Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 2 vulnerabilities #117

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 2 vulnerabilities #117

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

@snyk-bot snyk-bot commented Jul 6, 2022

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HAWK-2808852		 Yes No Known Exploit
medium severity 526/1000
Why? Recently disclosed, Has a fix available, CVSS 4.8		 Session Fixation
SNYK-JS-PASSPORT-2840631		 No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: cloudant The new version differs by 63 commits.
  • 3a2bfde Merge pull request #235 from cloudant/prepare-1.10.0-release
  • 83244a6 Prepare version 1.10.0 release
  • 83480c6 Merge pull request #234 from cloudant/use-cloudant-nano-6.7.0
  • 0da884f Bump node engine requirements
  • ab46f63 Use [email protected]
  • 0e3e027 Update version to 1.10.0-SNAPSHOT
  • b174c4d Merge pull request #230 from cloudant/prepare-1.9.0-release
  • 894f564 Prepare 1.9.0 release
  • dc0b8cb Merge pull request #232 from cloudant/bump-cloudant-nano-dep
  • 3d019de Use [email protected]
  • b7b7b71 Merge pull request #231 from cloudant/use-latest-3.x.x-debug
  • bf1d236 Use latest [email protected]
  • 212ff3b Merge pull request #224 from gdams/master
  • 222c175 fixup tests
  • a54a1c3 Merge pull request #206 from cloudant/update-npm-ignore
  • 3f24076 Refactor test credential environment variables
  • 254805d Update .npmignore
  • 0c252a7 Merge pull request #205 from cloudant/add-jenkins-publish-stage
  • 0aa7141 Correct snapshot version number
  • 0a0fc30 Add jenkins publish stage
  • 3a54d0d Add @ cloudant scope to package name
  • 049c66b Merge pull request #203 from kjdelisle/package/fix-tunnel-agent-vuln
  • 12631ba package: use request@^2.81.0
  • 26c8f8c Fix unexpected end of input in test/plugins/retry429.js

See the full diff

Package name: couchimport The new version differs by 8 commits.

See the full diff

Package name: passport The new version differs by 160 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@snyk-bot