AlaSQL / node-red-contrib-alasql

A Node-RED node wrapping AlaSQL for fast SQL based in-memory data processing for BI and ERP applications.
MIT License
8 stars 11 forks source link

[Snyk] Security upgrade alasql from 0.6.5 to 0.7.1 #45

Closed mathiasrw closed 3 years ago

mathiasrw commented 3 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 798/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 8.1
Arbitrary Code Injection
SNYK-JS-ALASQL-1082932
No Proof of Concept
medium severity 658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905
No Proof of Concept
high severity 753/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.2
Command Injection
SNYK-JS-LODASH-1040724
No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: alasql The new version differs by 11 commits.
  • a2ccc47 Bump lodash from 4.17.20 to 4.17.21 (#1298)
  • 7c7c6d5 Update README.md
  • 7622a17 Update README.md
  • 602f9a2 Updated version in files to 0.7.0
  • b1a58b1 Fix #1302
  • f1c0d8f Bump prettier from 2.1.2 to 2.2.1 (#1261)
  • a8d3cb0 Bump uglify-js from 3.11.3 to 3.12.6 (#1286)
  • 6ceefd4 Return empty results in group by when input is empty (#1279)
  • 6b6e5e8 Bump husky from 4.3.0 to 4.3.6 (#1270)
  • 82864ed Bump ini from 1.3.5 to 1.3.7 (#1269)
  • ef75a14 Updated version in files to 0.6.5
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic