Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 1 vulnerabilities #48

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #48

wants to merge 1 commit into from

Conversation

jcentino
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-LODASH-6139239		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: cheerio The new version differs by 106 commits.

See the full diff

Package name: connect-assets The new version differs by 46 commits.
  • 263f1ac Release version 5.2.0.
  • de0efc6 Updated changelog to include inline addition.
  • 33d171a Updated readme to include inline variants.
  • 06ac2b7 Refactored code to reuse helper instead of having a separate method for inline tag writers. Merged tests into helper.
  • 6ef4eb6 Merge branch 'v5.2.0' into OOShoppingnl-feature/allow-for-inline-tags
  • 434c0f3 Updated missed test to use bundle instead of build.
  • eb5e5c0 Merge branch 'v5.2.0' into OOShoppingnl-feature/allow-for-inline-tags
  • a571450 Merge branch 'feature/allow-for-inline-tags' of git://github.com/OOShoppingnl/connect-assets into OOShoppingnl-feature/allow-for-inline-tags
  • 458fc81 Changed build option -> bundle option and using build option to control whether the assets are stored to disk, matching the original intent.
  • 461857a Updated changelog.
  • b0951f4 Updated all dependancies to the latest.
  • 48778cb Release version 5.1.1.
  • d39678b Fixed style from I can post a story/comment as another user freeCodeCamp/freeCodeCamp#327.
  • 6a8bc12 Merge branch 'inukshuk-patch-1'
  • ef19a36 Merge branch 'patch-1' of git://github.com/inukshuk/connect-assets into inukshuk-patch-1
  • 13f4e5b Added test for pull request dependency on fbgraph is missing freeCodeCamp/freeCodeCamp#323.
  • ec0e6be Broke out test commands in package.json to allow for passing flags to mocha.
  • 16fce64 Merge branch 'master' of git://github.com/dapriett/connect-assets into dapriett-master
  • 3073921 Update README.md
  • eb7466a add some tests for the basic inline css/js output functionality
  • 9a7504e expose helpers that generate inline JS/CSS output
  • c878196 add function capable of driving a tag-writer function that outputs a css/js asset inline
  • 2dce3fb Release version 5.1.0.
  • 200976e Add test to ensure mincer is exposed.

See the full diff

Package name: express-validator The new version differs by 44 commits.

See the full diff

Package name: helmet The new version differs by 37 commits.
  • e99bcb8 0.8.0
  • 9a1262b Prepare changelog for 0.8.0 release
  • f22cb82 More notes that this is an HTTP header module
  • 4344ee7 Minor: changelog order should be new, update, fix, remove
  • e0c3039 Add "deprecate crossdomain" notes to history file
  • bf65c0f Deprecate crossdomain in the code and add relevant tests
  • ecf4f40 Remove "crossdomain.xml" from npm keywords
  • ddc4ce8 Remove crossdomain from the readme
  • 86da539 Bump frameguard to 0.2.2
  • 10ddccf Update CSP and HSTS modules to latest
  • d89df25 Small readme tweaks
  • 6907874 Recommend express-content-length-validator module
  • fed5bfd Readme: disclaimer in recommended modules section
  • 013a135 0.7.1
  • 1c2bc50 Bump dependency versions
  • 8864c69 Readme: Used to be 9, now is 10 middlewares
  • 56b0844 Recommend HPP module
  • 64f8cd8 0.7.0
  • 0697d1c Update history
  • 9a2e0e6 Add note about default middlewares
  • a6ee110 Add hpkp
  • e913076 Update Travis config to use Node 0.12
  • 7798164 Add "minor code cleanup" to unreleased history
  • 3379d9c 0.6.2

See the full diff

Package name: node-linkedin The new version differs by 62 commits.

See the full diff

Package name: stripe The new version differs by 51 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

@snyk-bot
fix: package.json to reduce vulnerabilities
a17f62f 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-LODASH-6139239
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
2 participants
@jcentino @snyk-bot