Skip to content

[Snyk] Fix for 19 vulnerabilities #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: gh-pages
Choose a base branch
from
Open

[Snyk] Fix for 19 vulnerabilities #21

wants to merge 1 commit into from

Conversation

@baby636
Copy link
Owner

@baby636 baby636 commented Nov 28, 2023

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • assets/vendor/clipboard/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
medium severity 641/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.4		 Prototype Pollution
SNYK-JS-JSON5-3182856		 Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 Yes Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASH-1040724		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-450202		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-608086		 Yes Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-73638		 Yes Proof of Concept
medium severity 541/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 4.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Prototype Pollution
SNYK-JS-MINIMIST-2429795		 Yes Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-SOCKETIOPARSER-1056752		 Yes Proof of Concept
critical severity 704/1000
Why? Has a fix available, CVSS 9.8		 Improper Input Validation
SNYK-JS-SOCKETIOPARSER-3091012		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-UNSETVALUE-2400660		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-USERAGENT-174737		 Yes No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:braces:20180219		 Yes Proof of Concept
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:debug:20170905		 Yes Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
npm:lodash:20180130		 Yes Proof of Concept
low severity 399/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
npm:ms:20170412		 Yes No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
npm:parsejson:20170908		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: babelify The new version differs by 32 commits.

See the full diff

Package name: karma The new version differs by 250 commits.
  • 1b48637 chore(release): 5.0.0 [skip ci]
  • a5dbe89 Update issue templates (#3460)
  • 1074f38 chore(ci): rely on karma-runnre/integration-tests for saucelabs config (#3462)
  • 4d45cf0 chore(ci): remove more old connection security stuffs (#3459)
  • be76fcc chore(ci): use travis UI for sauce config (#3458)
  • a04a542 chore(ci): remove secure encryption var (#3457)
  • 1eaf35e fix: install semantic-release as a regular dev dependency (#3455)
  • 0647109 docs: Fix simple typo, overriden -> overridden (#3453)
  • ec1e69a fix(server): replace optimist on yargs lib (#3451)
  • ffad7fa refactor(launcher): use class syntax (#3437)
  • 7166ce2 fix(server): detection new MS Edge Chromium (#3440)
  • b8b2ed8 fix(ci): echo travis env that gates release after_success (#3446)
  • 33a069f refactor: use native Promise instead of Bluebird (#3436)
  • 131d154 refactor: drop safe-buffer dependency in favor of native Buffer (#3438)
  • cb1bcbf fix(server): cleanup import of the removed method (#3439)
  • 5c334f5 fix(server): createPreprocessor was removed (#3435)
  • d7128d4 refactor(server): remove PromiseContainer class (#3416)
  • 057d527 feat(docs): document `DEFAULT_LISTEN_ADDR` constant (#3443)
  • a673aa8 ci: drop node 8, adopt node 12 (#3430)
  • 9eb6436 chore(server): Convert PromiseContainer to object and remove (#3401)
  • 0856234 chore(travis): release on node 10 success (#3428)
  • 708ae13 feat(preprocessor): obey Pattern.isBinary when set (#3422)
  • 00d536f chore(test): logLevel debug in proxy test (#3427)
  • da9d8bd chore(docs): delete PULL_REQUEST_TEMPLATE.md

See the full diff

Package name: karma-browserify The new version differs by 10 commits.
  • 9081a68 chore(project): release v5.0.0
  • 3417225 chore(project): add browserify 13 compatibility
  • 47b8a43 docs(README): document browserify and watchify dependencies
  • ffd145c chore(bro): make watchify an optional dependency
  • 84138e2 chore(example): add explicit browserify/watchify versions
  • b9ad424 chore(travis): test against stable Node.JS
  • 6d91d86 chore(deps): depend on browserify + watchify as peer dependencies
  • 1537cd7 Add missing dev dependencies
  • 13e74e2 chore(deps): bump dependencies to latest version(s)
  • ace2dfb feat(bro): throw bundle error in client

See the full diff

Package name: watchify The new version differs by 9 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Prototype Pollution
🦉 Improper Input Validation
@snyk-bot
fix: assets/vendor/clipboard/package.json to reduce vulnerabilities
c31e2b2 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-JSON5-3182856
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-LODASH-73638
- https://snyk.io/vuln/SNYK-JS-LODASH-73639
- https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-1056752
- https://snyk.io/vuln/SNYK-JS-SOCKETIOPARSER-3091012
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660
- https://snyk.io/vuln/SNYK-JS-USERAGENT-174737
- https://snyk.io/vuln/npm:braces:20180219
- https://snyk.io/vuln/npm:debug:20170905
- https://snyk.io/vuln/npm:lodash:20180130
- https://snyk.io/vuln/npm:ms:20170412
- https://snyk.io/vuln/npm:parsejson:20170908
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants

@baby636 @snyk-bot