Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 1 vulnerabilities #110

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #110

wants to merge 1 commit into from

Conversation

adamlaska
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • deps/npm/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: init-package-json The new version differs by 21 commits.

See the full diff

Package name: licensee The new version differs by 70 commits.

See the full diff

Package name: node-gyp The new version differs by 97 commits.

See the full diff

Package name: normalize-package-data The new version differs by 10 commits.

See the full diff

Package name: npm-install-checks The new version differs by 13 commits.
  • 9b68df3 4.0.0
  • d498feb allow engine if npm version not specified
  • f9cc89a update travis to only include live nodes
  • 0fc0126 auto-publish scripts
  • ca36bca update changelog for v4
  • a0d38b4 update docs for v4
  • 44b7124 Simplified functionality needed for npm v7
  • 1646fd7 remove unnecessary deps and metadata
  • d74d479 chore: project settings
  • d4463a3 chore(deps): update semver, tap, standard
  • 89937d4 minimal package
  • 893b181 fix: allow pre-release versions of npm and node
  • ab92033 chore: bump version of semver package

See the full diff

Package name: npm-package-arg The new version differs by 8 commits.
  • 26ffdd5 chore(release): 8.0.0
  • 17598ad chore: normalize settings, license, and update standard-version
  • ba85e68 drop support for node 6 and 8
  • 2c06e53 update tap
  • 9434f79 chore: update semver to v7
  • bf86221 chore(release): 7.0.0
  • 68a4fc3 deps: bump hosted-git-info to 3.0.2
  • ee44e84 chore: update deps

See the full diff

Package name: npm-pick-manifest The new version differs by 12 commits.
  • 3c8cb5d chore(release): 5.0.0
  • dc2e61c chore: normalize settings, drop old nodes, update deps
  • 661ba9d chore: bump version of semver package
  • 405d00b chore(release): 4.0.0
  • 42c76d8 deps: bump npm-package-arg to v7
  • 8e66272 chore(release): 3.0.2
  • 420fb8c chore: update repo links
  • 543da7c chore(release): 3.0.1
  • 003286e fix: throw 403 for forbidden major/minor versions
  • ed0fc29 chore(release): 3.0.0
  • 6ab64fd chore: remove node 4.0 from travis
  • ad2a962 feat: throw forbidden error when package is blocked by policy

See the full diff

Package name: npm-registry-fetch The new version differs by 21 commits.
  • d370dba chore(release): 6.0.0
  • 8c6622f chore: make-fetch-happen 7.1.0
  • 5813da6 fix: detect CI so our tests don't fail in CI
  • 3de1695 chore: replace nyc config with tap config
  • e18ed22 chore: bump make-fetch-happen to v7
  • 62f81a2 chore: bump ssri to v7
  • 8ccfa8a fix: Use WhatWG URLs instead of url.parse
  • 510b125 chore: normalize settings, drop old nodes, update deps
  • 622afb4 chore(release): 5.0.1
  • 7aa14fd deps: update all deps
  • 5764c15 deps: npm-package-arg@7
  • 786f092 chore(release): 5.0.0
  • 41ff216 chore: update travis config
  • 39e5cfe doc: fix badge url
  • 97c1208 chore: update tap, improve offline/prefer-offline tests
  • 82abf26 chore: Add missing tests and clean up dead code
  • 90ac7b1 fix: prefer const in getAuth function
  • e64702e fix: use minizlib instead of core zlib
  • 5cfe30b test: add string query example to test
  • e7286f7 fix!: Use native Promises
  • bb37f20 feat: refactor to use Minipass streams

See the full diff

Package name: pacote The new version differs by 115 commits.
  • e88f844 10.3.0
  • b21dd92 update semver
  • d8ab8cf update npm-packlist
  • 361f0b3 update tap
  • c4bbf23 test: make the remote timeout test time out forever
  • b4ea91f npm-registry-fetch 6.0.0
  • 591edd8 @ npmcli/installed-package-contents@1.0.5
  • 5ce1093 test: make remote timeout test more reliably time out
  • 48fc9b8 use WhatWG URL instead of url.parse
  • e515bce Update deps, float patch for npm-registry-fetch
  • cf50f54 update @ npmcli/installed-package-contents, require node >=10
  • 698e996 Extract: rimraf dir contents, not dir itself
  • e568305 add @ npmcli/installed-package-contents module
  • e8a80d7 upgrade all deps
  • dfccb4f remove extraneous isNaN checking in git opts
  • e33c9ce 10.2.1
  • bad55cd fix: Do not drop perms in git when not root
  • ccc9e20 bin: only add log listener once
  • 8a8cd6a 10.2.0
  • e8c274c registry: verify integrity when loading manifest
  • f28888e bin: Only JSON.stringify by default if an object
  • 0018eda 10.1.6
  • fc1053f git: prefer git+https over git+ssh for hosted repo
  • 9d2ce90 10.1.5

See the full diff

Package name: read-package-json The new version differs by 8 commits.
  • 9f7049d chore(release): 3.0.0
  • 19d9fbe fix: check-in updated lockfile
  • eef46fa chore: add engines definition
  • 36b7ef7 chore: remove old .travis.yml envs
  • b3a8831 globa@7.1.6
  • fb3ceae json-parse-even-better-errors@2.3.1
  • 78add03 npm-normalize-package-bin@1.0.1
  • 7595d70 normalize-package-data@3.0.0

See the full diff

Package name: semver The new version differs by 168 commits.

See the full diff

Package name: standard The new version differs by 250 commits.

See the full diff

Package name: tap The new version differs by 250 commits.
  • bc49fb7 15.0.0
  • 4378608 remove publishConfig beta tag
  • 2c2e75f provide mkdirRecursive polyfill for old node versions
  • 8f4c855 correctly specify 10.0.x versions
  • 5e61672 update deps
  • c44c418 Support 10.0 and test in CI
  • dc5c841 tcompare@5.0.4
  • 385b6d2 Add .taprc.yml/yaml handling to change log
  • 4f87466 just run regular test script as snap script
  • 315a921 delete FORCE_COLOR/NO_COLOR rather than setting to '0'
  • 564e96f Add detection for .yaml and .yml
  • 75bae93 update cli doc
  • c1289bf 15.0.0-3
  • d6fe32f Do not CI on node 10
  • d2e0428 do not use equals() alias in self-test
  • 3f787c4 tell npm to be colorful in CI
  • 1512818 run tests with color on github actions
  • 4626fa1 Docs: update documentation for tap v15
  • 02d536b libtap@1.0.1
  • f7c7c58 update cli doc
  • 2aa497c 15.0.0-2
  • 8d7f62e Add support for overriding libtap's internal settings
  • 29eed63 new snapshot folder layout
  • 3a28d4d update libtap git ref to isaacs/tap-v15-prep branch

See the full diff

Package name: update-notifier The new version differs by 42 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

@google-cla
Copy link

google-cla bot commented Jun 23, 2023

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@socket-security
Copy link

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Issue Package Version Note Source
Network access http-proxy-agent 4.0.1 deps/npm/package.json via libnpmaccess@4.0.3, libnpmhook@6.0.3, libnpmorg@2.0.3, libnpmsearch@3.1.2, libnpmteam@2.0.4, npm-profile@5.0.4
Network access http-proxy-agent 5.0.0 deps/npm/package.json via licensee@9.0.0
Network access http2-wrapper 2.2.0 deps/npm/package.json via update-notifier@6.0.2
Network access https-proxy-agent 5.0.1 deps/npm/package.json via libnpmaccess@4.0.3, libnpmhook@6.0.3, libnpmorg@2.0.3, libnpmsearch@3.1.2, libnpmteam@2.0.4, licensee@9.0.0, npm-profile@5.0.4
Network access resolve-alpn 1.2.1 deps/npm/package.json via update-notifier@6.0.2
Network access socks-proxy-agent 6.2.1 deps/npm/package.json via libnpmaccess@4.0.3, libnpmhook@6.0.3, libnpmorg@2.0.3, libnpmsearch@3.1.2, libnpmteam@2.0.4, npm-profile@5.0.4
Network access socks-proxy-agent 7.0.0 deps/npm/package.json via licensee@9.0.0
Network access tap 15.2.3 deps/npm/package.json via tap@15.2.3
Network access @npmcli/arborist 5.6.3 deps/npm/package.json via licensee@9.0.0
Network access minipass-fetch 1.4.1 deps/npm/package.json via libnpmaccess@4.0.3, libnpmhook@6.0.3, libnpmorg@2.0.3, libnpmsearch@3.1.2, libnpmteam@2.0.4, npm-profile@5.0.4, npm-registry-fetch@6.0.2, pacote@10.3.2
Network access minipass-fetch 2.1.2 deps/npm/package.json via licensee@9.0.0
Network access make-fetch-happen 10.2.1 deps/npm/package.json via licensee@9.0.0
Network access make-fetch-happen 7.1.1 deps/npm/package.json via npm-registry-fetch@6.0.2, pacote@10.3.2
Network access make-fetch-happen 9.1.0 deps/npm/package.json via libnpmaccess@4.0.3, libnpmhook@6.0.3, libnpmorg@2.0.3, libnpmsearch@3.1.2, libnpmteam@2.0.4, npm-profile@5.0.4
Network access agentkeepalive 4.3.0 deps/npm/package.json via libnpmaccess@4.0.3, libnpmhook@6.0.3, libnpmorg@2.0.3, libnpmsearch@3.1.2, libnpmteam@2.0.4, licensee@9.0.0, npm-profile@5.0.4, npm-registry-fetch@6.0.2, pacote@10.3.2

Next steps

What is network access?

This module accesses the network.

Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore http-proxy-agent@4.0.1
  • @SocketSecurity ignore http-proxy-agent@5.0.0
  • @SocketSecurity ignore http2-wrapper@2.2.0
  • @SocketSecurity ignore https-proxy-agent@5.0.1
  • @SocketSecurity ignore resolve-alpn@1.2.1
  • @SocketSecurity ignore socks-proxy-agent@6.2.1
  • @SocketSecurity ignore socks-proxy-agent@7.0.0
  • @SocketSecurity ignore tap@15.2.3
  • @SocketSecurity ignore @npmcli/arborist@5.6.3
  • @SocketSecurity ignore minipass-fetch@1.4.1
  • @SocketSecurity ignore minipass-fetch@2.1.2
  • @SocketSecurity ignore make-fetch-happen@10.2.1
  • @SocketSecurity ignore make-fetch-happen@7.1.1
  • @SocketSecurity ignore make-fetch-happen@9.1.0
  • @SocketSecurity ignore agentkeepalive@4.3.0

@socket-security
Copy link

New and updated dependency changes detected. Learn more about Socket for GitHub ↗︎

Packages Version New capabilities Transitives1 Size Publisher
npm-profile 🆕 5.0.4 eval, network +39 1.32 MB nlf
libnpmhook 🆕 6.0.3 eval, network +39 1.3 MB gar
npm-package-arg 🆕 8.1.5 environment +0 16.6 kB isaacs
libnpmorg 🆕 2.0.3 eval, network +39 1.3 MB gar
pacote 🆕 10.3.2 eval, filesystem, environment +34 1.13 MB isaacs
libnpmaccess 🆕 4.0.3 eval, network +39 1.33 MB gar
libnpmsearch 🆕 3.1.2 eval, network +39 1.3 MB nlf
libnpmteam 🆕 2.0.4 eval, network +39 1.3 MB nlf
npm-registry-fetch 🆕 6.0.2 eval +28 988 kB isaacs
ini 🆕 2.0.0 None +0 9.47 kB isaacs
node-gyp 🆕 7.1.2 None +13 2.34 MB rvagg
read-package-json 🆕 3.0.1 None +0 19.9 kB isaacs
mkdirp 🆕 1.0.4 environment +0 19.1 kB isaacs
update-notifier 🆕 6.0.2 network, environment +69 1.59 MB sindresorhus
tap ⬆️ 12.7.0...15.2.3 eval, network, filesystem +77/-35 59.4 MB isaacs
init-package-json ⬆️ 1.10.3...2.0.5 None +2/-0 53 kB gar
npm-pick-manifest ⬆️ 2.2.3...5.0.0 None +1/-0 30.6 kB isaacs
npm-install-checks ⬆️ 3.0.2...4.0.0 None +0/-0 5.17 kB isaacs
licensee ⬆️ 7.0.3...9.0.0 eval, network, shell +96/-3 2.99 MB kemitchell
standard ⬆️ 11.0.1...15.0.1 None +57/-27 8.99 MB feross

Footnotes

  1. https://docs.socket.dev ↩

This was referenced Dec 1, 2023
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
do-not-merge
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@adamlaska @snyk-bot