Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 20 vulnerabilities #15

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 20 vulnerabilities #15

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
⚠️ Warning 
Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-APOLLOSERVERCORE-2928764		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-BROWSERSLIST-1090194		 No Proof of Concept
low severity 476/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.1		 Cross-site Scripting (XSS)
SNYK-JS-DATATABLESNET-1540544		 No Proof of Concept
medium severity 526/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.1		 Arbitrary Code Injection
SNYK-JS-EJS-1049328		 Yes Proof of Concept
high severity 726/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1		 Remote Code Execution (RCE)
SNYK-JS-EJS-2803307		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-IMMER-1540542		 No Proof of Concept
high severity 676/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.1		 Cross-site Scripting (XSS)
SNYK-JS-JQUERYUI-1767167		 No Proof of Concept
high severity 569/1000
Why? Has a fix available, CVSS 7.1		 Cross-site Scripting (XSS)
SNYK-JS-JQUERYUI-1767175		 No No Known Exploit
high severity 676/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.1		 Cross-site Scripting (XSS)
SNYK-JS-JQUERYUI-1767767		 No Proof of Concept
medium severity 484/1000
Why? Has a fix available, CVSS 5.4		 Cross-site Scripting (XSS)
SNYK-JS-JQUERYUI-2946728		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-JQUERYVALIDATION-2840635		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-JQUERYVALIDATION-2940620		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-NTHCHECK-1586032		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-PROMPTS-1729737		 No Proof of Concept
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Remote Code Execution (RCE)
SNYK-JS-SHELLQUOTE-1766506		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-STYLELINT-1585622		 Yes No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TRIM-1017038		 No Proof of Concept
high severity 594/1000
Why? Has a fix available, CVSS 7.6		 Remote Code Execution (RCE)
SNYK-JS-VUECLI-1731684		 No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @storybook/addon-essentials The new version differs by 250 commits.
  • 05070ca v6.5.0
  • 88c6a62 Update root, peer deps, version.ts/json to 6.5.0 [ci skip]
  • ca93284 6.5.0 changelog
  • ff28cd9 6.5.0-rc.1 next.json version file
  • 9e1f519 Update git head to 6.5.0-rc.1, update yarn.lock
  • 3f09d4e v6.5.0-rc.1
  • 82b7ac1 Update root, peer deps, version.ts/json to 6.5.0-rc.1 [ci skip]
  • 4b50e28 6.5.0-rc.1 changelog
  • 0a6e347 Merge pull request #18220 from storybookjs/improve/detection-webpack5
  • 95a5c80 move nextjs detection up
  • 152e441 Merge pull request #18248 from storybookjs/18177-fix-conditional-args-fail-gracefully
  • 2948cae ArgsTable: Gracefully handle conditional args failures
  • f837e31 Merge pull request #18246 from storybookjs/chore_docs_adds_mdx2_steps
  • 73cf6ba adds MDX 2 docs and gotchas
  • 64b07fe Merge pull request #18244 from storybookjs/chore_docs_cleanup_broken_links
  • fef1a32 Fixes broken links
  • 82ce9de Merge pull request #18231 from Tomastomaslol/issue-18143-reset-button-broken-for-URL-values
  • ebf9341 Merge pull request #18038 from bisubus/fix-vue3-tsx
  • 9583cea remove repeated test
  • 1b396fd 6.5.0-rc.0 next.json version file
  • 6cc69b5 Update git head to 6.5.0-rc.0, update yarn.lock
  • c27fd9e v6.5.0-rc.0
  • b56b1ce re add reset of args that was not set initially. Extend tests for onResetArgs
  • 19ba77b Update root, peer deps, version.ts/json to 6.5.0-rc.0 [ci skip]

See the full diff

Package name: @storybook/vue The new version differs by 250 commits.
  • 05070ca v6.5.0
  • 88c6a62 Update root, peer deps, version.ts/json to 6.5.0 [ci skip]
  • ca93284 6.5.0 changelog
  • ff28cd9 6.5.0-rc.1 next.json version file
  • 9e1f519 Update git head to 6.5.0-rc.1, update yarn.lock
  • 3f09d4e v6.5.0-rc.1
  • 82b7ac1 Update root, peer deps, version.ts/json to 6.5.0-rc.1 [ci skip]
  • 4b50e28 6.5.0-rc.1 changelog
  • 0a6e347 Merge pull request #18220 from storybookjs/improve/detection-webpack5
  • 95a5c80 move nextjs detection up
  • 152e441 Merge pull request #18248 from storybookjs/18177-fix-conditional-args-fail-gracefully
  • 2948cae ArgsTable: Gracefully handle conditional args failures
  • f837e31 Merge pull request #18246 from storybookjs/chore_docs_adds_mdx2_steps
  • 73cf6ba adds MDX 2 docs and gotchas
  • 64b07fe Merge pull request #18244 from storybookjs/chore_docs_cleanup_broken_links
  • fef1a32 Fixes broken links
  • 82ce9de Merge pull request #18231 from Tomastomaslol/issue-18143-reset-button-broken-for-URL-values
  • ebf9341 Merge pull request #18038 from bisubus/fix-vue3-tsx
  • 9583cea remove repeated test
  • 1b396fd 6.5.0-rc.0 next.json version file
  • 6cc69b5 Update git head to 6.5.0-rc.0, update yarn.lock
  • c27fd9e v6.5.0-rc.0
  • b56b1ce re add reset of args that was not set initially. Extend tests for onResetArgs
  • 19ba77b Update root, peer deps, version.ts/json to 6.5.0-rc.0 [ci skip]

See the full diff

Package name: @vue/cli The new version differs by 250 commits.

See the full diff

Package name: @vue/cli-service The new version differs by 250 commits.

See the full diff

Package name: datatables.net-dt The new version differs by 65 commits.
  • d432cc3 Sync tag release - 1.11.0
  • 1ffa75a a6ece4b2200e305b761f1ba2a893d8bcc5c5cb52 Fix: Language information being loaded in might not take into account the thousands and decimal separator options if using camelCase style
  • a22b728 2fbd02e4f168a5b5a4f5e9a7a935230ffc694e05 Readme: Update package manager section
  • 2e24d8c 82e29b70c11f82a33c180362fcb7680f6032a624
  • 5c96990 Include types in package.json and correct folder
  • 567b229 90d756c563582681fce93859952654d814bf1414 Update: Remove `zoom` hacks for IE6
  • 3adece4 c786a08db6bf6a8cd9b9da1707bc0f776b380483 Fix: CSS for nested DataTable in a scrolling DataTable would have its sorting icons removed
  • 71a2063 bff756573cff460d180af024046fa12173335650 Example: Add a search-side processing example for `-init search.return`.
  • 8511e80 92eec59cf594ce7aadba5945031e2442c2086136 DEV tweaks to enter key example
  • 0d48635 b732d779fe8861e16fabf41e83c2b5d7ade6e2b2 new: New initialisation option for search on return.
  • 0cf6f84 f49883e2fd683142fe688f5670908a443d52c856 Fix: Rather than using Bootstrap 5's default row striping (which is 2n+1 based) we need to use the .odd selector to account for injected rows (child rows, rowgroup, etc).
  • f41acf3 2c9940c023915984f5325b051af6748a887a8431 DEV tweaks to fuzzy search example
  • 6a45873 2bef3655d1427404e06a18720ac380ce989dc9b8 new: New example for fuzzySearch - won't work until js file is added to cdn
  • 53d4753 99456a13f37aa243e85d008869439d75f3a4c626 Types: Fix for old style `$().dataTable()` init
  • 016639f e1c071b8e2b3e4ce6d3e508f4851c3a2c8ee9744 Types: Fix jQuery definitions
  • 85d24e9 6cd6387e6a0c32c3c83f3a91c34ae3eda4cc5fcb Types: Typing for selectors and passing around the data type more
  • 2fb0254 4d9ddb4ac48674f01c432d0488e1884db5308d69 Types: Row data type information can be passed around now
  • 2331ac7 95508a92b2a5c638afbee859e774cd57dab7e135 Docs: Fix names of new static get/set methods
  • 500443f d34661c11a58978b17afdc27bea78acfc5458444 Fix: Remove superflous aria roles
  • ae133c6 bf1f0eb31dfdc5b9790c597b8c63bf4876d9c03f Docs: Add Bootstrap 5 to `-init dom`
  • ef71e30 b5287626fe86319a25e1182ddddf8adf17ed7096 Fix: Scrollbar was showing on tables which had a border on the table
  • 86daddb 0c7ee29e8de948282be59f640be0d7214c184cfa TEST updated tests for DD02036
  • 5dc2f4f 01128f168f9b2112ea9e565bef0a67d3afcfc1d4 fix: Make requestChild event run before initComplete
  • f761e80 aef9c8080d64820cf72b1fe957e36bff8688df5f fix: Fix mistake in docs by removing a third parameter documented in requestChild event that does not exist

See the full diff

Package name: jquery-ui The new version differs by 160 commits.
  • d6c028c 1.13.2
  • 8cc5bae Checkboxradio: Don't re-evaluate text labels as HTML
  • b53e7be All: Remove deprecated .click() usage in demos/tests
  • bb00536 Build: Update AUTHORS.txt
  • 9d1fc97 Datepicker: Capitalize some Indonesian words
  • 1f467ba Selectmenu: Remove a call to the deprecated .focus() method
  • ac1866f Build: Update AUTHORS.txt
  • 395aa7d Datepicker: Add missing localization for prevText and nextText
  • 218c6af Datepicker: Remove symbols in localization
  • 3126e12 Datepicker: Remove symbols in localization
  • e853971 Build(deps): Bump actions/checkout from 2 to 3
  • d55645c Build(deps): Bump actions/cache from 2 to 3
  • a4060a2 Build(deps): Bump actions/setup-node from 1 to 3
  • d66fdd5 Build: Add dependabot.yml config (GitHub Actions)
  • 50d35e6 Build: Update Grunt to resolve CVE-2022-1537
  • e21a254 Build: Include all the files published to the CDN in npm/Bower packages
  • 54074fc Build: Updating the main version to 1.13.2-pre.
  • d2779bd Build: Update some npm dependencies
  • 0c5becc Widget: Optimize attachment of the _untrackClassesElement listener
  • 4a7cec3 Build: Add Felix to .mailmap, update AUTHORS.txt
  • 933ce5d Autocomplete: Rewrite with a delay instead of appending the live region
  • e90096e Build: Add extra Github action job for PR required checks configuration
  • e0a78d4 Build: Switch from Travis to GitHub actions
  • ed637b0 Widget: Make contextless widget construction work

See the full diff

Package name: jquery-validation The new version differs by 21 commits.

See the full diff

Package name: stylelint The new version differs by 219 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)
🦉 Arbitrary Code Injection
🦉 Remote Code Execution (RCE)
🦉 More lessons are available in Snyk Learn

@snyk-bot
fix: package.json to reduce vulnerabilities
db184e4 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-APOLLOSERVERCORE-2928764
- https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194
- https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1540544
- https://snyk.io/vuln/SNYK-JS-EJS-1049328
- https://snyk.io/vuln/SNYK-JS-EJS-2803307
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-IMMER-1540542
- https://snyk.io/vuln/SNYK-JS-JQUERYUI-1767167
- https://snyk.io/vuln/SNYK-JS-JQUERYUI-1767175
- https://snyk.io/vuln/SNYK-JS-JQUERYUI-1767767
- https://snyk.io/vuln/SNYK-JS-JQUERYUI-2946728
- https://snyk.io/vuln/SNYK-JS-JQUERYVALIDATION-2840635
- https://snyk.io/vuln/SNYK-JS-JQUERYVALIDATION-2940620
- https://snyk.io/vuln/SNYK-JS-NTHCHECK-1586032
- https://snyk.io/vuln/SNYK-JS-PROMPTS-1729737
- https://snyk.io/vuln/SNYK-JS-SHELLQUOTE-1766506
- https://snyk.io/vuln/SNYK-JS-STYLELINT-1585622
- https://snyk.io/vuln/SNYK-JS-TRIM-1017038
- https://snyk.io/vuln/SNYK-JS-VUECLI-1731684
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@snyk-bot