New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 6 vulnerabilities #63

Open

snyk-bot wants to merge 1 commit into dev from snyk-fix-720575448acac450ca14202930c6d169

snyk-bot commented Mar 10, 2023

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- app/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	479/1000 Why? Has a fix available, CVSS 5.3	Improper Certificate Validation SNYK-JS-NODESASS-1059081	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-TRIMNEWLINES-1298042	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	Yes	No Known Exploit
	601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: html-webpack-plugin

The new version differs by 139 commits.

eb73905 chore(release): 4.0.0
42a6d4a Add typing for getHooks
a1a37cf Release html-webpack-plugin 4.0.0-beta.14
97f9fb9 fix: load script files before style files files in defer script loading mode
e97ce17 Release html-webpack-plugin 4.0.0-beta.13
e448b5d Release html-webpack-plugin 4.0.0-beta.12
de315eb feat: Add defer script loading
7df269f feat: Provide a verbose error message if html minification failed
1d66e53 feat: merge templateParameters with default template parameters
dfb98e7 Fix typo in template option docts
096a760 Fix broken links in examples
a195c34 docs: Update template-option documentation
40b410e docs: Update example for template parameters
bf017f3 chore: Release 4.0.0-beta.11
2549557 test: Don't use minification for speed measurement
de22fc2 test: Adjust measurment for node 6 on travis
24bf1b5 fix: Update references to html-minifier
f4eafdc chore: Release 4.0.0-beta.10
a2ad30a refactor: Use getAssetPath instead of calling the hook directly
2595a79 chore: Release 4.0.0-beta.9
c66766c feat: Add support for minifying inline ES6 inside html templates
655cbcd Fix README typo
6de319b update lodash dependency for prototype polution vulnerability
35a1541 Properly encode file names emitted as part of URLs.

See the full diff

Package name: node-sass

The new version differs by 78 commits.

918dcb3 Lint fix
0a21792 Set rejectUnauthorized to true by default (fix(quasar): Uploader mix-in fix for scoped-slot "list" quasarframework/quasar#3149)
e80d4af chore: Drop EOL Node 15 ([v1] VTouchHold/Repeat/Pan: allow a 20ms window before aborting for move quasarframework/quasar#3122)
d753397 feat: Add Node 17 support (Theme Builder not exporting QDrawer unless left drawer selected [v1.0] quasarframework/quasar#3195)
dcf2e75 build(deps-dev): bump eslint from 7.32.0 to 8.0.0
bfa1a3c build(deps): bump actions/setup-node from 2.4.0 to 2.4.1
80d6c00 chore: Windows x86 on GitHub Actions (feat(docs): Formatter Utils quasarframework/quasar#3041)
566dc27 build(deps-dev): bump fs-extra from 0.30.0 to 10.0.0 (fix(quasar): q-table, safari, ios quasarframework (#3079) quasarframework/quasar#3102)
7bb5157 build(deps): bump npmlog from 4.1.2 to 5.0.0 ([Request] Override 'Enter' key action on q-checkbox quasarframework/quasar#3156)
2efb38f build(deps): bump chalk from 1.1.3 to 4.1.2 (Validation improvements quasarframework/quasar#3161)
fca5257 build(deps): bump actions/setup-node from 2.3.0 to 2.4.0
6200b21 docs: Double word "support" ([Docs] Added some Related items quasarframework/quasar#3159)
eaf791a build(deps): bump actions/setup-node from 2.1.5 to 2.3.0
16b8d4b build(deps): bump coverallsapp/github-action from 1.1.2 to 1.1.3
c167004 6.0.1
911d4db remove mkdirp dep (QEditor Cleanup (with doc revision) quasarframework/quasar#3108)
30a52f7 build(deps): bump meow from 3.7.0 to 9.0.0
7e08463 build(deps-dev): bump mocha from 8.4.0 to 9.0.1
cfcbb2c chore: Use default Apline version from docker-node ([v1] QTime: enhance model string parsing quasarframework/quasar#3121)
886319b chore: Drop Node 10 support
c908f4f fix: Bump OSX minimum to 10.11
8ab02da fix: Remove old compiler gyp settings
3d7b9d0 chore: Add Node 16 support
4115e9d build(deps): bump actions/setup-node from v2.1.4 to v2.1.5

See the full diff

Package name: webpack-dev-server

The new version differs by 33 commits.

4ab1f21 chore(release): 3.11.0
0e51fb1 fix: invalidate route (SessionStorage: fix wrong name quasarframework/quasar#2584)
f857c40 chore: deps and tests
41d1d0c fix(deps): security vulnerability in yargs-parser (QPopover: only dismiss if mousedown and mouseup are both outside quasarframework/quasar#2566)
375ab23 ci: add node@14 (QSelect/QAutocomplete too much options hide the form element quasarframework/quasar#2530)
776e7d4 chore(deps): update dependency html-entities to ^1.3.1 (master) ([DIRECTIVE] Masked Input Directive quasarframework/quasar#2513)
984536c chore: update lint-staged config (QCollapsible in 'accordion' mode stops working if section 'disable' prop changes quasarframework/quasar#2524)
89ffb86 feat: add invalidate endpoint ([Proposal] vue-fontawesome support quasarframework/quasar#2493)
0e9bffb chore(deps): update all patch dependencies (tickStrategy could have a "leafParent" option too quasarframework/quasar#2508)
99ccfd8 fix: update jquery (QDatetimePicker unable to detect date selection quasarframework/quasar#2516)
06583f2 fix: do not swallow errors from server (QInput icon is active even if input is disabled quasarframework/quasar#2512)
0d5c681 fix(server): don't crash on setupExitSignals(undefined) (QSelect: fix clearValue quasarframework/quasar#2507)
c436058 chore(deps): update all patch dependencies (master) (patch) (when Touch hold working, the click event will not work? quasarframework/quasar#2503)
4808abd feat(progess): emit progress-update ([Request] QBtn customazible icon ratio quasarframework/quasar#2498)
adeb92e feat: allow open option to accept an object (Clearing select results in undefined display string if no placeholder is provided quasarframework/quasar#2492)
c6bdfe4 feat(contentBasePublicPath): allow multiple paths (Auto focus on filter fields causing erratic q-select behaviour quasarframework/quasar#2489)
f317358 chore(deps): update all patch dependencies (master) (patch) (Form controls: fix spacer label not stacking. More checks on fakeInputValue quasarframework/quasar#2481)
de763e9 chore(deps): update all minor dependencies (master) (minor) (q-popover @show & @hide events trigger 2 times quasarframework/quasar#2473)
f7b6fa1 chore(deps): update package-lock.json (QSelect multiple returns undefined quasarframework/quasar#2482)
3bf43a7 chore(deps): update all patch dependencies (devProxy on dev env, but how to set API proxy on production? quasarframework/quasar#2477)
12d76be docs: fix typos across the project (QLayout: fixes for container quasarframework/quasar#2452)
9a6e4a1 chore(deps): update all patch dependencies ([REQUEST] Please add "filter-method" into q-select with filter quasarframework/quasar#2468)
d4739f8 chore(deps): update dependency husky to v4 ( Fixes issue #2379 Clearable not working in ChipsInput quasarframework/quasar#2383)
5f357f3 chore(deps): update all patch dependencies (Element in QModal doesn't scroll horizontally quasarframework/quasar#2450)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Arbitrary File Write
🦉 Denial of Service (DoS)
🦉 Prototype Pollution


          fix: app/package.json to reduce vulnerabilities

7dab2c1

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-NODESASS-1059081
- https://snyk.io/vuln/SNYK-JS-TAR-1579152
- https://snyk.io/vuln/SNYK-JS-TAR-1579155
- https://snyk.io/vuln/SNYK-JS-TRIMNEWLINES-1298042
- https://snyk.io/vuln/SNYK-JS-UGLIFYJS-1727251
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet