search

docket-fyi / docket-api

Docket API
1 stars 0 forks source link

[Snyk] Fix for 2 vulnerabilities #242

Open john-goldsmith opened 5 months ago

john-goldsmith commented 5 months ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json
⚠️ Warning ``` Failed to update the package-lock.json, please update manually before merging. ```
#### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **768/1000**
**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5 | Prototype Pollution
[SNYK-JS-LODASH-6139239](https://snyk.io/vuln/SNYK-JS-LODASH-6139239) | Yes | Proof of Concept ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **586/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-WS-1296835](https://snyk.io/vuln/SNYK-JS-WS-1296835) | No | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: node-vault The new version differs by 123 commits.
  • e709b04 0.10.0
  • 9b6a076 0.9.23-canary.4
  • 28d5f9d 0.9.23-canary.3
  • a4a935d chore: fixing version extraction for releases
  • 1d6e65b 0.9.23-canary.2
  • efba4b7 new: release will now create GH release
  • 7938ef5 0.9.23-canary.1
  • 7bcf82c 0.9.22-canary.0
  • cc2b586 chore: fixing workflow permissions
  • b1ac54f chore: fixing ssh access
  • 468cc8b chore: updated job name
  • ed4cc2b fix: Updated permissions for release job
  • 50b912a chore: update job name for release
  • 081c5e5 new: automation for package release to NPM
  • 877f591 Replace request with postman-request
  • 4c7b0c2 Merge pull request #236 from nodevault/chore/better-codecov
  • 8c5a08b chore: better codecov usage
  • 098cb0a Merge pull request #232 from orgads/test-images
  • 1c2b76a Merge branch 'master' into test-images
  • 04cc618 Fixing a typo in action from #233 (#235)
  • ac25b18 Merge branch 'master' into chore/fix-action-type
  • 8b5d985 Bump word-wrap from 1.2.3 to 1.2.4 (#234)
  • e3fb47e chore: typos in readme, permissions in actions and actions upgrade (#233)
  • 1605c2a Merge branch 'master' into test-images
See the full diff
Package name: pm2 The new version differs by 69 commits.
See the full diff
Package name: sequelize The new version differs by 213 commits.
  • 901bceb 6.1.0
  • 6b32821 6.0.0-beta.7
  • 0ca8d72 docs: prepare for v6 release (#12416)
  • 663261b feat(sequelize): allow passing dialectOptions.options from url (#12404)
  • c6e4192 fix(postgres): parse enums correctly when describing a table (#12409)
  • e33d2bd fix(reload): include default scope (#12399)
  • 5611ef0 build: update dependencies (#12395)
  • e80501d fix(types): transactionType in Options (#12377)
  • 4914367 fix(types): add clientMinMessages to Options interface (#12375)
  • b71cd05 fix(query): preserve cls context for logger (#12328)
  • 95f7fb5 fix(mssql): empty order array generates invalid FETCH statement (#12261)
  • ed2d7a9 fix(model.destroy): return 0 with truncate (#12281)
  • 72925cf fix: add missing fields to 'FindOrCreateType' (#12338)
  • f367191 fix(query-generator): do not generate GROUP BY clause if options.group is empty (#12343)
  • 7afd589 docs(sequelize): omitNull only works for CREATE/UPDATE queries
  • f9e660f docs: update feature request template
  • 2bf7f7b fix(typings): add support for optional values in "where" clauses (#12337)
  • 65a9e1e fix(types): add Association into OrderItem type (#12332)
  • 1b86729 docs: responsive (#12308)
  • 59b8a7b fix(include): check if attributes specified for included through model (#12316)
  • 6d87cc5 docs(associations): belongs to many create with through table
  • a2dcfa0 fix(query): ensure correct return signature for QueryTypes.RAW (#12305)
  • 0769aea refactor: cleanup query generators (#12304)
  • 4d9165b feat(postgres): native upsert (#12301)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/docket-ope/project/66e40190-a3fa-4369-a7b2-51a8f5a697cf?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/docket-ope/project/66e40190-a3fa-4369-a7b2-51a8f5a697cf?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"628c28de-bea3-41eb-b5fb-f16234b84d48","prPublicId":"628c28de-bea3-41eb-b5fb-f16234b84d48","dependencies":[{"name":"node-vault","from":"0.9.12","to":"0.10.0"},{"name":"pm2","from":"4.2.1","to":"4.4.0"},{"name":"sequelize","from":"5.21.5","to":"6.1.0"}],"packageManager":"npm","projectPublicId":"66e40190-a3fa-4369-a7b2-51a8f5a697cf","projectUrl":"https://app.snyk.io/org/docket-ope/project/66e40190-a3fa-4369-a7b2-51a8f5a697cf?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-LODASH-6139239","SNYK-JS-WS-1296835"],"upgrade":["SNYK-JS-LODASH-6139239","SNYK-JS-WS-1296835"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["pr-warning-shown","priorityScore"],"priorityScoreList":[768,586],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Prototype Pollution](https://learn.snyk.io/lesson/prototype-pollution/?loc=fix-pr) 🦉 [Regular Expression Denial of Service (ReDoS)](https://learn.snyk.io/lesson/redos/?loc=fix-pr)