search

RoyHarrow / DO180-apps

DO180 Repository for Sample Applications
0 stars 0 forks source link

[Snyk] Fix for 1 vulnerabilities #66

Open RoyHarrow opened 1 year ago

RoyHarrow commented 1 year ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - todoapp/nodejs_api/package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **658/1000**
**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-SEMVER-3247795](https://snyk.io/vuln/SNYK-JS-SEMVER-3247795) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: restify The new version differs by 250 commits.
  • 2053ef6 chore(master): release 10.0.0
  • 3f94e4f chore: upgrade release-please (please work)
  • c21f6a8 chore: remove wrong link from CHANGELOG.md
  • 5795223 feat!: support v18.x
  • f384900 chore: Update example to allow downgrading to http1
  • fa52f60 feat: bump dtrace-provider version to avoid MacOS errors
  • e911d17 chore: upgrade send@^0.18.0
  • c9e5dfd chore: upgrade mime@^3.0.0
  • 15b8458 chore: upgrade semver@^7.0.0
  • 1e25d31 chore: upgrade pidusage@^3.0.0
  • 70370d9 chore: upgrade pino@^8.0.0
  • de36103 chore: upgrade lru-cache@^7.0.0
  • c944080 chore: upgrade uuid@^9.0.0
  • 50bfac7 chore: upgrade csv@^6.0.0
  • 638930c chore(examples): delete bench example in favor of the benchmark script
  • a70880e chore(examples): update socket.io
  • 23a80ae chore(examples): update todoapp
  • 7228b94 chore: bump find-my-way to ^7.2.0
  • caba351 updated package.json [ci skip]
  • bf2e42a updated CHANGELOG.md [ci skip]
  • c15111f chore: drop support for EOL Node.js versions
  • d052b7c feat: deprecate req.closed
  • 839fb4a chore: bump version of http-signature to ^1.3.6 (#1889)
  • cc483e0 chore: remove travis and update github ci (#1878)
See the full diff
Package name: sequelize The new version differs by 250 commits.
  • 901bceb 6.1.0
  • 6b32821 6.0.0-beta.7
  • 0ca8d72 docs: prepare for v6 release (#12416)
  • 663261b feat(sequelize): allow passing dialectOptions.options from url (#12404)
  • c6e4192 fix(postgres): parse enums correctly when describing a table (#12409)
  • e33d2bd fix(reload): include default scope (#12399)
  • 5611ef0 build: update dependencies (#12395)
  • e80501d fix(types): transactionType in Options (#12377)
  • 4914367 fix(types): add clientMinMessages to Options interface (#12375)
  • b71cd05 fix(query): preserve cls context for logger (#12328)
  • 95f7fb5 fix(mssql): empty order array generates invalid FETCH statement (#12261)
  • ed2d7a9 fix(model.destroy): return 0 with truncate (#12281)
  • 72925cf fix: add missing fields to 'FindOrCreateType' (#12338)
  • f367191 fix(query-generator): do not generate GROUP BY clause if options.group is empty (#12343)
  • 7afd589 docs(sequelize): omitNull only works for CREATE/UPDATE queries
  • f9e660f docs: update feature request template
  • 2bf7f7b fix(typings): add support for optional values in "where" clauses (#12337)
  • 65a9e1e fix(types): add Association into OrderItem type (#12332)
  • 1b86729 docs: responsive (#12308)
  • 59b8a7b fix(include): check if attributes specified for included through model (#12316)
  • 6d87cc5 docs(associations): belongs to many create with through table
  • a2dcfa0 fix(query): ensure correct return signature for QueryTypes.RAW (#12305)
  • 0769aea refactor: cleanup query generators (#12304)
  • 4d9165b feat(postgres): native upsert (#12301)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/royharrow/project/38efa714-0728-49b7-8821-a2bd9721eeae?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/royharrow/project/38efa714-0728-49b7-8821-a2bd9721eeae?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"02c699c1-e6d0-4181-8415-8b6c373ffd86","prPublicId":"02c699c1-e6d0-4181-8415-8b6c373ffd86","dependencies":[{"name":"restify","from":"4.0.3","to":"10.0.0"},{"name":"sequelize","from":"3.14.2","to":"6.1.0"}],"packageManager":"npm","projectPublicId":"38efa714-0728-49b7-8821-a2bd9721eeae","projectUrl":"https://app.snyk.io/org/royharrow/project/38efa714-0728-49b7-8821-a2bd9721eeae?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-SEMVER-3247795"],"upgrade":["SNYK-JS-SEMVER-3247795"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[658],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Regular Expression Denial of Service (ReDoS)](https://learn.snyk.io/lessons/redos/javascript/?loc=fix-pr)