search

JaredReisinger / react-crossword

A flexible, responsive, and easy-to-use crossword component for React apps.
https://react-crossword.jaredreisinger.com
MIT License
176 stars 85 forks source link

[Snyk] Fix for 9 vulnerabilities #402

Closed JaredReisinger closed 1 year ago

JaredReisinger commented 1 year ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **586/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-GLOBPARENT-1016905](https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905) | Yes | Proof of Concept ![low severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/l.png "low severity") | **506/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 3.7 | Prototype Pollution
[SNYK-JS-MINIMIST-2429795](https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795) | No | Proof of Concept ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **586/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.3 | Open Redirect
[SNYK-JS-NODEFORGE-2330875](https://snyk.io/vuln/SNYK-JS-NODEFORGE-2330875) | Yes | Proof of Concept ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **529/1000**
**Why?** Has a fix available, CVSS 6.3 | Prototype Pollution
[SNYK-JS-NODEFORGE-2331908](https://snyk.io/vuln/SNYK-JS-NODEFORGE-2331908) | Yes | No Known Exploit ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **494/1000**
**Why?** Has a fix available, CVSS 5.6 | Improper Verification of Cryptographic Signature
[SNYK-JS-NODEFORGE-2430337](https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430337) | Yes | No Known Exploit ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **579/1000**
**Why?** Has a fix available, CVSS 7.3 | Improper Verification of Cryptographic Signature
[SNYK-JS-NODEFORGE-2430339](https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430339) | Yes | No Known Exploit ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **494/1000**
**Why?** Has a fix available, CVSS 5.6 | Improper Verification of Cryptographic Signature
[SNYK-JS-NODEFORGE-2430341](https://snyk.io/vuln/SNYK-JS-NODEFORGE-2430341) | Yes | No Known Exploit ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **479/1000**
**Why?** Has a fix available, CVSS 5.3 | Information Exposure
[SNYK-JS-SEMANTICRELEASE-2866292](https://snyk.io/vuln/SNYK-JS-SEMANTICRELEASE-2866292) | No | No Known Exploit ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **737/1000**
**Why?** Currently trending on Twitter, Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.4 | Command Injection
[SNYK-JS-SNYK-3037342](https://snyk.io/vuln/SNYK-JS-SNYK-3037342) | No | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: commitizen The new version differs by 48 commits.
  • 0939910 ci(release): defined a github workflow to release with semantic-release (#923)
  • 757a806 chore(deps): update all non-major dependencies
  • 25dc80c fix: fix the "isFunction" utility to match both "asyncFunction"s and "Function"s (#927)
  • fc283fb chore(deps): update dependency semver to v7.3.7
  • c35a3c7 chore(deps): update all non-major dependencies
  • 69de704 fix(deps): update all non-major dependencies
  • e79f3ee chore(deps): update dependency @ babel/core to v7.17.8
  • 69689fb chore(deps): update all non-major dependencies to v7.17.7
  • 3c2553f fix(deps): update all non-major dependencies
  • 4118263 docs: add cz-git commitizen adapter (#905)
  • 70ca1f4 docs: adjust example to a valid husky prepare-commit-msg command (#908)
  • fcc85e5 docs(readme): match casing of tutorial's title
  • bcd9c73 docs(readme): fix dead link to tutorial
  • 941bf38 chore(deps): update all non-major dependencies
  • a3f4ffa chore(deps): update dependency @ babel/core to v7.17.2
  • 8f76acd chore(deps): update dependency node-fetch to 2.6.7 [security] (#902)
  • d4e39c6 chore(deps): update all non-major dependencies to v7.17.0
  • 056b0ed chore(deps): update all non-major dependencies (#891)
  • 5b2c458 chore: remove unused dev-dependency axios (#894)
  • 9c7e863 fix(deps): update dependency inquirer to v8 (#874)
  • 218d454 chore: remove unused Travis-CI config (#880)
  • f1cf649 chore(deps): update all non-major dependencies
  • dc7ac60 chore(deps): update all non-major dependencies
  • c6a2857 chore(deps): update dependency conventional-changelog-conventionalcommits to v4.6.2
See the full diff
Package name: react-styleguidist The new version differs by 10 commits.
  • a460fcc feat: Upgrade to Webpack 5 (#1996)
  • 4c55077 Build(deps): Bump ua-parser-js in /examples/webpack (#1928)
  • e630725 Build(deps): Bump browserslist in /examples/webpack (#1927)
  • 2c855fa Build(deps): Bump follow-redirects in /examples/react-native (#1924)
  • 7f4d1fa Build(deps): Bump follow-redirects in /examples/preact (#1921)
  • d486074 Build(deps): Bump follow-redirects in /examples/customised (#1920)
  • 4861363 Build(deps): Bump follow-redirects in /examples/express (#1919)
  • abfc18e Build(deps): Bump follow-redirects in /examples/sections (#1917)
  • 6d4c1e7 Build(deps): Bump follow-redirects in /examples/basic (#1916)
  • c66b152 Build(deps): Bump prismjs in /examples/styled-components (#1913)
See the full diff
Package name: semantic-release The new version differs by 10 commits.
  • 58a226f fix(log-repo): use the original form of the repo url to remove the need to mask credentials (#2459)
  • 17d60d3 build(deps): bump npm from 8.3.1 to 8.12.0 (#2447)
  • ab45ab1 chore(lint): disabled rules that dont apply to this project (#2408)
  • ea389c3 chore(deps): update dependency yargs-parser to 13.1.2 [security] (#2402)
  • fa994db build(deps): bump node-fetch from 2.6.1 to 2.6.7 (#2399)
  • b79116b build(deps): bump trim-off-newlines from 1.0.1 to 1.0.3
  • 6fd7e56 build(deps): bump minimist from 1.2.5 to 1.2.6
  • 2b94bb4 docs: update broken link to CI config recipes (#2378)
  • b4bc191 docs: Correct circleci workflow (#2365)
  • 2c30e26 Merge pull request #2333 from semantic-release/next
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/jaredreisinger/project/101d36fe-85dc-415f-9ad6-b8a7ea7d271a?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/jaredreisinger/project/101d36fe-85dc-415f-9ad6-b8a7ea7d271a?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"3cdc5ade-99e0-4b35-bbf3-1c71453525d3","prPublicId":"3cdc5ade-99e0-4b35-bbf3-1c71453525d3","dependencies":[{"name":"commitizen","from":"4.2.4","to":"4.2.5"},{"name":"react-styleguidist","from":"11.2.0","to":"12.0.0"},{"name":"semantic-release","from":"19.0.2","to":"19.0.3"},{"name":"snyk","from":"1.865.0","to":"1.996.0"}],"packageManager":"npm","projectPublicId":"101d36fe-85dc-415f-9ad6-b8a7ea7d271a","projectUrl":"https://app.snyk.io/org/jaredreisinger/project/101d36fe-85dc-415f-9ad6-b8a7ea7d271a?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-SNYK-3037342","SNYK-JS-SEMANTICRELEASE-2866292","SNYK-JS-NODEFORGE-2430341","SNYK-JS-NODEFORGE-2430339","SNYK-JS-NODEFORGE-2430337","SNYK-JS-NODEFORGE-2331908","SNYK-JS-NODEFORGE-2330875","SNYK-JS-MINIMIST-2429795","SNYK-JS-GLOBPARENT-1016905"],"upgrade":["SNYK-JS-GLOBPARENT-1016905","SNYK-JS-MINIMIST-2429795","SNYK-JS-NODEFORGE-2330875","SNYK-JS-NODEFORGE-2331908","SNYK-JS-NODEFORGE-2430337","SNYK-JS-NODEFORGE-2430339","SNYK-JS-NODEFORGE-2430341","SNYK-JS-SEMANTICRELEASE-2866292","SNYK-JS-SNYK-3037342"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[737,479,494,579,494,529,586,506,586]}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Prototype Pollution](https://learn.snyk.io/lessons/prototype-pollution/javascript/?loc=fix-pr) 🦉 [Open Redirect](https://learn.snyk.io/lessons/open-redirect/javascript/?loc=fix-pr) 🦉 [Prototype Pollution](https://learn.snyk.io/lessons/prototype-pollution/javascript/?loc=fix-pr) 🦉 [More lessons are available in Snyk Learn](https://learn.snyk.io?loc=fix-pr)