EmpathyTechnologies / CareerPlanToday-Frontend

3 stars 0 forks source link

[Snyk] Security upgrade aws-amplify from 5.3.6 to 6.0.0 #349

Open SomdattaPatra opened 10 months ago

SomdattaPatra commented 10 months ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **748/1000**
**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.1 | Cross-site Request Forgery (CSRF)
[SNYK-JS-AXIOS-6032459](https://snyk.io/vuln/SNYK-JS-AXIOS-6032459) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: aws-amplify The new version differs by 250 commits.
  • d505105 release: Amplify JS v6 Initial Release (#12461)
  • 04fd02c chore: Disable SSR tests (#12458)
  • af23a19 chore: Merge `next/main` into `main` (#12454)
  • 798c540 chore: Merge next/main into main
  • 7a5440a chore: Make `adapter-nextjs` private (#12453)
  • 6a1a0cb fix(notifications): Duplicate types from optional packages (#12446) (#12452)
  • 0d43443 chore: Re-baseline bundle size checks (#12423)
  • 54633aa feat: prep predictions for publish (#12441)
  • 6b1c478 chore(pubsub): Migrate PubSub to named params (#12440)
  • 5a5b71e chore(interactions): enable interactions (#12443)
  • dd382ee feat(auth): add signInDetails to AuthUser interface (#12439)
  • dc4b91f fix(interactions): align type names and use named params (#12406)
  • 80715c3 docs(core): mark signer as internal (#12413)
  • 8918802 chore: Move `@ types/uuid` to dependencies (#12437)
  • 74915a4 chore: Update release deployment target (#12438)
  • 6f4d984 feat: ssr support for graphql (#12430)
  • 9717d77 fix: export missing output type (#12434)
  • f405448 fix(datastore): crypto random numbers for ulid factory (#12435)
  • 9e75bda chore: Remove config & library option merging (#12432)
  • 9277184 fix(core): disable type to accept empty config for analytics (#12426)
  • b06a7e4 fix(adapter-nextjs): ensure to use meaningful exception on config resolution
  • 0216e44 chore(aws-amplify): change deafult sameSite value to 'lax'
  • fdb6732 fix(core): give ampilfyUuid clear type info (#12388)
  • 4cd6dc0 fix(auth): handle multiple redirect links (#12415)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/markamiller90-tgi/project/7f83c33a-4b24-4b32-9949-70733e35ad2c?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/markamiller90-tgi/project/7f83c33a-4b24-4b32-9949-70733e35ad2c?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"5492f674-6fef-4482-8b5e-ce6f82e461f3","prPublicId":"5492f674-6fef-4482-8b5e-ce6f82e461f3","dependencies":[{"name":"aws-amplify","from":"5.3.6","to":"6.0.0"}],"packageManager":"npm","projectPublicId":"7f83c33a-4b24-4b32-9949-70733e35ad2c","projectUrl":"https://app.snyk.io/org/markamiller90-tgi/project/7f83c33a-4b24-4b32-9949-70733e35ad2c?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-AXIOS-6032459"],"upgrade":["SNYK-JS-AXIOS-6032459"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[748],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Cross-site Request Forgery (CSRF)](https://learn.snyk.io/lesson/csrf-attack/?loc=fix-pr)