseconds` types with `number` (#13155)
  • 4def94b v29.0.0-alpha.6
  • 0f00d4e fix: replace non-CLI `rimraf` usage (#13151)
  • 6a90a2c fix: Allow updating inline snapshots when test includes JSX (#12760)
  • 983274a feat: Let `babel` find config when updating inline snapshots (#13150)
  • d2ff18a chore: make prettierPath optional in `SnapshotState` (#13149)
  • 7d8d01c feat(circus): added each to failing tests (#13142)
  • a5b52a5 chore(types): separate MatcherContext, MatcherUtils and MatcherState (#13141)
  • 79b5e41 chore: get rid of peer dep warning in website
  • 812763d chore: enable 'no-duplicate-imports' (#13138)

See the full diff

Package name: mocha The new version differs by 109 commits.
  • 5f96d51 build(v10.1.0): release
  • ed74f16 build(v10.1.0): update CHANGELOG
  • 51d4746 chore(devDeps): update 'ESLint' to v8 (#4926)
  • 4e06a6f fix(browser): increase contrast for replay buttons (#4912)
  • 41567df Support prefers-color-scheme: dark (#4896)
  • 61b4b92 fix the regular expression for function `clean` in `utils.js` (#4770)
  • 77c18d2 chore: use standard 'Promise.allSettled' instead of polyfill (#4905)
  • 84b2f84 chore(ci): upgrade GH actions to latest versions (#4899)
  • 023f548 build(v10.0.0): release
  • 62b1566 build(v10.0.0): update CHANGELOG
  • fbe7a24 chore: update dependencies (#4878)
  • 2b98521 docs: replace 'git.io' short links (#4877) [ci skip]
  • 007fa65 chore(ci): add Node v18 to test matrix (#4876)
  • f6695f0 chore(esm): remove code for Node v12 (#4874)
  • 59f6192 chore(ci): conditionally skip 'push' event (#4872)
  • b863359 docs: fix 'fgrep' url (#4873)
  • baaa41a chore(ci): ignore changes to docs files (#4871)
  • ac81cc5 refactor!: drop support of 'growl' notification (#4866)
  • 3946453 chore(deps)!: upgrade 'minimatch' (#4865)
  • 592905b refactor!: rename 'bin/mocha' to 'bin/mocha.js' (#4863)
  • b7b849b refactor!: remove deprecated Runner signature (#4861)
  • 0608fa3 chore(site): fix supporters' download (#4859)
  • 785aeb1 chore(test): drop AMD/'requirejs' (#4857)
  • ed640c4 chore(devDeps): upgrade 'coffee-script' (#4856)

See the full diff

Package name: sequelize The new version differs by 250 commits.
  • d3f5b5a feat: throw an error if attribute includes parentheses (fixes CVE-2023-22578) (#15710)
  • 53bd9b7 meta: fix null test getWhereConditions (#15705)
  • 13f2e89 fix: accept undefined in where (#15703)
  • d9e0728 fix: throw if where receives an invalid value (#15699)
  • 48d6193 fix: update moment-timezone version (#15685)
  • fd4afa6 feat(types): use retry-as-promised types for retry options to match documentation (#15484)
  • 1247c01 feat: add support for bigints (backport of #14485) (#15413)
  • 94beace feat(postgres): add support for lock_timeout [#15345] (#15355)
  • 7885000 fix(oracle): remove hardcoded maxRows value (#15323)
  • bc39fd6 fix: fix parameters not being replaced when after $$ strings (#15307)
  • a205765 fix(postgres): invalidate connection after client-side timeout (#15283)
  • 67e69cd fix: remove options.model overwrite on bulkUpdate (#15252)
  • 00c6da3 fix(types): add instance.dataValues property to model.d.ts (#15240)
  • bf98d7c meta: swap Slack links (#15159)
  • 7990095 fix: don't treat \ as escape in standard strings, support E-strings, support vars after ->> operator, treat lowercase e as valid e-string prefix (#15139)
  • 851daaf fix(types): fix TS 4.9 excessive depth error on `InferAttributes` (v6) (#15135)
  • 9dd93b8 fix(types): expose legacy "types" folder in export alias ( #15123)
  • 06ad05d feat(oracle): add support for `dialectOptions.connectString` (#15042)
  • a44772e feat(snowflake): Add support for `QueryGenerator#tableExistsQuery` (#15087)
  • 55051d0 docs: add missing ssl options for sequelize instance (v6) (#15049)
  • 5c88734 docs(model): Added paranoid option for Model.BelongsToMany.through (#15065)
  • 7203b66 fix(postgres): add custom order direction to subQuery ordering with minified alias (#15056)
  • 5f621d7 fix(oracle): add support for Oracle DB 18c CI (#15016)
  • 3468378 feat(types): add typescript 4.8 compatibility (#14990)

See the full diff

Package name: socket.io The new version differs by 84 commits.
  • f8a66fd chore(release): 3.0.5
  • 752dfe3 chore: bump debug version
  • bf54327 revert: restore the socket middleware functionality
  • 170b739 fix: properly clear timeout on connection failure
  • 230cd19 chore: bump dependencies
  • a0a3481 test: fix random test failure
  • f773b48 chore: update GitHub issue templates
  • 292d62e docs(examples): update TypeScript example
  • 178e899 docs(examples): add Angular TodoMVC + Socket.IO example
  • d1bfe40 refactor: add more typing info and upgrade prettier (#3725)
  • 81c1f4e chore(release): 3.0.4
  • 1fba399 ci: migrate to GitHub Actions
  • 4e6d404 chore: make tests work on Windows (#3708)
  • 28c7cc0 style(issue-template): fix typo (#3700)
  • 06a2bd3 chore(release): 3.0.3
  • 85ebd35 chore: cleanup dist folder before compilation
  • 9b6f971 chore(release): 3.0.2
  • 43705d7 fix: merge Engine.IO options
  • 118cc68 chore: add 3rd party types in the list of dependencies
  • c596e54 docs(examples): update React Native example
  • f7e0009 docs(examples): update TypeScript example
  • e69d0ad chore: bump socket.io-client version
  • 0317a07 chore(release): 3.0.1
  • d00c0c0 docs(examples): update examples to Socket.IO v3

See the full diff

Package name: standard The new version differs by 82 commits.
  • fa0c1e4 update authors
  • 81de719 16.0.0
  • 9f94f98 prep changelog for 16.0.0
  • f5b298a standard-engine@14
  • 9f73bf2 eslint-config-standard-jsx@10
  • 0ce671d eslint-config-standard@16
  • dfea036 changelog
  • c167c0a disable failing repos for 'no-var' rule
  • 24ddf3f changelog
  • 258ee48 disable no-var rule for cmd since it needs to run on all node versions
  • 59dc70e remove eslint-plugin-standard
  • 7c7dbec changelog
  • 6fbe538 test: fix logs
  • e5e0b37 test: disable failing repos
  • a98eba7 test: re-enable disabled repos which now pass!
  • 0bfd793 test: disable non-existent repo
  • 6f9f2f1 test: add script to detect non-existent repos
  • 0d429d0 test: remove non-existant repo
  • 0b64eb3 test: add --write option to save changes to "disable" prop
  • 8b97b72 test: add test packages into same repo
  • e1b0466 changelog
  • 692c0fe changelog
  • c30a584 remove mkdirp dependency
  • d1f9de1 remove broken eslint-index package

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Use of Weak Hash
🦉 Denial of Service (DoS)
🦉 Improper Authentication
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json to reduce vulnerabilities
1c56642 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-CRYPTOJS-6028119
- https://snyk.io/vuln/SNYK-JS-ECSTATIC-540354
- https://snyk.io/vuln/SNYK-JS-ENGINEIO-1056749
- https://snyk.io/vuln/SNYK-JS-EXPRESSJWT-575022
- https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180022
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180024
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180026
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-6139239
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-MOCHA-2863123
- https://snyk.io/vuln/SNYK-JS-MOMENT-2440688
- https://snyk.io/vuln/SNYK-JS-NANOID-2332193
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-SANITIZEHTML-1070780
- https://snyk.io/vuln/SNYK-JS-SANITIZEHTML-1070786
- https://snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526
- https://snyk.io/vuln/SNYK-JS-SANITIZEHTML-585892
- https://snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-2959225
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-3324088
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-3324089
- https://snyk.io/vuln/SNYK-JS-SEQUELIZE-3324090
- https://snyk.io/vuln/SNYK-JS-TINYMCE-1056408
- https://snyk.io/vuln/SNYK-JS-TINYMCE-1298037
- https://snyk.io/vuln/SNYK-JS-TINYMCE-1766967
- https://snyk.io/vuln/SNYK-JS-TINYMCE-1910225
- https://snyk.io/vuln/SNYK-JS-TINYMCE-3166281
- https://snyk.io/vuln/SNYK-JS-TINYMCE-543825
- https://snyk.io/vuln/SNYK-JS-TINYMCE-568922
- https://snyk.io/vuln/SNYK-JS-TINYMCE-598223
- https://snyk.io/vuln/SNYK-JS-TINYMCE-6016276
- https://snyk.io/vuln/SNYK-JS-TINYMCE-6016290
- https://snyk.io/vuln/SNYK-JS-TINYMCE-6062167
- https://snyk.io/vuln/SNYK-JS-TINYMCE-6501006
- https://snyk.io/vuln/SNYK-JS-TINYMCE-6501605
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660
- https://snyk.io/vuln/npm:debug:20170905
- https://snyk.io/vuln/npm:jsonwebtoken:20150331
- https://snyk.io/vuln/npm:jws:20160726
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:moment:20160126
- https://snyk.io/vuln/npm:moment:20161019
- https://snyk.io/vuln/npm:moment:20170905
- https://snyk.io/vuln/npm:sanitize-html:20141024
- https://snyk.io/vuln/npm:sanitize-html:20160801
- https://snyk.io/vuln/npm:sanitize-html:20161026
- https://snyk.io/vuln/npm:tinymce:20150610
- https://snyk.io/vuln/npm:tinymce:20150813
- https://snyk.io/vuln/npm:tinymce:20170613
- https://snyk.io/vuln/npm:tinymce:20180522
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jake-shobin @snyk-bot