Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 12 vulnerabilities #142

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 12 vulnerabilities #142

wants to merge 1 commit into from

Conversation

Omrisnyk
Copy link
Owner

@Omrisnyk Omrisnyk commented Feb 4, 2024

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • large-file/package.json
    • large-file/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity Reachability
high severity 159/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00089, Social Trends: No, Days since published: 667, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.64, Score Version: V5		 Prototype Pollution
SNYK-JS-ASYNC-2441827		 No Proof of Concept No Path Found
critical severity 235/1000
Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Changed, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Local, EPSS: 0.0006, Social Trends: No, Days since published: 113, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Critical, Package Popularity Score: 99, Impact: 10.1, Likelihood: 2.33, Score Version: V5		 Incomplete List of Disallowed Inputs
SNYK-JS-BABELTRAVERSE-5962462		 Yes Proof of Concept No Path Found
high severity 159/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00109, Social Trends: No, Days since published: 432, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.64, Score Version: V5		 Denial of Service (DoS)
SNYK-JS-DECODEURICOMPONENT-3149970		 Yes Proof of Concept No Path Found
high severity 149/1000
Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00209, Social Trends: No, Days since published: 811, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 7.84, Likelihood: 1.9, Score Version: V5		 Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922		 No No Known Exploit No Path Found
medium severity 63/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: Low, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00231, Social Trends: No, Days since published: 1083, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 2.35, Likelihood: 2.65, Score Version: V5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 Yes Proof of Concept No Path Found
high severity 239/1000
Why? Confidentiality impact: High, Integrity impact: High, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): High, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00606, Social Trends: No, Days since published: 1083, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 9.79, Likelihood: 2.43, Score Version: V5		 Command Injection
SNYK-JS-LODASH-1040724		 Yes Proof of Concept No Path Found
high severity 114/1000
Why? Confidentiality impact: None, Integrity impact: High, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.0033, Social Trends: No, Days since published: 669, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.9, Score Version: V5		 Directory Traversal
SNYK-JS-MOMENT-2440688		 No No Known Exploit No Path Found
high severity 159/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.002, Social Trends: No, Days since published: 576, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.65, Score Version: V5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOMENT-2944238		 No Proof of Concept No Path Found
medium severity 104/1000
Why? Confidentiality impact: High, Integrity impact: None, Availability impact: None, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): Low, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00137, Social Trends: No, Days since published: 747, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.73, Score Version: V5		 Information Exposure
SNYK-JS-NODEFETCH-2342118		 No No Known Exploit No Path Found
medium severity 101/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Unproven, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: High, Attack Vector: Network, EPSS: 0.00096, Social Trends: No, Days since published: 1240, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.67, Score Version: V5		 Denial of Service
SNYK-JS-NODEFETCH-674311		 No No Known Exploit No Path Found
high severity 159/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00437, Social Trends: No, Days since published: 426, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.65, Score Version: V5		 Prototype Poisoning
SNYK-JS-QS-3153490		 No Proof of Concept No Path Found
high severity 160/1000
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00632, Social Trends: No, Days since published: 1194, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.66, Score Version: V5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TRIM-1017038		 Yes Proof of Concept No Path Found

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: babel-eslint
  • 10.1.0 - 2020-02-26
    • Added ability to parse Flow enums #812 (@ gkz)
  • 10.0.3 - 2019-08-25

    Fixes #791, also eslint/eslint#12117

    Some context: #793 (comment)

    We ended up going with @ JLHwung's PR #794 which uses ESLint's deps instead of going with peerDeps since it really depends on the version being used and we don't want users to have to install it directly on their own.

    babel-eslint is patching patches of the dependencies of ESLint itself so these kinds of issues have happened in the past. We'll need to look into figuring out how to have a more solid way of modifying behavior instead of this monkeypatching type of thing for future releases.

  • 10.0.2 - 2019-06-17

    Fixes #772

  • 10.0.1 - 2018-09-27

    v10.0.1

    The TypeAlias "conversion" to a function has issues. Sounds like we need to rethink the change, most likely we can just actually change the scoping rather than hardcode an AST change.

  • 10.0.0 - 2018-09-25

    v10.0.0

    Small breaking change: add a peerDependency starting from the ESLint version that added a parser feature that we were monkeypatching before (and drop that code). If already using ESLint 5 shouldn't be any different.

    • Bugfix for TypeAlias: #584
    /* @ flow */
    type Node<T> = { head: T; tail: Node<T> }

    // or

    type File = {chunks: Array<Chunk>}
    type Chunk = {file: File}

    • Update to test against ESLint 5, add a peerDependency: #689
    • Drop monkeypatching behavior: #690
  • 9.0.0 - 2018-08-27

    v9.0.0

    We've released v7: https://twitter.com/left_pad/status/1034204330352500736, so this just updates babel-eslint to use those versions internally. That in itself doesn't break anything but:

    • Babel now supports the new decorators proposal by default, so we need to switch between the new and the old proposal. This is a breaking change.

    To enable the legacy decorators proposal users should add a specific parser option:

    {
  parserOptions: {
    ecmaFeatures: {
      legacyDecorators: true
    }
  }
}
    • Babel removed the support for Node 4 , so I propagated that here.
from babel-eslint GitHub release notes
Package name: css from css GitHub release notes
Package name: expand-brackets from expand-brackets GitHub release notes
Package name: extglob from extglob GitHub release notes
Package name: mongodb-extended-json from mongodb-extended-json GitHub release notes
Package name: mongodb-stitch-browser-core
  • 4.8.0 - 2020-01-03
    • Add customData to user object
    • Add ability to refresh customData to StitchAuth
  • 4.7.1 - 2019-11-11

    • STITCH-3383 Update browser README SDK version to 4.7.1

    • STITCH-3383 Release v4.7.1

  • 4.7.0 - 2019-11-06
    • Add Custom Function authentication auth provider
    • Add custom reset password function to UserPass auth provider
  • 4.6.0 - 2019-10-23

    STITCH-3376 Release 4.6.0

  • 4.5.0 - 2019-07-12
  • 4.4.1 - 2019-06-11
  • 4.4.0 - 2019-05-16
  • 4.3.2 - 2019-03-12
  • 4.3.1 - 2019-03-05
  • 4.3.0 - 2019-02-15
  • 4.2.0 - 2019-01-29
  • 4.1.3 - 2019-01-24
  • 4.1.2 - 2018-12-26
  • 4.1.1 - 2018-12-06
  • 4.1.0 - 2018-11-27
  • 4.0.15-beta-2.0 - 2018-11-26
  • 4.0.15-beta-1.0 - 2018-11-20
  • 4.0.15-0 - 2018-10-15
from mongodb-stitch-browser-core GitHub release notes
Package name: mongodb-stitch-browser-sdk
  • 4.8.0 - 2020-01-03
    • Add customData to user object
    • Add ability to refresh customData to StitchAuth
  • 4.7.1 - 2019-11-11

    • STITCH-3383 Update browser README SDK version to 4.7.1

    • STITCH-3383 Release v4.7.1

  • 4.7.0 - 2019-11-06
    • Add Custom Function authentication auth provider
    • Add custom reset password function to UserPass auth provider
  • 4.6.0 - 2019-10-23

    STITCH-3376 Release 4.6.0

  • 4.5.0 - 2019-07-12
  • 4.4.1 - 2019-06-11
  • 4.4.0 - 2019-05-16
  • 4.3.2 - 2019-03-12
  • 4.3.1 - 2019-03-05
  • 4.3.0 - 2019-02-15
  • 4.2.0 - 2019-01-29
  • 4.1.3 - 2019-01-24
  • 4.1.2 - 2018-12-26
  • 4.1.1 - 2018-12-06
  • 4.1.0 - 2018-11-27
  • 4.0.15-beta-2.0 - 2018-11-26
  • 4.0.15-beta-1.0 - 2018-11-20
  • 4.0.15-0 - 2018-10-15
from mongodb-stitch-browser-sdk GitHub release notes
Package name: mongodb-stitch-browser-services-mongodb-remote
  • 4.8.0 - 2020-01-03
    • Add customData to user object
    • Add ability to refresh customData to StitchAuth
  • 4.7.1 - 2019-11-11

    • STITCH-3383 Update browser README SDK version to 4.7.1

    • STITCH-3383 Release v4.7.1

  • 4.7.0 - 2019-11-06
    • Add Custom Function authentication auth provider
    • Add custom reset password function to UserPass auth provider
  • 4.6.0 - 2019-10-23

    STITCH-3376 Release 4.6.0

  • 4.5.0 - 2019-07-12
  • 4.4.1 - 2019-06-11
  • 4.4.0 - 2019-05-16
  • 4.3.2 - 2019-03-12
  • 4.3.1 - 2019-03-05
  • 4.3.0 - 2019-02-15
  • 4.2.0 - 2019-01-29
  • 4.1.3 - 2019-01-24
  • 4.1.2 - 2018-12-26
  • 4.1.1 - 2018-12-06
  • 4.1.0 - 2018-11-27
  • 4.0.15-beta-2.0 - 2018-11-26
  • 4.0.15-beta-1.0 - 2018-11-20
  • 4.0.15-0 - 2018-10-15
from mongodb-stitch-browser-services-mongodb-remote GitHub release notes
Package name: mongodb-stitch-core-sdk
  • 4.8.0 - 2020-01-03
    • Add customData to user object
    • Add ability to refresh customData to StitchAuth
  • 4.7.1 - 2019-11-11

    • STITCH-3383 Update browser README SDK version to 4.7.1

    • STITCH-3383 Release v4.7.1

  • 4.7.0 - 2019-11-06
    • Add Custom Function authentication auth provider
    • Add custom reset password function to UserPass auth provider
  • 4.6.0 - 2019-10-23

    STITCH-3376 Release 4.6.0

  • 4.5.0 - 2019-07-12
  • 4.4.1 - 2019-06-11
  • 4.4.0 - 2019-05-16
  • 4.3.2 - 2019-03-12
  • 4.3.1 - 2019-03-05
  • 4.3.0 - 2019-02-15
  • 4.2.0 - 2019-01-29
  • 4.1.3 - 2019-01-24
  • 4.1.2 - 2018-12-26
  • 4.1.1 - 2018-12-06
  • 4.1.0 - 2018-11-27
  • 4.0.15-beta-2.0 - 2018-11-26
  • 4.0.15-beta-1.0 - 2018-11-20
  • 4.0.15-0 - 2018-10-15
from mongodb-stitch-core-sdk GitHub release notes
Package name: mongodb-stitch-core-services-mongodb-remote
  • 4.8.0 - 2020-01-03
    • Add customData to user object
    • Add ability to refresh customData to StitchAuth
  • 4.7.1 - 2019-11-11

    • STITCH-3383 Update browser README SDK version to 4.7.1

    • STITCH-3383 Release v4.7.1

  • 4.7.0 - 2019-11-06
    • Add Custom Function authentication auth provider
    • Add custom reset password function to UserPass auth provider
  • 4.6.0 - 2019-10-23

    STITCH-3376 Release 4.6.0

  • 4.5.0 - 2019-07-12
  • 4.4.1 - 2019-06-11
  • 4.4.0 - 2019-05-16
  • 4.3.2 - 2019-03-12
  • 4.3.1 - 2019-03-05
  • 4.3.0 - 2019-02-15
  • 4.2.0 - 2019-01-29
  • 4.1.3 - 2019-01-24
  • 4.1.2 - 2018-12-26
  • 4.1.1 - 2018-12-06
  • 4.1.0 - 2018-11-27
  • 4.0.15-beta-2.0 - 2018-11-26
  • 4.0.15-beta-1.0 - 2018-11-20
  • 4.0.15-0 - 2018-10-15
from mongodb-stitch-core-services-mongodb-remote GitHub release notes
Package name: request from request GitHub release notes
Package name: request-promise-native from request-promise-native GitHub release notes
Package name: snapdragon
  • 0.12.1 - 2021-04-09
    • Update source-map-resolve to v0.6.0
  • 0.12.0 - 2018-04-18

    0.12.0

  • 0.11.5 - 2018-04-18
  • 0.11.4 - 2018-04-09

    0.11.4

  • 0.11.3 - 2018-03-21

    0.11.3

  • 0.11.2 - 2018-02-24

    0.11.2

  • 0.11.1 - 2018-02-24

    0.11.1

  • 0.11.0 - 2017-03-12
  • 0.10.1 - 2017-02-09
  • 0.10.0 - 2017-02-07
  • 0.9.1 - 2017-02-02
  • 0.9.0 - 2017-01-21
  • 0.8.2 - 2018-03-11
from snapdragon GitHub release notes
Package name: source-map-resolve from source-map-resolve GitHub release notes
Package name: trim from trim GitHub release notes
Commit messages
Package name: babel-eslint The new version differs by 13 commits.

See the full diff

Package name: css The new version differs by 4 commits.

See the full diff

Package name: expand-brackets The new version differs by 18 commits.

See the full diff

Package name: extglob The new version differs by 7 commits.

See the full diff

Package name: mongodb-extended-json The new version differs by 15 commits.

See the full diff

Package name: request-promise-native The new version differs by 23 commits.

See the full diff

Package name: source-map-resolve The new version differs by 16 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Denial of Service (DoS)
🦉 Command Injection
🦉 More lessons are available in Snyk Learn

@Omrisnyk Omrisnyk mentioned this pull request Apr 30, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@Omrisnyk @snyk-bot