Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Fix for 5 vulnerabilities #925

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

aliscco
Copy link
Owner

@aliscco aliscco commented Nov 29, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • node_modules/uuid/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908
Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2
Command Injection
SNYK-JS-LODASHTEMPLATE-1088054
Yes Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5
Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831
Yes Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5
Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873
Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Prototype Pollution
SNYK-JS-UNSETVALUE-2400660
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @wdio/cli The new version differs by 250 commits.
  • 6aa9e33 v8.20.0
  • 2b6cea3 (@ wdio/cli): ignore import error, ref fix: update types loading egoist/detect-package-manager#6
  • 658c217 (@ wdio/utils): separate between common and node utils (#11469)
  • 355adfe (@ wdio/cli) replace `yarn-install` with a custom install that supports pnpm as well (#11476)
  • 5027cae fix(types): Element and WebdriverIO.Element definitions do not match (#11470)
  • e14cfd2 Bump @ babel/traverse and depcheck (#11451)
  • 20c17bf (docs): add ElectronJS video to docs
  • 75c629a (docs): update sharding docs
  • 5179b3b v8.19.0
  • d2c4693 removing Element as not needed (#11444)
  • a429320 (@ wdio/cli): Support for sharding (#11441)
  • 86375f9 Bump @ babel/traverse from 7.23.0 to 7.23.2 in /website (#11443)
  • 8c34e15 (docs): add tests on how to parameterize tests (#11424)
  • 387cf11 (wdio) Adding addLocatorStrategy to attach returning object #7724 (#11422)
  • 484f92b (docs): simplify Electron example
  • 83b8f80 Bump @ babel/traverse from 7.21.2 to 7.23.2 in /e2e (#11439)
  • 340eed3 Bump @ babel/traverse from 7.23.0 to 7.23.2 (#11440)
  • 89ab5be Bump aws-sdk from 2.1472.0 to 2.1473.0 (#11435)
  • 1abe2ea Bump edgedriver from 5.3.7 to 5.3.8 (#11438)
  • d0e5d20 Bump @ typescript-eslint/eslint-plugin from 6.7.4 to 6.7.5 (#11437)
  • bdcbd34 Bump @ types/express from 4.17.18 to 4.17.19 (#11436)
  • 147c36c Bump winston-transport from 4.5.0 to 4.6.0 (#11434)
  • 88b1694 Bump saucelabs from 7.2.2 to 7.4.0 (#11433)
  • 196958f Bump @ types/eslint from 8.44.3 to 8.44.4 (#11432)

See the full diff

Package name: jest The new version differs by 250 commits.
  • be16e47 v27.0.0
  • 63102ec chore: update changelog for release
  • 564694a docs(blog): Jest 27 blog post (#11131)
  • b68d91b feat(pretty-print): add option `printBasicPrototype` (#11441)
  • 2226742 chore: minor simplify format results error (#11432)
  • 78eb25d chore: remove needless assign (#11433)
  • 696c455 chore: update lockfile after publish
  • e2eb9ae v27.0.0-next.11
  • 3b253f8 Wait for closed resources to actually close before detecting open handles (#11429)
  • 27bee72 fix: run GC before collecting open handles (#11278)
  • 50451df feat: use fallback if prettier not found (#11400)
  • 150dbd8 chore: update lockfile after publish
  • 6f44529 v27.0.0-next.10
  • cbcec7d Upgrade fsevents in jest-haste-map (#11428)
  • 9633a26 feat: support reporters written in ESM (#11427)
  • 59f42d8 fix: do not cache modules that throw during evaluation (#11263)
  • 57e32e9 Detect open handles with done callbacks (#11382)
  • a397607 Document and test dontThrow for custom inline snapshot matchers (#10995)
  • 4fa3a0b feat: custom haste (#11107)
  • 2047a36 chore: bump deps (#11419)
  • a4358d6 chore: run prettier on changelog
  • bdd6282 Move all default values into `jest-config` (#9924)
  • db643a1 Link to Jest config (#11106)
  • b16082c Fix locale issue #10014 (#11412)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Server-side Request Forgery (SSRF)
🦉 Prototype Pollution

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants