Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 31 vulnerabilities #3

Merged
merged 1 commit into from Jan 1, 2020
Merged

[Snyk] Fix for 31 vulnerabilities #3

merged 1 commit into from Jan 1, 2020

Conversation

snyk-bot
Copy link

@snyk-bot snyk-bot commented Jan 1, 2020

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • test/fixtures/demo-os/package.json
    • test/fixtures/demo-os/.snyk

Vulnerabilities that will be fixed

With an upgrade:
Severity Issue Breaking Change
high severity Prototype Pollution
SNYK-JS-HANDLEBARS-173692		 Yes
high severity Prototype Pollution
SNYK-JS-HANDLEBARS-469063		 Yes
high severity Arbitrary Code Execution
SNYK-JS-HANDLEBARS-534478		 Yes
high severity Prototype Pollution
SNYK-JS-HANDLEBARS-534988		 Yes
high severity SQL Injection
SNYK-JS-KNEX-471962		 No
high severity Prototype Pollution
SNYK-JS-LODASH-450202		 Yes
high severity Prototype Pollution
SNYK-JS-LODASH-73638		 Yes
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		 Yes
medium severity Arbitrary Code Injection
SNYK-JS-MORGAN-72579		 No
low severity Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 No
high severity Prototype Pollution
npm:extend:20180424		 No
high severity Regular Expression Denial of Service (ReDoS)
npm:fresh:20170908		 No
medium severity Cross-site Scripting (XSS)
npm:handlebars:20151207		 Yes
low severity Regular Expression Denial of Service (DoS)
npm:hawk:20160119		 No
medium severity Prototype Pollution
npm:hoek:20180212		 Yes
medium severity Timing Attack
npm:http-signature:20150122		 No
medium severity SQL Injection
npm:knex:20150413		 No
medium severity Prototype Pollution
npm:lodash:20180130		 Yes
low severity Regular Expression Denial of Service (ReDoS)
npm:mime:20170907		 Yes
high severity Regular Expression Denial of Service (DoS)
npm:minimatch:20160620		 Yes
medium severity Regular Expression Denial of Service (ReDoS)
npm:moment:20160126		 No
medium severity Regular Expression Denial of Service (ReDoS)
npm:moment:20161019		 No
low severity Regular Expression Denial of Service (ReDoS)
npm:moment:20170905		 No
medium severity Regular Expression Denial of Service (ReDoS)
npm:ms:20151024		 No
low severity Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 No
high severity Regular Expression Denial of Service (DoS)
npm:negotiator:20160616		 No
medium severity Insecure Randomness
npm:node-uuid:20160328		 No
high severity Prototype Override Protection Bypass
npm:qs:20170213		 No
medium severity Remote Memory Exposure
npm:request:20160119		 No
medium severity Uninitialized Memory Exposure
npm:tunnel-agent:20170305		 No
medium severity Buffer Overflow
npm:validator:20160218		 Yes
Commit messages
Package name: body-parser The new version differs by 197 commits.
  • b2659a7 1.18.2
  • 6339bf7 perf: remove argument reassignment
  • d5f9a4a deps: debug@2.6.9
  • d041563 1.18.1
  • 9efa9ab deps: content-type@~1.0.4
  • f1ef6cc deps: qs@6.5.1
  • e438db5 deps: raw-body@2.3.2
  • 15c3585 deps: iconv-lite@0.4.19
  • adfa01c 1.18.0
  • 0632e2f Include the "type" property on all generated errors
  • b8f97cd Include the "body" property on verify errors
  • c659e8a tests: add test for err.body on json parse error
  • 4e15325 tests: reorganize json error tests
  • 5bd7ed5 tests: reorganize json strict option tests
  • 3cb380b tests: store server on mocha context instead of variable shadowing
  • 29c8cd0 docs: document too many parameters error
  • 7b9cb14 Use http-errors to set status code on errors
  • 29a27f1 docs: fix typo in jsdoc comment
  • 448dc57 Fix JSON strict violation error to match native parse error
  • 87df7e6 tests: add leading whitespace strict json test
  • 1841248 deps: raw-body@2.3.1
  • e666dbe deps: http-errors@~1.6.2
  • c2a110a deps: bytes@3.0.0
  • a1a2e31 build: Node.js@8.4

See the full diff

Package name: bookshelf The new version differs by 250 commits.

See the full diff

Package name: cheerio The new version differs by 106 commits.

See the full diff

Package name: compression The new version differs by 117 commits.

See the full diff

Package name: cookie-session The new version differs by 43 commits.

See the full diff

Package name: express The new version differs by 250 commits.
  • f974d22 4.16.0
  • 8d4ceb6 docs: add more information to installation
  • c0136d8 Add express.json and express.urlencoded to parse bodies
  • 86f5df0 deps: serve-static@1.13.0
  • 4196458 deps: send@0.16.0
  • ddeb713 tests: add maxAge option tests for res.sendFile
  • 7154014 Add "escape json" setting for res.json and res.jsonp
  • 628438d deps: update example dependencies
  • a24fd0c Add options to res.download
  • 95fb5cc perf: remove dead .charset set in res.jsonp
  • 44591fe deps: vary@~1.1.2
  • 2df1ad2 Improve error messages when non-function provided as middleware
  • 12c3712 Use safe-buffer for improved Buffer API
  • fa272ed docs: fix typo in jsdoc comment
  • d9d09b8 perf: re-use options object when generating ETags
  • 02a9d5f deps: proxy-addr@~2.0.2
  • c2f4fb5 deps: finalhandler@1.1.0
  • 673d51f deps: utils-merge@1.0.1
  • 5cc761c deps: parseurl@~1.3.2
  • ad7d96d deps: qs@6.5.1
  • e62bb8b deps: etag@~1.8.1
  • 70589c3 deps: content-type@~1.0.4
  • 9a99c15 deps: accepts@~1.3.4
  • 550043c deps: setprototypeof@1.1.0

See the full diff

Package name: glob The new version differs by 76 commits.
  • 3a7e71d v5.0.15
  • 841fda0 use latest minimatch
  • 4ba54a8 Skip some tests on Windows, make others pass
  • 3936e1e Build: Add build for node v4
  • c47d451 v5.0.14
  • 821fac8 Handle ENOTSUP for sync glob as well as async
  • 9625618 Test for when readdir raises ENOTSUP
  • 0a2b519 Generate fixtures more effectively, with -O instead of eval
  • f96190b Use js for benchmark cleanup
  • 957fd93 Fix some 'use strict' errors
  • bf3381e Treat ENOTSUP like ENOTDIR in readdir
  • 507733d v5.0.13
  • f5878af Do not emit 'match' events for ignored items
  • 9439afd v5.0.12
  • 6071f3a Revert "Use graceful-fs if available"
  • 38ff16c v5.0.11
  • f09292b Use graceful-fs if available
  • 4f39b60 Remove duplicate option description
  • e3cdccc v5.0.10
  • 480da05 ignore .nyc_output, upgrade tap, use coverage, rm fixtures
  • 155124b add more sync cb thrower tests
  • f7302ca Test base-matching
  • 7530e88 v5.0.9
  • b185987 reduce cases where tests need to be regenerated

See the full diff

Package name: morgan The new version differs by 149 commits.

See the full diff

Package name: node-uuid The new version differs by 14 commits.

See the full diff

Package name: request The new version differs by 250 commits.

See the full diff

Package name: sqlite3 The new version differs by 188 commits.

See the full diff

Package name: validator The new version differs by 250 commits.

See the full diff

With a Snyk patch:
Severity Issue
medium severity Prototype Pollution
npm:hoek:20180212

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:

🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

@snyk-bot
fix: test/fixtures/demo-os/package.json & test/fixtures/demo-os/.snyk…
35a7bd3 
… to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-173692
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-469063
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534478
- https://snyk.io/vuln/SNYK-JS-HANDLEBARS-534988
- https://snyk.io/vuln/SNYK-JS-KNEX-471962
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/SNYK-JS-MORGAN-72579
- https://snyk.io/vuln/npm:debug:20170905
- https://snyk.io/vuln/npm:extend:20180424
- https://snyk.io/vuln/npm:fresh:20170908
- https://snyk.io/vuln/npm:handlebars:20151207
- https://snyk.io/vuln/npm:hawk:20160119
- https://snyk.io/vuln/npm:hoek:20180212
- https://snyk.io/vuln/npm:http-signature:20150122
- https://snyk.io/vuln/npm:knex:20150413
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:mime:20170907
- https://snyk.io/vuln/npm:minimatch:20160620
- https://snyk.io/vuln/npm:moment:20160126
- https://snyk.io/vuln/npm:moment:20161019
- https://snyk.io/vuln/npm:moment:20170905
- https://snyk.io/vuln/npm:ms:20151024
- https://snyk.io/vuln/npm:ms:20170412
- https://snyk.io/vuln/npm:negotiator:20160616
- https://snyk.io/vuln/npm:node-uuid:20160328
- https://snyk.io/vuln/npm:qs:20170213
- https://snyk.io/vuln/npm:request:20160119
- https://snyk.io/vuln/npm:tunnel-agent:20170305
- https://snyk.io/vuln/npm:validator:20160218


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/npm:hoek:20180212
@allRounderWiser allRounderWiser merged commit 0d98575 into master Jan 1, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

not working with pnpm Misdetection of vuln path when dependencies originate on a git url
2 participants
@snyk-bot @allRounderWiser