[Snyk] Fix for 8 vulnerabilities #57

pratapadi · 2022-10-06T01:15:54Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
484/1000 Why? Has a fix available, CVSS 5.4	Open Redirect SNYK-JS-GOT-2932019	No	No Known Exploit
449/1000 Why? Has a fix available, CVSS 4.7	Open Redirect SNYK-JS-NEXT-1540422	Yes	No Known Exploit
484/1000 Why? Has a fix available, CVSS 5.4	Cross-site Scripting (XSS) SNYK-JS-NEXT-1577139	Yes	No Known Exploit
509/1000 Why? Has a fix available, CVSS 5.9	User Interface (UI) Misrepresentation of Critical Information SNYK-JS-NEXT-2405694	Yes	No Known Exploit
539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	Yes	No Known Exploit
619/1000 Why? Has a fix available, CVSS 8.1	Remote Code Execution (RCE) SNYK-JS-SHELLQUOTE-1766506	Yes	No Known Exploit
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-TRIM-1017038	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: got

The new version differs by 8 commits.

5e17bb7 11.8.5
bce8ce7 Backport 861ccd9ac2237df762a9e2beed7edd88c60782dc
8ced192 Fix build
670eb04 11.8.4
20f29fe Backport add update index.md github/docs#1543: Initialize globalResponse in case of ignored HTTPError (x github/docs#2017)
0da732f 11.8.3
9463bb6 Bump cacheable-request dependency (Vcc.com github/docs#1921)
0e167b8 HTTPError code set to 'HTTPError' #1711 (rohittravels.md github/docs#1739)

See the full diff

Package name: next

The new version differs by 250 commits.

8545fd1 v12.1.0
1605f30 v12.0.11-canary.21
69aedbd Fix typo (Fix typos in Creating Diagrams github/docs#34480)
f0f322c Remove deprecation for relative URL usage in middlewares (Dev github/docs#34461)
d4d79b2 Fix chunk buffering for server components (https://github.com/rayhanremoon/-github.git github/docs#34474)
74fa4d4 update webpack (Revert "Repo sync" github/docs#34477)
b70397e Revert "Allow reading request bodies in middlewares (Update basic-writing-and-formatting-syntax.md.freeanjeel github/docs#34294)" (Repo sync github/docs#34479)
4202011 Update font-optimization test snapshot (Repo sync github/docs#34478)
1edd851 Allow reading request bodies in middlewares (Update basic-writing-and-formatting-syntax.md.freeanjeel github/docs#34294)
ba78437 fix: don't wrap `profile` in firebase example (afzatipu github/docs#34457)
f3c3810 Remove hello world RSC example. (Repo sync github/docs#34456)
49da8c0 v12.0.11-canary.20
2264d35 Fix `.svg` image optimization with a `loader` prop (Repo sync github/docs#34452)
59714db Update server-only changes HMR handling (Repo sync github/docs#34298)
d288d43 Update MDX Guide config example (Repo sync github/docs#34405)
54dbeb3 update webpack (Repo sync github/docs#34444)
9b38ffe Update 2.example_bug_report.yml
86aac3f Update 1.bug_report.yml
732b405 v12.0.11-canary.19
01524ef Revert swc css bump temporarily (Repo sync github/docs#34440)
8a55612 Add image config for `dangerouslyAllowSVG` and `contentSecurityPolicy` (Delete content/authentication/keeping-your-account-and-data-secure/to… github/docs#34431)
9639fe7 Ensure we don't poll page in development when notFound: true is returned (Rename index.md to index.md github/docs#34352)
7e93a89 Update 2.example_bug_report.yml
d88793d feat: improve opening a new issue flow (Ftj github/docs#34434)

See the full diff

Package name: node-fetch

The new version differs by 7 commits.

1ef4b56 backport of Lukáš github/docs#1449 (repo sync github/docs#1453)
8fe5c4e 2.x: Specify encoding as an optional peer dependency in package.json (repo sync github/docs#1310)
f56b0c6 fix(URL): prefer built in URL version when available and fallback to whatwg (Adding your SSH key to the ssh-agent still shows "$ ssh-add ~/.ssh/id_rsa" when it should show "$ ssh-add ~/.ssh/id_ed25519" github/docs#1352)
b5417ae fix: import whatwg-url in a way compatible with ESM Node (Add new example to Actions Code examples github/docs#1303)
18193c5 fix v2.6.3 that did not sending query params (Update about-custom-domains-and-github-pages.md github/docs#1301)
ace7536 fix: properly encode url with unicode characters (Update and rename content/github/collaborating-with-issues-and-pull-r… github/docs#1291)
152214c Fix(package.json): Corrected main file path in package.json (repo sync github/docs#1274)

See the full diff

Package name: pa11y-ci

The new version differs by 17 commits.

efad302 Fix minimum node version in README
28f161a Version 3.0.0
52fd274 Fix error with absolute paths on Windows ([Snyk] Fix for 24 vulnerabilities #82)
6b2d4f5 Replace chalk with kleur
4e5bc51 use https where possible
5c842cf Add support for reporters (GitHub App Guide typo github/docs#129)
40ba01a Replace make with npm scripts and update Node versions (Use operationId for #anchor tags of REST API endpoint titles github/docs#139)
1374cd7 Bump deps to match versions used by pa11y v6
fb86a33 Update test matrix to LTS node (12, 14, 16)
edabbeb Update package lock
e5dbbc7 Replace chalk with kleur
96a3882 Chance concurrency and incognito mode defaults
9de41f3 Version 2.4.2
7cb5bd8 Replace npmignore with allow list for consistency
fefa70b Retry launching browser if first time fails
6846233 Adds example of running pa11y-ci in Docker (Tests may be broken on Windows github/docs#137)
00ac4f9 refactor(npm): remove unnecessary files from package (#126)