search

ExtensionEngine / tailor

Content authoring platform
MIT License
31 stars 10 forks source link

[Snyk] Security upgrade yup from 0.28.5 to 0.30.0 #957

Closed snyk-bot closed 2 years ago

snyk-bot commented 2 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 673/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-YUP-2420835		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: yup The new version differs by 59 commits.
  • 31bbfc3 Publish v0.30.0
  • d225b5d chore: fix lockfile
  • f08d507 fix: defined() so it doesn't mark a schema as nullable
  • 57d42a8 fix: uuid's regexp (#1112)
  • 15a0f43 fix: security Fix for Prototype Pollution - huntr.dev (#1088)
  • 040c40d docs: Clarify return value of mixed.test (#1089)
  • e616039 chore(deps): update all non-major dependencies (#1087)
  • 7fd80aa fix: IE11 clone() (#1029)
  • 7459544 chore: bump lodash (#1071)
  • 66bb500 chore(deps): update all non-major dependencies (#1069)
  • 6096064 feat: exposes context on mixed.test function and add originalValue to context (#1021)
  • a56655d chore(deps): update all non-major dependencies (#1058)
  • 0dcfa21 chore(deps): update all non-major dependencies (#1049)
  • 7573a1a chore: upgrades property-expr dependency to 2.0.4 (#1048)
  • a3f94b0 chore(deps): update all non-major dependencies (#1044)
  • ed49b9e chore(deps): update all non-major dependencies (#1037)
  • 02f59ad chore(deps): update dependency eslint-plugin-jest to v24 (#1030)
  • a5f55a4 chore(deps): update all non-major dependencies (#1031)
  • ce83c0b chore(deps): update all non-major dependencies (#1025)
  • 01da7e1 perf: reduce function calls for shallower stacks (#1022)
  • dcae108 feat!: remove sync promise implementation and use callbacks internally (#1019)
  • 70e39ef Update issue templates
  • f8d5189 chore(deps): update all non-major dependencies (#1014)
  • 234b296 chore(deps): update all non-major dependencies (#1011)
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

underscope commented 2 years ago

Resolved on the latest develop