New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 10 vulnerabilities #200

Open

ryan-ally wants to merge 1 commit into master from snyk-fix-6592d3b64c24be428f6d255b9292f58f

Owner

ryan-ally commented Nov 27, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- docs/package.json
- docs/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-GLOBPARENT-1016905	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
	529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430337	Yes	No Known Exploit
	579/1000 Why? Has a fix available, CVSS 7.3	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430339	Yes	No Known Exploit
	494/1000 Why? Has a fix available, CVSS 5.6	Improper Verification of Cryptographic Signature SNYK-JS-NODEFORGE-2430341	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: eslint

The new version differs by 242 commits.

80b8d5d 5.5.0
b68e403 Build: changelog update for 5.5.0
6e110e6 Fix: camelcase duplicate warning bug (fixes [DocDB] org.yb.pgsql.TestPgTransparentRestarts.selectStarShortWithSavepoints yugabyte/yugabyte-db#10801) ([DocDB] Code cleanup: RocksDB Lite specific should be removed yugabyte/yugabyte-db#10802)
5103ee7 Docs: Add Brackets integration ([docs] Clean up and simplify wording in yb_hash_code doc yugabyte/yugabyte-db#10813)
b61d2cd Update: max-params to only highlight function header ([docs] Further improved interval domain types code yugabyte/yugabyte-db#10815)
2b2f11d Upgrade: babel-code-frame to version 7 ([Docs] Quarkus and Micronaut framework integration for YSQL API using JDBC smart driver yugabyte/yugabyte-db#10808)
2824d43 Docs: fix comment placement in a code example ([YSQL] Support CREATE INDEX CONCURRENTLY yugabyte/yugabyte-db#10799)
10690b7 Upgrade: devdeps and deps to latest ([DocDB] ASAN build failed yugabyte/yugabyte-db#10622)
80c8598 Docs: gitignore syntax updates (fixes [Platform] Backup goes to unknown state when "disable backups" is enabled yugabyte/yugabyte-db#8139) ([docs] correct the 2.6.7.0 release date yugabyte/yugabyte-db#10776)
cb946af Chore: use meta.messages in some rules (1/4) (PgRegress tests are bulky and their output is difficult to analyze yugabyte/yugabyte-db#10764)
a857cd9 5.4.0
8dee250 Build: changelog update for 5.4.0
a70909f Docs: Add jscs-dev.github.io links ([docs] add C and C++ SSL quickstarts yugabyte/yugabyte-db#10771)
034690f Fix: no-invalid-meta crashes for non Object values (fixes [DocDB] Faster backfills yugabyte/yugabyte-db#10750) ([DocDB] CppCassandraDriverTest.TestTableBackfillWithLeaderMoves flaky in master yugabyte/yugabyte-db#10753)
11a462d Docs: Broken jscs.info URLs (fixes [DocDB] Bunch of CDC and TwoDC tests flaky in master yugabyte/yugabyte-db#10732) ([docs] Cloud Whats New yugabyte/yugabyte-db#10770)
985567d Chore: rm unused dep string.prototype.matchall ([ossexp] Update the Java driver and ORM documentation with the new template yugabyte/yugabyte-db#10756)
f3d8454 Update: Improve no-extra-parens error message ([YSQL] Import Warning on SET of nonexisting setting with a prefix reserved by an extension yugabyte/yugabyte-db#10748)
562a03f Fix: consistent-docs-url crashes if meta.docs is empty (fixes [docs] Minor edits to the JDBC integrations page. yugabyte/yugabyte-db#10722) ([docs] [platform] clarify OS prerequisites yugabyte/yugabyte-db#10749)
6492233 Chore: enable no-prototype-builtins in codebase (fixes [DocDB] Improve Traces yugabyte/yugabyte-db#10660) ([DocDB] Clean shutdown path yugabyte/yugabyte-db#10664)
137140f Chore: use eslintrc overrides (Test: [DocDB] Split up tablet-split-itest yugabyte/yugabyte-db#10677)
2af6f4f 5.3.0
11e70c7 Build: changelog update for 5.3.0
dd6cb19 Docs: Updated no-return-await Rule Documentation (fixes [xcluster] Hardening improvements: tracking issue yugabyte/yugabyte-db#9695) ([YSQL] foreign key constraints are not supported on foreign tables yugabyte/yugabyte-db#10699)
6009239 Chore: rename utils for consistency ([CDCSDK] yb-admin command list_change_data_streams is unable to filter out streams yugabyte/yugabyte-db#10727)

See the full diff

Package name: node-sass

The new version differs by 33 commits.

3b556c1 7.0.2
c716359 Bump sass-graph@^4.0.1 ([YW] Edit Universe did not pick the last 3 nodes in the list when downsizing yugabyte/yugabyte-db#3292)
24741b3 docs(readme): fix docpad plugin link
1523330 feat: Drop Node 12
365d357 update https://registry.npm.taobao.org to https://registry.npmmirror.com
1456114 build(deps): bump actions/upload-artifact from 2 to 3
b465b69 chore: bump GitHub Actions to Windows 2019 ([docdb] QLTabletTest.OperationMemTracking is flaky yugabyte/yugabyte-db#3254)
e6194b1 build(deps): bump make-fetch-happen from 9.1.0 to 10.0.4
4edf594 build(deps): bump node-gyp from 8.4.1 to 9.0.0
29e2344 build(deps): bump actions/checkout from 2 to 3
85b0d22 build(deps): bump actions/setup-node from 2 to 3
3bb51da Use make-fetch-happen instead of request ([yugabyted] Start takes a long time if yb-ctl cluster already running yugabyte/yugabyte-db#3193)
adc2f8b build(deps): bump true-case-path from 1.0.3 to 2.2.1 (Fix k8s encryption itest yugabyte/yugabyte-db#3000)
77d12f0 chore: disable Apline for Node 16/17 builds
308d533 ci: use Python 3 for Node 12
c818907 ci: unpin actions/setup-node to v2
99242d7 7.0.1
77049d1 build(deps): bump sass-graph from 2.2.5 to 4.0.0 (Add a timeout to itest run yugabyte/yugabyte-db#3224)
c929f25 build(deps): bump node-gyp from 7.1.2 to 8.4.1 ([docs] Update note on yugabyted reference page yugabyte/yugabyte-db#3209)
918dcb3 Lint fix
0a21792 Set rejectUnauthorized to true by default ([Platform] Charts repo should be deployable to a specified namespace yugabyte/yugabyte-db#3149)
e80d4af chore: Drop EOL Node 15 (v2.0.7 fresh install won't run in Ubuntu yugabyte/yugabyte-db#3122)
d753397 feat: Add Node 17 support ([yugabyted] Issues when running on a public cloud instance yugabyte/yugabyte-db#3195)
dcf2e75 build(deps-dev): bump eslint from 7.32.0 to 8.0.0

See the full diff

Package name: webpack

The new version differs by 250 commits.

610f368 5.0.0
5ce65c1 update examples
bbe1230 Merge pull request [YSQL] Implement Async Flush for COPY command. yugabyte/yugabyte-db#11628 from webpack/bugfix/real-content-hash
75ecff2 5.0.0-rc.6
bfc35d6 Merge pull request [DocDB] Public IP deployment "Error retrieving leader master URL" from the master UI follower in another zone yugabyte/yugabyte-db#11603 from MayaWolf/master
76e8cbd Merge pull request [docs][cloud] Maintenance tab yugabyte/yugabyte-db#11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
36bcfaa Merge pull request [docs] restructure releases section yugabyte/yugabyte-db#11621 from webpack/bugfix/11619
9130d10 fix called variables with ProvidePlugin
3e42105 Merge pull request [docs][core] new quickstart tutorial yugabyte/yugabyte-db#11620 from webpack/bugfix/11617
4709719 skip connections copied to concatenated module
57b493f 5.0.0-rc.5
1658e2f Merge pull request [YSQL] TestPgRegressContribPostgresFdw fails MISMATCHED_SCHEMA yugabyte/yugabyte-db#11618 from webpack/bugfix/11615
a8fb45d fixes crash in SideEffectsFlagPlugin
84b196d emit error instead of crashing when unexpected problem occurs
5573fed Merge pull request [docs] Change the database name for DELETE FROM at Step 5 in Row-Level Geo-Partitioning yugabyte/yugabyte-db#11601 from Hornwitser/improve-suggested-polyfill-config
9b5cce9 Merge pull request [docs] PR for Documentation for multiple subscription support with azure yugabyte/yugabyte-db#11609 from snitin315/export-types
37c495c export type RuleSetUseItem
39faf34 export type RuleSetUse
e5fd246 export type RuleSetConditionAbsolute
660baad export RuleSetCondition types
13e3ca5 Merge pull request Add PostgreSQL-Compatibility, SQL Feature Coverage, PG Extensions yugabyte/yugabyte-db#11602 from webpack/bugfix/shared-runtime-chunk
9c0587e Merge pull request [Docs] Ordering of entries in the "Indexes and Constraints" section in explore yugabyte/yugabyte-db#11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
502d166 Merge pull request [Docs] Intro page for indexes and constraints in explore section yugabyte/yugabyte-db#11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4

See the full diff

Package name: webpack-dev-server

The new version differs by 250 commits.

5280ee7 docs: fix typo
d834582 chore(release): 4.7.3
7b8c85b chore(deps): update `selfsigned` ([Platform] Make the health check email configuration overridable from platform yugabyte/yugabyte-db#4170)
d598325 chore: fix lint
c1907f1 refactor: remove redundant `if` statements ([DOCS] Best practices v2 yugabyte/yugabyte-db#4158)
e535f25 ci: debug (Extract CreateReadOp into client-test-util yugabyte/yugabyte-db#4144)
75999bb chore(release): 4.7.2
90a96f7 ci: fix (Better descriptive messages for backfill jobs in master/tasks yugabyte/yugabyte-db#4143)
f6bc644 fix: compatible with `onAfterSetupMiddleware`
317e4b9 docs: fix testing instructions (added scala contributions from colinlouie yugabyte/yugabyte-db#4133)
ff4550e test: remove redundant test cases related to 3rd party code ([docdb] yb-admin logging WARNING about "Failed to schedule invoking callback on response" yugabyte/yugabyte-db#4131)
0dd1ee6 test: add e2e tests for `setupExitSignals` option (Add a GitHub Actions based build yugabyte/yugabyte-db#4130)
afe4975 chore(release): 4.1.7
4e5d8ea fix: droped `url` package ([docs] Change goldmark autoHeadingIDType to blackfriday yugabyte/yugabyte-db#4132)
b0c98f0 chore(release): 4.7.0
3138213 chore(deps): update ([YSQL] Single row update overwrites unmodified columns with default values to null yugabyte/yugabyte-db#4127)
8f02c3f feat: added types
f4fb15f fix: update description of `onAfterSetupMiddleware` and `onBeforeSetupMiddleware` options ([#4059][Docs] Add margin to code block if it is inside an anchor tag yugabyte/yugabyte-db#4126)
37b73d5 test: add e2e test for `WEBPACK_SERVE` env variable ([Platform] Restrict the number of collectors we want to use for node_exporter yugabyte/yugabyte-db#4125)
f5a9d05 chore(deps-dev): bump eslint from 8.4.1 to 8.5.0 (Raise ulimits to recommended values via setrlimit if possible yugabyte/yugabyte-db#4121)
c9b959f chore(deps): bump ws from 8.3.0 to 8.4.0 ([Platform] Update the version of node_exporter we ship with platform yugabyte/yugabyte-db#4124)
42208aa chore(deps-dev): bump lint-staged from 12.1.2 to 12.1.3 (Unable to LOGIN via cqlsh with dots in username yugabyte/yugabyte-db#4122)
f440f84 chore(deps): bump express from 4.17.1 to 4.17.2 (SQL: Multiple paranetheses not parsed correctly (error: 'only hash column group is allowed') yugabyte/yugabyte-db#4120)
c13aa56 feat: added the `setupMiddlewares` option (Adding notes indicating that the benchmark binaries are compiled with… yugabyte/yugabyte-db#4068)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Open Redirect
🦉 Prototype Pollution
🦉 More lessons are available in Snyk Learn


          fix: docs/package.json & docs/package-lock.json to reduce vulnerabili…

d5eee58

…ties

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2330875
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2331908
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430337
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430339
- https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430341
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment