search

dustin-lennon / DexcomMongoBackup

Discord JS bot using the Sapphire JS framework to backup a MongoDB for my NightScout website
The Unlicense
0 stars 0 forks source link

[Snyk] Security upgrade mongodb from 5.7.0 to 6.0.0 #46

Open dustin-lennon opened 6 months ago

dustin-lennon commented 6 months ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **823/1000**
**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 8.6 | Server-side Request Forgery (SSRF)
[SNYK-JS-IP-6240864](https://snyk.io/vuln/SNYK-JS-IP-6240864) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: mongodb The new version differs by 67 commits.
  • e57b738 chore(main): release 6.0.0 [skip-ci] (#3762)
  • e70826a docs: generate docs from latest main [skip-ci] (#3744)
  • df1b4f2 docs(NODE-5560): add v6 upgrade guide (#3844)
  • 7bef363 feat(NODE-5584)!: adopt bson v6 and mongodb-client-encryption v6 (#3845)
  • 05d2725 fix(NODE-5592): withTransaction return type (#3846)
  • 91152b9 chore(NODE-5581): pull in bson alpha.1 and mongodb-legacy main (#3843)
  • ecb2e20 chore: fix alpha version guard
  • ea2d60a refactor(NODE-5514): make FLE logic use async-await (#3830)
  • a17b0af feat(NODE-5484)!: mark MongoError for internal use and remove Node14 cause assignment logic (#3800)
  • 33c86c9 feat(NODE-5566): add ability to provide CRL file via tlsCRLFile (#3834)
  • 2323ca8 ci(NODE-5125): fix flaky case 14 prose test (#3833)
  • a0955bd fix(NODE-5548): ensure that tlsCertificateKeyFile maps to cert and key (#3819)
  • bf00e32 docs(no-story): generate api docs for 5.8 release (#3832)
  • 11682d0 docs(NODE-5532): fix docs for `types` and regenerate 5.7 docs (#3822)
  • a7ffdf5 ci(NODE-5446): revert bump dev dependencies (#3801) (#3829)
  • 46e15e7 docs: fix cutoff sentence on CommandStartedEvent (#3827)
  • 1c05b38 docs: generate 4.17.0 documentation (#3826)
  • 45f8fb9 chore(NODE-5544): fix duplicate PR highlights (#3816)
  • bd031fc feat(NODE-5396): add `mongodb-js/saslprep` as a required dependency (#3815)
  • fd9a467 chore(NODE-5446): bump dev dependencies (#3801)
  • 6483276 docs(NODE-5540): Fix MDB University links in GH pages (#3814)
  • 7955610 fix(NODE-4788)!: use implementer Writable methods for GridFSBucketWriteStream (#3808)
  • 2fbb715 docs(NODE-5523): add component support matrix to readme (#3806)
  • af47529 docs(NODE-5535): fix link to Transactions quickstart (#3811)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/demonicpagan/project/972af938-f4c0-4b2b-8c4e-d299efdd363d?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/demonicpagan/project/972af938-f4c0-4b2b-8c4e-d299efdd363d?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"2c104523-f48d-411a-92aa-9811d8f056dc","prPublicId":"2c104523-f48d-411a-92aa-9811d8f056dc","dependencies":[{"name":"mongodb","from":"5.7.0","to":"6.0.0"}],"packageManager":"npm","projectPublicId":"972af938-f4c0-4b2b-8c4e-d299efdd363d","projectUrl":"https://app.snyk.io/org/demonicpagan/project/972af938-f4c0-4b2b-8c4e-d299efdd363d?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-IP-6240864"],"upgrade":["SNYK-JS-IP-6240864"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[823],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Server-side Request Forgery (SSRF)](https://learn.snyk.io/lesson/ssrf-server-side-request-forgery/?loc=fix-pr)