search

18F / fedramp-dashboard

https://marketplace.fedramp.gov
Creative Commons Zero v1.0 Universal
21 stars 16 forks source link

[Snyk] Fix for 1 vulnerabilities #163

Open JJediny opened 2 years ago

JJediny commented 2 years ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-ANSIREGEX-1583908](https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: gulp-sass The new version differs by 8 commits.
  • 5775044 Update CHANGELOG.md
  • 978b8f6 Update to major version 5 (#802)
  • 10eae93 Update changelog for 4.1.1
  • 947b26c Upgrade lodash to fix a security issue (#776)
  • 8d6ac29 Update changelog
  • 43c0547 4.1.0
  • ebe3ec6 Set appropriate file stat times (#763)
  • 7ab018e Migrate to the lodash package
See the full diff
Package name: gulp-zip The new version differs by 2 commits.
See the full diff
Package name: node-gyp The new version differs by 183 commits.
  • f5fa6b8 chore: release 8.4.1
  • cc37b88 fix: windows command missing space (#2553)
  • 8083f6b deps: npmlog@6.0.0
  • 787cf7f docs: fix typo in powershell node-gyp update
  • 7073c65 chore: release 8.4.0
  • a27dc08 feat: build with config.gypi from node headers
  • 5a00387 feat: support vs2022 (#2533)
  • fb85fb2 chore: release 8.3.0
  • 5585792 feat(gyp): update gyp to v0.10.0 (#2521)
  • b05b4fe chore(deps): bump make-fetch-happen from 8.0.14 to 9.1.0
  • 0a67dcd test: Python 3.10 was release on Oct. 4th (#2504)
  • f2ad87f chore: refactor the creation of config.gypi file
  • bc47cd6 chore: release 8.2.0
  • ed9a9ed feat(gyp): update gyp to v0.9.6 (#2481)
  • 660dd7b doc: correct link to "binding.gyp files out in the wild" (#2483)
  • ec15a3e chore(deps): bump tar from 6.1.0 to 6.1.2 (#2474)
  • 78361b3 ISSUE_TEMPLATE.md: Instructions for old versions (#2470)
  • f0882b1 fix: missing spaces
  • c8c0af7 fix: doc how to update node-gyp independently from npm
  • b6e1cc7 Add title to node-gyp version document (#2452)
  • b7bccdb ci: GitHub Actions Test on node: [12.x, 14.x, 16.x] (#2439)
  • 161c235 doc(wiki): safer doc names, remove unnecessary TypedArray doc
  • b52e487 doc(wiki): link to docs/ from README
  • f0a4835 doc(wiki): move wiki docs into doc/
See the full diff
Package name: node-sass The new version differs by 74 commits.
  • 99242d7 7.0.1
  • 77049d1 build(deps): bump sass-graph from 2.2.5 to 4.0.0 (#3224)
  • c929f25 build(deps): bump node-gyp from 7.1.2 to 8.4.1 (#3209)
  • 918dcb3 Lint fix
  • 0a21792 Set rejectUnauthorized to true by default (#3149)
  • e80d4af chore: Drop EOL Node 15 (#3122)
  • d753397 feat: Add Node 17 support (#3195)
  • dcf2e75 build(deps-dev): bump eslint from 7.32.0 to 8.0.0
  • bfa1a3c build(deps): bump actions/setup-node from 2.4.0 to 2.4.1
  • 80d6c00 chore: Windows x86 on GitHub Actions (#3041)
  • 566dc27 build(deps-dev): bump fs-extra from 0.30.0 to 10.0.0 (#3102)
  • 7bb5157 build(deps): bump npmlog from 4.1.2 to 5.0.0 (#3156)
  • 2efb38f build(deps): bump chalk from 1.1.3 to 4.1.2 (#3161)
  • fca5257 build(deps): bump actions/setup-node from 2.3.0 to 2.4.0
  • 6200b21 docs: Double word "support" (#3159)
  • eaf791a build(deps): bump actions/setup-node from 2.1.5 to 2.3.0
  • 16b8d4b build(deps): bump coverallsapp/github-action from 1.1.2 to 1.1.3
  • c167004 6.0.1
  • 911d4db remove mkdirp dep (#3108)
  • 30a52f7 build(deps): bump meow from 3.7.0 to 9.0.0
  • 7e08463 build(deps-dev): bump mocha from 8.4.0 to 9.0.1
  • cfcbb2c chore: Use default Apline version from docker-node (#3121)
  • 886319b chore: Drop Node 10 support
  • c908f4f fix: Bump OSX minimum to 10.11
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/tts/project/3cf7ef92-4c73-4460-8b00-da6842cbf980?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/tts/project/3cf7ef92-4c73-4460-8b00-da6842cbf980?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"92f17fbc-a695-403f-acb7-261602e9f18e","prPublicId":"92f17fbc-a695-403f-acb7-261602e9f18e","dependencies":[{"name":"gulp-sass","from":"4.0.2","to":"5.0.0"},{"name":"gulp-zip","from":"3.2.0","to":"4.0.0"},{"name":"node-gyp","from":"6.1.0","to":"8.4.1"},{"name":"node-sass","from":"4.14.1","to":"7.0.1"}],"packageManager":"npm","projectPublicId":"3cf7ef92-4c73-4460-8b00-da6842cbf980","projectUrl":"https://app.snyk.io/org/tts/project/3cf7ef92-4c73-4460-8b00-da6842cbf980?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-ANSIREGEX-1583908"],"upgrade":["SNYK-JS-ANSIREGEX-1583908"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[696]}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Learn about vulnerability in an interactive lesson of Snyk Learn.](https://learn.snyk.io?loc=fix-pr)