search

LBH3 / lbh3.org

LBH3 website
https://www.lbh3.org
Other
0 stars 0 forks source link

[Snyk] Fix for 1 vulnerabilities #450

Open chasenlehara opened 1 year ago

chasenlehara commented 1 year ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **658/1000**
**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-SEMVER-3247795](https://snyk.io/vuln/SNYK-JS-SEMVER-3247795) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: @feathersjs/authentication The new version differs by 250 commits.
  • 18872c0 chore(release): publish v4.5.16
  • 1936c64 fix(transport-commons): Crow - fix array dispatching (#3073)
  • f5f7fae chore: Update publishin dist tag
  • 70335c4 fix(dependencies): Update dependencies
  • 141ecac chore: Fix changelog name
  • e81cad0 chore: Get builds and installation working again
  • 1f7ee5c chore: Fix NPM page links an images (#2768)
  • 5fe9644 chore: Moving community from slack to discord (#2736)
  • 1774fe0 chore: Update changelog
  • d0e9600 chore(release): publish v4.5.15
  • 849180f chore: Update package-lock.json
  • 25b6fb5 chore(release): publish v4.5.14
  • 5ec2ec8 fix(transport-commons): Ensure socket queries are always plain objects (#2598)
  • 445e804 fix(rest-client): Import errors from @ feathers/errors (#2591)
  • b5e94c4 chore(release): publish v4.5.13
  • 32356a5 fix: Fix socket.io type dependency (#2526)
  • 7fd94ce chore: Fix changelog
  • 8697ecc chore(release): publish v4.5.12
  • 67a7e31 fix(authentication-oauth): OAuth redirect lost sometimes due to session store race (#2514) (#2515)
  • 1c63e6b fix: Update all dependencies for crow release (#2520)
  • 12ed64e chore: Get crow build passing again
  • 325e633 chore(deps): [security] bump ini from 1.3.5 to 1.3.7 (#2150)
  • 64754a7 chore: Update changelog
  • de05268 chore(release): publish v4.5.11
See the full diff
Package name: feathers-sequelize The new version differs by 17 commits.
  • e27ffa0 3.0.2
  • 860495e Fix Sequelize dependency (#194)
  • dea4725 chore(package): update sqlite3 to version 4.0.0 (#196)
  • 1025c4d Update README.md (#192)
  • 847bc6b Update Readme on associations (#191)
  • fed556d Updating changelog
  • 10dd0d9 3.0.1
  • 786d618 Add default ES module export for TS compatibility (#190)
  • 3c161ba chore(package): update mocha to version 5.0.0 (#187)
  • 0153c2f chore(package): update semistandard to version 12.0.0 (#185)
  • 9f7cc8a Update README.md
  • 4f7b1eb Updating changelog
  • 216c167 3.0.0
  • 6e560bd Upgrade to Feathers Buzzard (v3) (#183)
  • 28bd31e Update to new plugin infrastructure (#182)
  • 9d7c871 Update dependencies to enable Greenkeeper 🌴 (#170)
  • 7447bf6 Updating changelog
See the full diff
Package name: sequelize The new version differs by 250 commits.
  • 901bceb 6.1.0
  • 6b32821 6.0.0-beta.7
  • 0ca8d72 docs: prepare for v6 release (#12416)
  • 663261b feat(sequelize): allow passing dialectOptions.options from url (#12404)
  • c6e4192 fix(postgres): parse enums correctly when describing a table (#12409)
  • e33d2bd fix(reload): include default scope (#12399)
  • 5611ef0 build: update dependencies (#12395)
  • e80501d fix(types): transactionType in Options (#12377)
  • 4914367 fix(types): add clientMinMessages to Options interface (#12375)
  • b71cd05 fix(query): preserve cls context for logger (#12328)
  • 95f7fb5 fix(mssql): empty order array generates invalid FETCH statement (#12261)
  • ed2d7a9 fix(model.destroy): return 0 with truncate (#12281)
  • 72925cf fix: add missing fields to 'FindOrCreateType' (#12338)
  • f367191 fix(query-generator): do not generate GROUP BY clause if options.group is empty (#12343)
  • 7afd589 docs(sequelize): omitNull only works for CREATE/UPDATE queries
  • f9e660f docs: update feature request template
  • 2bf7f7b fix(typings): add support for optional values in "where" clauses (#12337)
  • 65a9e1e fix(types): add Association into OrderItem type (#12332)
  • 1b86729 docs: responsive (#12308)
  • 59b8a7b fix(include): check if attributes specified for included through model (#12316)
  • 6d87cc5 docs(associations): belongs to many create with through table
  • a2dcfa0 fix(query): ensure correct return signature for QueryTypes.RAW (#12305)
  • 0769aea refactor: cleanup query generators (#12304)
  • 4d9165b feat(postgres): native upsert (#12301)
See the full diff
Package name: sharp The new version differs by 250 commits.
  • 1ff84b2 Release v0.29.3
  • 97655d2 Bump deps
  • d10d7b0 Docs: remove duplicate entry for mbklein (#2971)
  • 2ffdae2 Docs: changelog and credit for #2952
  • 342de36 Impute TIFF xres/yres from withMetadata({density})
  • b33231d Ensure correct dimensions when contain 1px image #2951
  • 319db21 Release v0.29.2
  • d359331 Remove animation props from single page images #2890
  • 7ae1513 Bump devDeps
  • 648a1e0 Throw error rather than exit for invalid binaries #2931
  • b9f211f Docs: changelog for #2918
  • e475d9e Improve error message on Windows for version conflict (#2918)
  • f37ca82 Bump deps
  • 1dd4be6 Add timeout function to limit processing time
  • 197d4cf Docs: changelog and credit for #2893
  • 83eed86 Docs: clarify prebuilt libc support on ARMv6/v7
  • bbf612c Replace use of deprecated util.inherits
  • 2679bb5 Allow use of 'tif' to select TIFF output (#2893)
  • 481e350 Ensure 'versions' is populated from vendored libvips
  • 50c7a08 Release v0.29.1
  • 9a0bb60 Bump deps
  • deb5d81 Docs: changelog entries for #2878 #2879
  • 916b04d Allow using speed 9 for AVIF/HEIC encoding (#2879)
  • 52307fa Resolve paths before comparing input/output destination (#2878)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/chasenlehara/project/cc7408d4-89bd-4d22-a48e-38923d9f711b?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/chasenlehara/project/cc7408d4-89bd-4d22-a48e-38923d9f711b?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"c838bb92-9aab-4294-b63e-f4c226a5fb8d","prPublicId":"c838bb92-9aab-4294-b63e-f4c226a5fb8d","dependencies":[{"name":"@feathersjs/authentication","from":"2.1.16","to":"4.5.16"},{"name":"feathers-sequelize","from":"2.4.0","to":"3.0.2"},{"name":"sequelize","from":"4.44.4","to":"6.1.0"},{"name":"sharp","from":"0.25.4","to":"0.29.3"}],"packageManager":"npm","projectPublicId":"cc7408d4-89bd-4d22-a48e-38923d9f711b","projectUrl":"https://app.snyk.io/org/chasenlehara/project/cc7408d4-89bd-4d22-a48e-38923d9f711b?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-SEMVER-3247795"],"upgrade":["SNYK-JS-SEMVER-3247795"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[658],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Regular Expression Denial of Service (ReDoS)](https://learn.snyk.io/lessons/redos/javascript/?loc=fix-pr)