search

Nishkalkashyap / Quark-electron

Quark is a cross-platform, integrated development environment for rapidly building - functional , prototypal projects, written in HTML, CSS and JavaScript with native desktop app like capabilities.
https://quarkjs.io
GNU General Public License v3.0
239 stars 19 forks source link

[Snyk] Fix for 1 vulnerabilities #58

Open Nishkalkashyap opened 1 year ago

Nishkalkashyap commented 1 year ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **713/1000**
**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 6.4 | Prototype Pollution
[SNYK-JS-JSON5-3182856](https://snyk.io/vuln/SNYK-JS-JSON5-3182856) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: css-loader The new version differs by 136 commits.
  • 7857d8f chore(release): 4.0.0
  • 5604205 feat: support `file:` protocol
  • 5303db2 chore(deps): update (#1131)
  • 9aa0549 chore(deps): update
  • a54c955 test: imports
  • 5b45d87 test: support in `@ import` at-rule
  • 83515fa refactor: code
  • 1c20b1e fix: parsing
  • 7f49a0a feat: `@ value` supports importing `url()` (#1126)
  • 791fff3 refactor: named export (#1125)
  • 01e8c76 refactor: change function arguments of the `import` option (#1124)
  • c153fe6 refactor: improve schema options (#1123)
  • 58b4b98 test: unresolved (#1122)
  • d2f6bd2 refactor: getLocalIdent function (#1121)
  • 069dbb0 refactor: the `modules.localsConvention` option was renamed to the `modules.exportLocalsConvention` option (#1120)
  • fc04401 refactor: the `modules.context` option was renamed to the `modules.localIdentContext` option (#1119)
  • 3a96a3d refactor: the `hashPrefix` option was renamed to the `localIdentHashPrefix` option (#1118)
  • 0080f88 refactor: default values `modules` and `module.auto` are true (#1117)
  • e1c55e4 refactor: rename the `onlyLocals` option (#1116)
  • ac5f413 refactor: code
  • a5c1b5f test: code coverange (#1114)
  • 908ecee refactor: `esModule` option is `true` by default (#1111)
  • 7cca035 test: coverange (#1112)
  • bc19ddd feat: improve `url()` resolving algorithm
See the full diff
Package name: html-loader The new version differs by 55 commits.
  • d7cccfa chore(release): 1.0.0
  • 3c9a1d8 refactor: `attributes` option (#265)
  • 8c73761 feat: `preprocessor` option (#263)
  • f2ce5b1 feat: improve errors
  • 9923244 chore(deps): update (#260)
  • 9835bde feat: supports `link:href` attribute for css (#258)
  • 7af2eff refactor: improve schema (#257)
  • 98412f9 docs: `filter` sources (#256)
  • ff0f44c feat: implement the `filter` option for filtering some of sources (#255)
  • 1c24662 refactor: move the `root` option under the `attributes` option (#254)
  • 888b8fe docs: add footnote for `-attributes` (#252)
  • 3d2907e refactor: remove the `interpolate` option
  • bd979e2 refactor: remove the `interpolate` option
  • fcba4ec fix: handle only valid srcset tags (#253)
  • 9e5ce56 perf: improve source parse (#251)
  • c9c8dad refactor: improve source parse (#250)
  • 079d623 fix: respect `#hash` in sources
  • a17df49 fix: reduce `import`/`require` count
  • d0b0150 fix: adding quotes when necessary for unquoted sources (#247)
  • e3727ab test: minifier
  • 0bbe29c feat: migrate on `htmlparse2`
  • b7af031 fix: escape `\u2028` and `\u2029` characters (#244)
  • 24b0427 fix: parser tags and attributes according spec (#243)
  • 3df909d feat: support `script:src` attributes
See the full diff
Package name: markdown-loader The new version differs by 25 commits.
See the full diff
Package name: raw-loader The new version differs by 17 commits.
  • 35a10f4 chore(release): 4.0.1
  • 21f0ca5 chore(deps): update (#90)
  • e76476c chore(release): 4.0.0
  • 5ec82d6 refactor: next (#88)
  • d231710 chore(release): 3.1.0
  • 6cf76b8 feat: improved validation error messages (#85)
  • aebfd74 chore(deps): update (#84)
  • f5b6aa4 docs: fix tests badge (#82)
  • 854d6c8 chore(release): 3.0.0
  • d11ff27 chore(deps): update (#81)
  • 35762bd chore(release): 2.0.0
  • 03933c7 chore(defaults): update (#70)
  • 3c7bf2c feat: use ES Module export instead of CommonJS (#69)
  • 7fa759c chore: integrate babel (#68)
  • 6519eb2 chore: update webpack defaults (#67)
  • 062b267 docs: improve (#66)
  • 0622dc7 docs: improve information about loader order (#65)
See the full diff
Package name: stylus-loader The new version differs by 58 commits.
See the full diff
Package name: ts-loader The new version differs by 126 commits.
  • 268bc69 chore(deps): upgrade most production deps (#1237)
  • e160564 Add a cache to file path mapping (#1228)
  • 14fa3f8 Add documentation about performance profiling (#1230)
  • 3cc78b8 Fix typo in README.md (#1229)
  • 8f2a509 Add documentation for the useCaseSensitiveFileNames option (#1227)
  • 566e6ce Instead of checking date, check time thats more accurate to see if something has changed (#1217)
  • 172ebeb Feature/typescript 4 1 (#1213)
  • 0816fe9 Add peer dependencies for Yarn PnP (#1209)
  • 4909d99 Fixed missing errors in watch mode in webpack5 (#1208)
  • 3f73e98 Fix failed builds when using thread-loader (#1207)
  • e90f8ad Fix memory leak when using multiple webpack instances (#1205)
  • 95050eb Speeds up project reference build and doesnt store the result in memory (#1202)
  • f99c7c4 doc: escape pipe in table (#1201)
  • 0b4a86d Replace afterCompile to stop webpack 5 warning (#1200)
  • 6d8d601 Fixed deprecation warnings on webpack@5. (#1195)
  • cafc933 Fix installation link on README.md (#1192)
  • f5e901e Bump http-proxy in /examples/react-babel-karma-gulp (#1182)
  • 0767bce add github action status badge (#1190)
  • db5ea55 Feature/upgrade testpack to ts4 (#1189)
  • 95b6fe8 Uses existing instance if config file is same as already built solution (#1177)
  • b38678a Update minimum compiler version to 3.6.3 (#1188)
  • f8eba53 Add documentation and example code for projectReferences (#1184)
  • 46d9761 Update docs to show transpileOnly does not affect project references (#1175)
  • 0e64ceb Fix getOptionsHash when two options has different props but same values. (#1170)
See the full diff
Package name: url-loader The new version differs by 27 commits.
  • 8828d64 chore(release): 4.0.0
  • fc8721f chore(deps): migrate on `mime-types` package (#209)
  • f13757a chore(deps): update (#208)
  • a2f127d fix: description on the `esModule` option (#204)
  • 4301f87 chore(release): 3.0.0
  • 3f0bbc5 refactor: next (#198)
  • 2451157 chore(release): 2.3.0
  • 0ee2b99 feat: new `esModules` option to output ES modules
  • cbd1950 chore(release): 2.2.0
  • 196110e fix: yarn pnp support (#195)
  • 9431124 docs: improve documentation about `fallback` (#194)
  • a251a23 chore(deps): update (#193)
  • 2bffcfd fix: limit must allow infinity and max value (#192)
  • 1b9dbd1 chore(release): 2.1.0
  • f3d4dd2 feat: improved validation error messages (#187)
  • 37c6acc chore(release): 2.0.1
  • 4842f93 fix: allow using limit as string when you use loader with query string (#185)
  • c0341da chore(defaults): update (#184)
  • 78833ac chore(release): 2.0.0
  • 4386b3e chore(deps): update (#182)
  • 60d2cb3 feat: limit option can be boolean (#181)
  • d82e453 fix: `limit` should always be a number and 0 value handles as number (#180)
  • 3c24545 fix: fallback loader will be used than limit is equal or greater (#179)
  • a6705cc test: test svg scenario. #176 (#177)
See the full diff
Package name: webpack The new version differs by 250 commits.
  • 610f368 5.0.0
  • 5ce65c1 update examples
  • bbe1230 Merge pull request #11628 from webpack/bugfix/real-content-hash
  • 75ecff2 5.0.0-rc.6
  • bfc35d6 Merge pull request #11603 from MayaWolf/master
  • 76e8cbd Merge pull request #11622 from webpack/dependabot/npm_and_yarn/types/node-13.13.25
  • 9fd1be2 chore(deps-dev): bump @ types/node from 13.13.23 to 13.13.25
  • 36bcfaa Merge pull request #11621 from webpack/bugfix/11619
  • 9130d10 fix called variables with ProvidePlugin
  • 3e42105 Merge pull request #11620 from webpack/bugfix/11617
  • 4709719 skip connections copied to concatenated module
  • 57b493f 5.0.0-rc.5
  • 1658e2f Merge pull request #11618 from webpack/bugfix/11615
  • a8fb45d fixes crash in SideEffectsFlagPlugin
  • 84b196d emit error instead of crashing when unexpected problem occurs
  • 5573fed Merge pull request #11601 from Hornwitser/improve-suggested-polyfill-config
  • 9b5cce9 Merge pull request #11609 from snitin315/export-types
  • 37c495c export type RuleSetUseItem
  • 39faf34 export type RuleSetUse
  • e5fd246 export type RuleSetConditionAbsolute
  • 660baad export RuleSetCondition types
  • 13e3ca5 Merge pull request #11602 from webpack/bugfix/shared-runtime-chunk
  • 9c0587e Merge pull request #11606 from webpack/dependabot/npm_and_yarn/simple-git-2.21.0
  • 502d166 Merge pull request #11607 from webpack/dependabot/npm_and_yarn/acorn-8.0.4
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/nishkalkashyap/project/1f69bd6d-330a-4f30-ac57-14a5ddb67367?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/nishkalkashyap/project/1f69bd6d-330a-4f30-ac57-14a5ddb67367?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"089634a6-509c-4ada-b69f-cebdd862bbd5","prPublicId":"089634a6-509c-4ada-b69f-cebdd862bbd5","dependencies":[{"name":"babel-loader","from":"8.1.0","to":"8.2.4"},{"name":"css-loader","from":"2.1.1","to":"4.0.0"},{"name":"html-loader","from":"0.5.5","to":"1.0.0"},{"name":"markdown-loader","from":"5.1.0","to":"8.0.0"},{"name":"raw-loader","from":"1.0.0","to":"4.0.1"},{"name":"stylus-loader","from":"3.0.2","to":"4.0.0"},{"name":"ts-loader","from":"5.4.5","to":"8.0.14"},{"name":"url-loader","from":"1.1.2","to":"4.0.0"},{"name":"vue-loader","from":"15.9.1","to":"16.0.0"},{"name":"webpack","from":"4.42.1","to":"5.0.0"}],"packageManager":"npm","projectPublicId":"1f69bd6d-330a-4f30-ac57-14a5ddb67367","projectUrl":"https://app.snyk.io/org/nishkalkashyap/project/1f69bd6d-330a-4f30-ac57-14a5ddb67367?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-JSON5-3182856"],"upgrade":["SNYK-JS-JSON5-3182856"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[713]}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Prototype Pollution](https://learn.snyk.io/lessons/prototype-pollution/javascript/?loc=fix-pr)