search

Snugug / gulp-armadillo

The rebirth of the Armadillo static site generator, as a series of Gulp tasks!
MIT License
16 stars 6 forks source link

[Snyk] Fix for 3 vulnerabilities #360

Open Snugug opened 2 years ago

Snugug commented 2 years ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-ANSIREGEX-1583908](https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908) | Yes | Proof of Concept ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **654/1000**
**Why?** Has a fix available, CVSS 8.8 | Authentication Bypass by Spoofing
[SNYK-JS-AUTOLINKER-2438289](https://snyk.io/vuln/SNYK-JS-AUTOLINKER-2438289) | Yes | No Known Exploit ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **479/1000**
**Why?** Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-SCSSTOKENIZER-2339884](https://snyk.io/vuln/SNYK-JS-SCSSTOKENIZER-2339884) | Yes | No Known Exploit (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: critical The new version differs by 250 commits.
  • d64bb6b 5.0.0
  • 58c3958 rewrite paths in lcov.info
  • 8cf283f rewrite paths in lcov.info
  • 589dcde rewrite paths in lcov.info
  • 14122a5 deactivates coveralls debug mode
  • cdbdaa3 updates package-lock
  • 5df9861 deactivates coveralls debug mode & adds jest coverage config
  • c6ad4df coveralls debug mode
  • 5e04dce debug coveralls
  • 595d9fb debug coveralls
  • acf5402 Run coveralls on node 16
  • 618dfb6 Removes david dependency badges
  • b92a55c audit fix
  • b030b79 Bump deps, moves to ESM & require Node.js 14 (#543)
  • 3fa92c4 Correct the parameters in callback example (#537)
  • 2206d45 Bump got from 11.8.2 to 11.8.5 (#539)
  • 8c28b57 Bump async from 3.2.0 to 3.2.2 (#531)
  • e3a4e8c TASK: Fix typo in cli help output (#512)
  • 08debdc Bump path-parse from 1.0.6 to 1.0.7 (#513)
  • 6555d6d 4.0.1
  • f6aadc9 Adds support for media attribute on link elements (#510)
  • 24e2266 Npm audit fix
  • 4c8988c Bump normalize-url from 4.5.0 to 4.5.1 (#502)
  • 8e5beb8 Bump trim-newlines from 3.0.0 to 3.0.1 (#501)
See the full diff
Package name: eyeglass The new version differs by 250 commits.
  • 6b06179 Publish
  • 77b3f43 Add yarn back to the package dev dependencies.
  • 9ee991e Updates to broccoli-eyeglass to support dart-sass.
  • c07029d Update CHANGELOG files for broccoli and ember-cli.
  • 9617614 README updates for 2.5 and 3.0.
  • 6e1d933 dart-sass support (#247)
  • d9b1844 Don't test against node 8 anymore.
  • 228b167 chore: Refactor eyeglass version lookup to a utility.
  • 7b7fd25 chore: Remove deprecated assets APIs.
  • c63656c chore: Remove obsolete test case.
  • e1741d2 chore: Remove deprecated API Eyeglass#enableImportOnce.
  • 6ab4f9b chore: Remove deprecated sass engine argument from Eyeglass constructor.
  • 1ecd85f Deprecated options will now cause an error.
  • 57d33b0 chore: Remove deprecated sassOptions() method.
  • 5b89784 Enable esModuleInterop for all packages.
  • 0935d09 chore: Pin node and yarn versions in remaining packages.
  • f9e5e57 chore: Emit typescript output for node 10+.
  • b784582 feat: Officially drop support for node 6, 8, and 11.
  • 8334e0e fix: Remove deprecation warning and emit errors instead for version conflicts when strictModuleVersions is set.
  • cc00552 docs: Note duplicate modules change in the CHANGELOG.
  • 521f485 Merge branch 'ignore-duplicate-modules' into release-3.0
  • 9d9500a fix: Don't add manual modules if they already exist.
  • 1a537a1 Don't even try to install deasync.
  • 7664351 docs: CHANGELOG entry for deasync removal.
See the full diff
Package name: gulp-sass The new version differs by 28 commits.
  • 5775044 Update CHANGELOG.md
  • 978b8f6 Update to major version 5 (#802)
  • 10eae93 Update changelog for 4.1.1
  • 947b26c Upgrade lodash to fix a security issue (#776)
  • 8d6ac29 Update changelog
  • 43c0547 4.1.0
  • ebe3ec6 Set appropriate file stat times (#763)
  • 7ab018e Migrate to the lodash package
  • fa670c6 4.0.2
  • fefa00e Revert package.json version bump
  • 98254d2 Fix README typos
  • 8a14419 Continue loading Node Sass by default
  • 938afbe Add a note about synchronous versus asynchronous speed
  • 7cc2db1 Make this package implementation-agnostic
  • 643f73b Add documentation for synchronous code options
  • 0b3c7e7 4.0.1
  • daca90d Merge pull request #681 from DKvistgaard/master
  • 71471c2 Declaring logError as function instead of arrow function.
  • 450a7b8 4.0.0
  • e9b1fe8 Fix node versions in appveyor.yml
  • 44be409 Merge pull request #667 from dlmanning/next
  • 7656eff Adopt airbnb eslint preset
  • 1293169 Bump autoprefixer@^8.1.0, gulp-postcss@^7.0.1
  • 9fa817b Bump gulp-sourcemaps@^2.6.4
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/snugug/project/b9278098-ce02-4a0e-a425-6d157716cace?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/snugug/project/b9278098-ce02-4a0e-a425-6d157716cace?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"9d860aa1-a4b2-4d71-8977-38cdd923a716","prPublicId":"9d860aa1-a4b2-4d71-8977-38cdd923a716","dependencies":[{"name":"critical","from":"0.8.4","to":"5.0.0"},{"name":"eyeglass","from":"1.6.0","to":"3.0.0"},{"name":"gulp-sass","from":"3.2.1","to":"5.0.0"},{"name":"remarkable","from":"1.7.4","to":"2.0.0"}],"packageManager":"npm","projectPublicId":"b9278098-ce02-4a0e-a425-6d157716cace","projectUrl":"https://app.snyk.io/org/snugug/project/b9278098-ce02-4a0e-a425-6d157716cace?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-ANSIREGEX-1583908","SNYK-JS-AUTOLINKER-2438289","SNYK-JS-SCSSTOKENIZER-2339884"],"upgrade":["SNYK-JS-ANSIREGEX-1583908","SNYK-JS-AUTOLINKER-2438289","SNYK-JS-SCSSTOKENIZER-2339884"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[696,654,479]}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Learn about vulnerability in an interactive lesson of Snyk Learn.](https://learn.snyk.io?loc=fix-pr)