New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 4 vulnerabilities #11

Open

enterstudio wants to merge 1 commit into master from snyk-fix-3d8a3096a3968ef55ac31a8156bcecee

Owner

enterstudio commented Nov 29, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	679/1000 Why? Has a fix available, CVSS 9.3	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962463	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: babel-eslint

The new version differs by 31 commits.

a0fbd50 8.0.2
2004b91 require correct deps
fa56d21 Always use unpad (#535)
295091d Allow ^ version for babel dependencies (#534)
d3b8519 fix(package): update babylon to version 7.0.0-beta.31 (#533)
54ab4ac 8.0.1
c1a7882 Update README.md support (#531) [skip ci]
51100c9 chore(package): update mocha to version 4.0.0 (#524)
5742b71 Adding optionalCatchBinding to plugins. (#521)
905887c 8.0.0
49493e4 update to beta.0
42d0c5b Remove already fixed workaround (#508)
25bd208 8.0.0-alpha.17
1468905 alpha.17
57c133e 8.0.0-alpha.15
1e41162 update (#504)
c31b577 Readme update usage section (#501) [skip ci]
c2626f9 Update eslint to the latest version 🚀 (#500)
3c6b2de chore(package): update husky to version 0.14.0 (#498)
e052d5a Update install instructions to use latest stable release (#497) [skip ci]
8e3e088 8.0.0-alpha.13
f757e22 Merge pull request #493 from danez/regression-test
5736be6 Update babylon
37f9242 Add Prettier (#491)

See the full diff

Package name: hexo-fs

The new version differs by 68 commits.

780a5a9 Merge pull request Add ability to setup repo with env hexojs/hexo-deployer-git#46 from curbengh/2.0.0
b108888 release: 2.0.0
3cde091 Refactor(test): tuple to map (Deploy to master branch hexojs/hexo-deployer-git#45)
2d2efcd Merge pull request It doesn't work with 2FA (two factor authentication) hexojs/hexo-deployer-git#44 from segayuu/Refactor-test-1
7d600ad Destructuring path module
ba54c11 Refactor test
bca03f3 Merge pull request Getting more done in GitHub with ZenHub hexojs/hexo-deployer-git#43 from segayuu/Refactor-useful-chai-as-promised
21da957 Fix test: Usefull chai-as-promised
afc4e3e Install chai-as-promised
0154d8a Merge pull request 使用hexo -d 没有反应是怎么回事？ hexojs/hexo-deployer-git#41 from curbengh/badge
8fec0e0 Merge pull request deploy之后仓库里的历史文件都被删除 hexojs/hexo-deployer-git#42 from hexojs/dependabot/npm_and_yarn/escape-string-regexp-tw-2.0.0
9071966 Update escape-string-regexp requirement from ^1.0.5 to ^2.0.0
060fcba docs(readme): fix appveyor badge
726da41 docs(readme): add npm link and fix appveyor link
719038e Merge pull request In order to synchornize the commit history with more than a working computer, add the pull() function in lib/deployer.js hexojs/hexo-deployer-git#37 from hexojs/dependabot/npm_and_yarn/eslint-tw-6.0.1
d2100fb Merge pull request deploy指令需要更新了 hexojs/hexo-deployer-git#38 from curbengh/nyc
8c83d6e fix: hasOwnProperty syntax
35df948 chore: deprecate npmignore (if branch has ':' will go wrong hexojs/hexo-deployer-git#40)
6e32aed chore: add node 12 to appveyor (Add extend_dirs support hexojs/hexo-deployer-git#39)
1716d2a test: replace istanbul with nyc
29643ad eslint fiixes
491ae31 Update eslint requirement from ^5.16.0 to ^6.0.1
571e1b9 fix chokidar update by removing support for nodejs 6 (What's the syntax to use a dfferent ssh port? hexojs/hexo-deployer-git#34)
20cb85a Revert "Update escape-string-regexp requirement from ^1.0.5 to ^2.0.0" (avoid force push when deploy to git repository hexojs/hexo-deployer-git#33)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution


          fix: package.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-BABELTRAVERSE-5962463
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment