Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 1 vulnerabilities #105

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 1 vulnerabilities #105

wants to merge 1 commit into from

Conversation

ajesse11x
Copy link
Owner

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
⚠️ Warning 
Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-LODASH-6139239		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: babel-eslint The new version differs by 28 commits.

See the full diff

Package name: newrelic The new version differs by 250 commits.
  • f35a229 release: 6.5.0 (2020-03-19)
  • 5779e3c Updated release notes
  • 435d053 Merge pull request #1969 from NodeJS-agent/ntzaperas/attribute-rename
  • 3d0dbd2 Rename span error attribute
  • a01821f Fix span error attributes appearing on span intrinsics
  • 76e0572 Updated changelog for v6.5.0.
  • cd9406c Merge pull request #1966 from NodeJS-agent/ntzaperas/lasp-span-errors
  • bfb2e70 Remove span_error_attributes feature flag
  • 613a285 Test span error attributes and HSM/ignore
  • a4ac95b Merge pull request #1964 from NodeJS-agent/mgoin/ConvertAgentAggregatorsUnitTests
  • 2de8843 Merge pull request #1959 from NodeJS-agent/mgoin/ConvertAgentsUnitTestFullyTap
  • 3f53da6 Converts event-aggregator.test.js to fully use tap API.
  • e339089 Use the same attributes on spans as on TransactionErrors
  • 0166c8a Span error attributes should adhere to security policy
  • de2658d Converts base-aggregator.test.js to fully use tap API.
  • 1e036e5 Converts synthetics.test.js to fully use tap API.
  • 6d75845 Converts intrinsics.test.js to fully use tap API.
  • 8c43fc6 Converts agent.test.js to fully use tap API.
  • ade4dc3 Merge pull request #1957 from NodeJS-agent/ntzaperas/NODE-2307-error-attrs-on-spans
  • 2ce89a6 Put span error attributes behind a feature flag
  • 9013e0f Tests for span error attributes
  • 64c6d47 Update tests to match new error interface
  • ecae7a2 Add error info to span and link to TransactionError events
  • 233e48e Merge pull request #1956 from NodeJS-agent/mgoin/NODE-2314-EventHandlersNotCleaningUp

See the full diff

Package name: sinon The new version differs by 250 commits.
  • 6547aa1 16.1.2
  • 9ea3d5b Fix hooks-install
  • 6c28d07 16.1.1
  • ff0e993 Showcase #replace.usingAccessor for DI in the typescript case study (#2556)
  • c47a4be Bump @ babel/traverse from 7.22.5 to 7.23.2 (#2555)
  • f0d250b Add TOC feature to articles (#2554)
  • 737736f 16.1.0
  • cac5184 Enable use of assignment in the presence of accessors (#2538)
  • f8c20e5 New article: making Sinon work with complex setups (#2540)
  • cb5b962 Add NPM script 'dev-docs' and document its usage
  • dd7c609 Add a little update to contributing
  • 79acdf3 Move tool versions into single file at root
  • 03b1db5 Expose Changelog page (#2550)
  • e1c3dad Add section on tooling and recommend using ASDF for tool versioning (#2547)
  • 062e318 16.0.0
  • c339605 fix(2525): ensure non empty message when error of type string is passed, but no message (#2544)
  • 8d1f85b Modernize build script syntax slightly (#2546)
  • 67a8cea docs(sandbox): fix example that defines a non-function property (#2543)
  • baa1aee .define method (#2539)
  • 2ddf7ff Bump actions/checkout from 3 to 4 (#2542)
  • 5fc17c7 Remove dead code
  • fe799e7 Fix issue 2534: spies are not restored (#2535)
  • 305fb6c fix: actaully reset 'injectedKeys' (#2456)
  • 8186280 Bump word-wrap from 1.2.3 to 1.2.4 (#2526)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

@snyk-bot
fix: package.json to reduce vulnerabilities
9b7b3e7 
The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-LODASH-6139239
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@ajesse11x @snyk-bot