search

BestGamersH / Multipurpose-Discord-Bot

The bot that has everything! - Leveling • Music • Memes • Moderation • nsfw • Logging • Tickets • Reaction Roles • Fun • Anime • Applications • Much More
MIT License
114 stars 42 forks source link

[Snyk] Security upgrade undici from 5.22.1 to 5.26.2 #36

Closed BestGamersH closed 1 year ago

BestGamersH commented 1 year ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - node_modules/discord-backup/node_modules/discord.js/package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![low severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/l.png "low severity") | **266/1000**
**Why?** Recently disclosed, CVSS 3.9 | Information Exposure
[SNYK-JS-UNDICI-5962466](https://snyk.io/vuln/SNYK-JS-UNDICI-5962466) | No | No Known Exploit (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: undici The new version differs by 104 commits.
  • 12a6218 Bumped v5.26.2
  • e041de3 Merge pull request from GHSA-wqq4-5wpv-mx2g
  • c8c80b1 5.26.1
  • 7bcb80c Fix node detection omfg (#2341)
  • 69ea7b9 hopefully this fixes it for good (#2338)
  • 4006aaf Bumped v5.26.0
  • df97958 fix: 🐛 fix process http2 header (#2332)
  • b9d8368 fix: 🏷️ add allowH2 to BuildOptions (#2334)
  • 06380f6 Fix stuck when using http2 POST Buffer (#2336)
  • 3a9f481 fix fetch with coverage enabled (#2330)
  • 882ff6d [StepSecurity] ci: Harden GitHub Actions (#2325)
  • 470ee38 disallow setting host header in fetch (#2322)
  • e5c9d70 fix(#2311): End stream after body sent (#2314)
  • 045d4db feat: respect `--max-http-header-size` Node.js flag (#2234)
  • af78c98 test: handle npm ignore-scripts settings (#2313)
  • 2de330f build(deps-dev): bump sinon from 15.2.0 to 16.1.0 (#2312)
  • e645012 fix: Agent.Options.factory should accept URL object or string as parameter (#2295)
  • 898040d chore: change order of the pseudo-headers (#2308)
  • fcc1e39 change default header to `node` (#2310)
  • 0fde27d use npm install instead of npm ci (#2309)
  • 5e654f3 Bumped v5.23.4
  • 7c2486d feat: disable FinalizationRegistry if NODE_V8_COVERAGE is set (#2304)
  • 4024468 Further automate publishing of undici-types using GitHub Actions workflow (#2290)
  • 5a75005 build(deps): bump actions/dependency-review-action from 3.0.8 to 3.1.0 (#2301)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/bestgamershk/project/b94e4954-111a-4e15-b6dc-85b577a7c207?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/bestgamershk/project/b94e4954-111a-4e15-b6dc-85b577a7c207?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"2be76381-04a2-4569-b42c-51f6393b10e1","prPublicId":"2be76381-04a2-4569-b42c-51f6393b10e1","dependencies":[{"name":"undici","from":"5.22.1","to":"5.26.2"}],"packageManager":"npm","projectPublicId":"b94e4954-111a-4e15-b6dc-85b577a7c207","projectUrl":"https://app.snyk.io/org/bestgamershk/project/b94e4954-111a-4e15-b6dc-85b577a7c207?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-UNDICI-5962466"],"upgrade":["SNYK-JS-UNDICI-5962466"],"isBreakingChange":false,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[266],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Learn about vulnerability in an interactive lesson of Snyk Learn.](https://learn.snyk.io/?loc=fix-pr)