[Snyk] Fix for 17 vulnerabilities #1909

aliscco · 2024-02-03T05:05:02Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- test/fixtures/qs-package/node_modules/hawk/package.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
631/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.2	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
681/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-450202	Yes	Proof of Concept
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-608086	Yes	Proof of Concept
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASH-73638	Yes	Proof of Concept
541/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 4.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-73639	Yes	Proof of Concept
686/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-LODASHMERGE-173732	Yes	Proof of Concept
636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-LODASHMERGE-173733	Yes	Proof of Concept
589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-1019388	Yes	No Known Exploit
479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
676/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.1	Improper Privilege Management SNYK-JS-SHELLJS-2332187	Yes	Proof of Concept
506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:eslint:20180222	Yes	Proof of Concept
636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:hoek:20180212	Yes	Proof of Concept
636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:lodash:20180130	Yes	Proof of Concept
589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:minimatch:20160620	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: boom

The new version differs by 88 commits.

75de579 7.3.0
a236a89 add debug mode to reformat() ([Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #211)
8727b89 Add changelog.md ([Snyk] Security upgrade sanitize from 4.6.2 to 4.6.2 #210)
af5dc90 Update README.md
692379a 7.2.2
25d4ab8 Remove engines. Closes [Snyk] Security upgrade snyk from 1.101.1 to 1.124.1 #208
87d4562 misc
9e2c5e4 misc
bf7ee73 7.2.1
8e9e651 Update hoek. Closes [Snyk] Security upgrade actionpack from 4.2.5 to 5.2.6.2 #206
2790af3 misc
e11e99e node 11 + cleanup
cb994ed version 7.2.0
c897ab6 424 Failed dependency implementation ([Snyk] Security upgrade django from 1.6.1 to 2.2.27 #188)
9681132 docs(readme): clarified `boomify` statusCode default option ([Snyk] Security upgrade django from 1.6.1 to 2.2.27 #187)
9fac0ec Fix spelling mistake ([Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #182)
e3dc6a9 Corrected minor typo in README.md ([Snyk] Security upgrade node-fetch from 2.6.0 to 3.1.1 #180)
3e25415 Fix typo in README ([Snyk] Security upgrade node-fetch from 2.6.0 to 3.1.1 #178)
55d8996 Test boomify with instanceof
19189a9 7.1.1
310c986 Support instanceof Boom. Closes [Snyk] Security upgrade snyk from 1.101.1 to 1.230.7 #173
a47d150 7.1.0
9bfefb6 decorate option. Closes [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.11.3 #172
a75a104 Clarified usage of new

See the full diff

Package name: code

The new version differs by 94 commits.

e3d110f v5.2.4
b49b01b - Fixed unnamed functions error reporting
0fc756c update to lab 18
57c974c 5.2.3
ef8eccf Remove engines. Closes [Snyk] Security upgrade snyk from 1.101.1 to 1.230.7 #130
6d87669 5.2.2
1e2fefd Update hoek. Closes [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #129
b458d13 v5.2.1
03d7b92 update deps and test on node 11
0dfe00e Add the correct thrownAt() location when using expect().to.reject()
40e5271 Merge branch 'master' of github.com:hapijs/code
506b432 5.2.0
7417485 Return error when asserting for thrown. Closes [Snyk] Security upgrade django from 1.6.1 to 2.2.25 #123
6bf9d1d Invalidates rejection with wrong type or message arguments ([Snyk] Security upgrade django from 2.0.1 to 2.2.25 #121)
18cd84c 5.1.2
5d533ff merge
bece7c3 Merge branch 'master' of github.com:hapijs/code
d2af62a 5.1.1
85fcb25 Update deps. Closes [Snyk] Security upgrade sanitize from 4.6.2 to 5.2.1 #117
7cf8a2d Fix broken API.md anchor ([Snyk] Security upgrade aiohttp from 2.2.2 to 3.8.0 #116)
70c82c7 fix(length): throw decent error on length check of `null` ([Snyk] Security upgrade lodash from 4.17.13 to 4.17.21 #111)
a878e86 Return rejection error. Closes [Snyk] Security upgrade sanitize from 4.6.2 to 4.6.2 #106
50faff7 Update docs
bb37cc5 add test to identify async functions

See the full diff

Package name: cryptiles

The new version differs by 28 commits.

8bfd938 4.1.3
cffed1d Remove engines. Closes [Snyk] Security upgrade open from 0.0.5 to 6.0.0 #36
725c3aa node 11 + cleanup
bd1eba1 4.1.2
9332d42 Fix less than ideal random digits generator. Closes [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5.1 #34
96e63fd Update README.md
7b0c35f 4.1.1
e7cff8f Merge pull request [Snyk] Security upgrade npm from 2.15.12 to 6.13.3 #33 from AdriVanHoudt/AdriVanHoudt-buffer-from
546d1cf fix(fixedTimeComparison): use Buffer.from
3e18271 4.1.0
3ca30ab Add fixedTimeComparison(). Closes [Snyk] Security upgrade mongoose from 4.2.4 to 4.2.5 #32
bc7c151 Merge branch 'master' of github.com:hapijs/cryptiles
997afef 4.0.2
c32e519 Update deps. Closes [Snyk] Security upgrade nodemailer from 0.7.1 to 6.6.1 #31
50793bf Update README.md
13cd4c4 Update deps. Closes [Snyk] Security upgrade django from 1.6.1 to 1.8.16 #28
c44c0e9 Throw errors. Closes [Snyk] Security upgrade jsonpointer from 2.0.0 to 4.1.0 #24. Closes [Snyk] Security upgrade django from 1.6.1 to 1.8.16 #27
434bddb node 8
c32a74c Update deps. Closes [Snyk] Security upgrade django from 1.6.1 to 1.8.16 #26
8baae7e Update .travis.yml
2c34bef Support node 4. Closes [Snyk] Security upgrade open from 0.0.5 to 6.0.0 #23
6bdcd0f Random digits. Closes [Snyk] Security upgrade npm from 2.15.12 to 6.13.4 #22
b083c9d Deps. Closes [Snyk] Security upgrade snyk from 1.101.1 to 1.230.7 #21
a0da466 3.0.1

See the full diff

Package name: hoek

The new version differs by 141 commits.

47d6306 6.1.3
eef9740 cleanup
fc934af Cleanup
f2eb7fd Clone without prototype. Closes [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #290
5bfe5b6 6.1.2
17fe9a1 Revert all symbol handlings to false by default. Closes [Snyk] Security upgrade python from 3.6-slim to 3.10-slim #283
542939b 6.1.1
947a326 Ignore symbols in deepEqual() by default. Closes [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #281
27ac630 6.1.0
b3b5134 Merge pull request [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #281 from kanongil/symbol-support
bec8b86 Update docs
b159f54 Support symbol properties and keys in cloneWithShallow()
9fa34af Support symbol properties for reach(). Closes [Snyk] Security upgrade django from 1.6.1 to 2.2.28 #267
ea1ee6a Support symbol properties in contain()
b6907ac Support symbol properties in clone()
c123e61 Merge pull request [Snyk] Security upgrade nconf from 0.7.2 to 0.11.4 #279 from Nargonath/changelog
f15fd25 Add changelog.md
56f4849 Support enumerable symbol properties in merge()
96ab1bc Support enumerable symbol properties in deepEqual()
6350261 6.0.4
6f02157 Fix clone() for redefined properties. Closes [Snyk] Security upgrade snyk from 1.101.1 to 1.465.0 #278
73c35e8 Expand tests for exotic objects
927974e Update lab 18
bcfa947 6.0.3

See the full diff

Package name: lab

The new version differs by 250 commits.

8387d6b 18.0.2
93d6b38 Update deps. Closes [Snyk] Fix for 1 vulnerabilities #905
a2b8b52 version 18.0.1
5c11479 Merge pull request [Snyk] Security upgrade actionpack from 4.2.5 to 4.2.5 #898 from secretcowlevel/master
a9c6b7a Explicitly test for color output on supporting consoles.
3a2486e Do not run "Leaks ignores Counter globals" on Windows Node >= 11.
b169b65 Update dependencies.
4b12c69 Fix lint and switch to use regex matching instead of endsWith/Os.EOL in output tests.
072c02e Support limited consoles in test/reporters.js.
f0e2f4e Linter tests should use Os.EOL.
e003fff Update .gitattributes
0b6f26e Create .gitattributes
c0d8bb1 Add Windows and MacOS X to Travis.
47e8181 Merge pull request [Snyk] Security upgrade django from 1.6.1 to 1.8.16 #899 from Nargonath/changelog
13d1574 Add changelog.md
e060ace Switch back to Hoek.clone from lodash.deepClone.
da9c89d Merge pull request [Snyk] Fix for 1 vulnerabilities #895 from secretcowlevel/master
c877a18 Use lodash.deepClone in place of Hoek.clone until it's fixed.
9db5dee Fix coverage with sourcemaps inlined via Transform API.
246d25d version 18.0.0
d5c6976 Merge pull request [Snyk] Security upgrade django from 1.6.1 to 1.6.3 #894 from geek/master
4ef5bc4 Have correct exit code with multiple reporters
6dbb48c Merge pull request [Snyk] Fix for 1 vulnerabilities #893 from geek/tests
495dd4f Properly propagate term sig to child lab process