[Snyk] Fix for 3 vulnerabilities - #2

Merged

kadirselcuk merged 1 commit into

snyk-fix-99cc451f8fb0a026bf1475cf3a8ff253

Sep 29, 2020

snyk-bot commented Aug 10, 2020

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- deps/npm/docs/package.json
- deps/npm/docs/package-lock.json
- deps/npm/docs/.snyk

Vulnerabilities that will be fixed

With an upgrade:

Severity	Issue	Breaking Change	Exploit Maturity
	Prototype Pollution SNYK-JS-FLAT-596927	No	No Known Exploit
	Cross-site Scripting (XSS) SNYK-JS-PRISMJS-597628	No	No Known Exploit

Commit messages

Package name: gatsby

The new version differs by 250 commits.

0049249 chore(release): Publish
bc4a39b chore(gatsby-plugin-less): less-loader version 6.1.0 with tests and doc… (doc: simplify author ready nodejs/node#24893)
35cf175 chore(showcase): Removing my site from the showcase (generateKeyPairSync doesn't return KeyObject nodejs/node#25322)
96ba315 chore(showcase): Showcase addition: Real Estate Shows (doc: fs.mkdir('/') throws EPERM on Windows nodejs/node#25340)
04b9ea6 Remove micro modules ( readline: add support for async iteration nodejs/node#23916)
6e68f17 refactor(www): Turn HubspotForm to function component (Vary: Accept-Encoding missing in zlib examples nodejs/node#25495)
88cfa77 enhancement(docs): dictionary.txt -> Infer* -> putting all code prefixed with infer into code blocks (doc: add clarification for exception behaviour nodejs/node#25339)
c41a800 Fix file name typo (Official(?) discord abandoned. nodejs/node#25494)
c58203f fix(www): Fix getting active item when pathname does not end with / (process: improve --redirect-warnings handling nodejs/node#24965)
1a1177e fix: incorrect typedef parsing for interfaces (test: fixing arguments order in assert.strictEqual() nodejs/node#24192)
baddf58 refactor pagination to function component ([v11.x] src: move more process methods initialization in bootstrap/node.js nodejs/node#25496)
6a6ac17 fix(gatsby-plugin-google-analytics): Separate preconnect and dns-prefetch (lib: move DEP0006 to end of life nodejs/node#25279)
f08687c refactor(www): Make easy-to-convert class components into function components (doc: fix http.Agent timeout option description nodejs/node#25489)
c9692ab chore(release): Publish
5250a02 Revert "feat(gatsby): Track static queries by template (There are random numbers coming out from the console from node ... ? nodejs/node#25120)" (os: add fallback for undefined CPUs nodejs/node#25493)
473d2c8 Remove file copy from www (deps: v8, cherry-pick 9365d09, aac2f8c, 47d34a3 nodejs/node#25429)
3a94eb6 remove unused typobot file (tls: do not free cert in .getCertificate() nodejs/node#25490)
7efdbd3 fix(gatsby-design-tokens): Add border definitions to theme (inspector fails in noPrototypeIterator on Array with incomplete custom prototype nodejs/node#25486)
0ffe483 import layer icons directly (http: make timeout event work with agent timeout nodejs/node#25488)
d0b6a83 Switch layer-icon to pure SVGs (Missing process functions under workers should throw explicit error nodejs/node#25448)
1081ea7 chore(showcase): Add Inbound Latino website (test: set umask explicitly nodejs/node#25213)
6cf4588 chore(release): Publish
e2af89d chore: update xstate and adjust code to not use deprecated transient transitions (os.cpus: Cannot read property 'length' of undefined nodejs/node#25483)
6dc5458 remove last updated field on docs pages (tools: update crypo check rule nodejs/node#25399)

See the full diff

Package name: prismjs

The new version differs by 206 commits.

187c8a6 1.21.0
bf4f323 Changelog for v1.21.0 (Computed props are not properly handled nodejs/node#2507)
8bba488 Previewers: Fixed XSS (Release proposal: v3.2.0 nodejs/node#2506)
158caf5 JSON: Greedy comments (stream: code cleanup and micro-optimization nodejs/node#2479)
f0f8210 Batch: Fix escaped double quote (zlib streams emitting data after end nodejs/node#2485)
649e51e Added support for Dhall (Buffer.buffer in iojs 3.0 nodejs/node#2473)
453079b Line Numbers: Fixed class name on website
a0efa40 Fixed Treeview page (Odd Buffer behavior that leads to crash in iojs 3.0 nodejs/node#2484)
78161d6 VB: Added VBA alias (Investigate flaky test test-net-connect-timeout nodejs/node#2469)
ed1df1e Added support for YANG (tls error nodejs/node#2467)
447429f Line Numbers: Improved documentation (changelog missing for v3.1.0 release nodejs/node#2456)
3fcce6f Added support for .gitignore (The future of HTTP in Node nodejs/node#2481)
0c30c58 EditorConfig: Trim spaces before key and section title (deps: update V8 to 4.4.63.30 nodejs/node#2482)
2ff40fe Rust: Improvements (test: parallel/test-net-socket-local-address frequently fails on freebsd nodejs/node#2464)
2805ae3 JSDoc: Improvements (Why UV_RUN_ONCE and not UV_RUN_NOWAIT? nodejs/node#2466)
398e294 Added support for Cypher (nan errors on opt deps? nodejs/node#2459)
4f55052 JS: Improved regex detection (url.parse parses hostname as protocol when protocol/scheme is absent in hostname:port formatted uRL nodejs/node#2465)
16fbe3e Bump lodash from 4.17.15 to 4.17.19 (v8::Isolate::GetCurrent()->IdleNotificationDeadline not working in 3.x (manual gc not working) nodejs/node#2478)
bea7a58 SQL: Added PostgreSQL `RETURNING` keyword (Investigate flaky test test-debug-signal-cluster nodejs/node#2476)
67f97e2 Kotlin: Added `kt` and `kts` aliases (Investigate flaky test test-dgram-multicast-multi-process nodejs/node#2474)
4028520 Core: Fixed greedy matching bug (test: remove obsolete TODO comments for fs.read nodejs/node#2032)
ed8fff9 Added support for EditorConfig (Investigate flaky test test-tick-processor nodejs/node#2471)
278316c SAS: Improved macro string functions (Buffer.length became significantelly slower in 3.x nodejs/node#2463)
537a9e8 CSP: Fixed directives (http.ClientRequest poor documentation nodejs/node#2461)

See the full diff

With a Snyk patch:

Severity	Issue	Exploit Maturity
	Prototype Pollution SNYK-JS-LODASH-567746	Proof of Concept

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


          fix: deps/npm/docs/package.json, deps/npm/docs/package-lock.json & de…

965544f

…ps/npm/docs/.snyk to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-FLAT-596927
- https://snyk.io/vuln/SNYK-JS-PRISMJS-597628


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746

kadirselcuk merged commit 9bc5fdc into master

pull-assistant Bot commented Sep 29, 2020

Best reviewed: commit by commit

Optimal code review plan

fix: deps/npm/docs/package.json, deps/npm/docs/package-lock.json & dep...

Powered by Pull Assistant. Last update 965544f ... 965544f. Read the comment docs.

delete-merged-branch Bot deleted the snyk-fix-99cc451f8fb0a026bf1475cf3a8ff253 branch

September 29, 2020 10:44

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment