Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Fix for 1 vulnerabilities #10

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

apoorvanand
Copy link
Owner

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • deps/npm/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5
Regular Expression Denial of Service (ReDoS)
SNYK-JS-SSRI-1085630
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: cacache The new version differs by 79 commits.
  • f9c677b chore(release): 15.0.0
  • e8afcff chore: ssri 8
  • 81b3fd9 docs: update options info
  • 57d11bc feat: remove figgy-pudding
  • a36bb4b chore: basic project updates
  • 9ab38aa chore(release): 14.0.0
  • 5a66e7a chore(deps): tar v6 and mkdirp v1
  • f96e40d chore: enforce tap 100% coverage
  • 5390048 test: Add to lib/verify.js test coverage
  • fee725d test: Add to lib/entry.index.js test coverage
  • 5488bcb test: Add to get.js test coverage
  • c40323f chore: Remove translation ref from README
  • b45a2bc test: coverage for last few lines of content/write.js
  • 025d585 chore: clean up path.join call for readability
  • 2128770 chore: collapse conditionals in lib/content/rm.js
  • 7bd8620 chore: Removes unnecessary check for error
  • fbbcf93 chore: Removes unnecessary if block
  • 79e3f1c chore: small readability refactor
  • cdb4e48 test: Add lib/content/read.js tests
  • 6a6716a test: verify strange EPERM on Windows handling in move-file
  • 94ea1cf Use explicit block in order to isolate istanbul ignore comment
  • c8d624e Moved ignore line
  • 75c2ba5 test(move-file): Added test to renaming fallback
  • a931c99 chore(release): 13.0.1

See the full diff

Package name: libnpmhook The new version differs by 14 commits.

See the full diff

Package name: npm-registry-fetch The new version differs by 85 commits.
  • 68a2570 chore(release): 7.0.0
  • 5d78c78 chore: ignore coverage folder
  • 57fcc88 chore: update cacache, ssri, make-fetch-happen
  • 152e666 chore: remove extraneous safe-buffer dep
  • 6bccc1a chore: remove extraneous semver dep
  • ede3c08 fix: Remove figgy-pudding, use canonical option names
  • ae7e994 chore(release): 6.0.2
  • 1770f1b chore(doc): document the effect of ?write=true on caching
  • 450447f chore: fix the 'not in ci' config test when in CI
  • 83f89f3 fix: always bypass cache when ?write=true
  • 55d602e chore(release): 6.0.1
  • 50e8afc fix: use 30s default for timeout as per README
  • 42f998a Added missing ci tests
  • 280ad2f chore: cleanup, force 100% test cov
  • d370dba chore(release): 6.0.0
  • 8c6622f chore: make-fetch-happen 7.1.0
  • 5813da6 fix: detect CI so our tests don't fail in CI
  • 3de1695 chore: replace nyc config with tap config
  • e18ed22 chore: bump make-fetch-happen to v7
  • 62f81a2 chore: bump ssri to v7
  • 8ccfa8a fix: Use WhatWG URLs instead of url.parse
  • 510b125 chore: normalize settings, drop old nodes, update deps
  • 622afb4 chore(release): 5.0.1
  • 7aa14fd deps: update all deps

See the full diff

Package name: pacote The new version differs by 195 commits.
  • f156b62 11.0.0
  • 7eabcc4 remove all traces of figgy-pudding
  • ee19d6f Do not mutate the opts arg passed into Fetcher
  • 872a63e 10.3.2
  • 96d364c Never provide the string 'null' as an integrity value
  • aef0f62 10.3.1
  • f119a20 update cacache and other deps to latest
  • 71dd75f tar@6
  • 7d95bdf Upgrade to mkdirp v1
  • e88f844 10.3.0
  • b21dd92 update semver
  • d8ab8cf update npm-packlist
  • 361f0b3 update tap
  • c4bbf23 test: make the remote timeout test time out forever
  • b4ea91f npm-registry-fetch 6.0.0
  • 591edd8 @ npmcli/installed-package-contents@1.0.5
  • 5ce1093 test: make remote timeout test more reliably time out
  • 48fc9b8 use WhatWG URL instead of url.parse
  • e515bce Update deps, float patch for npm-registry-fetch
  • cf50f54 update @ npmcli/installed-package-contents, require node >=10
  • 698e996 Extract: rimraf dir contents, not dir itself
  • e568305 add @ npmcli/installed-package-contents module
  • e8a80d7 upgrade all deps
  • dfccb4f remove extraneous isNaN checking in git opts

See the full diff

Package name: ssri The new version differs by 25 commits.
  • 3eec7a3 chore(release): 8.0.1
  • 2083289 chore: update package-lock and dev dependencies
  • 76e2233 fix: simplify regex for strict mode, add tests
  • 41b764f chore(release): 8.0.0
  • 4062735 fix: harden SRI parsing against ../ funny business
  • a6811cb fix: throw null when sri is empty or bad
  • 1727a7c chore: consistent project setup
  • 4a963e5 fix: IntegrityStream responds to mutating opts object mid-stream
  • 0e78fd7 feat: remove figgy-pudding
  • 79ba4ec chore(release): 7.1.0
  • 0572c1d feat: Add Integrity#merge method
  • 3084efd deps: tap@14.8.2
  • 6545b4b deps: minipass@3.1.1
  • 806e8c8 fix: Do not blow up if the opts object is mutated
  • cea474f chore(release): 7.0.1
  • 3ff8ba8 chore: require node >=8, update minipass
  • 9c76e0c chore(release): 7.0.0
  • 55b055d fix: return super.write() return value
  • d834c8d chore: add code owners to github metadata
  • 6d13165 Use native promises only
  • f7224bc docs: update github repository links
  • 0659cca test: bring up to 100% coverage
  • 2e54956 test: update tap, standard, standard-version, travis
  • 34a7c74 chore(streams): refactor integrityStream fn

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants