search

DemocracyOS / democracyos

Democracia en Red is focusing on specific implementations of DemocracyOS. We are working now working with governments and activists all over Latin America. If you are interested in our online participation tools you can check them out on our site.
https://democraciaos.org/en/
GNU General Public License v3.0
1.77k stars 616 forks source link

[Snyk] Security upgrade victory from 0.26.1 to 36.0.0 #1696

Open gvilarino opened 2 years ago

gvilarino commented 2 years ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

![merge advice](https://app.snyk.io/badges/merge-advice/?package_manager=npm&package_name=victory&from_version=0.26.1&to_version=36.0.0&pr_id=bb3c76cc-0a67-404e-a66b-9304aed41d38&visibility=true&has_feature_flag=false) #### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **479/1000**
**Why?** Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-D3COLOR-1076592](https://snyk.io/vuln/SNYK-JS-D3COLOR-1076592) | Yes | No Known Exploit (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: victory The new version differs by 250 commits.
  • 0f9e082 v36.0.0
  • 8e9bf64 update changelog
  • 363ac3d Merge pull request #1961 from FormidableLabs/revert-1949-revert-1940-feature/refactor-and-memoize-parent-components
  • 5f18e56 Revert "Revert "Refactor and memoize parent components (VictoryGroup, VictoryStack, VictoryChart)""
  • 59ec44a v35.11.4
  • aea3612 Merge pull request #1958 from FormidableLabs/revert-d3-change
  • 871fa0e revert d3-interpolate while updating only d3-color
  • a66afca v35.11.3
  • 9d10e0b Merge pull request #1956 from FormidableLabs/bug/package-script-typo
  • 65b80f6 remove dulicate yarn run
  • 03c8f3c Merge pull request #1955 from FormidableLabs/bug/lerna-publish
  • 0810f7f add notes
  • 1fb536f link parent bin for lerna scripts
  • e94eea6 Merge pull request #1954 from FormidableLabs/chore/lerna-changes
  • e660492 modify version scripts in individual packages
  • c0daefa update changelog
  • 3213be7 Merge pull request #1928 from FormidableLabs/dependabot/npm_and_yarn/path-parse-1.0.7
  • 188886e Merge pull request #1950 from FormidableLabs/chore/upgrade-d3-interpolate
  • f14da75 Merge pull request #1953 from 2metres/main
  • 7775396 Merge pull request #1952 from FormidableLabs/chore/update-lerna
  • 10b6fde Add histogram to VictoryThemeDefinition interface
  • e9d206c prettier
  • 07fa899 typos
  • e9bed6a update contributor notes about lerna-dry-run
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/gvilarino/project/a23fa7ec-cd0c-4abf-8f18-91a91cae9379?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/gvilarino/project/a23fa7ec-cd0c-4abf-8f18-91a91cae9379?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"bb3c76cc-0a67-404e-a66b-9304aed41d38","prPublicId":"bb3c76cc-0a67-404e-a66b-9304aed41d38","dependencies":[{"name":"victory","from":"0.26.1","to":"36.0.0"}],"packageManager":"npm","projectPublicId":"a23fa7ec-cd0c-4abf-8f18-91a91cae9379","projectUrl":"https://app.snyk.io/org/gvilarino/project/a23fa7ec-cd0c-4abf-8f18-91a91cae9379?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-D3COLOR-1076592"],"upgrade":["SNYK-JS-D3COLOR-1076592"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore","merge-advice-badge-shown"],"priorityScoreList":[479]}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Learn about vulnerability in an interactive lesson of Snyk Learn.](https://learn.snyk.io?loc=fix-pr)