Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 31 vulnerabilities #1

Merged
merged 1 commit into from
Apr 11, 2024
Merged

[Snyk] Fix for 31 vulnerabilities #1

merged 1 commit into from
Apr 11, 2024

Conversation

Zesix
Copy link
Owner

@Zesix Zesix commented Apr 11, 2024

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
⚠️ Warning 
Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 Directory Traversal
SNYK-JS-ADMZIP-1065796		 No No Known Exploit
medium severity 591/1000
Why? Recently disclosed, Has a fix available, CVSS 6.1		 Open Redirect
SNYK-JS-EXPRESS-6474509		 No No Known Exploit
high severity 741/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.4		 DLL Injection
SNYK-JS-KERBEROS-568900		 No Proof of Concept
high severity 731/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2		 Prototype Pollution
SNYK-JS-LODASH-567746		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-174116		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-451540		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Directory Traversal
SNYK-JS-MOMENT-2440688		 No No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Information Exposure
SNYK-JS-MONGOOSE-472486		 No No Known Exploit
high severity 801/1000
Why? Mature exploit, Has a fix available, CVSS 8.3		 Prototype Pollution
SNYK-JS-TYPEORM-590152		 No Mature
medium severity 596/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.5		 Arbitrary Code Injection
SNYK-JS-UNDERSCORE-1080984		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090599		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090600		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090601		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090602		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Prototype Pollution
SNYK-JS-XML2JS-5414874		 No Proof of Concept
critical severity 899/1000
Why? Mature exploit, Has a fix available, CVSS 9.4		 Arbitrary File Write via Archive Extraction (Zip Slip)
npm:adm-zip:20180415		 No Mature
high severity 644/1000
Why? Has a fix available, CVSS 8.6		 Code Injection
npm:dustjs-linkedin:20160819		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:fresh:20170908		 No No Known Exploit
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:lodash:20180130		 No Proof of Concept
high severity 654/1000
Why? Has a fix available, CVSS 8.8		 Cross-site Scripting (XSS)
npm:marked:20150520		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Cross-site Scripting (XSS)
npm:marked:20170112		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Cross-site Scripting (XSS)
npm:marked:20170815		 No No Known Exploit
medium severity 454/1000
Why? Has a fix available, CVSS 4.8		 Cross-site Scripting (XSS)
npm:marked:20170815-1		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:marked:20170907		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:marked:20180225		 No Proof of Concept
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Regular Expression Denial of Service (ReDoS)
npm:moment:20161019		 No No Known Exploit
medium severity 641/1000
Why? Mature exploit, Has a fix available, CVSS 5.1		 Remote Memory Exposure
npm:mongoose:20160116		 No Mature
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
npm:ms:20151024		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:negotiator:20160616		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Override Protection Bypass
npm:qs:20170213		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Directory Traversal
npm:st:20140206		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: adm-zip The new version differs by 134 commits.

See the full diff

Package name: body-parser The new version differs by 221 commits.

See the full diff

Package name: cfenv The new version differs by 3 commits.
  • fb0a2aa update dependencies, now at version 1.2.4
  • 63e072a version 1.2.3
  • 02bb92d Issue 45 Remove '.cfignore'

See the full diff

Package name: errorhandler The new version differs by 85 commits.

See the full diff

Package name: express The new version differs by 250 commits.
  • b28db2c 4.19.2
  • 0b74695 Improved fix for open redirect allow list bypass
  • 4f0f6cc 4.19.1
  • a003cfa Allow passing non-strings to res.location with new encoding handling checks fixes #5554 #5555
  • a1fa90f fixed un-edited version in history.md for 4.19.0
  • 11f2b1d build: fix build due to inconsistent supertest behavior in older versions
  • 084e365 4.19.0
  • 0867302 Prevent open redirect allow list bypass due to encodeurl
  • 567c9c6 Add note on how to update docs for new release (#5541)
  • 69a4cf2 deps: cookie@0.6.0
  • 4ee853e docs: loosen TC activity rules
  • 414854b docs: nominating @ wesleytodd to be project captian
  • 06c6b88 docs: update release date
  • 1b51eda 4.18.3
  • b625132 build: pin Node 21.x to minor
  • e3eca80 build: pin Node 21.x to minor
  • 23b44b3 build: support Node.js 21.6.2
  • b9fea12 build: support Node.js 21.x in appveyor
  • c259c34 build: support Node.js 21.x
  • fdeb1d3 build: support Node.js 20.x in appveyor
  • 734b281 build: support Node.js 20.x
  • 0e3ab6e examples: improve view count in cookie-sessions
  • 59af63a build: Node.js@18.19
  • e720c5a docs: add documentation for benchmarks

See the full diff

Package name: humanize-ms The new version differs by 3 commits.

See the full diff

Package name: marked The new version differs by 250 commits.
  • 529a8d4 Merge pull request #1441 from styfle/release-0.6.2
  • fc5dbf1 🗜️ minify [skip ci]
  • b1ddd3c Merge pull request #1460 from andersk/inline-text-quadratic
  • be27472 Improve worst-case performance of inline.text regex
  • 6b88601 0.6.2
  • ba1de1e 🗜️ minify [skip ci]
  • d94253c Merge pull request #1438 from UziTech/html-new-line-fix
  • 6eec528 Merge pull request #1449 from UziTech/use-htmldiffer
  • 0cd0333 remove redundant comments
  • ff127c5 use template literals
  • a16251d fix test spacing
  • da57301 use htmldiffer in file tests & update to node 4
  • 621f649 abstract htmldiffer
  • 42e816c fix again
  • 246dd3d fix whitespace after tag
  • f1089fe add test
  • 0f0b763 allow html without \n after
  • d069d0d Merge pull request #1448 from UziTech/version
  • 5d6bde0 Merge pull request #1444 from UziTech/normalize-tests
  • 4760772 fix tests
  • df310a8 remove header ids from original tests
  • 775d08d move redos tests to /redos folder
  • b169e7b add excerpt length constant
  • fd9dc21 update deps

See the full diff

Package name: mongoose The new version differs by 250 commits.
  • f88eb25 fix(query): delete top-level `_bsontype` property in queries to prevent silent empty queries
  • 1db031c test(schema): clean up messy tests re: #8459
  • 8fa8012 test: test cleanup re: #8459
  • 4a55040 chore: remove problematic mongoose-long dep and use mongodb 3.4 in tests
  • 91f95da chore: run consistent mongod version in tests
  • 0e65e6e chore: release 4.13.20
  • 803090d fix(schema): make aliases handle mongoose-lean-virtuals
  • 6a8b381 chore: add .config.js to gitignore and npmignore
  • f51c4aa chore: release 4.13.19
  • 2aeeaa8 Merge pull request #7950 from cdimitroulas/backport-aggregate-options-bugfix
  • b10cc98 rename aggregation option test
  • d9a2027 fix bug: Using options in aggregates doesn't set anything
  • 75daf18 chore: release 4.13.18
  • 8c75e9b chore: dont run nsp
  • c8b8720 style: fix lint
  • edf70e4 fix(cast): backport fix from #7290 to 4.x
  • 29f6709 fix(model): handle setting populated path set via `Document#populate()`
  • 0e1772f test(document): repro #7302
  • 2370f97 chore: now working on 4.13.18
  • 4545d44 chore: release 4.13.17
  • fb8b644 fix(document): disallow setting constructor and prototype if strict mode false
  • b33d8c2 style: fix lint
  • df93f5b chore: release 4.13.16
  • a3b98f6 fix(document): disallow setting __proto__ if strict mode false

See the full diff

Package name: validator The new version differs by 114 commits.
  • 47ee5ad 13.7.0
  • 496fc8b fix(rtrim): remove regex to prevent ReDOS attack (#1738)
  • 45901ec Merge pull request #1851 from validatorjs/chore/fix-merge-conflicts
  • 83cb7f8 chore: merge conflict clean-up
  • f17e220 feat(isMobilePhone): add El Salvador es-SV locale
  • 5b06703 feat(isMobilePhone): add Palestine ar-PS locale
  • a3faa83 feat(isMobilePhone): add Botswana en-BW locale
  • 26605f9 feat(isMobilePhone): add Turkmenistan tk-TM
  • 0e5d5d4 feat(isMobilePhone): add Guyana en-GY locale
  • f7ff349 feat(isMobilePhone): add Frech Polynesia fr-PF locale
  • 8627e48 feat(isMobilePhone): add Kiribati en-KI locale
  • ed60123 feat(isMobilePhone): add Tajikistan tg-TJ locale (#1846)
  • c96d805 feat(isMobilePhone): add Maldives dv-MV locale
  • 5c2d69e feat(isMobilePhone): regex for Burkina Faso fr-BF and Namibia en-NA locales
  • fc0fefc feat(isMobilePhone): add Bhutan dz-BT locale (#1770)
  • 01d3da3 feat(isMobilePhone): add Tajikistan tg-TJ locale (#1846)
  • af2b43c feat(isUUID): add support for validation of version v1 and v2 (#1848)
  • 769f6d5 feat(contains): add possibility to check that string contains seed multiple times (#1836)
  • f2381e0 feat: (isMobilePhone): add Cameroon fr-CM locale (#1772)
  • 5773869 feat(isVAT): add dutch NL locale (#1825)
  • de1cb29 fix: Russian passport number regex (#1810)
  • 7bee611 add CDN use option with unpkg (#1844)
  • 57cc14e feat(isIdentityCard): add finnish locale (#1838)
  • 2201869 feat: added finnish locale to isAlpha and isAlphanumeric (#1837)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal
🦉 Code Injection
🦉 Open Redirect
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json to reduce vulnerabilities
145f0c4 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ADMZIP-1065796
- https://snyk.io/vuln/SNYK-JS-EXPRESS-6474509
- https://snyk.io/vuln/SNYK-JS-KERBEROS-568900
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-MARKED-174116
- https://snyk.io/vuln/SNYK-JS-MARKED-451540
- https://snyk.io/vuln/SNYK-JS-MOMENT-2440688
- https://snyk.io/vuln/SNYK-JS-MONGOOSE-472486
- https://snyk.io/vuln/SNYK-JS-TYPEORM-590152
- https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090599
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090600
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090601
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090602
- https://snyk.io/vuln/SNYK-JS-XML2JS-5414874
- https://snyk.io/vuln/npm:adm-zip:20180415
- https://snyk.io/vuln/npm:dustjs-linkedin:20160819
- https://snyk.io/vuln/npm:fresh:20170908
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:marked:20150520
- https://snyk.io/vuln/npm:marked:20170112
- https://snyk.io/vuln/npm:marked:20170815
- https://snyk.io/vuln/npm:marked:20170815-1
- https://snyk.io/vuln/npm:marked:20170907
- https://snyk.io/vuln/npm:marked:20180225
- https://snyk.io/vuln/npm:moment:20161019
- https://snyk.io/vuln/npm:mongoose:20160116
- https://snyk.io/vuln/npm:ms:20151024
- https://snyk.io/vuln/npm:negotiator:20160616
- https://snyk.io/vuln/npm:qs:20170213
- https://snyk.io/vuln/npm:st:20140206
@Zesix Zesix merged commit c6a5120 into main Apr 11, 2024
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@Zesix @snyk-bot