New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 9 vulnerabilities #33

Open

snyk-bot wants to merge 1 commit into master from snyk-fix-0ebd3c1e76f164b59245a2722cb24de8

snyk-bot commented Apr 30, 2022

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- cyclic-dep/package.json
- cyclic-dep/package-lock.json
- cyclic-dep/.snyk

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-DOTPROP-543489	No	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	No	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	No	Proof of Concept
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	No	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	No	Proof of Concept
	686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	No	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
	469/1000 Why? Has a fix available, CVSS 5.1	Denial of Service (DoS) npm:mem:20180117	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @thebespokepixel/string

The new version differs by 46 commits.

9583b13 Update Dependencies
d308121 Merge branch 'release/v0.5.10' into develop
8ccef83 Update Documentation
bc53933 Update Dependencies
b7d5241 Update deps
9a77bdc Merge branch 'release/v0.5.9' into develop
95c31b0 Update Documentation
00dad7b Update Dependencies
edfac96 Update docs
27bb87a Merge branch 'release/v0.5.8' into develop
ded82f1 Update Documentation
35b67a8 Update Dependencies
de95214 Update docs
746892a Update docs
a801b36 Update pkg/docs/travis
13d97f4 Merge branch 'release/v0.5.7' into develop
355ed65 Update Documentation
853814a Update Dependencies
b8ee7a9 Merge branch 'master' into develop
699a440 Merge branch 'release/v0.5.6'
2b9d5c9 Update docs
243bb0c 0.5.6
f967333 Update deps
8c250b8 Merge branch 'master' into develop

See the full diff

Package name: term-ng

The new version differs by 54 commits.

8ce336f Update Dependencies
a8824fc Update
8899e0a Merge branch 'release/v1.0.5' into develop
b4eb2d9 Update Documentation
2d7bdde Update Dependencies
243b195 Update docs
10e8bd4 Update docs
040b71f Merge branch 'release/v1.0.4' into develop
b5dcbbb Update Documentation
9fe33e4 Update Dependencies
87e9c19 Update pkg/docs
e8100fa Merge branch 'release/v1.0.3' into develop
ffaf4ff Update Documentation
d8c7593 Update Dependencies
fe38dac Merge branch 'release/v1.0.2' into develop
b78514e Update Documentation
e6ec966 1.0.2
9d19ad4 Update Dependencies
5d45f8f Merge branch 'master' into develop
a600e2f Merge branch 'release/v1.0.1'
0f23c61 Update docs
72e2d91 1.0.1
203fcc5 Update deps
d22a586 Update deps

See the full diff

Package name: truwrap

The new version differs by 68 commits.

ba9fc1c Update Dependencies
55cf3bd Update
25e4939 Merge branch 'release/v1.0.5' into develop
d325317 Update Documentation
1fa9520 Update Dependencies
6094c14 Update docs
afa86e6 Update docs
f22498f Update pkg
939000b Fix docs
652ca51 Merge branch 'release/v1.0.4' into develop
3d3a874 Update Documentation
af5206f Update Dependencies
fd02e69 Fix import ordering
ef8ebb9 Update pkg/docs
a195d36 Merge branch 'release/v1.0.3' into develop
d2a773d Update Documentation
4e0b673 Update Dependencies
03aa4b3 Merge branch 'release/v1.0.2' into develop
0be40c6 Update Documentation
1cbef73 1.0.2
5f9f1a7 Update Dependencies
81b9e50 Merge branch 'master' into develop
c8efb2e Merge branch 'release/v1.0.1'
a24502e Update docs

See the full diff

Package name: update-notifier

The new version differs by 23 commits.

adf7803 4.0.0
fb5161c Remove the `callback` option ([Snyk] Security upgrade tap from 5.8.0 to 12.0.2 #158)
39682de Rename `boxenOpts` option to `boxenOptions`
bc1721a Avoid showing notification if current version is the latest ([Snyk] Security upgrade bootstrap from 3.4.1 to 4.0.0 #174)
ccaf686 Update dependencies
b1525e6 Disable when `NODE_ENV` is `test` ([Snyk] Security upgrade bootstrap from 3.4.1 to 5.0.0 #173)
bf73119 Fix install command for npm global ([Snyk] Security upgrade tap from 5.8.0 to 18.0.0 #165)
592b025 3.0.1
f8b4e60 Update Travis matrix
a6d6b49 Update URL to TTY ([Snyk] Security upgrade tap from 5.8.0 to 11.1.3 #163)
f9d168a Remove object spread to support node >=8.0.0 <8.6.0 ([Snyk] Fix for 1 vulnerabilities #164)
1712928 Tidelift tasks
72f83d1 Create funding.yml
a7bb3ee 3.0.0
ad8ed1b Suggest yarn when installed with yarn ([Snyk] Security upgrade karma from 2.0.3 to 3.0.0 #132)
5f06620 Exit the update check process if it does not respond after 30s ([Snyk] Security upgrade ejs from 1.0.0 to 3.1.10 #156)
79e89ad Fix failing test ([Snyk] Fix for 1 vulnerabilities #155)
c8faa84 Add `distTag` option ([Snyk] Security upgrade express from 4.16.3 to 4.19.2 #151)
14632e4 Add failing test for [Snyk] Fix for 1 vulnerabilities #153 ([Snyk] Security upgrade lodash from 4.17.10 to 4.17.17 #154)
aafd8a0 Require Node.js 8
0d49f51 Add Tidelift mention in the readme
8df01b3 Fix docs position of `shouldNotifyInNpmScript` ([Snyk] Fix for 1 vulnerabilities #143)
d371834 Docs: isGlobal option does not default to true ([Snyk] Fix for 12 vulnerabilities #142)

See the full diff

Package name: verbosity

The new version differs by 66 commits.

b22429f Update Dependencies
5608b79 Merge branch 'release/v1.2.0' into develop
e6adfb8 Update Documentation
9151889 Update Dependencies
5dc6c7e Turn off global default.
f565bf5 Merge branch 'release/v1.1.3' into develop
216d67a Update Documentation
e103271 Update Dependencies
e1ed24b Update docs
2d1799d Update travis
1ee0e3b Update travis
5e07a23 Merge branch 'release/v1.1.2' into develop
69f544e Update Documentation
598bf10 Update Dependencies
e0662a5 Fix tests
671cc1a Update pkg/docs
497a2f2 Merge branch 'release/v1.1.1' into develop
9e632a3 Update Documentation
da98104 Update Dependencies
8da3319 Merge branch 'release/v1.1.0' into develop
f1f90d3 Update Documentation
03106a1 Update Dependencies
9e61575 Add global verbosity control
a46aef1 Merge branch 'release/v1.0.2' into develop

See the full diff

Package name: yargs

The new version differs by 166 commits.

aa09faf chore: release 15.0.1 ([Snyk(Unlimited)] Upgrade node-uuid from 1.4.0 to 1.4.8 snyk-fixtures/npm-lockfiles#1480)
6a9ebe2 fix(deps): cliui, find-up, and string-width, all drop Node 6 support ([Snyk(Unlimited)] Upgrade qs from 0.0.6 to 0.6.6 snyk-fixtures/npm-lockfiles#1479)
5cc2b5e chore: release 15.0.0 ([Snyk(Unlimited)] Upgrade verbosity from 0.9.2 to 0.10.1 snyk-fixtures/npm-lockfiles#1462)
62a114a force build
1840ba2 feat: expose `Parser` from `require('yargs/yargs')` ([Snyk(Unlimited)] Upgrade node-uuid from 1.4.0 to 1.4.8 snyk-fixtures/npm-lockfiles#1477)
afd5b48 fix(docs): update boolean description and examples in docs ([Snyk(Unlimited)] Upgrade node-uuid from 1.4.0 to 1.4.8 snyk-fixtures/npm-lockfiles#1474)
c10c38c feat(deps)!: yargs-parser now throws on invalid combinations of config ([Snyk(Unlimited)] Upgrade qs from 0.0.6 to 0.6.6 snyk-fixtures/npm-lockfiles#1470)
0cba424 build: switch to release-please for releases ([Snyk(Unlimited)] Upgrade node-uuid from 1.4.0 to 1.4.8 snyk-fixtures/npm-lockfiles#1471)
445bc58 chore: update engines to note Node 6 is dropped ([Snyk(Unlimited)] Upgrade debug from 2.0.0 to 2.6.9 snyk-fixtures/npm-lockfiles#1469)
52d875a test: add additional test for 1459
12c82e6 fix: stop-parse was not being respected by commands ([Snyk(Unlimited)] Upgrade sgr-composer from 0.5.0 to 0.5.3 snyk-fixtures/npm-lockfiles#1459)
b4812ac test: add tests for argsert warning to display positional information ([Snyk(Unlimited)] Upgrade node-uuid from 1.4.0 to 1.4.8 snyk-fixtures/npm-lockfiles#1468)
10f10ee test: cover missing filter arg in obj-filter ([Snyk(Unlimited)] Upgrade qs from 0.0.6 to 0.6.6 snyk-fixtures/npm-lockfiles#1467)
cb0396f build: switch to c8 for coverage ([Snyk(Unlimited)] Upgrade color-convert from 1.9.2 to 1.9.3 snyk-fixtures/npm-lockfiles#1464)
ebee59d fix!: update to yargs-parser with fix for array default values ([Snyk(Unlimited)] Upgrade @thebespokepixel/es-tinycolor from 0.3.1 to 0.3.2 snyk-fixtures/npm-lockfiles#1463)
5120aec test: adds missing array choice regression test ([Snyk(Unlimited)] Upgrade verbosity from 0.9.2 to 0.10.1 snyk-fixtures/npm-lockfiles#1447)
2ba8ce0 chore!: drop Node 6 support ([Snyk(Unlimited)] Upgrade @thebespokepixel/meta from 0.2.3 to 0.2.5 snyk-fixtures/npm-lockfiles#1461)
cb64329 build: configure release-please
0d3642b refactor!: remove package.json-based parserConfiguration ([Snyk(Unlimited)] Upgrade truwrap from 0.8.1 to 0.8.4 snyk-fixtures/npm-lockfiles#1460)
9adf22e doc(webpack): webpack example ([Snyk(Unlimited)] Upgrade qs from 0.0.6 to 0.6.6 snyk-fixtures/npm-lockfiles#1436)
7e1c8fc Add missing french translation ([Snyk(Unlimited)] Upgrade @thebespokepixel/string from 0.5.2 to 0.5.10 snyk-fixtures/npm-lockfiles#1456)
b1b156a fix(docs): TypeScript import to prevent a future major release warning ([Snyk(Unlimited)] Upgrade @thebespokepixel/string from 0.5.2 to 0.5.10 snyk-fixtures/npm-lockfiles#1441)
bc3c4d1 chore(release): 14.2.0
4d21520 feat(deps): introduce yargs-parser with support for unknown-options-as-args ([Snyk(Unlimited)] Upgrade node-uuid from 1.4.0 to 1.4.8 snyk-fixtures/npm-lockfiles#1440)

See the full diff

With a Snyk patch:

Severity	Priority Score (*)	Issue	Exploit Maturity
	731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.


          fix: cyclic-dep/package.json, cyclic-dep/package-lock.json & cyclic-d…

d5483c6

…ep/.snyk to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-DOTPROP-543489
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
- https://snyk.io/vuln/npm:mem:20180117


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746

snyk-bot mentioned this pull request

[Snyk] Fix for 2 vulnerabilities #75

Open

Omrisnyk mentioned this pull request

[Snyk] Fix for 12 vulnerabilities #142

Open

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet