Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade serialize-javascript from 5.0.1 to 6.0.2 #98

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

ali1k
Copy link
Owner

@ali1k ali1k commented Jan 9, 2024

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 698/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.1
Cross-site Scripting (XSS)
SNYK-JS-SERIALIZEJAVASCRIPT-6147607
Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: serialize-javascript The new version differs by 46 commits.
  • b71ec23 6.0.2
  • f27d65d fix: serialize URL string contents to prevent XSS (#173)
  • 02499c0 Bump @ babel/traverse from 7.10.1 to 7.23.7 (#171)
  • 0d88527 docs: update readme with URL support (#146)
  • e2a3a91 chore: update node version and lock file
  • 5a1fa64 fix typo (#164)
  • 7139f92 Release v6.0.1 (#157)
  • 7e23ae8 Fix serialization issue for 0n. (#156)
  • 343abd9 Bump json5 from 2.1.3 to 2.2.3 (#155)
  • 38d0e70 Bump mocha from 10.1.0 to 10.2.0 (#153)
  • a472d9d Bump minimatch from 3.0.4 to 3.1.2 (#152)
  • d9ad87c ci: bump GitHub Actions
  • 07e8205 Bump chai from 4.3.6 to 4.3.7 (#150)
  • 0cbf6ae Bump mocha from 10.0.0 to 10.1.0 (#149)
  • c68e16a Bump mocha from 9.2.2 to 10.0.0 (#145)
  • 8097fe2 Bump minimist from 1.2.5 to 1.2.6 (#144)
  • 5fbddae Bump mocha from 9.2.0 to 9.2.2 (#143)
  • 183c18a Bump ansi-regex from 5.0.0 to 5.0.1 (#141)
  • 3a88913 Bump chai from 4.3.4 to 4.3.6 (#140)
  • 8984bbb Bump mocha from 9.1.4 to 9.2.0 (#138)
  • 2b4f837 Bump mocha from 9.1.3 to 9.1.4 (#137)
  • f60bab5 Bump mocha from 9.1.2 to 9.1.3 (#133)
  • 9da6d14 Bump mocha from 9.1.1 to 9.1.2 (#132)
  • da9210e Bump mocha from 9.1.0 to 9.1.1 (#131)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants