New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 7 vulnerabilities #13

Open

mysky528 wants to merge 1 commit into master from snyk-fix-2dc4e02eed7dbc0fefb7ac9178442e59

Owner

mysky528 commented Nov 27, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- superset/assets/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	Yes	No Known Exploit
	520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	596/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.5	Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: react-bootstrap-table

The new version differs by 80 commits.

ec9f036 Merge pull request build Caravel from sources apache/superset#1534 from AllenFang/v4.0.0-dev
9e48bb7 README
99e2815 v4.0.0 ✨
3ce53cc prod
d4fcae7 bootstrap 4 script&css
9f3eab8 fix bug about wrong compare for React Component
d369521 use btn-secondary as default button style for bootstrap 4
9d1856b fix footer of insert modal was broken when use bootstrap 4
02cfe11 fix mode header of insert modal was broken when use bootstrap 4
d88c2e5 fix dropdown options broken when use bootstrap 4
2d85bfa v4.0.0-beta.10
55b394a prod
c33eb02 increase selection column width when use bootstrap 4
4c86555 increase expand column width when use bootstrap4
78c42b7 fix conflicts
4e0a950 fix sort caret broken when using bootstrap 4
51c3217 version props to assign the bootstrap version
4ff2e5a make compatiable with font awesome
5758b7d fix 0.12.0 artifact missing on pypi.python.org/simple apache/superset#1481, toolbar broken when upgrade to bootstrap 4
613b983 CHANGELOG
4168db3 Merge branch 'jspaine-fix-double-validation' into v4.0.0-dev
b460abc simpified the solution to fix double validation
f80af3e Merge branch 'fix-double-validation' of https://github.com/jspaine/react-bootstrap-table into jspaine-fix-double-validation
b06fd5b 4.0.0-beta.9

See the full diff

Package name: react-map-gl

The new version differs by 250 commits.

014d1b1 4.0.13
ef0f28b fix security vulnerability (Fix path for windows platfrom apache/superset#742)
c1a1c36 Bump mapbox-gl to 0.53 (Add histogram/bucketing visualization apache/superset#739)
dbd6aa8 4.0.12
4d689a1 fix synchronous redraw (Global custom where clause for dashboard apache/superset#736)
818de9a add onNativeClick callback (Create a helper to get translated key/strings to frontend apache/superset#733)
342050a 4.0.11
9c254a1 Updated docs for using non-mapbox sourced tiles (Fix erroneous options for default slices apache/superset#730)
4b9faf4 doc: fix the value type of circle-radius (viz: make sunburst work again apache/superset#728)
9c40c56 Force map rerender synchronously after props update (When connecting caravel to hive server, throws this error when loading a table apache/superset#720)
c24dfe2 Deregister mapbox events listeners when destroy map (dist folder is missing in javascript folder apache/superset#723)
c633c92 Consolidate InteractiveContext and StaticContext into one (Dashboard Autorefresh Settings Persist apache/superset#718)
2202f84 Remove link to redux-map-gl in documentation (Revert "Binding key Q to the running the query in explore view" apache/superset#713)
c5f6aef fix on custom-map-controller.md (更新到源最新 apache/superset#715)
063d9d8 4.0.10
338ee01 Improve heatmap example
954832e Improve reuse map example
0be69cf Fix website build
039abd3 Bug fix: implement onLoad event calling when reuseMaps is set to true (Filter empty strings or nulls, and add more operators apache/superset#704)
1b941b2 Don't query interactive layer ids before map has loaded (refresh druid metadata apache/superset#708)
5def7f7 Add heatmap example (Tutorials apache/superset#698)
dedf110 Attach a default onError handler, logging to console.error (Make DruidDatasource.version_higher support funky version strings apache/superset#706)
0e04ce7 Remove excessive fields from NavigationControl's callback argument (sunburst: ordering of groupby not preserved on dashboard apache/superset#702)
aeeaf35 Update broken url to the ScatterplotOverlay

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Denial of Service
🦉 Server-side Request Forgery (SSRF)
🦉 More lessons are available in Snyk Learn


          fix: superset/assets/package.json to reduce vulnerabilities

3c335d5

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-2342118
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet