Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 8 vulnerabilities #43

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 8 vulnerabilities #43

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link
Contributor

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • functions/package.json
    • functions/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Issue Breaking Change Exploit Maturity
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 No Proof of Concept
medium severity Prototype Pollution
SNYK-JS-FIREBASEUTIL-1038324		 Yes Proof of Concept
high severity Prototype Pollution
SNYK-JS-JSONBIGINT-608659		 Yes Proof of Concept
medium severity Denial of Service (DoS)
SNYK-JS-JSZIP-1251497		 No Proof of Concept
high severity Server-side Request Forgery (SSRF)
SNYK-JS-NETMASK-1089716		 No Proof of Concept
high severity Prototype Pollution
SNYK-JS-NODEFORGE-598677		 Yes Proof of Concept
high severity Remote Code Execution (RCE)
SNYK-JS-PACRESOLVER-1564857		 No Proof of Concept
high severity Command Injection
SNYK-JS-SSH2-1656673		 No No Known Exploit
Commit messages
Package name: snyk The new version differs by 250 commits.
  • 4cc1a94 Merge pull request #2105 from snyk/feat/webpack
  • 7737f75 Merge pull request #2181 from snyk/test/migrate-old-snyk-format
  • 418e6ad Merge pull request #2180 from snyk/test/migrate-is-docker
  • 95631e7 test: migrate is-docker to jest
  • babe22a test: migrate old-snyk-format to jest
  • e22e94f feat: Snyk CLI is bundled with Webpack
  • dd46c19 Merge pull request #2175 from snyk/fix/snyk-protect-multiple
  • e7c314f Merge pull request #2178 from snyk/test/server-close
  • 5e824c0 fix(protect): skip previously patched files
  • ca2177a fix(protect): catch and log unexpected errors
  • c9ddb44 chore(protect): move api url warnings to stderr
  • e8fed38 refactor(protect): move stdout logs to top level
  • 55e88f9 Merge pull request #2177 from snyk/test/set-jest-acceptance-timeout
  • 1522c5f test: server.close uses callbacks, not promises
  • 13dce51 test: increase timeout for slow oauth test
  • 65c35be Merge pull request #2172 from snyk/chore/no-run-test-on-master
  • a1e3992 chore: don't run tests on master
  • 20feb67 Merge pull request #2165 from snyk/chore/dont-wait-for-regression-tests
  • f50bca7 Merge pull request #2167 from snyk/refactor/replace-cc-parser-with-split-functions
  • 1ed7d11 refactor: replace cc parser with split functions
  • 707801d Merge pull request #2166 from snyk/fix/support_quotes_in_poetry_toml
  • dc6b784 Merge pull request #2163 from snyk/chore/remove-store-test-results
  • 7973015 fix: support quoted keys in inline tables
  • 18f0d2a Merge pull request #2164 from snyk/chore/upgrade-snyk-nuget-plugin

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

@commit-lint
Copy link

commit-lint bot commented Nov 22, 2021

Bug Fixes

  • functions/package.json & functions/package-lock.json to reduce vulnerabilities (8efc55f)

Contributors

snyk-bot

Commit-Lint commands

You can trigger Commit-Lint actions by commenting on this PR:

  • @Commit-Lint merge patch will merge dependabot PR on "patch" versions (X.X.Y - Y change)
  • @Commit-Lint merge minor will merge dependabot PR on "minor" versions (X.Y.Y - Y change)
  • @Commit-Lint merge major will merge dependabot PR on "major" versions (Y.Y.Y - Y change)
  • @Commit-Lint merge disable will desactivate merge dependabot PR
  • @Commit-Lint review will approve dependabot PR
  • @Commit-Lint stop review will stop approve dependabot PR

@mergify mergify bot added the conflict label Nov 22, 2021
@mergify
Copy link

mergify bot commented Nov 22, 2021

Could you please fix the conflicts @snyk-bot?

@mergify mergify bot added conflict and removed conflict labels Jul 5, 2023
@mergify
Copy link

mergify bot commented Jul 5, 2023

Could you please fix the conflicts @snyk-bot?

1 similar comment
@mergify
Copy link

mergify bot commented Aug 15, 2023

Could you please fix the conflicts @snyk-bot?

@mergify mergify bot added conflict and removed conflict labels Oct 16, 2023
@mergify
Copy link

mergify bot commented Oct 16, 2023

Could you please fix the conflicts @snyk-bot?

@mergify mergify bot added conflict and removed conflict labels Jan 9, 2024
@mergify Mergify
Copy link

mergify bot commented Jan 9, 2024

Could you please fix the conflicts @snyk-bot?

1 similar comment
@mergify Mergify
Copy link

mergify bot commented Mar 16, 2024

Could you please fix the conflicts @snyk-bot?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
conflict
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@snyk-bot