Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 10 vulnerabilities #40

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 10 vulnerabilities #40

wants to merge 1 commit into from

Conversation

Emilemuny
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-AMMO-548920		 Yes No Known Exploit
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HAWK-2808852		 Yes No Known Exploit
high severity 741/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.4		 DLL Injection
SNYK-JS-KERBEROS-568900		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-MQUERY-1050858		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-MQUERY-1089718		 Yes Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831		 Yes Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
npm:content:20170908		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:content:20180305		 Yes Proof of Concept
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:hawk:20160119		 Yes No Known Exploit
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:hoek:20180212		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: good The new version differs by 27 commits.
  • 0ff67e6 version 6.0.0
  • f372719 Merge pull request #322 from arb/stream-event-reporter-interface
  • decbba9 PR updates.
  • 31c92d6 Updated to data stream and pipe method for transmitting data. Closes #300.
  • 7ee3dd8 Merge pull request #321 from arb/stop-cleanup
  • 8619d2e PR updates.
  • 76f57d4 Cleaned up stop function. Closes #312
  • 9e4e405 Merge pull request #317 from geek/master
  • 4e726c5 Report on timespent
  • b851ba0 Merge branch 'master' of github.com:hapijs/good
  • 2cc355f Update check for io.js
  • 3933e4e More tests
  • b4f4f88 Remove listeners in tests
  • c06bc98 Missing ;
  • 4420a38 Merge pull request #320 from lloydbenson/master
  • 9117917 get rid of 0.11 check now that 0.12 is out
  • 57789ca Merge pull request #319 from atroo/master
  • e357cea added logstash reporter to the community section
  • cc893f8 Expand logged data for wreck
  • 938d4b9 Report on wreck requests
  • 90ed138 Merge pull request #314 from lancespeelmon/patch-1
  • ec909d0 Added community powered reference to winston adapter
  • 5f2c813 Merge pull request #313 from arb/dynamic-events
  • b6ddd0b Closes #311. Added extension methods.

See the full diff

Package name: good-console The new version differs by 12 commits.

See the full diff

Package name: hapi The new version differs by 236 commits.
  • c4593b6 deps. Closes #2897. Closes #2898. Closes #2899. Closes #2900. Closes #2901. Closes #2902. Closes #2903. Closes #2904. Closes #2905. Closes #2906. Closes #2907. Closes #2908. Closes #2909. Closes #2910. Closes #2911. Closes #2912. Closes #2913. Closes #2914. Closes #2915. Closes #2916. Closes #2917. Closes #2918. Closes #2919. Closes #2920. Closes #2921. Closes #2922. Closes #2923
  • ca4320e Merge pull request #2891 from nlindley/payload-test-typo
  • 02b6ac7 Fix typo in payload test
  • e5da51c Merge branch 'master' of github.com:hapijs/hapi
  • 5a0dc49 Remove compount assignments
  • 375fe30 Merge pull request #2888 from cjihrig/master
  • 05f6a26 style fixes
  • 635089b Merge pull request #2887 from gergoerdosi/node-5
  • 86102c7 Test on node v5
  • fc503f8 lab 7
  • fdf7ed3 Merge pull request #2885 from gergoerdosi/subtext
  • 0cb9143 Update hapijs/subtext to 2.0.2 from 2.0.1
  • d3a6cf8 typo
  • 47373dd Remove bluebird. Closes #2881
  • 98d3404 Skip most lifecycle on not found and bad path. Closes #2867
  • 7041325 CORS error cases. Closes #2868
  • 1696838 Replace function with arrow. Closes #2877
  • 2aedf38 Merge branch 'master' of github.com:hapijs/hapi
  • ca3ee7e Additional => conversions. For #2877
  • 1ef09e8 Merge pull request #2876 from sfabriece/patch-1
  • a7b3ad7 Initial transition to arrow functions. For #2877
  • 7ec0ae3 Update API.md
  • 32cf03c for style change. Closes #2875
  • 38f90bb Replace var with let. Closes #2874

See the full diff

Package name: mongoose The new version differs by 250 commits.
  • f8d2721 chore: release 5.12.3
  • 58cad73 fix(connection): use queueing instead of event emitter for `createCollection()` and other helpers to avoid event emitter warning
  • 5382408 fix(index.d.ts): add `transform` to PopulateOptions interface
  • dca1d70 Merge branch 'master' of github.com:Automattic/mongoose
  • 2648088 fix(index.d.ts): add DocumentQuery type for backwards compatibility
  • 966770f Merge pull request #10063 from Automattic/gh-10044
  • 9e4a083 style: fix lint
  • f3cd3a8 chore: use variable instead of function
  • f24953c fix(query): add `writeConcern()` method to avoid writeConcern deprecation warning
  • 7d2e9c9 chore: upgrade mquery -> 3.2.5 re: Security Fix for Prototype Pollution - huntr.dev聽mongoosejs/mquery#121
  • d1a9a1e made requested changes
  • cf1b666 Merge pull request #10078 from pezzu/master
  • 2aef528 Merge pull request #10062 from Automattic/gh-10025
  • 452c77c Fixes #10072
  • c9bfb30 Update model.indexes.test.js
  • 6f0133a removed comments
  • 9e98cd8 Merge pull request #10055 from emrebass/patch-1
  • 1c20044 Merge pull request #10054 from coro101/add-discriminator-type
  • 4e74ea7 TIL that includes() is also not supported in all browsers
  • f231d7b should work and is designed to handle multiple text fields
  • c4897f9 TIL Object.values in not supported on all browsers
  • 391ecec collation not added to text indexes
  • 7a93c16 linter fix
  • 6deb668 fix: connection ids are now scoped

See the full diff

Package name: twilio The new version differs by 250 commits.
  • 07891d5 Release 3.41.0
  • 3120c68 [Librarian] Regenerated @ b99d9f1d3667442d965805ac71bf6185ee04b82c
  • c76264e fix: remove the lock file since this is a library
  • d073d8c fix: Page JSON parsing and integration tests (#546)
  • ef0d339 fix: add overloaded TS definitions for non-required params (#545)
  • 465d158 fix: Add method overload to VoiceResponse.prototype.play (#544)
  • 747a091 fix: don't re-parse parsed JSON (#543)
  • 6266910 feat: migrate from deprecated request module to axios (#542)
  • 5249e3b [Librarian] Regenerated @ ee964c66599ebcd125eb411ba410bde1e62b3503
  • ad2e98b Release 3.40.0
  • ec54ee2 [Librarian] Regenerated @ ee964c66599ebcd125eb411ba410bde1e62b3503
  • 5a65128 docs: add url parameter documentation in twilio.webhook() (#541)
  • 6d96611 fix: proper indentation (#534)
  • 3b07aca docs: guide for enabling lazy loading (#532)
  • 25ec77d feat: Faster requiring using optional lazy loading (#526)
  • deca8ff Release 3.39.5
  • f8f368c [Librarian] Regenerated @ 59055a0e4517ecbe8ab584e0f9b38f2a70cd94a8
  • 3d0e4a1 Release 3.39.4
  • 2d7f7fa [Librarian] Regenerated @ 0d359fdcea150a7f3ec36771ffeb0bd2bf34ea1d
  • 412b484 [Librarian] Regenerated @ d279b32f822f241b774d58939b2c4c04ca4152e9
  • 1294266 [Librarian] Regenerated @ d279b32f822f241b774d58939b2c4c04ca4152e9
  • 0d96c5b [Librarian] Regenerated @ d279b32f822f241b774d58939b2c4c04ca4152e9
  • 1286866 [Librarian] Regenerated @ d279b32f822f241b774d58939b2c4c04ca4152e9
  • 548eed3 [Librarian] Regenerated @ d279b32f822f241b774d58939b2c4c04ca4152e9

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
馃 View latest project report

馃洜 Adjust project settings

馃摎 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

馃 Denial of Service (DoS)
馃 Prototype Pollution
馃 Server-side Request Forgery (SSRF)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@Emilemuny @snyk-bot