Open snyk-bot opened 3 years ago
Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches. Find out more.
(*) Note that the real score may have changed since the PR was raised.
Check the changes in this PR to ensure they won't cause issues with your project.
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information: 🧐 View latest project report
🛠 Adjust project settings
📚 Read more about Snyk's upgrade and patch logic
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
Changes included in this PR
Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches. Find out more.
Vulnerabilities that will be fixed
With an upgrade:
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3
SNYK-JS-DOTOBJECT-548905
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
SNYK-JS-ENGINEIO-1056749
Why? Has a fix available, CVSS 5.3
SNYK-JS-GLOBPARENT-1016905
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3
SNYK-JS-LODASH-1018905
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2
SNYK-JS-LODASH-1040724
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3
SNYK-JS-LODASH-450202
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3
SNYK-JS-LODASH-567746
Why? Has a fix available, CVSS 9.8
SNYK-JS-LODASH-590103
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3
SNYK-JS-LODASH-608086
Why? Has a fix available, CVSS 7.3
SNYK-JS-LODASH-73638
Why? Has a fix available, CVSS 4.4
SNYK-JS-LODASH-73639
Why? Has a fix available, CVSS 7.5
SNYK-JS-MINIMATCH-1019388
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6
SNYK-JS-MINIMIST-559764
Why? Has a fix available, CVSS 7.5
SNYK-JS-MOCHA-561476
Why? Has a fix available, CVSS 6.5
SNYK-JS-NODESASS-535499
Why? Has a fix available, CVSS 8.1
SNYK-JS-NODESASS-535501
Why? Has a fix available, CVSS 7.5
SNYK-JS-NODESASS-535503
Why? Has a fix available, CVSS 6.5
SNYK-JS-NODESASS-535504
Why? Has a fix available, CVSS 8.8
SNYK-JS-NODESASS-535505
Why? Has a fix available, CVSS 7.5
SNYK-JS-NODESASS-540960
Why? Has a fix available, CVSS 7.5
SNYK-JS-NODESASS-540962
Why? Has a fix available, CVSS 7.5
SNYK-JS-NODESASS-540966
Why? Has a fix available, CVSS 7.5
SNYK-JS-NODESASS-540968
Why? Has a fix available, CVSS 7.5
SNYK-JS-NODESASS-540970
Why? Has a fix available, CVSS 7.5
SNYK-JS-NODESASS-540972
Why? Has a fix available, CVSS 8.8
SNYK-JS-NODESASS-540974
Why? Has a fix available, CVSS 6.5
SNYK-JS-NODESASS-540982
Why? Has a fix available, CVSS 6.5
SNYK-JS-NODESASS-540984
Why? Has a fix available, CVSS 7.5
SNYK-JS-NODESASS-540986
Why? Has a fix available, CVSS 7.5
SNYK-JS-NODESASS-540988
Why? Has a fix available, CVSS 5.9
SNYK-JS-NODESASS-542662
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3
SNYK-JS-SOCKETIO-1024859
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
SNYK-JS-SOCKETIOPARSER-1056752
Why? Recently disclosed, Has a fix available, CVSS 8.2
SNYK-JS-TAR-1536528
Why? Recently disclosed, Has a fix available, CVSS 8.2
SNYK-JS-TAR-1536531
Why? Has a fix available, CVSS 7.5
SNYK-JS-TRIMNEWLINES-1298042
Why? Has a fix available, CVSS 5.3
SNYK-JS-WS-1296835
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7
npm:braces:20180219
Why? Has a fix available, CVSS 3.7
npm:debug:20170905
Why? Has a fix available, CVSS 7.3
npm:extend:20180424
Why? Has a fix available, CVSS 9.8
npm:growl:20160721
Why? Has a fix available, CVSS 6.3
npm:lodash:20180130
Why? Has a fix available, CVSS 7.5
npm:minimatch:20160620
Why? Has a fix available, CVSS 3.7
npm:ms:20170412
Why? Has a fix available, CVSS 8.4
npm:shell-quote:20160621
(*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: browserify-istanbul
The new version differs by 12 commits.Package name: gulp
The new version differs by 134 commits.Package name: gulp-bump
The new version differs by 4 commits.Package name: gulp-clone
The new version differs by 6 commits.Package name: gulp-sass
The new version differs by 42 commits.Package name: gulp-template
The new version differs by 3 commits.Package name: karma
The new version differs by 250 commits.Package name: karma-browserify
The new version differs by 45 commits.Package name: karma-coverage
The new version differs by 59 commits.Package name: mocha
The new version differs by 250 commits.Package name: uglifyify
The new version differs by 21 commits.With a Snyk patch:
Why? Has a fix available, CVSS 3.7
npm:debug:20170905
Why? Has a fix available, CVSS 7.5
npm:minimatch:20160620
Why? Has a fix available, CVSS 3.7
npm:ms:20170412
(*) Note that the real score may have changed since the PR was raised.
Check the changes in this PR to ensure they won't cause issues with your project.
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.
For more information:
🧐 View latest project report
🛠 Adjust project settings
📚 Read more about Snyk's upgrade and patch logic