Skip to content

[Snyk] Upgrade: browser-or-node, chai, isomorphic-ws, q, thrift, ws #155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Upgrade: browser-or-node, chai, isomorphic-ws, q, thrift, ws #155

wants to merge 1 commit into from

Conversation

@taeb3
Copy link
Owner

@taeb3 taeb3 commented Sep 7, 2024

snyk-top-banner

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

Name Versions Released on

browser-or-node
from 1.3.0 to 3.0.0 | 5 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 5 months ago
on 2024-04-18
chai
from 4.5.0 to 5.1.1 | 9 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 4 months ago
on 2024-05-09
isomorphic-ws
from 4.0.1 to 5.0.0 | 4 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 2 years ago
on 2022-06-27
q
from 1.5.1 to 2.0.3 | 4 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 10 years ago
on 2015-01-31
thrift
from 0.13.0 to 0.20.0 | 10 versions ahead of your current version | 6 months ago
on 2024-03-22
ws
from 7.5.10 to 8.18.0 | 30 versions ahead of your current version
⚠️ This is a major version upgrade, and may be a breaking change | 2 months ago
on 2024-07-03

Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Internal Property Tampering
SNYK-JS-TAFFYDB-2992450		 479 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-174116		 479 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-2342073		 479 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-2342082		 479 Proof of Concept
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-451540		 479 No Known Exploit
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MARKED-584281		 479 No Known Exploit
medium severity Arbitrary Code Injection
SNYK-JS-UNDERSCORE-1080984		 479 Proof of Concept
Release notes
Package name: browser-or-node
  • 3.0.0 - 2024-04-18
  • 3.0.0-pre.0 - 2023-11-19

    No breaking API changes. Although the import might break because of the new build setup.

    I've migrated the build setup from babel to tsup in #30. As a part of that I've also introduced CJS/ESM import compatibility. Since this package has half a mil downloads a week, I'm slightly hesitant to publish a major (v3) before testing the packages in all the runtimes which I don't have the capacity or the means to do so. So this prerelease is a candidate to test the new build setup in all runtimes with the community's help to make sure the next major is good to go.

  • 2.1.1 - 2022-12-01
  • 2.1.0 - 2022-11-30
  • 2.0.0 - 2021-11-12
    • isDeno support added
    • TypeScript types added

    Breaking:

    • isJsDom is no more a method
  • 1.3.0 - 2020-06-25
from browser-or-node GitHub release notes
Package name: chai from chai GitHub release notes
Package name: isomorphic-ws
  • 5.0.0 - 2022-06-27

    5.0.0 (June 27, 2022)

  • 5.0.0-beta.3 - 2022-06-27
  • 5.0.0-beta.2 - 2022-06-27
  • 5.0.0-beta.1 - 2022-06-06
  • 4.0.1 - 2018-04-27
from isomorphic-ws GitHub release notes
Package name: q
  • 2.0.3 - 2015-01-31
  • 2.0.2 - 2014-06-06

    2.0.2

  • 2.0.1 - 2014-03-20
  • 2.0.0 - 2014-03-20

    Accessible only with:

    npm install q@future

    For adventurers only.

  • 1.5.1 - 2017-10-19
from q GitHub release notes
Package name: thrift
  • 0.20.0 - 2024-03-22

    Please head over to the official release download source:
    http://thrift.apache.org/download

    The assets listed below are added by Github based on the release tag and they will therefore not match the checkums published on the Thrift project website.

  • 0.19.0 - 2023-09-02

    Please head over to the official release download source:
    http://thrift.apache.org/download

    The assets listed below are added by Github based on the release tag and they will therefore not match the checkums published on the Thrift project website.

  • 0.18.1 - 2023-03-01

    Please head over to the official release download source:
    http://thrift.apache.org/download

    The assets listed below are added by Github based on the release tag and they will therefore not match the checkums published on the Thrift project website.

  • 0.18.0 - 2023-02-14

    Please head over to the official release download source:
    http://thrift.apache.org/download

    The assets listed below are added by Github based on the release tag and they will therefore not match the checkums published on the Thrift project website.

  • 0.17.0 - 2022-09-18

    Please head over to the official release download source:
    http://thrift.apache.org/download

    The assets listed below are added by Github based on the release tag and they will therefore not match the checkums published on the Thrift project website.

  • 0.16.0 - 2022-02-17

    For release 0.16.0 head over to the official release download source:
    http://thrift.apache.org/download

    The assets below are added by Github based on the release tag and they may therefore not match the checkums.

  • 0.15.0 - 2021-09-11

    For release 0.15.0 head over to the official release download source:
    http://thrift.apache.org/download

    The assets below are added by Github based on the release tag and they may therefore not match the checkums.

  • 0.14.2 - 2021-06-17

    For release 0.14.0 head over to the official release download source:
    http://thrift.apache.org/download

    The assets below are added by Github based on the release tag and they may therefore not match the checkums.

  • 0.14.1 - 2021-03-08

    For release 0.14.1 head over to the official release download source:
    http://thrift.apache.org/download

    The assets below are added by Github based on the release tag and they may therefore not match the checkums.

  • 0.14.0 - 2021-02-12
  • 0.13.0 - 2019-11-18
from thrift GitHub release notes
Package name: ws
  • 8.18.0 - 2024-07-03

    Features

    • Added support for Blob (#2229).
  • 8.17.1 - 2024-06-16

    Bug fixes

    • Fixed a DoS vulnerability (#2231).

    A request with a number of headers exceeding theserver.maxHeadersCount
    threshold could be used to crash a ws server.

    const http = require('http');
    const WebSocket = require('ws');

    const wss = new WebSocket.Server({ port: 0 }, function () {
    const chars = "!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~".split('');
    const headers = {};
    let count = 0;

    for (let i = 0; i < chars.length; i++) {
    if (count === 2000) break<span class="pl-kos...
@snyk-bot
feat: upgrade multiple dependencies with Snyk
de72a0c 
Snyk has created this PR to upgrade:
  - browser-or-node from 1.3.0 to 3.0.0.
    See this package in npm: https://www.npmjs.com/package/browser-or-node
  - chai from 4.5.0 to 5.1.1.
    See this package in npm: https://www.npmjs.com/package/chai
  - isomorphic-ws from 4.0.1 to 5.0.0.
    See this package in npm: https://www.npmjs.com/package/isomorphic-ws
  - q from 1.5.1 to 2.0.3.
    See this package in npm: https://www.npmjs.com/package/q
  - thrift from 0.13.0 to 0.20.0.
    See this package in npm: https://www.npmjs.com/package/thrift
  - ws from 7.5.10 to 8.18.0.
    See this package in npm: https://www.npmjs.com/package/ws

See this project in Snyk:
https://app.snyk.io/org/taeb3/project/d774ea56-0f4e-4632-b2ec-86818396711a?utm_source=github&utm_medium=referral&page=upgrade-pr
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants

@taeb3 @snyk-bot