search

apavlidi / IT_API

The Internet services of the IT department of Alexander Technological Education Institute of Thessaloniki
http://api.it.teithe.gr/
MIT License
14 stars 5 forks source link

[Snyk] Fix for 4 vulnerabilities #163

Open apavlidi opened 10 months ago

apavlidi commented 10 months ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![low severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/l.png "low severity") | **506/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 3.7 | Prototype Pollution
[SNYK-JS-MINIMIST-2429795](https://snyk.io/vuln/SNYK-JS-MINIMIST-2429795) | Yes | Proof of Concept ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **601/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.6 | Prototype Pollution
[SNYK-JS-MINIMIST-559764](https://snyk.io/vuln/SNYK-JS-MINIMIST-559764) | Yes | Proof of Concept ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-SEMVER-3247795](https://snyk.io/vuln/SNYK-JS-SEMVER-3247795) | Yes | Proof of Concept ![low severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/l.png "low severity") | **506/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 3.7 | Regular Expression Denial of Service (ReDoS)
[npm:bson:20180225](https://snyk.io/vuln/npm:bson:20180225) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: connect-mongo The new version differs by 52 commits.
  • 63ca966 docs: update readme and bump version to 3.0.0
  • aceb1ee chore: bump version to 3.0.0-rc.2
  • 0e4a234 test: add test cases on event listener
  • e77a7f1 test: replace mocha with jest (#324)
  • ad39e88 test: replace deprecated collection.insert to collection.insertOne
  • 545c06e docs: update README on testing
  • 2d5442e chore: upgrade depns mocha
  • 5d3a321 chore: upgrade nyc depns
  • 54cd91d chore: upgrade depns
  • afb7a12 docs: remove some badges
  • 6c2484b docs: update README for supporting version
  • c925c92 test: fix test case
  • 6827330 chore: bump version to 3.0.0-rc.1
  • f62692b ci: update .npmignore
  • aa2637d ci: remove node 6 support and add linting in travis
  • 801291b fix linting error
  • f928547 travis add test on Node 12
  • 12275f0 better linting
  • eb23b1e linting fix
  • 66194c7 bump major version to 3.0.0-rc
  • f29084f Wait for client open, before calling db. (#321)
  • d252bfc Install Stale bot
  • 15d91c1 Transparent crypto support (#314)
  • 08ccada Update readme refer to latest release to avoid confusion
See the full diff
Package name: log4js The new version differs by 250 commits.
  • 9fdbed5 6.4.0
  • 788c7a8 Merge pull request #1150 from log4js-node/update-changelog
  • 7fdb141 chore: updated changelog for 6.4.0
  • e6bd888 Merge pull request #1151 from log4js-node/feat-zero-backup
  • ac599e4 allow for zero backup - in sync with https://github.com/log4js-node/streamroller/pull/74
  • 53248cd Merge pull request #1149 from log4js-node/migrate-daysToKeep-to-numBackups
  • 436d9b4 Merge pull request #1148 from log4js-node/update-docs
  • d6b017e chore(docs): updated fileSync.md and misc comments
  • d4617a7 chore(deps): migrated from daysToKeep to numBackups due to streamroller@^3.0.0
  • 0ad0133 Merge pull request #1147 from log4js-node/update-deps
  • 773962b Merge pull request #1146 from log4js-node/update-deps
  • 823bb46 Merge pull request #1145 from log4js-node/update-deps
  • 6cc0035 chore(deps): bump streamroller from 3.0.1 to 3.0.2
  • 0f39859 chore(deps): bump date-format from 4.0.2 to 4.0.3
  • 85ac31e chore(deps-dev): bump eslint from from 8.6.0 to 8.7.0
  • acd41ef Merge pull request #1144 from log4js-node/refactor
  • 4c4bbe8 chore(refactor): using writer.writable instead of alive for checking
  • e86a809 Merge pull request #1097 from 4eb0da/datefile-error-handling
  • 34ab3b2 Merge pull request #1143 from log4js-node/update-test
  • 8cba85f chore(test): renamed tap.teardown() to tap.tearDown() for consistency (while both works, only tap.tearDown() is documented)
  • a0baec2 chore(test): fixed teardown() causing tests to fail due to fs errors on removal
  • 51ac865 Merge pull request #1103 from polo-language/recording-typescript
  • 653a20f Merge pull request #1028 from techmunk/master
  • 43a2199 chore(test): Changed default TAP test suite timeout from 30s to 45s because Windows takes a long time
See the full diff
Package name: mongoose The new version differs by 250 commits.
  • 76fae6d chore: release 5.3.9
  • 40d4177 Merge pull request #7213 from NewEraCracker/master
  • 751397c fix(document): run setter only once when doing `.set()` underneath a single nested subdoc
  • 10837d4 test(document): repro #7196
  • 10a63a9 Bump version of bson dependency to match mongodb-core
  • d10274e docs(transactions): add example of aborting a transaction
  • d245847 Merge branch 'master' of github.com:Automattic/mongoose
  • 551a75b chore: add cpc to some pages that were missing it
  • 1ca3514 Merge pull request #7210 from gfranco93/patch-1
  • c1606b6 Merge pull request #7207 from lineus/fix-7098
  • e9d538e Merge pull request #7203 from lineus/fix-7202
  • 8f16b67 fix(document): surface errors in subdoc pre validate
  • 87005a1 test(document): repro #7187
  • 5b1d81c Documentation fix: fixed anchor link
  • eebfb36 docs(query): add note re: cursor()
  • c1e2617 docs(query): improve find() docs re: #7188
  • 526f82d fix(query): run default functions after hydrating the loaded document
  • 320d5f8 test(query): repro #7182
  • 64c6d15 if our update schema path is a nested array do not skip query casting.
  • 5d122e8 test for #7098
  • 5ba13a7 refactor(test): move strictQuery tests to query.test.js since they do not use findOneAndUpdate()
  • 4121629 chore: refer to correct issue #7178
  • 22ed5d2 fix(query): handle strictQuery: 'throw' with nested path correctly
  • 8c16354 test(query): repro #7152
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/noomados/project/50c336ef-8a10-41dd-98ac-c157e9534430?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/noomados/project/50c336ef-8a10-41dd-98ac-c157e9534430?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"8d5deff3-3e7a-4257-93ca-944a9c8353ff","prPublicId":"8d5deff3-3e7a-4257-93ca-944a9c8353ff","dependencies":[{"name":"connect-mongo","from":"2.0.1","to":"3.0.0"},{"name":"log4js","from":"1.1.1","to":"6.4.0"},{"name":"mongoose","from":"5.0.0","to":"5.3.9"}],"packageManager":"npm","projectPublicId":"50c336ef-8a10-41dd-98ac-c157e9534430","projectUrl":"https://app.snyk.io/org/noomados/project/50c336ef-8a10-41dd-98ac-c157e9534430?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["npm:bson:20180225","SNYK-JS-MINIMIST-2429795","SNYK-JS-MINIMIST-559764","SNYK-JS-SEMVER-3247795"],"upgrade":["SNYK-JS-MINIMIST-2429795","SNYK-JS-MINIMIST-559764","SNYK-JS-SEMVER-3247795","npm:bson:20180225"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[506,506,601,696],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Regular Expression Denial of Service (ReDoS)](https://learn.snyk.io/lesson/redos/?loc=fix-pr) 🦉 [Prototype Pollution](https://learn.snyk.io/lesson/prototype-pollution/?loc=fix-pr)