New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 11 vulnerabilities #1

Closed

shubham2811 wants to merge 1 commit into master from snyk-fix-9e658c838168c89a834c5c58120cc3e4

Owner

shubham2811 commented Dec 21, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- samples/universal-react-node/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-AMMO-548920	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	630/1000 Why? Has a fix available, CVSS 8.1	Internal Property Tampering SNYK-JS-BSON-561052	Yes	No Known Exploit
	630/1000 Why? Has a fix available, CVSS 8.1	Internal Property Tampering SNYK-JS-BSON-6056525	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-HAPI-548911	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-MONGODB-473855	Yes	No Known Exploit
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	Yes	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-SUBTEXT-467257	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-SUBTEXT-548913	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-SUBTEXT-548915	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: electrode-server

The new version differs by 25 commits.

87e6281 3.0.0
d105362 updating hapi with latest @ hapi/hapi-18 (Disabling local scope by default for css electrode-io/electrode#46)
634aee6 look for hapi plugin from module through hapiPlugin field (Additional URL parameters in production electrode-io/electrode#44)
ef26d3f udpate changelog
2e900fa 2.2.2
fd11ab0 avoid auto abort in prod or inspect mode
63cf71d Update .travis.yml
763850a 2.2.1
769c9b0 update changelog
8655456 [chore] dep: chalk@^2.4.2
17653b3 2.2.0
647a4a0 update changelog
f8ab75b more and improved error handling and reporting (gulp test-frontend-cov fails in Sierra electrode-io/electrode#41)
b1f1d34 Merge pull request Add an .eslintrc so editors can lint electrode-io/electrode#39 from jchip/develop
4f0027b update prepublish script
feb62cc delete lockfile
5bb9a04 update README
ec6724c expand require-from-path support
26bce2f update LICENSE
8836036 2.1.0
a2ebbc6 [minor] allow plugin module to specify require from path ([Snyk] Security upgrade @xarc/react-query from 0.1.4 to 2.0.0 #37)
a989e62 2.0.0
89c9f81 fix plugins register ([Snyk] Security upgrade @xarc/react-query from 1.0.7 to 2.0.0 #36)
38d05ac update superagent ([Snyk] Security upgrade @xarc/react-query from 1.0.7 to 2.0.0 #35)

See the full diff

Package name: electrode-static-paths

The new version differs by 7 commits.

a6e9049 2.0.2
1fbdacd dep: chalk@^2.4.2, lodash@^4.17.11
89e1bda update travis
7667651 update ci
16eb77a 2.0.1
fec164c bump up inert to 5 (force hapi17)
76cf855 update dep

See the full diff

Package name: isomorphic-fetch

The new version differs by 12 commits.

fc5e0d0 3.0.0
496fa43 Add version that was previously uncomitted to the package.json due to the previous release process
9f5a8b6 Add a list of alternatives
49280e6 Resolve minor security issue
0f5edd0 Explain why Isomorphic Fetch is needed in docs ([HMR] css are not updated in hot mode electrode-io/electrode#135)
e32b006 Fix travis (CSS Module Hook: Flash of Unstyled Content electrode-io/electrode#190)
db0aa8c Update to latest version
8bf02c4 Bump node-fetch from 1.7.3 to 2.6.1 (.build directory is not built (breaks gulp dev) electrode-io/electrode#189)
89c7e70 Merge pull request Component / Route based async Server-Side Rendering electrode-io/electrode#93 from paulmelnikow/fetch_ponyfill
25e3cab Add link to fetch-ponyfill
8d33aba Merge pull request add react-redux 5.x.x to dep electrode-io/electrode#90 from josiah0/update-lintspaces-cli
c22fcda Update lintspaces-cli

See the full diff

Package name: mongojs

The new version differs by 22 commits.

b2ad375 3.0.0
0552311 Add auto-changelog to dependencies and to release workflow
2664828 Reflect the move to the mongo-js organization in URLs
9a39edd Generate a new changelog with auto-changelog
d0f139b Fix release script
106af3e Fix connection string extension with mongodb+srv protocol
c516e92 Switch to nyc for coverage reports
9deab34 Merge branch 'master' of github.com:mafintosh/mongojs
d23f0ee Implement updateOne, insertOne and updateMany, insertMany
9c3218b Publicly expose mongo BSON Map (ES5 polyfill) (archetype-react-app: [patch] fix webpack simple-progress output electrode-io/electrode#364)
f9763da Replaces xtend dependency by Object.assign (archetype-react-app: [major] remove babel-register dep from prod electrode-io/electrode#380)
0bd8f71 removes shelljs dependency ((multiple): [patch][chore] update engines to node 8 electrode-io/electrode#379)
6ca5c55 Expose Decimal128 BSON type ( generator-electrode: [feat][patch] Accept CommandLine Parameters electrode-io/electrode#362)
af9776f Publicly expose mongo BSON Int32 type (archetype-react-component: [chore] [patch] Update travis.yml file electrode-io/electrode#363)
c576f60 update var to const (css without css-modules electrode-io/electrode#361)
a432765 Update dependencies (archetype-react-app: [patch] use babel to optimize modules for PROD electrode-io/electrode#377)
747f270 Remove package-lock.json as it breaks builds due to a bug in npm with bundleDependencies and shoe
a318000 Add mongodb 4 to build matrix
e0ab473 Remove support for node v0.10, v0.12 from travis build matrix and add v9 and v10 to build matrix
3be25ef Add package lock file
781d7ac Merge pull request [patch][bug-fix][app-archetype] FIX gulp lint as it skips src/server files electrode-io/electrode#353 from mafintosh/mongodb3
109eec6 Upgrade mongodb to version ^3.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Prototype Pollution


          fix: samples/universal-react-node/package.json to reduce vulnerabilities

a03420a

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AMMO-548920
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-BSON-561052
- https://snyk.io/vuln/SNYK-JS-BSON-6056525
- https://snyk.io/vuln/SNYK-JS-HAPI-548911
- https://snyk.io/vuln/SNYK-JS-MONGODB-473855
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-SUBTEXT-467257
- https://snyk.io/vuln/SNYK-JS-SUBTEXT-548913
- https://snyk.io/vuln/SNYK-JS-SUBTEXT-548915

shubham2811 closed this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet