New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade gatsby from 3.15.0 to 4.14.0 #954

Open

Rutam21 wants to merge 1 commit into master from snyk-fix-ec4fc3360402c5bdbe94ff66bb9a9f35

Owner

Rutam21 commented Mar 1, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- e2e-tests/mdx/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Authorization Bypass Through User-Controlled Key SNYK-JS-PARSEPATH-2936439	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-PARSEURL-3023021	Yes	Proof of Concept
	571/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5	Improper Input Validation SNYK-JS-PARSEURL-3024398	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-PROMPTS-1729737	Yes	Proof of Concept
	619/1000 Why? Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-SHELLQUOTE-1766506	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: gatsby

The new version differs by 250 commits.

2c324f6 chore(release): Publish
55c7183 feat(contentful): add support for tables in Rich Text (feat(contentful): add support for tables in Rich Text gatsbyjs/gatsby#33870)
053180a fix(gatsby): Better TS compilation error (fix(gatsby): Better TS compilation error gatsbyjs/gatsby#35594)
0cf0bd9 chore(release): Publish next
9a91295 fix(gatsby-plugin-image): fix image flickers (fix(gatsby-plugin-image): fix image flickers gatsbyjs/gatsby#35226)
f358dc3 chore(release): Publish next
966aca8 feat(gatsby): Improvements to GraphQL TypeScript Generation (feat(gatsby): Improvements to GraphQL TypeScript Generation gatsbyjs/gatsby#35581)
8bad9b3 perf(gatsby): Minify page-data (perf(gatsby): Minify page-data gatsbyjs/gatsby#35578)
39e9840 chore(gatsby): Expose `serverDataStatus` field in SSR type declaration file (chore(gatsby): Expose serverDataStatus field in SSR type declaration file gatsbyjs/gatsby#35505)
ebd63b2 feat(gatsby-source-wordpress): use image cdn for non-resizable images in html (svgs/gifs mainly) (feat(gatsby-source-wordpress): use image cdn for non-resizable images in html (svgs/gifs mainly) gatsbyjs/gatsby#35529)
5e51519 fix(gatsby-source-wordpress): update test deps and fix int tests (fix(gatsby-source-wordpress): update test deps and fix int tests gatsbyjs/gatsby#35582)
128c7bb feat(gatsby-source-wordpress): always include draft slugs (feat(gatsby-source-wordpress): always include draft slugs gatsbyjs/gatsby#35573)
abc6dca feat(gatsby-plugin-image): add check for node.gatsbyImage in the getImage helper (feat(gatsby-plugin-image): add check for node.gatsbyImage in the getImage helper gatsbyjs/gatsby#35507)
e51c3a3 chore(release): Publish next
c9d98a4 feat(gatsby): Initial GraphQL Typegen Implementation (feat(gatsby): Initial GraphQL Typegen Implementation gatsbyjs/gatsby#35487)
17cbc7c fix(deps): update minor and patch dependencies for gatsby-source-graphql (fix(deps): update minor and patch dependencies for gatsby-source-graphql gatsbyjs/gatsby#35545)
10752ed fix(deps): update dependency fs-extra to ^10.1.0 (fix(deps): update dependency fs-extra to ^10.1.0 gatsbyjs/gatsby#34976)
0abdcd6 fix(deps): update dependency coffeescript to ^2.7.0 for gatsby-plugin-coffeescript (fix(deps): update dependency coffeescript to ^2.7.0 for gatsby-plugin-coffeescript gatsbyjs/gatsby#35550)
7cda002 fix(deps): update dependency eslint-plugin-import to ^2.26.0 (fix(deps): update dependency eslint-plugin-import to ^2.26.0 gatsbyjs/gatsby#35551)
3e74a9f fix(deps): update dependency eslint-plugin-react-hooks to ^4.5.0 (fix(deps): update dependency eslint-plugin-react-hooks to ^4.5.0 gatsbyjs/gatsby#35552)
fb98116 fix(deps): update minor and patch dependencies for gatsby-source-drupal (fix(deps): update minor and patch dependencies for gatsby-source-drupal gatsbyjs/gatsby#35554)
c09287a chore(deps): update starters and examples (chore(deps): update starters and examples gatsbyjs/gatsby#35565)
bf854ca fix(deps): update dependency prop-types to ^15.8.1 for gatsby-link (fix(deps): update dependency prop-types to ^15.8.1 for gatsby-link gatsbyjs/gatsby#35291)
71eb414 chore(deps): update dependency typescript to ^4.6.4 (chore(deps): update dependency typescript to ^4.6.4 gatsbyjs/gatsby#34984)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Server-side Request Forgery (SSRF)
🦉 Regular Expression Denial of Service (ReDoS)
🦉 More lessons are available in Snyk Learn


          fix: e2e-tests/mdx/package.json to reduce vulnerabilities

5eb095d

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://snyk.io/vuln/SNYK-JS-PARSEPATH-2936439
- https://snyk.io/vuln/SNYK-JS-PARSEURL-3023021
- https://snyk.io/vuln/SNYK-JS-PARSEURL-3024398
- https://snyk.io/vuln/SNYK-JS-PROMPTS-1729737
- https://snyk.io/vuln/SNYK-JS-SHELLQUOTE-1766506

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment