Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Fix for 2 vulnerabilities #160

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

AndreDalcher
Copy link

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • packages/lego-scripts/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908
Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Prototype Pollution
SNYK-JS-UNSETVALUE-2400660
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: lint-staged The new version differs by 32 commits.
  • e24aaf2 fix: parse titles for function linters
  • e862e7e docs: correct config file name
  • 309ff1c docs: restore filtering section to README
  • 4bef26e feat: add deprecation error for advanced configuration
  • e829646 refactor: remove dependency on path-is-inside
  • 767edbd refactor: remove dependency on lodash
  • c59cd9a chore: upgrade dependencies
  • 19536e3 refactor: pass unparsed commands to execa with --shell
  • 275d996 refactor: rename --silent to --quiet
  • 18acd59 docs: update README
  • 2ba6d61 test: ignore testSetup from coverage report
  • ecf9227 feat: add --shell and --quiet flags
  • 04190c8 refactor: remove advanced configuration options
  • bed9127 refactor: use execa's shell option to run commands
  • d3f6475 docs: update contributors
  • b71b9c8 refactor: warn about long arguments string only once
  • bcd52ac docs: update README
  • efe8f06 docs: print a warning when arguments length is too long based on platform
  • 2753640 docs: update README
  • 28f3c40 refactor: remove unused configuration options
  • 4db2353 test: add test for linter command exiting with code 1
  • 6d4beec test: update tests for function linters
  • 36e54a2 feat: support function linter returning array of commands
  • 9e4346f refactor: support function linters in getConfig

See the full diff

Package name: stylelint The new version differs by 61 commits.
  • c789336 Prepare 10.0.0
  • 70c63e0 Update CHANGELOG.md
  • 9b76cec Fix autofix for single-line comments within maps in value-keyword-case (#4019)
  • 49fa75f Update CHANGELOG.md
  • 6308199 Update CHANGELOG.md
  • 4ca75e7 Throw error on non-existent files unless allow-empty-input is enabled (#3965)
  • 5811b65 chore(package): update prettier to version 1.17.0 (#4025)
  • 7c8d769 Replace Node.js legacy API for URL parsing. Fixes #3803 (#4024)
  • 77c70b5 Update dependencies (#4013)
  • a8f93d6 fix(package): update micromatch to version 4.0.0 (#4015)
  • bfbf462 Update CHANGELOG.md
  • 9efd6f4 Remove `styled` and `jsx` syntax options (#4009)
  • 6ab5e1f Update CHANGELOG.md
  • 2b73704 Add ignore: ["comments"] to block-no-empty (#4008)
  • b6f3057 Update CHANGELOG.md
  • 81f4139 Drop Node.js 6 support (#4006)
  • b4dc965 Fix documentation typos and mistakes (#3922)
  • d66354d Update CHANGELOG.md
  • 4ec7170 Fix false negatives for `isStandardSyntaxDeclaration` (#3933)
  • a174409 fix(package): update string-width to version 4.0.0 (#3991)
  • bdd3685 Update CHANGELOG.md
  • e92d5e0 Fix false positives for negative numbers in function-calc-no-invalid (#3921)
  • 59681a0 Update CHANGELOG.md
  • 35c3f5a Apply rule in the order defined in `lib/rules/index.js` (#3923)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants