New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 6 vulnerabilities #382

Open

snyk-bot wants to merge 1 commit into master from snyk-fix-77f6d6d30410db7aa74da2d41b217f0a

snyk-bot commented Apr 12, 2022

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- packages/verification-pool-api/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: firebase-tools

The new version differs by 250 commits.

9df5e52 10.1.0
fc2c57f use built-in cache with setup-node (Geth performance (memory, sync time, peers) analytics is easily accessible celo-org/celo-monorepo#4006)
8e14e83 update mocha, nyc, chai (Create and implement a protocol to handle flaky tests celo-org/celo-monorepo#3991)
9ae4fef shrinkwrap CLI dependencies (Mobile Analytics data is easily accessible celo-org/celo-monorepo#4004)
dfaa859 Add support for emulating functions from multiple sources at once (Fix celostat blockscout link celo-org/celo-monorepo#3937)
a90f28a update some dev dependencies (Address existing crashes/errors celo-org/celo-monorepo#3988)
bf9021e updates inquirer; updates a couple packages in package-json for audit (Create Release Process, gather assets needed for release, general release work celo-org/celo-monorepo#3985)
e5d55e2 increase auth emulator timeout (Improve invitation & redemption experience celo-org/celo-monorepo#3986)
e05d2e0 security(deps): upgrade to ora@5.4.1 (Deliver and integration of Transactions + Sankey Diagram for WB PoC celo-org/celo-monorepo#3981)
8998185 upgrade exegesis* packages and regenerate api to update messages (Deliver Grameen Integrations (Ayannah and B&G) celo-org/celo-monorepo#3977)
9e9a8cd upgrade typescript to 4.5 (Complete and publish the smart contract release process celo-org/celo-monorepo#3957)
edbe969 disabling http in the fetchwebsetup requests makes them much faster (Collect Early Feedback celo-org/celo-monorepo#3984)
012f327 Revive the runtime config loader in the emulator runtime. (Publish documentation for Istanbul RPC methods celo-org/celo-monorepo#3974)
1ca8364 Upgrade google-auth-library (Refactor "getting started" docs to improve security and reliability of the resulting setup celo-org/celo-monorepo#3972)
754c8e4 Fix bug where empty vpc connector setting was removed. (Create "Operating manual" for validator security and reliability best practices celo-org/celo-monorepo#3973)
9736bb0 Added finer grained metrics to ext:install. (Fixing Tech debt in ReleaseGold and Election celo-org/celo-monorepo#3940)
6ecb791 New provider metrics command for extension providers (Add readiness probe to full nodes, use exec for long running processes in containers ran from sh/bash celo-org/celo-monorepo#3938)
c068382 upgrade npm in node12 container for building (Merge and test implementation of new DowntimeSlasher contract celo-org/celo-monorepo#3958)
428ba3c [firebase-release] Removed change log and reset repo after 10.0.1 release
b97dc4a 10.0.1
09e9dbc package-lock.json and npm audit package updates (Add celotool local-testnet command as an easy way to create local testnets celo-org/celo-monorepo#3954)
318087b Release Database Emulator v4.7.3. (Adding transfers with comments to CLI celo-org/celo-monorepo#3955)
f12728d [firebase-release] Removed change log and reset repo after 10.0.0 release
0da4c43 10.0.0

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Open Redirect
🦉 Prototype Pollution


          fix: packages/verification-pool-api/package.json to reduce vulnerabil…

3eb9c1c

…ities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2330875
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2331908
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430337
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430339
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430341

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet