adobe / aio-cli-plugin-runtime

Adobe I/O Runtime plugin for the Adobe I/O CLI
https://www.adobe.io
Apache License 2.0
15 stars 31 forks source link

[Snyk] Security upgrade properties-reader from 2.0.0 to 2.2.0 #217

Closed snyk-bot closed 3 years ago

snyk-bot commented 3 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 758/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.3
Prototype Pollution
SNYK-JS-PROPERTIESREADER-1048968
No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: properties-reader The new version differs by 19 commits.
  • a79ef3b 2.2.0
  • 45cd522 Merge pull request #41 from steveukx/feature/tests-update
  • 4e4bc39 Allow for relying on Object prototype in steps of the expanded properties
  • 0877cc8 Test case covering the use of `__proto__` as a section name
  • 79637cb Merge pull request #39 from steveukx/feature/tests-update
  • a250c95 Tests updated to use jest
  • 9dc55e5 Merge remote-tracking branch 'origin/master'
  • dd9d028 Add no-response bot
  • de58ae1 Update .travis.yml
  • 650c17f 2.1.1
  • 3544155 Merge branch 'master' of github.com:steveukx/properties
  • 60442e2 2.1.0
  • f8a665d Set min node=10
  • 567fbc1 Merge branch 'writer-options'
  • 7f71978 Update readme
  • f925b73 Writer options - allows saving without sections
  • 9812ef2 Merge pull request #35 from steveukx/dependabot/npm_and_yarn/lodash-4.17.19
  • cb3d0a6 Bump lodash from 4.17.14 to 4.17.19
  • 84bedfa Update README.md
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

codecov[bot] commented 3 years ago

Codecov Report

Merging #217 (a7c7a7e) into master (d64037a) will not change coverage. The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff            @@
##            master      #217   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           57        57           
  Lines         1472      1472           
  Branches       277       277           
=========================================
  Hits          1472      1472           

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update d64037a...a7c7a7e. Read the comment docs.