Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 3 vulnerabilities #64

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 3 vulnerabilities #64

wants to merge 1 commit into from

Conversation

MaxMood96
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5		 Uncontrolled resource consumption
SNYK-JS-BRACES-6838727		 Yes Proof of Concept
critical severity 858/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 9.3		 Authentication Bypass
SNYK-JS-HAWK-6969142		 Yes Proof of Concept
high severity 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: add-asset-html-webpack-plugin The new version differs by 61 commits.

See the full diff

Package name: karma The new version differs by 227 commits.
  • 16010eb chore(release): 5.0.8 [skip ci]
  • a409696 chore: remove unused `grunt lint` command (#3515)
  • 47f1cb2 fix(dependencies): update to latest log4js major (#3514)
  • b60391f fix(dependencies): update and unlock socket.io dependency (#3513)
  • 4d49948 chore(release): 5.0.7 [skip ci]
  • f399063 fix: detect type for URLs with query parameter or fragment identifier (#3509)
  • 17b50bc chore(release): 5.0.6 [skip ci]
  • 0cd696f fix(dependencies): update production dependencies (#3512)
  • 7c24a03 chore: fix broken HTML markup in the changelog file (#3507)
  • fdc4f9d refactor(test): remove no debug matching option (#3504)
  • 35d57e9 chore(release): 5.0.5 [skip ci]
  • e99da31 fix(cli): restore command line help contents (#3502)
  • 4f2fe56 chore: add Node 14 to the build matrix (#3501)
  • 100b227 refactor(test): move execKarma into the World (#3500)
  • f375884 refactor(test): reduce execKarma to a reasonable size (#3496)
  • a3d1f11 refactor(test): add common method to start server in background (#3495)
  • e4a5126 refactor(test): write config file in its own steps (#3494)
  • 0bd5c2b refactor(test): adjust sandbox folder location and simplify config logic (#3493)
  • b788f94 refactor(test): extract proxy into a separate Given claim (#3492)
  • 633f833 chore(release): 5.0.4 [skip ci]
  • 810489d refactor(test): migrate Proxy to ES2015 (#3490)
  • fa95fa3 fix(browser): make sure that empty results array is still recognized (#3486)
  • 255bf67 refactor(test): migrate World to ES2015 (#3489)
  • be5db67 chore(test): remove usage of deprecated defineSupportCode (#3488)

See the full diff

Package name: webpack-dev-server The new version differs by 250 commits.
  • c9271b9 chore(release): 4.0.0
  • 18bf369 test: fix stability (#3676)
  • cdcabb2 fix: respect protocol from browser for manual setup (#3675)
  • 1768d6b fix: initial reloading for lazy compilation (#3662)
  • 4f5bab1 docs: improve examples (#3672)
  • f2d87fb fix: improve https CLI output (#3673)
  • 0277c5e chore: remove redundant console statements (#3671)
  • 16fcdbc docs: add `ipc` example (#3667)
  • 8915fb8 test: add e2e tests for built in routes (#3669)
  • 4d1cbe1 docs: ask `version` information in issue template (#3668)
  • b6c1881 chore(deps-dev): bump core-js from 3.16.1 to 3.16.2 (#3666)
  • ffa8cc5 chore(deps-dev): bump supertest from 6.1.5 to 6.1.6 (#3665)
  • f1fdaa7 chore(release): 4.0.0-rc.1
  • c4678bc fix: legacy API (#3660)
  • d8bdd03 test: fix stability (#3661)
  • 22b1414 refactor: remove `killable` (#3657)
  • 75bafbf test: add e2e tests for module federation (#3658)
  • 493ccbd chore(deps): update `ws` (#3652)
  • ae8c523 test: add e2e test for universal compiler (#3656)
  • f94b84f chore(deps): update (#3655)
  • 1923132 test: fix cli
  • 2adfd01 test: fix todo (#3653)
  • 6e2cbde fix: proxy logging and allow to pass options without the `target` option (#3651)
  • c9ccc96 fix: respect infastructureLogging.level for client.logging (#3613)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Note: This is a default PR template raised by Snyk. Find out more about how you can customise Snyk PRs in our documentation.

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled resource consumption
🦉 Authentication Bypass

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@MaxMood96 @snyk-bot