From 766bd1d53c8dd5300b4d950a9056d54a50fb1c3b Mon Sep 17 00:00:00 2001 From: Sandor Trombitas Date: Wed, 16 Oct 2024 11:50:48 +0300 Subject: [PATCH 1/2] fix: update snyk-nodejs-plugin to fix micromatch vuln --- package-lock.json | 270 ++++++++++++++++++++++------------------------ package.json | 2 +- 2 files changed, 128 insertions(+), 144 deletions(-) diff --git a/package-lock.json b/package-lock.json index 2fb7e99826..572b993ed4 100644 --- a/package-lock.json +++ b/package-lock.json @@ -74,7 +74,7 @@ "snyk-module": "3.1.0", "snyk-mvn-plugin": "3.6.0", "snyk-nodejs-lockfile-parser": "1.58.10", - "snyk-nodejs-plugin": "1.3.3", + "snyk-nodejs-plugin": "1.3.4", "snyk-nuget-plugin": "2.7.8", "snyk-php-plugin": "1.9.2", "snyk-policy": "^4.0.0", @@ -20974,9 +20974,9 @@ "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" }, "node_modules/snyk-nodejs-plugin": { - "version": "1.3.3", - "resolved": "https://registry.npmjs.org/snyk-nodejs-plugin/-/snyk-nodejs-plugin-1.3.3.tgz", - "integrity": "sha512-QWvN9mZzbYJAYP1oog8HITfWMyGsR7jey2BphnKvi+mgfq9VgopixryvhXv63m8jMCiTQZEUSTGd2qbR2uJVnA==", + "version": "1.3.4", + "resolved": "https://registry.npmjs.org/snyk-nodejs-plugin/-/snyk-nodejs-plugin-1.3.4.tgz", + "integrity": "sha512-diUvn/H8RwNzDJZagHNp7SenTnaYf7YKnp6/qvLmyuft0q3vQrFJerYZAVRmyn6I+f07GL13dufOzLi9/BBkTA==", "dependencies": { "@snyk/cli-interface": "^2.13.0", "@snyk/dep-graph": "^2.7.4", @@ -20985,8 +20985,8 @@ "lodash.groupby": "^4.6.0", "lodash.isempty": "^4.4.0", "lodash.sortby": "^4.7.0", - "micromatch": "4.0.7", - "snyk-nodejs-lockfile-parser": "1.58.10", + "micromatch": "4.0.8", + "snyk-nodejs-lockfile-parser": "1.58.13", "snyk-resolve-deps": "4.8.0" }, "engines": { @@ -21004,93 +21004,90 @@ "@snyk/dep-graph": ">=1" } }, - "node_modules/snyk-nodejs-plugin/node_modules/hosted-git-info": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-4.1.0.tgz", - "integrity": "sha512-kyCuEOWjJqZuDbRHzL8V93NzQhwIB71oFWSyzVo+KPZI+pnQPPxucdkrOZvkLRnrf5URsQM+IJ09Dw29cRALIA==", + "node_modules/snyk-nodejs-plugin/node_modules/@snyk/error-catalog-nodejs-public": { + "version": "5.32.1", + "resolved": "https://registry.npmjs.org/@snyk/error-catalog-nodejs-public/-/error-catalog-nodejs-public-5.32.1.tgz", + "integrity": "sha512-qheDTzRn82lLDsp+GEz1dsXmxKKsqlk09Hy5fqLYwQBSXry/FVHNH0RfpBeGHNiWhfdbuGgxni9KTXVcCJJglg==", "dependencies": { - "lru-cache": "^6.0.0" - }, - "engines": { - "node": ">=10" + "tslib": "^2.6.2", + "uuid": "^9.0.0" } }, - "node_modules/snyk-nodejs-plugin/node_modules/hosted-git-info/node_modules/lru-cache": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", - "dependencies": { - "yallist": "^4.0.0" - }, - "engines": { - "node": ">=10" - } + "node_modules/snyk-nodejs-plugin/node_modules/@snyk/error-catalog-nodejs-public/node_modules/tslib": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.0.tgz", + "integrity": "sha512-jWVzBLplnCmoaTr13V9dYbiQ99wvZRd0vNWaDRg+aVYRcjDF3nDksxFDE/+fkXnKhpnUUkmx5pK/v8mCtLVqZA