search

Alek-S / pseudozen

Online pseudocoder that makes pseudocoding as easy as it should be
Apache License 2.0
0 stars 0 forks source link

[Snyk] Security upgrade bcrypt from 1.0.3 to 2.0.0 #34

Open snyk-bot opened 3 years ago

snyk-bot commented 3 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Recently disclosed, Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 Yes No Known Exploit
high severity 696/1000
Why? Recently disclosed, Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: bcrypt The new version differs by 26 commits.
  • ab026b2 v2.0.0
  • f00d4b8 Merge pull request #589 from agathver/libc-aware
  • dab435e install and use any-promise (#504)
  • 9a9ab45 Make binaries libc aware
  • aac593c Merge pull request #587 from agathver/hash-version-support
  • 2d45be1 Allow to choose bcrypt minor version
  • 0ea1b36 Merge pull request #549 from agathver/2b-hashes
  • 4c44f20 Add support for $2b$ hashes
  • e8cde51 Merge pull request #583 from ofrobots/async-resource
  • 6a79eaf fix: propagate async context
  • 88590ea Merge pull request #584 from kelektiv/snyk-fix-bc668290
  • 1da0f44 fix: package.json to reduce vulnerabilities
  • 43734e3 Merge pull request #564 from david-a-wheeler/readme-timing
  • f2bec20 README: comparisons resist timing attacks
  • 096a34f Merge pull request #554 from agathver/node-9
  • d1cb91d Bump deps
  • 7b928fb Add NodeJS 9 to CI matrix
  • 90d438b Merge pull request #550 from agathver/drop-old-node
  • 9540ed0 Remove support for NodeJS < 4
  • 99e2a09 Merge pull request #539 from tonylukasavage/issue-538
  • 7914916 Merge pull request #545 from agathver/test-improvements
  • f3a34bd Add additional testcases for testing bcrypt implementation
  • ebb7417 preserve stack traces on async error callbacks
  • 6746a04 Use strict equality comparison in tests
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic