-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[Snyk] Upgrade: , , , async, chai, minimatch, eslint, google-auth-library, mocha, ms-rest-azure, nodemon, nyc #145
base: master
Are you sure you want to change the base?
Conversation
Snyk has created this PR to upgrade: - @octokit/app from 3.0.2 to 15.1.0. See this package in npm: https://www.npmjs.com/package/@octokit/app - @octokit/request from 3.0.3 to 9.1.3. See this package in npm: https://www.npmjs.com/package/@octokit/request - @octokit/rest from 16.43.2 to 21.0.2. See this package in npm: https://www.npmjs.com/package/@octokit/rest - async from 2.6.4 to 3.2.6. See this package in npm: https://www.npmjs.com/package/async - chai from 4.5.0 to 5.1.1. See this package in npm: https://www.npmjs.com/package/chai - minimatch from 3.1.2 to 10.0.1. See this package in npm: https://www.npmjs.com/package/minimatch - eslint from 6.8.0 to 9.9.1. See this package in npm: https://www.npmjs.com/package/eslint - google-auth-library from 8.9.0 to 9.14.0. See this package in npm: https://www.npmjs.com/package/google-auth-library - mocha from 6.2.3 to 10.7.3. See this package in npm: https://www.npmjs.com/package/mocha - ms-rest-azure from 2.6.2 to 3.0.2. See this package in npm: https://www.npmjs.com/package/ms-rest-azure - nodemon from 1.19.4 to 3.1.4. See this package in npm: https://www.npmjs.com/package/nodemon - nyc from 14.1.1 to 17.0.0. See this package in npm: https://www.npmjs.com/package/nyc See this project in Snyk: https://app.snyk.io/org/ekmixon/project/a50a9592-0b85-48c9-9301-0888580e6c10?utm_source=github&utm_medium=referral&page=upgrade-pr
Micro-Learning Topic: Insecure authentication (Detected by phrase)Matched on "Improper Authentication"Improper authentication happens when mechanisms intended to identify the user are flawed (easily tamperable or insufficient). This would allow an attacker to bypass access controls or to easily impersonate a user. Try a challenge in Secure Code WarriorHelpful references
Micro-Learning Topic: Regular expression denial of service (Detected by phrase)Matched on "Regular Expression Denial of Service"Denial of Service (DoS) attacks caused by Regular Expression which causes the system to hang or cause them to work very slowly when attacker sends a well-crafted input(exponentially related to input size).Denial of service attacks significantly degrade the service quality experienced by legitimate users. These attacks introduce large response delays, excessive losses, and service interruptions, resulting in direct impact on availability. Try a challenge in Secure Code WarriorMicro-Learning Topic: Denial of service (Detected by phrase)Matched on "Denial of Service"The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. Source: https://www.owasp.org/index.php/Denial_of_Service Try a challenge in Secure Code WarriorMicro-Learning Topic: Inefficient regular expression (Detected by phrase)Matched on "Inefficient Regular Expression"A regular expression that requires exponential time to match certain inputs can be a performance bottleneck, and may be vulnerable to denial-of-service attacks. Try a challenge in Secure Code WarriorMicro-Learning Topic: Open redirect (Detected by phrase)Matched on "Open Redirect"This vulnerability refers to the ability of an attacker to arbitrarily perform a redirection (external) or forward (internal) against the system. It arises due to insufficient validation or sanitisation of inputs used to perform a redirect or forward and may result in privilege escalation (in the case of a forward) or may be used to launch phishing attacks against users (in the case of redirects). Try a challenge in Secure Code WarriorHelpful references
Micro-Learning Topic: Prototype pollution (Detected by phrase)Matched on "Prototype Pollution"By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Try a challenge in Secure Code WarriorMicro-Learning Topic: Use of a broken or risky cryptographic algorithm (Detected by phrase)Matched on "Use of a Broken or Risky Cryptographic Algorithm"Using broken or weak cryptographic algorithms can allow an attacker to compromise security. Try a challenge in Secure Code WarriorHelpful references
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We have skipped reviewing this pull request. Here's why:
- It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
- We don't review packaging changes - Let us know if you'd like us to change this.
Snyk has created this PR to upgrade multiple dependencies.
👯♂ The following dependencies are linked and will therefore be updated together.ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
@octokit/app
⚠️ This is a major version upgrade, and may be a breaking change | 3 months ago
⚠️ This is a major version upgrade, and may be a breaking change | 2 months ago
⚠️ This is a major version upgrade, and may be a breaking change | a month ago
⚠️ This is a major version upgrade, and may be a breaking change | 25 days ago
⚠️ This is a major version upgrade, and may be a breaking change | 4 months ago
⚠️ This is a major version upgrade, and may be a breaking change | 2 months ago
⚠️ This is a major version upgrade, and may be a breaking change | 21 days ago
⚠️ This is a major version upgrade, and may be a breaking change | 25 days ago
⚠️ This is a major version upgrade, and may be a breaking change | a month ago
⚠️ This is a major version upgrade, and may be a breaking change | 2 years ago
⚠️ This is a major version upgrade, and may be a breaking change | 3 months ago
⚠️ This is a major version upgrade, and may be a breaking change | 3 months ago
from 3.0.2 to 15.1.0 | 78 versions ahead of your current version
on 2024-06-06
@octokit/request
from 3.0.3 to 9.1.3 | 83 versions ahead of your current version
on 2024-07-14
@octokit/rest
from 16.43.2 to 21.0.2 | 116 versions ahead of your current version
on 2024-08-16
async
from 2.6.4 to 3.2.6 | 12 versions ahead of your current version
on 2024-08-19
chai
from 4.5.0 to 5.1.1 | 9 versions ahead of your current version
on 2024-05-09
minimatch
from 3.1.2 to 10.0.1 | 62 versions ahead of your current version
on 2024-07-08
eslint
from 6.8.0 to 9.9.1 | 125 versions ahead of your current version
on 2024-08-23
google-auth-library
from 8.9.0 to 9.14.0 | 20 versions ahead of your current version
on 2024-08-20
mocha
from 6.2.3 to 10.7.3 | 44 versions ahead of your current version
on 2024-08-09
ms-rest-azure
from 2.6.2 to 3.0.2 | 3 versions ahead of your current version
on 2022-04-28
nodemon
from 1.19.4 to 3.1.4 | 45 versions ahead of your current version
on 2024-06-20
nyc
from 14.1.1 to 17.0.0 | 9 versions ahead of your current version
on 2024-06-09
Issues fixed by the recommended upgrade:
SNYK-JS-LODASHSET-1320032
SNYK-JS-MICROMATCH-6838728
SNYK-JS-BRACES-6838727
SNYK-JS-MOCHA-2863123
SNYK-JS-UNSETVALUE-2400660
SNYK-JS-GLOBPARENT-1016905
SNYK-JS-GOT-2932019
SNYK-JS-MINIMATCH-3050818
SNYK-JS-ISTANBULREPORTS-2328088
SNYK-JS-JSONWEBTOKEN-3180022
SNYK-JS-JSONWEBTOKEN-3180024
SNYK-JS-JSONWEBTOKEN-3180026
npm:debug:20170905
Release notes
Package name: @octokit/app
15.1.0 (2024-06-06)
Features
getInstallationUrl
method (#542) (691ccfb)15.0.1 (2024-04-30)
Bug Fixes
App
class (#536) (318e6fd)15.0.0 (2024-04-30)
Features
BREAKING CHANGES
15.0.0-beta.5 (2024-04-30)
Bug Fixes
@ octokit/auth-app
(70a3fca)15.0.0-beta.4 (2024-04-16)
Features
15.0.0-beta.3 (2024-04-16)
Bug Fixes
15.0.0-beta.2 (2024-02-27)
Bug Fixes
main
entry point (09e0241), closes octokit/core.js#66215.0.0-beta.1 (2024-02-25)
Bug Fixes
Features
BREAKING CHANGES
14.1.0 (2024-04-03)
Features
14.0.2 (2023-11-15)
Bug Fixes
14.1.0 (2024-04-03)
Features
Package name: @octokit/request
9.1.3 (2024-07-14)
Bug Fixes
9.1.2 (2024-07-13)
Bug Fixes
9.1.1 (2024-04-15)
Bug Fixes
default
fallback to exports (#688) (9866c41)9.1.0 (2024-04-09)
Bug Fixes
Features
redirect
request option (#636) (23200c0), closes #5999.0.1 (2024-02-27)
Bug Fixes
main
export (#681) (1d834ae)9.0.0 (2024-02-24)
Features
BREAKING CHANGES
9.0.0-beta.1 (2024-02-23)
Bug Fixes
Features
BREAKING CHANGES
8.4.0 (2024-04-09)
Features
redirect
request option (#636) (abc4955), closes #5998.3.1 (2024-04-05)
Bug Fixes
@ octokit/endpoint
(4e7127c)8.3.0 (2024-04-05)
Bug Fixes
@ octokit/types
(6822e8b)Features
Package name: @octokit/rest
21.0.2 (2024-08-16)
Bug Fixes
21.0.1 (2024-07-17)
Bug Fixes
21.0.0 (2024-06-20)
Features
BREAKING CHANGES
21.0.0-beta.4 (2024-06-19)
Bug Fixes
21.0.0-beta.3 (2024-04-30)
Features
21.0.0-beta.2 (2024-04-16)
Bug Fixes
21.0.0-beta.1 (2024-03-05)
Bug Fixes
add explicit type anotation (3ddd79e)
build: adapt for ESM (aad55f4)
bump deps (21f1aaa)
deps: bump deps (f179b0b)
deps: update octokit monorepo (aed67c2)
docs: update for ESM (42be65a)
Empty commit to trigger release (828467b)
BREAKING CHANGES
20.1.1 (2024-05-03)
Bug Fixes
20.1.0 (2024-04-03)
Features
20.0.2 (2023-09-25)
Bug Fixes
Package name: async
Version 3.2.6
Version 3.2.5
Version 3.2.4
Version 3.2.3
Version 3.2.2
Version 3.2.1
Version 3.2.0
Version 3.1.1
Version 2.6.4
Package name: chai
What's Changed
toThrow
by @ 43081j in #1609New Contributors
Full Changelog: v5.1.0...v5.1.1
What's Changed
iterable
assertion by @ koddsson in #1592New Contributors
Full Changelog: v5.0.3...v5.1.0
Fix bad v5.0.2 publish.
Full Changelog: v5.0.2...v5.0.3
What's Changed
bump-cli
by @ koddsson in #1559??
for node compat (5.x) by @ 43081j in #1576loupe
to latest version by @ koddsson in #1579Full Changelog: v5.0.1...v5.0.2
BREAKING CHANGES
import {...} from 'chai'
orimport('chai')
.require('chai')
will cause failures in nodejs. If you're using ESM and seeing failures, it may be due to a bundler or transpiler which is incorrectly converting import statements into require calls.What's Changed
get-func-name
dependency by @ koddsson in #1416