Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 2 vulnerabilities #172

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 2 vulnerabilities #172

wants to merge 1 commit into from
+5 −5

Conversation

taotao2345
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • node_modules/@jest/reporters/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 Uncontrolled resource consumption
SNYK-JS-BRACES-6838727		 Yes No Known Exploit
high severity 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @jest/environment The new version differs by 209 commits.
  • 170eee1 fix: expose vm context directly from test envs (#9428)
  • e818dca feat: add support for .mjs config (#9431)
  • 8236779 Fix: Prevent maintaining RegExp state between multiple tests (#9289)
  • f19adb1 chore: bump babel (#9427)
  • 2ece4f9 Do not highlight matched asymmetricMatcher in diffs (#9257)
  • 2839036 chore: sort entries in changelog
  • 7ee717d Fix pretty-format to respect displayName on forwardRef. (#9422)
  • abaea37 Normalize --findRelatedTests paths on win32 platforms (#8961)
  • c8c4c4e jest-snapshot: Fix regression in diff for jest-snapshot-seriali… (#9419)
  • 17f6c83 jest-reporters: Use global coverage thresholds as high watermarks (#9416)
  • 72040d9 Avoid clashes with other globals in type declaration (#9415)
  • 5e5db14 Images of snapshot colors for Jest 25 blog (#9410)
  • a31fc41 jest-core: optimize collecting collectCoverageFrom (#9399)
  • 7f69176 chore: bump deps (#9394)
  • 5236155 chore: fix supporter fetching script on node 8
  • 282f400 chore: fetch open collective supporters via gql api (#9377)
  • 8c20a8d chore: deploy website when website deploy script changes (#9375)
  • 4425a1f fix(website): make sure to fetch supporters when deploying the website
  • 5014025 chore: bump @ types/micromatch to ^4.0.0 (#9369)
  • 9419034 Resolve dynamic dependencies correctly when a mapping exists (#9303)
  • a2fcda6 docs: Use `Object.defineProperty()` for stubbing global propert… (#9288)
  • acb9c09 chore: fix examples dependencies (#9344)
  • bc86f50 Add helpful link to custom transformer in the 'transform' confi… (#9309)
  • 75843e3 chore: refresh lockfile (#9338)

See the full diff

Package name: @jest/transform The new version differs by 250 commits.
  • be16e47 v27.0.0
  • 63102ec chore: update changelog for release
  • 564694a docs(blog): Jest 27 blog post (#11131)
  • b68d91b feat(pretty-print): add option `printBasicPrototype` (#11441)
  • 2226742 chore: minor simplify format results error (#11432)
  • 78eb25d chore: remove needless assign (#11433)
  • 696c455 chore: update lockfile after publish
  • e2eb9ae v27.0.0-next.11
  • 3b253f8 Wait for closed resources to actually close before detecting open handles (#11429)
  • 27bee72 fix: run GC before collecting open handles (#11278)
  • 50451df feat: use fallback if prettier not found (#11400)
  • 150dbd8 chore: update lockfile after publish
  • 6f44529 v27.0.0-next.10
  • cbcec7d Upgrade fsevents in jest-haste-map (#11428)
  • 9633a26 feat: support reporters written in ESM (#11427)
  • 59f42d8 fix: do not cache modules that throw during evaluation (#11263)
  • 57e32e9 Detect open handles with done callbacks (#11382)
  • a397607 Document and test dontThrow for custom inline snapshot matchers (#10995)
  • 4fa3a0b feat: custom haste (#11107)
  • 2047a36 chore: bump deps (#11419)
  • a4358d6 chore: run prettier on changelog
  • bdd6282 Move all default values into `jest-config` (#9924)
  • db643a1 Link to Jest config (#11106)
  • b16082c Fix locale issue #10014 (#11412)

See the full diff

Package name: jest-haste-map The new version differs by 250 commits.
  • be16e47 v27.0.0
  • 63102ec chore: update changelog for release
  • 564694a docs(blog): Jest 27 blog post (#11131)
  • b68d91b feat(pretty-print): add option `printBasicPrototype` (#11441)
  • 2226742 chore: minor simplify format results error (#11432)
  • 78eb25d chore: remove needless assign (#11433)
  • 696c455 chore: update lockfile after publish
  • e2eb9ae v27.0.0-next.11
  • 3b253f8 Wait for closed resources to actually close before detecting open handles (#11429)
  • 27bee72 fix: run GC before collecting open handles (#11278)
  • 50451df feat: use fallback if prettier not found (#11400)
  • 150dbd8 chore: update lockfile after publish
  • 6f44529 v27.0.0-next.10
  • cbcec7d Upgrade fsevents in jest-haste-map (#11428)
  • 9633a26 feat: support reporters written in ESM (#11427)
  • 59f42d8 fix: do not cache modules that throw during evaluation (#11263)
  • 57e32e9 Detect open handles with done callbacks (#11382)
  • a397607 Document and test dontThrow for custom inline snapshot matchers (#10995)
  • 4fa3a0b feat: custom haste (#11107)
  • 2047a36 chore: bump deps (#11419)
  • a4358d6 chore: run prettier on changelog
  • bdd6282 Move all default values into `jest-config` (#9924)
  • db643a1 Link to Jest config (#11106)
  • b16082c Fix locale issue #10014 (#11412)

See the full diff

Package name: jest-runtime The new version differs by 250 commits.
  • be16e47 v27.0.0
  • 63102ec chore: update changelog for release
  • 564694a docs(blog): Jest 27 blog post (#11131)
  • b68d91b feat(pretty-print): add option `printBasicPrototype` (#11441)
  • 2226742 chore: minor simplify format results error (#11432)
  • 78eb25d chore: remove needless assign (#11433)
  • 696c455 chore: update lockfile after publish
  • e2eb9ae v27.0.0-next.11
  • 3b253f8 Wait for closed resources to actually close before detecting open handles (#11429)
  • 27bee72 fix: run GC before collecting open handles (#11278)
  • 50451df feat: use fallback if prettier not found (#11400)
  • 150dbd8 chore: update lockfile after publish
  • 6f44529 v27.0.0-next.10
  • cbcec7d Upgrade fsevents in jest-haste-map (#11428)
  • 9633a26 feat: support reporters written in ESM (#11427)
  • 59f42d8 fix: do not cache modules that throw during evaluation (#11263)
  • 57e32e9 Detect open handles with done callbacks (#11382)
  • a397607 Document and test dontThrow for custom inline snapshot matchers (#10995)
  • 4fa3a0b feat: custom haste (#11107)
  • 2047a36 chore: bump deps (#11419)
  • a4358d6 chore: run prettier on changelog
  • bdd6282 Move all default values into `jest-config` (#9924)
  • db643a1 Link to Jest config (#11106)
  • b16082c Fix locale issue #10014 (#11412)

See the full diff

Package name: jest-util The new version differs by 209 commits.
  • 170eee1 fix: expose vm context directly from test envs (#9428)
  • e818dca feat: add support for .mjs config (#9431)
  • 8236779 Fix: Prevent maintaining RegExp state between multiple tests (#9289)
  • f19adb1 chore: bump babel (#9427)
  • 2ece4f9 Do not highlight matched asymmetricMatcher in diffs (#9257)
  • 2839036 chore: sort entries in changelog
  • 7ee717d Fix pretty-format to respect displayName on forwardRef. (#9422)
  • abaea37 Normalize --findRelatedTests paths on win32 platforms (#8961)
  • c8c4c4e jest-snapshot: Fix regression in diff for jest-snapshot-seriali… (#9419)
  • 17f6c83 jest-reporters: Use global coverage thresholds as high watermarks (#9416)
  • 72040d9 Avoid clashes with other globals in type declaration (#9415)
  • 5e5db14 Images of snapshot colors for Jest 25 blog (#9410)
  • a31fc41 jest-core: optimize collecting collectCoverageFrom (#9399)
  • 7f69176 chore: bump deps (#9394)
  • 5236155 chore: fix supporter fetching script on node 8
  • 282f400 chore: fetch open collective supporters via gql api (#9377)
  • 8c20a8d chore: deploy website when website deploy script changes (#9375)
  • 4425a1f fix(website): make sure to fetch supporters when deploying the website
  • 5014025 chore: bump @ types/micromatch to ^4.0.0 (#9369)
  • 9419034 Resolve dynamic dependencies correctly when a mapping exists (#9303)
  • a2fcda6 docs: Use `Object.defineProperty()` for stubbing global propert… (#9288)
  • acb9c09 chore: fix examples dependencies (#9344)
  • bc86f50 Add helpful link to custom transformer in the 'transform' confi… (#9309)
  • 75843e3 chore: refresh lockfile (#9338)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled resource consumption

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@taotao2345 @snyk-bot