==" }, - "node_modules/snyk-nodejs-plugin/node_modules/hosted-git-info/node_modules/yallist": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" - }, - "node_modules/snyk-nodejs-plugin/node_modules/lru-cache": { - "version": "4.1.5", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.1.5.tgz", - "integrity": "sha512-sWZlbEP2OsHNkXrMl5GYk/jKk70MBng6UU4YI/qGDYbgf6YbP4EvmqISbXCoJiRKs+1bSpFHVgQxvJ17F2li5g==", - "dependencies": { - "pseudomap": "^1.0.2", - "yallist": "^2.1.2" + "node_modules/snyk-nodejs-plugin/node_modules/@snyk/error-catalog-nodejs-public/node_modules/uuid": { + "version": "9.0.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz", + "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==", + "funding": [ + "https://github.com/sponsors/broofa", + "https://github.com/sponsors/ctavan" + ], + "bin": { + "uuid": "dist/bin/uuid" } }, - "node_modules/snyk-nodejs-plugin/node_modules/micromatch": { - "version": "4.0.7", - "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.7.tgz", - "integrity": "sha512-LPP/3KorzCwBxfeUuZmaR6bG2kdeHSbe0P2tY3FLRU4vYrjYz5hI4QZwV0njUx3jeuKe67YukQ1LSPZBKDqO/Q==", + "node_modules/snyk-nodejs-plugin/node_modules/argparse": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", + "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==" + }, + "node_modules/snyk-nodejs-plugin/node_modules/js-yaml": { + "version": "4.1.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", + "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", "dependencies": { - "braces": "^3.0.3", - "picomatch": "^2.3.1" + "argparse": "^2.0.1" }, - "engines": { - "node": ">=8.6" + "bin": { + "js-yaml": "bin/js-yaml.js" } }, "node_modules/snyk-nodejs-plugin/node_modules/semver": { - "version": "5.7.2", - "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz", - "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==", + "version": "7.6.3", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.3.tgz", + "integrity": "sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==", "bin": { - "semver": "bin/semver" - } - }, - "node_modules/snyk-nodejs-plugin/node_modules/snyk-module": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/snyk-module/-/snyk-module-3.2.0.tgz", - "integrity": "sha512-6MLJyi4OMOZtCWTzGgRMEEw9qQ1fAwKoj5XYXfKOjIsohi3ubKsVfvSoScj0IovtiKowm2iCZ+VIRPJab6nCxA==", - "dependencies": { - "debug": "^4.1.1", - "hosted-git-info": "^4.0.2" + "semver": "bin/semver.js" + }, + "engines": { + "node": ">=10" } }, - "node_modules/snyk-nodejs-plugin/node_modules/snyk-resolve-deps": { - "version": "4.8.0", - "resolved": "https://registry.npmjs.org/snyk-resolve-deps/-/snyk-resolve-deps-4.8.0.tgz", - "integrity": "sha512-/pXaStapn8ldr68e1Bs2gmxoQpiB3fnjfZSfzY82bxedmSKzQgTJ5vhf1P9kALj3IBEb1wYaQ/MtNH5E9DK0/g==", + "node_modules/snyk-nodejs-plugin/node_modules/snyk-nodejs-lockfile-parser": { + "version": "1.58.13", + "resolved": "https://registry.npmjs.org/snyk-nodejs-lockfile-parser/-/snyk-nodejs-lockfile-parser-1.58.13.tgz", + "integrity": "sha512-VBxAewF3cIpGCOclzvZqW7e0PAHMIqSWV88Gz/OLkeTN3Hmw2POMwgYU1Bbhe/1ypKCO0QQPdAfegK1z0QlEJw==", "dependencies": { - "ansicolors": "^0.3.2", - "debug": "^4.3.4", - "lodash": "^4.17.21", - "lru-cache": "^4.1.5", - "semver": "^5.7.2", - "snyk-module": "^3.2.0", - "snyk-resolve": "^1.1.0", - "snyk-tree": "^1.0.0", - "snyk-try-require": "^2.0.2", - "then-fs": "^2.0.0" + "@snyk/dep-graph": "^2.3.0", + "@snyk/error-catalog-nodejs-public": "^5.16.0", + "@snyk/graphlib": "2.1.9-patch.3", + "@yarnpkg/core": "^2.4.0", + "@yarnpkg/lockfile": "^1.1.0", + "dependency-path": "^9.2.8", + "event-loop-spinner": "^2.0.0", + "js-yaml": "^4.1.0", + "lodash.clonedeep": "^4.5.0", + "lodash.flatmap": "^4.5.0", + "lodash.isempty": "^4.4.0", + "lodash.topairs": "^4.3.0", + "micromatch": "^4.0.8", + "p-map": "^4.0.0", + "semver": "^7.6.0", + "snyk-config": "^5.0.0", + "tslib": "^1.9.3", + "uuid": "^8.3.0" + }, + "bin": { + "parse-nodejs-lockfile": "bin/index.js" + }, + "engines": { + "node": ">=10" } }, - "node_modules/snyk-nodejs-plugin/node_modules/yallist": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz", - "integrity": "sha512-ncTzHV7NvsQZkYe1DW7cbDLm0YpzHmZF5r/iyP3ZnQtMiJ+pjzisCiMNI+Sj+xQF5pXhSHxSB3uDbsBTzY/c2A==" - }, "node_modules/snyk-nuget-plugin": { "version": "2.7.8", "resolved": "https://registry.npmjs.org/snyk-nuget-plugin/-/snyk-nuget-plugin-2.7.8.tgz", @@ -40233,9 +40230,9 @@ } }, "snyk-nodejs-plugin": { - "version": "1.3.3", - "resolved": "https://registry.npmjs.org/snyk-nodejs-plugin/-/snyk-nodejs-plugin-1.3.3.tgz", - "integrity": "sha512-QWvN9mZzbYJAYP1oog8HITfWMyGsR7jey2BphnKvi+mgfq9VgopixryvhXv63m8jMCiTQZEUSTGd2qbR2uJVnA==", + "version": "1.3.4", + "resolved": "https://registry.npmjs.org/snyk-nodejs-plugin/-/snyk-nodejs-plugin-1.3.4.tgz", + "integrity": "sha512-diUvn/H8RwNzDJZagHNp7SenTnaYf7YKnp6/qvLmyuft0q3vQrFJerYZAVRmyn6I+f07GL13dufOzLi9/BBkTA==", "requires": { "@snyk/cli-interface": "^2.13.0", "@snyk/dep-graph": "^2.7.4", @@ -40244,8 +40241,8 @@ "lodash.groupby": "^4.6.0", "lodash.isempty": "^4.4.0", "lodash.sortby": "^4.7.0", - "micromatch": "4.0.7", - "snyk-nodejs-lockfile-parser": "1.58.10", + "micromatch": "4.0.8", + "snyk-nodejs-lockfile-parser": "1.58.13", "snyk-resolve-deps": "4.8.0" }, "dependencies": { @@ -40257,82 +40254,69 @@ "@types/graphlib": "^2" } }, - "hosted-git-info": { - "version": "4.1.0", - "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-4.1.0.tgz", - "integrity": "sha512-kyCuEOWjJqZuDbRHzL8V93NzQhwIB71oFWSyzVo+KPZI+pnQPPxucdkrOZvkLRnrf5URsQM+IJ09Dw29cRALIA==", + "@snyk/error-catalog-nodejs-public": { + "version": "5.32.1", + "resolved": "https://registry.npmjs.org/@snyk/error-catalog-nodejs-public/-/error-catalog-nodejs-public-5.32.1.tgz", + "integrity": "sha512-qheDTzRn82lLDsp+GEz1dsXmxKKsqlk09Hy5fqLYwQBSXry/FVHNH0RfpBeGHNiWhfdbuGgxni9KTXVcCJJglg==", "requires": { - "lru-cache": "^6.0.0" + "tslib": "^2.6.2", + "uuid": "^9.0.0" }, "dependencies": { - "lru-cache": { - "version": "6.0.0", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz", - "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==", - "requires": { - "yallist": "^4.0.0" - } + "tslib": { + "version": "2.8.0", + "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.0.tgz", + "integrity": "sha512-jWVzBLplnCmoaTr13V9dYbiQ99wvZRd0vNWaDRg+aVYRcjDF3nDksxFDE/+fkXnKhpnUUkmx5pK/v8mCtLVqZA==" }, - "yallist": { - "version": "4.0.0", - "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz", - "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==" + "uuid": { + "version": "9.0.1", + "resolved": "https://registry.npmjs.org/uuid/-/uuid-9.0.1.tgz", + "integrity": "sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==" } } }, - "lru-cache": { - "version": "4.1.5", - "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.1.5.tgz", - "integrity": "sha512-sWZlbEP2OsHNkXrMl5GYk/jKk70MBng6UU4YI/qGDYbgf6YbP4EvmqISbXCoJiRKs+1bSpFHVgQxvJ17F2li5g==", - "requires": { - "pseudomap": "^1.0.2", - "yallist": "^2.1.2" - } + "argparse": { + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz", + "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==" }, - "micromatch": { - "version": "4.0.7", - "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.7.tgz", - "integrity": "sha512-LPP/3KorzCwBxfeUuZmaR6bG2kdeHSbe0P2tY3FLRU4vYrjYz5hI4QZwV0njUx3jeuKe67YukQ1LSPZBKDqO/Q==", + "js-yaml": { + "version": "4.1.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz", + "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==", "requires": { - "braces": "^3.0.3", - "picomatch": "^2.3.1" + "argparse": "^2.0.1" } }, "semver": { - "version": "5.7.2", - "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.2.tgz", - "integrity": "sha512-cBznnQ9KjJqU67B52RMC65CMarK2600WFnbkcaiwWq3xy/5haFJlshgnpjovMVJ+Hff49d8GEn0b87C5pDQ10g==" - }, - "snyk-module": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/snyk-module/-/snyk-module-3.2.0.tgz", - "integrity": "sha512-6MLJyi4OMOZtCWTzGgRMEEw9qQ1fAwKoj5XYXfKOjIsohi3ubKsVfvSoScj0IovtiKowm2iCZ+VIRPJab6nCxA==", - "requires": { - "debug": "^4.1.1", - "hosted-git-info": "^4.0.2" - } + "version": "7.6.3", + "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.3.tgz", + "integrity": "sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==" }, - "snyk-resolve-deps": { - "version": "4.8.0", - "resolved": "https://registry.npmjs.org/snyk-resolve-deps/-/snyk-resolve-deps-4.8.0.tgz", - "integrity": "sha512-/pXaStapn8ldr68e1Bs2gmxoQpiB3fnjfZSfzY82bxedmSKzQgTJ5vhf1P9kALj3IBEb1wYaQ/MtNH5E9DK0/g==", - "requires": { - "ansicolors": "^0.3.2", - "debug": "^4.3.4", - "lodash": "^4.17.21", - "lru-cache": "^4.1.5", - "semver": "^5.7.2", - "snyk-module": "^3.2.0", - "snyk-resolve": "^1.1.0", - "snyk-tree": "^1.0.0", - "snyk-try-require": "^2.0.2", - "then-fs": "^2.0.0" + "snyk-nodejs-lockfile-parser": { + "version": "1.58.13", + "resolved": "https://registry.npmjs.org/snyk-nodejs-lockfile-parser/-/snyk-nodejs-lockfile-parser-1.58.13.tgz", + "integrity": "sha512-VBxAewF3cIpGCOclzvZqW7e0PAHMIqSWV88Gz/OLkeTN3Hmw2POMwgYU1Bbhe/1ypKCO0QQPdAfegK1z0QlEJw==", + "requires": { + "@snyk/dep-graph": "^2.3.0", + "@snyk/error-catalog-nodejs-public": "^5.16.0", + "@snyk/graphlib": "2.1.9-patch.3", + "@yarnpkg/core": "^2.4.0", + "@yarnpkg/lockfile": "^1.1.0", + "dependency-path": "^9.2.8", + "event-loop-spinner": "^2.0.0", + "js-yaml": "^4.1.0", + "lodash.clonedeep": "^4.5.0", + "lodash.flatmap": "^4.5.0", + "lodash.isempty": "^4.4.0", + "lodash.topairs": "^4.3.0", + "micromatch": "^4.0.8", + "p-map": "^4.0.0", + "semver": "^7.6.0", + "snyk-config": "^5.0.0", + "tslib": "^1.9.3", + "uuid": "^8.3.0" } - }, - "yallist": { - "version": "2.1.2", - "resolved": "https://registry.npmjs.org/yallist/-/yallist-2.1.2.tgz", - "integrity": "sha512-ncTzHV7NvsQZkYe1DW7cbDLm0YpzHmZF5r/iyP3ZnQtMiJ+pjzisCiMNI+Sj+xQF5pXhSHxSB3uDbsBTzY/c2A==" } } }, diff --git a/package.json b/package.json index 3e53e3c127..9199a61f37 100644 --- a/package.json +++ b/package.json @@ -122,7 +122,7 @@ "snyk-module": "3.1.0", "snyk-mvn-plugin": "3.6.0", "snyk-nodejs-lockfile-parser": "1.58.10", - "snyk-nodejs-plugin": "1.3.3", + "snyk-nodejs-plugin": "1.3.4", "snyk-nuget-plugin": "2.7.8", "snyk-php-plugin": "1.9.2", "snyk-policy": "^4.0.0", From b5c89f642ed8ade9f0587b6f3aadac56f23f45ed Mon Sep 17 00:00:00 2001 From: Sandor Trombitas Date: Wed, 16 Oct 2024 16:21:58 +0300 Subject: [PATCH 2/2] chore: change cache key to invalidate cache --- .circleci/config.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 8df94018cd..ab1af6bf8f 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -186,7 +186,7 @@ commands: - restore_cache: name: Restoring Chocolatey cache keys: - - chocolatey-cache-v3-{{ arch }}-{{ checksum ".circleci/chocolatey.config" }} + - chocolatey-cache-v4-{{ arch }}-{{ checksum ".circleci/chocolatey.config" }} - run: name: Install Windows dependencies shell: bash.exe @@ -197,7 +197,7 @@ commands: choco install nodejs --version=$(head .nvmrc) --no-progress -y - save_cache: name: Saving Chocolatey cache - key: chocolatey-cache-v3-{{ arch }}-{{ checksum ".circleci/chocolatey.config" }} + key: chocolatey-cache-v4-{{ arch }}-{{ checksum ".circleci/chocolatey.config" }} paths: - ~\AppData\Local\Temp\chocolatey - install-deps-python: @@ -254,7 +254,7 @@ commands: - restore_cache: name: Restoring Chocolatey cache keys: - - chocolatey-cache-v3-{{ arch }}-{{ checksum ".circleci/chocolatey.config" }} + - chocolatey-cache-v4-{{ arch }}-{{ checksum ".circleci/chocolatey.config" }} - run: name: Install Windows dependencies shell: bash.exe @@ -262,7 +262,7 @@ commands: choco install make --no-progress -y - save_cache: name: Saving Chocolatey cache - key: chocolatey-cache-v3-{{ arch }}-{{ checksum ".circleci/chocolatey.config" }} + key: chocolatey-cache-v4-{{ arch }}-{{ checksum ".circleci/chocolatey.config" }} paths: - ~\AppData\Local\Temp\chocolatey - install-deps-python: