Njupt-Sast-Network / NICP-Node

创新杯管理系统
12 stars 3 forks source link

[Snyk] Security upgrade crypto-js from 3.1.8 to 3.2.1 #23

Open snyk-bot opened 4 years ago

snyk-bot commented 4 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Issue Breaking Change Exploit Maturity
high severity Insecure Randomness
SNYK-JS-CRYPTOJS-548472
No No Known Exploit
Commit messages
Package name: crypto-js The new version differs by 57 commits.
  • 79209bc Merge branch 'release/3.2.1'
  • 78bde5f Add release notes.
  • 409ae76 Bump version.
  • 1033040 Merge branch 'feature/crypto-secure-random' into develop
  • 7f809c9 Do not run the detect native crypto module for every cryptoSecureRandomInt call.
  • ac28862 Reduce try catch statements.
  • 4d5da7a Just one if to check whether crypto is defined.
  • 3cbd6c1 Update comment.
  • 20b827d Do not simply try catch, cheack availabilty instead.
  • 0241952 Remove the `| 1` left over from the previous float number operation.
  • 8623234 Fix syntax typo.
  • 7e2710a Fix typo in comment.
  • e4ac157 Do not convert into float number.
  • 3b4c51f Update jshint config for arrow functions in grunt task.
  • 9d1a450 Fix jshint window / global warning.
  • 2d9604e Merge branch 'release/3.2.0' into develop
  • 6a6d99a Merge branch 'release/3.2.0'
  • 77d1bdd Bump version.
  • b969c4b Merge pull request #210 from julkwiec/feature/grunt-cli
  • 73ba314 Merge pull request #211 from julkwiec/feature/3des-key-extension
  • 1e821e2 Merge pull request #228 from pearson-g/develop
  • 793d65c Merge branch 'feature/secure-random' into develop
  • eb61233 Fix this context in callbacks using arrow funtions.
  • b405ff5 Add secure random using native crypto module.
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:

🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic