Closed snyk-bot closed 1 year ago
Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches. Find out more.
(*) Note that the real score may have changed since the PR was raised.
Check the changes in this PR to ensure they won't cause issues with your project.
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information: 🧐 View latest project report
🛠 Adjust project settings
📚 Read more about Snyk's upgrade and patch logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Cross-site Scripting (XSS) 🦉 Prototype Pollution 🦉 Server-side Request Forgery (SSRF) 🦉 More lessons are available in Snyk Learn
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
Changes included in this PR
Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches. Find out more.
Vulnerabilities that will be fixed
With an upgrade:
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
SNYK-JS-ANSIREGEX-1583908
Why? Has a fix available, CVSS 7.5
SNYK-JS-APOLLOSERVERCORE-2928764
Why? Has a fix available, CVSS 7.5
SNYK-JS-APOLLOSERVERCORE-571663
Why? Mature exploit, Has a fix available, CVSS 6.5
SNYK-JS-GRAPHQLPLAYGROUNDHTML-571775
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3
SNYK-JS-NCONF-2395478
Why? Proof of Concept exploit, Has a fix available, CVSS 7.7
SNYK-JS-NETMASK-1089716
Why? Proof of Concept exploit, Has a fix available, CVSS 8.1
SNYK-JS-PACRESOLVER-1564857
(*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: graphql-yoga
The new version differs by 249 commits.- 05a00ef Upcoming Release Changes (#1005)
- 0fa6f8d e2e deployment testing (#979)
- 144d1e9 Revert "chore: major bump test (#1007)" (#1008)
- af653b3 chore: major bump test (#1007)
- 9256319 Add false as possible config option to typings (#998)
- 9411e9a Recipe for other envs (#1004)
- a8b619b fix(node): make sure socket object is valid before configuring it (#1006)
- 1e6e2e6 chore: remove beta mode (#1001)
- a69fc6e chore: do not publish lambda example (#1003)
- e508968 chore: do not publish aws lambda example (#1002)
- af8f2a1 chore(release): update monorepo packages versions (beta) (#978)
- f8bce0b Docs for Context (#1000)
- 6d60ebf feat: add tabs (#997)
- 5b6f025 feat(yoga-cli): fallback to default schema and add mock parameter
- 391bc3c fix: apply masked errors last (#993)
- 0424fe3 Simpler Integration/Usage (#991)
- 3c82b57 feat(node): respect parsed request bodies (e.g. graphql-upload, aws lambda) (#971)
- 2b6916f Add missing content-type and data property for error responses (#990)
- ee2938f Simplify next-auth example and update next docs (#989)
- d60f79f fix(node): resolve sendNodeResponse correctly when stream has been finished (#981)
- 9f628e5 :sparkles: NEW: credentials on graphiql-yoga & some improvements (#980)
- 5bba860 docs: fix markdown link (#988)
- fd6ebf1 docs: update homepage wording (#987)
- d12f3d1 docs: change some wordings to be more engaging and less redundant (#985)
See the full diffPackage name: snyk
The new version differs by 250 commits.- 8987918 Merge pull request #1781 from snyk/fix/replace-proxy
- eec11b7 test: raise timeout for snyk protect tests hitting real Snyk API
- 8045ceb test: update proxy tests for the new proxy global-agent
- 0d0c76a feat: support lowercase http_proxy envvars
- e597846 test(proxy): acceptance test for Proxy envvar settings
- 6d67579 fix: replace vulnerable proxy dependency
- 1449c57 Merge pull request #1707 from snyk/feat/snyk-fix
- 3d872fb test: assert exact errors for unsupported
- 5ebd685 Merge pull request #1777 from snyk/feat/fix-with-version-provenance
- 17e3431 Merge pull request #1778 from snyk/feat/dont-force-https
- fdd7f1a docs: update SNYK_HTTP_PROTOCOL_UPGRADE description
- 165b4b9 feat: introduce envvar to control HTTP-HTTPS upgrade behavior
- 77e6665 chore: lerna release with exact version
- f14819f Merge pull request #1760 from snyk/feat/support-critical-in-sarif
- b286418 feat: v1 support for previously fixed reqs.txt
- 0384020 feat: basic pip fix -r support
- f94c558 feat: include pins optionally
- 66ca77a feat: do not skip files with -r directive
- bc44f9a refactor: fix individual reqs manifest
- 6e84322 feat: fix individual file with provenance
- 9ed99f3 Merge pull request #1764 from snyk/feat/update-code-client
- c92599b Merge pull request #1774 from snyk/refactor/change-binaries-release-script
- ca508ac test: smoke test for `snyk fix`
- c68c7da feat: add @ snyk/fix as a dep
See the full diffWith a Snyk patch:
Why? Proof of Concept exploit, Has a fix available, CVSS 8.2
SNYK-JS-LODASH-567746
(*) Note that the real score may have changed since the PR was raised.
Check the changes in this PR to ensure they won't cause issues with your project.
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
🛠 Adjust project settings
📚 Read more about Snyk's upgrade and patch logic
Learn how to fix vulnerabilities with free interactive lessons:
🦉 Cross-site Scripting (XSS) 🦉 Prototype Pollution 🦉 Server-side Request Forgery (SSRF) 🦉 More lessons are available in Snyk Learn