New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk-dev] Fix for 12 vulnerabilities #144

Open

lili2311 wants to merge 1 commit into next from snyk-fix-8388649d404a7d0816b8d76b63493e5d

Owner

lili2311 commented Aug 11, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- app/react/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-BROWSERSLIST-1090194	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-CSSWHAT-1298035	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-IMMER-1019369	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-IMMER-1540542	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LOADERUTILS-3042992	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-LOADERUTILS-3043105	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LOADERUTILS-3105943	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-NTHCHECK-1586032	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Command Injection SNYK-JS-REACTDEVUTILS-1083268	Yes	Proof of Concept
	619/1000 Why? Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-SHELLQUOTE-1766506	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: @svgr/webpack

The new version differs by 197 commits.

af9a6cb v6.0.0
e9469c3 Merge pull request Broken with empty string as the story name storybookjs/storybook#629 from gregberge/rewriting-docs
eb3282b docs: rewriting
6f832f0 Merge pull request Update the postmsg channel module storybookjs/storybook#627 from gregberge/support-css-variables
cbdb47f fix: support CSS variables
985444d chore: fix package-lock.json
a5effba v6.0.0-alpha.4
3f071d6 Merge pull request Github based install does not work due to missing babel_config.js file storybookjs/storybook#626 from gregberge/upgrade-deps
daf6a08 chore(deps): upgrade
1c5f163 Merge pull request Update build state badge url storybookjs/storybook#625 from gregberge/icon-size
483560d chore: fix package-lock.json
3c0b779 feat: allow to specify icon size
6ba16a3 Merge pull request Import css fail when using npm link storybookjs/storybook#624 from gregberge/various-things
f61c8ba chore: fix ref following refactoring
261e1b5 v6.0.0-alpha.3
fe5c117 Merge pull request Add the react-perf query to the iframe storybookjs/storybook#623 from gregberge/webpack
9a4cbce docs(examples): update examples
1a8cc98 fix(webpack): fix webpack 5 behaviour with url-loader
a857bb1 feat: support mask-type property (feat: add storybook version to output storybookjs/storybook#621)
5966714 fix(template): make it possible to use type in template (Use commitizen & semantic-release to make releases more transparent storybookjs/storybook#619)
9ea5da4 refactor(core): use exportName transform (UI: Left Panel Search Box unknown dispatch SET_STORY_FILTER "A Title" storybookjs/storybook#616)
8a1b0aa docs(readme): Fixing CRA link (Sharing components between projects storybookjs/storybook#618)
00a1d4b chore: fix package-lock.json
f729efa v6.0.0-alpha.2

See the full diff

Package name: react-dev-utils

The new version differs by 250 commits.

221e511 Publish
6a3315b Update CONTRIBUTING.md
5614c87 Add support for Tailwind (Misc cleanup storybookjs/storybook#11717)
657739f chore(test): make all tests install with `npm ci` (It's not possible to export decorator that contains React or HTML tags Storybook 6.0 storybookjs/storybook#11723)
20edab4 fix(webpackDevServer): disable overlay for warnings (Issue with deepEqual in SourceContainer storybookjs/storybook#11413)
69321b0 Remove cached lockfile (Option to change the language attribute storybookjs/storybook#11706)
3afbbc0 Update all dependencies (Core: Optimize storiesHash by removing unused parameters storybookjs/storybook#11624)
f5467d5 feat(eslint-config-react-app): support ESLint 8.x (ability to set default addon tab per stories module storybookjs/storybook#11375)
e8319da [WIP] Fix integration test teardown / cleanup and missing yarn installation (ActionBar not clickable in the Actions addon storybookjs/storybook#11686)
c7627ce Update webpack and dev server (Core: Log message length on channel message storybookjs/storybook#11646)
f85b064 The default port used by `serve` has changed (Addon-controls: Fix undefined args handling storybookjs/storybook#11619)
544befe Update package.json (Generating source maps slow the build significantly, should they be opt-in? storybookjs/storybook#11597)
9d0369b Fix ESLint Babel preset resolution (Remove all ts-ignore in vue, tighten typings storybookjs/storybook#11547)
d7b23c8 test(create-react-app): assert for exit code (Update @storybook/preact to support Preact 10 storybookjs/storybook#10973)
1465357 Prepare 5.0.0 alpha release
3880ba6 Remove dependency pinning (Toolbars: Should show name if no icon is configured storybookjs/storybook#11474)
8b9fbee Update CODEOWNERS
cacf590 Bump template dependency version (Addon-docs: Fix subcomponents display logic storybookjs/storybook#11415)
5cedfe4 Bump browserslist from 4.14.2 to 4.16.5 (CSF: Deprecate duplicate titles rather than forbid them storybookjs/storybook#11476)
50ea5ad allow CORS on webpack-dev-server (Warning: Failed prop type: Invalid prop knob.value of type number supplied to RadiosType, expected string. storybookjs/storybook#11325)
63bba07 Upgrade jest and related packages from 26.6.0 to 27.1.0 (docs not processing jsdocs in non-SFC component storybookjs/storybook#11338)
960b21e Bump immer from 8.0.4 to 9.0.6 (Add/composition auto disable storybookjs/storybook#11364)
134cd3c Resolve dependency issues in v5 alpha (Composition: Allow refs versions in config storybookjs/storybook#11294)
b45ae3c Update CONTRIBUTING.md

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Remote Code Execution (RCE)


          fix: app/react/package.json to reduce vulnerabilities

281be85

The following vulnerabilities are fixed with an upgrade:
- https://dev.snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194
- https://dev.snyk.io/vuln/SNYK-JS-CSSWHAT-1298035
- https://dev.snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://dev.snyk.io/vuln/SNYK-JS-IMMER-1019369
- https://dev.snyk.io/vuln/SNYK-JS-IMMER-1540542
- https://dev.snyk.io/vuln/SNYK-JS-LOADERUTILS-3042992
- https://dev.snyk.io/vuln/SNYK-JS-LOADERUTILS-3043105
- https://dev.snyk.io/vuln/SNYK-JS-LOADERUTILS-3105943
- https://dev.snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
- https://dev.snyk.io/vuln/SNYK-JS-NTHCHECK-1586032
- https://dev.snyk.io/vuln/SNYK-JS-REACTDEVUTILS-1083268
- https://dev.snyk.io/vuln/SNYK-JS-SHELLQUOTE-1766506

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet