[Snyk] Fix for 7 vulnerabilities #998

aliscco · 2023-11-30T00:56:10Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- node_modules/eslint/package.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
679/1000 Why? Has a fix available, CVSS 9.3	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962462	Yes	No Known Exploit
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Internal Property Tampering SNYK-JS-TAFFYDB-2992450	Yes	Proof of Concept
589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit
589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-USERAGENT-174737	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: eslump

The new version differs by 48 commits.

ba9e85d More .prettierignore
da31c32 eslump v3.0.0
b76994d Remove unnecessary eslint-disable comment
57120a2 Add missing ESLint rule
885c123 master -> main
ce60563 Fix Acorn sourceType
ecd0bcd Fix Prettier example
024e479 Cleanups
ba583f5 Merge pull request [Snyk] Security upgrade ansi-regex from 5.0.0 to 6.0.1 #18 from stephenwade/master
ae4fea9 Update links in README
ef23c0f Move shift-parser to dependencies
0265321 Update unexpected to 12.0.0
3ff74dc Update rimraf to 3.0.2
ae9d113 Update meriyah to 4.1.5
b96d485 Update jest to 26.6.3
f39e138 Update flow-parser to 0.148.0
f6660a7 Update espree to 7.3.1
ca1275e Update all ESLint packages
f69aef6 Update escodegen to 2.0.0
af79254 Update doctoc to 2.0.0
2a93aed Replace cherow with meriyah
1443fa8 Update acorn to 8.1.0
1946f5c Update all Babel packages
29a9c8c Update all Shift packages

See the full diff

Package name: jsdoc

The new version differs by 2 commits.

0842185 4.0.0
b018408 chore!: replace taffydb package with @ jsdoc/salty

See the full diff

Package name: karma

The new version differs by 36 commits.

1b48637 chore(release): 5.0.0 [skip ci]
a5dbe89 Update issue templates (#3460)
1074f38 chore(ci): rely on karma-runnre/integration-tests for saucelabs config (#3462)
4d45cf0 chore(ci): remove more old connection security stuffs (#3459)
be76fcc chore(ci): use travis UI for sauce config (#3458)
a04a542 chore(ci): remove secure encryption var (#3457)
1eaf35e fix: install semantic-release as a regular dev dependency (#3455)
0647109 docs: Fix simple typo, overriden -> overridden (#3453)
ec1e69a fix(server): replace optimist on yargs lib (#3451)
ffad7fa refactor(launcher): use class syntax (#3437)
7166ce2 fix(server): detection new MS Edge Chromium (#3440)
b8b2ed8 fix(ci): echo travis env that gates release after_success (#3446)
33a069f refactor: use native Promise instead of Bluebird (#3436)
131d154 refactor: drop safe-buffer dependency in favor of native Buffer (#3438)
cb1bcbf fix(server): cleanup import of the removed method (#3439)
5c334f5 fix(server): createPreprocessor was removed (#3435)
d7128d4 refactor(server): remove PromiseContainer class (#3416)
057d527 feat(docs): document `DEFAULT_LISTEN_ADDR` constant (#3443)
a673aa8 ci: drop node 8, adopt node 12 (#3430)
9eb6436 chore(server): Convert PromiseContainer to object and remove (#3401)
0856234 chore(travis): release on node 10 success (#3428)
708ae13 feat(preprocessor): obey Pattern.isBinary when set (#3422)
00d536f chore(test): logLevel debug in proxy test (#3427)
da9d8bd chore(docs): delete PULL_REQUEST_TEMPLATE.md

See the full diff

Package name: webpack

The new version differs by 250 commits.

610f368 5.0.0
5ce65c1 update examples
bbe1230 Merge pull request #11628 from webpack/bugfix/real-content-hash
75ecff2 5.0.0-rc.6
bfc35d6 Merge pull request #11603 from MayaWolf/master
76e8cbd Merge pull request #11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
36bcfaa Merge pull request #11621 from webpack/bugfix/11619
9130d10 fix called variables with ProvidePlugin
3e42105 Merge pull request #11620 from webpack/bugfix/11617
4709719 skip connections copied to concatenated module
57b493f 5.0.0-rc.5
1658e2f Merge pull request #11618 from webpack/bugfix/11615
a8fb45d fixes crash in SideEffectsFlagPlugin
84b196d emit error instead of crashing when unexpected problem occurs
5573fed Merge pull request #11601 from Hornwitser/improve-suggested-polyfill-config
9b5cce9 Merge pull request #11609 from snitin315/export-types
37c495c export type RuleSetUseItem
39faf34 export type RuleSetUse
e5fd246 export type RuleSetConditionAbsolute
660baad export RuleSetCondition types
13e3ca5 Merge pull request #11602 from webpack/bugfix/shared-runtime-chunk
9c0587e Merge pull request #11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
502d166 Merge pull request #11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4

See the full diff

Package name: webpack-cli

The new version differs by 250 commits.

fb50f76 chore(release): publish new version
2c75aeb chore: new version of the packages
0d05c30 chore(release): publish %s
3f9e151 chore: fix lerna config
2c1e34c tests(generator): enhance init generator tests ([Snyk] Fix for 1 vulnerabilities #1236)
6ee61b9 Fix loader-generator and plugin-generator tests ([Snyk] Fix for 1 vulnerabilities #1250)
52956a2 Fixing the typos and grammatical errors in Readme files ([Snyk] Fix for 1 vulnerabilities #1246)
7faaed2 chore: update Bug_report & Feature_request Templates ([Snyk] Security upgrade nyc from 14.1.1 to 15.0.0 #1256)
7a5b33d feat(webpack-cli): added mode argument ([Snyk] Security upgrade nyc from 13.3.0 to 15.0.0 #1253)
3715756 tests(webpack-cli): add test case for defaults flag ([Snyk] Fix for 1 vulnerabilities #1254)
a7cba2f chore: project maintanance and typescript fix ([Snyk] Fix for 2 vulnerabilities #1247)
7748472 chore: ignore package-lock.json and remove its references ([Snyk] Fix for 1 vulnerabilities #1252)
a014aa7 docs: fix supported arguments & commands link in README ([Snyk] Security upgrade tap from 2.3.4 to 18.0.0 #1244)
06129a1 feat(webpack-cli): add progress bar for progress flag ([Snyk] Security upgrade eslint-release from 1.2.0 to 2.0.0 #1238)
6cc6a49 chore: post refactor CLI ([Snyk] Fix for 1 vulnerabilities #1237)
358651e chore: move cli under lerna package ([Snyk] Fix for 1 vulnerabilities #1225)
2dc495a fix(init): fix webpack config scaffold ([Snyk] Fix for 7 vulnerabilities #1231)
1ab62d2 tests(generator): add tests for plugin generator ([Snyk] Security upgrade standard from 10.0.3 to 16.0.0 #1235)
d2dd0c1 tests(sourcemap): fix flaky stats statement ([Snyk] Fix for 4 vulnerabilities #1232)
f6dc680 tests(loader-generator): add tests for loader generator ([Snyk] Fix for 1 vulnerabilities #1234)
35d1381 tests(generator): enable init generator test ([Snyk] Fix for 1 vulnerabilities #1233)
66cdcb6 chore(generator): remove transpiled tests ([Snyk] Security upgrade aud from 1.1.5 to 2.0.0 #1229)
f29a170 fix(init): fix the invalid package name ([Snyk] Fix for 1 vulnerabilities #1228)
8c3a66d chore(cli): updated changelog of v3 ([Snyk] Fix for 1 vulnerabilities #1224)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962462 - https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905 - https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795 - https://snyk.io/vuln/SNYK-JS-MINIMIST-559764 - https://snyk.io/vuln/SNYK-JS-TAFFYDB-2992450 - https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660 - https://snyk.io/vuln/SNYK-JS-USERAGENT-174737

This was referenced Dec 1, 2023

[Snyk] Security upgrade @commitlint/cli from 8.2.0 to 9.0.0 #1165

Open

[Snyk] Fix for 1 vulnerabilities #1283

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Snyk] Fix for 7 vulnerabilities #998

[Snyk] Fix for 7 vulnerabilities #998

aliscco commented Nov 30, 2023

[Snyk] Fix for 7 vulnerabilities #998

Are you sure you want to change the base?

[Snyk] Fix for 7 vulnerabilities #998

Conversation

aliscco commented Nov 30, 2023

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade: