search

flaviuse / mern-authentication

MERN stack authentication boilerplate: password reset, email verification, server sessions, redux, typescript, hooks and docker for dev and prod.
https://mern-auth-client.herokuapp.com/login
MIT License
439 stars 95 forks source link

[Snyk] Upgrade winston from 3.3.3 to 3.7.2 #131

Closed flaviuse closed 2 years ago

flaviuse commented 2 years ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to upgrade winston from 3.3.3 to 3.7.2.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
- The recommended version is **7 versions** ahead of your current version. - The recommended version was released **22 days ago**, on 2022-04-04. The recommended version fixes: Severity | Issue | PriorityScore (*) | Exploit Maturity | :-------------------------:|:-------------------------|-------------------------|:------------------------- | Directory Traversal
[SNYK-JS-MOMENT-2440688](https://snyk.io/vuln/SNYK-JS-MOMENT-2440688) | **661/1000**
**Why?** Recently disclosed, Has a fix available, CVSS 7.5 | No Known Exploit | Prototype Pollution
[SNYK-JS-ASYNC-2441827](https://snyk.io/vuln/SNYK-JS-ASYNC-2441827) | **661/1000**
**Why?** Recently disclosed, Has a fix available, CVSS 7.5 | Proof of Concept | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-RAMDA-1582370](https://snyk.io/vuln/SNYK-JS-RAMDA-1582370) | **661/1000**
**Why?** Recently disclosed, Has a fix available, CVSS 7.5 | No Known Exploit | Information Exposure
[SNYK-JS-FOLLOWREDIRECTS-2332181](https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2332181) | **661/1000**
**Why?** Recently disclosed, Has a fix available, CVSS 7.5 | Proof of Concept | Information Exposure
[SNYK-JS-FOLLOWREDIRECTS-2396346](https://snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-2396346) | **661/1000**
**Why?** Recently disclosed, Has a fix available, CVSS 7.5 | No Known Exploit (*) Note that the real score may have changed since the PR was raised.
Release notes
Package name: winston
  • 3.7.2 - 2022-04-04
  • 3.7.1 - 2022-04-04

    This change includes some minor updates to package-lock.json resolving npm audit failures: one in ansi-regex and another in minimist.

    Full Changelog: v3.7.0...v3.7.1

      </li>
  <li>
    <b>3.6.0</b> - <a href="https://snyk.io/redirect/github/winstonjs/winston/releases/tag/v3.6.0">2022-02-12</a></br><ul>
  • Changelog updates for v3.6.0 5e72485
  • Update dependencies, including latest logform (#2071) 93077ef
  • Update to @ colors/colors (#2069) 035f94a
  • Bump @ babel/core from 7.16.12 to 7.17.2 (#2068) 7665d88
  • Bump @ babel/cli from 7.16.8 to 7.17.0 (#2064) e658389
  • chore: add editorconfig (#2058) 30d260d
  • Add search terms field to bug report template (#2067) 40ef309
  • Bump @ types/node from 17.0.13 to 17.0.15 (#2062) c9b7579
  • Chore: Organize and restructure tests (#2049) 2b8cd55
  • Bump to latest winston-transport 2017c50
  • Memory leak fix: do not wait for process.nextTick to clear pending callbacks (#2057) f741383
  • Update linter dependencies and config (#2059) 438cb73
  • Bump @ types/node from 17.0.10 to 17.0.13 (#2051) 7f6a6f2

v3.5.1...v3.6.0

  </li>
  <li>
    <b>3.5.1</b> - <a href="https://snyk.io/redirect/github/winstonjs/winston/releases/tag/v3.5.1">2022-01-31</a></br><p>This release reverts the changes made in PR <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="835644953" data-permission-text="Title is private" data-url="https://github.com/winstonjs/winston/issues/1896" data-hovercard-type="pull_request" data-hovercard-url="/winstonjs/winston/pull/1896/hovercard" href="https://snyk.io/redirect/github/winstonjs/winston/pull/1896">#1896</a> which added stricter typing to the available log levels,<br>

and inadvertently broke use of custom levels with TypeScript (Issue #2047). Apologies for that!

  • 3.5.0 - 2022-01-27

    This release includes the following, in sequence by first merge in group:

    Feature updates:

    Patch-level updates:

    • Bump dependency versions (thanks @ dependabot & @ DABH!)
      • Bump @ types/node from 16.11.12 to 17.0.8 (PR #2009)
      • Bump @ babel/preset-env from 7.16.7 to 7.16.8 (#2036)
      • Bump @ types/node from 17.0.8 to 17.0.9 (#2035)
      • Bump @ babel/cli from 7.16.7 to 7.16.8 (#2034)
      • Bump @ types/node from 17.0.9 to 17.0.10 (#2042)
      • Bump @ babel/core from 7.16.7 to 7.16.12 (#2041)
      • Bump @ babel/preset-env from 7.16.8 to 7.16.11 (#2040)
    • Fixing documentation syntax errors in transports code examples (#1916; thanks @ romanzaycev!)
    • Fix missing type declarations, especially for .rejections (#1842, #1929, #2021; thanks @ vanflux, @ svaj, @ glensc, & others!)
    • More narrowly typing the “level” string (#1896, thanks @ yonas-g!)
    • Using a safer stringify, e.g. to avoid issues from circular structures, in the http transport (#2043, thanks @ karlwir!)

    Updates to the repo & project which don’t actually affect the running code:

    Thanks also to maintainers @ DABH, @ fearphage, @ maverick1872, and @ wbt for issue/PR shepherding and help across multiple parts of the release!

    If somebody got missed in the list of thanks, please forgive the accidental oversight and/or feel free to open a PR on the changelog.

    •   <li>
    <b>3.4.0</b> - <a href="https://snyk.io/redirect/github/winstonjs/winston/releases/tag/v3.4.0">2022-01-10</a></br><a href="https://snyk.io/redirect/github/winstonjs/winston/releases/tag/v3.4.0"> Read more </a>
  </li>
  <li>
    <b>3.3.4</b> - <a href="https://snyk.io/redirect/github/winstonjs/winston/releases/tag/3.3.4">2022-01-10</a></br><p>Version 3.3.4</p>
  </li>
  <li>
    <b>3.3.3</b> - <a href="https://snyk.io/redirect/github/winstonjs/winston/releases/tag/v3.3.3">2020-06-23</a></br><a href="https://snyk.io/redirect/github/winstonjs/winston/releases/tag/v3.3.3"> Read more </a>
  </li>
</ul>
from <a href="https://snyk.io/redirect/github/winstonjs/winston/releases">winston GitHub release notes</a>

    Commit messages
    Package name: winston
    • 7937f33 Revert for 2103 (#2104)
    • 68f595b Update changelog
    • 2aa2d4f Bump to 3.7.1
    • ce6fbc9 Bump ansi-regex in package-lock due to
    • cdf1da5 Bump minimist in package-lock due to
    • 23f29b1 Bump version number in package-lock
    • 3c79a63 Release - v3.7.0 (#2101)
    • 32bfa76 Bump @ babel/core from 7.17.5 to 7.17.8 (#2093)
    • efa495d Bump eslint from 8.10.0 to 8.12.0 (#2098)
    • 6fad825 Bump @ types/node from 17.0.21 to 17.0.23 (#2099)
    • ba93eae fix(metadata precedence) - fix metadata override issues (#1989)
    • e4acc5a Bump actions/setup-node from 2 to 3 (#2081)
    • 70fc03d Bump @ types/node from 17.0.17 to 17.0.21 (#2084)
    • 64351af Bump eslint from 8.9.0 to 8.10.0 (#2083)
    • b068f14 Bump @ babel/cli from 7.17.0 to 7.17.6 (#2082)
    • d9bba28 Bump @ babel/core from 7.17.2 to 7.17.5 (#2079)
    • 0dae690 Bump actions/checkout from 2 to 3 (#2086)
    • c9e5f17 Bump @ dabh/diagnostics from 2.0.2 to 2.0.3 (#2074)
    • b09fa5d Feature: Further improve issue templates (#2073)
    • d1d9358 Fix: add missing type of batch http option (#2075)
    • b2fde9d 3.6.0
    • 5e72485 Changelog updates for v3.6.0
    • 93077ef Update dependencies, including latest logform (#2071)
    • 035f94a Update to @ colors/colors (#2069)
    Compare

    Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

    For more information:

    🧐 View latest project report

    🛠 Adjust upgrade PR settings

    🔕 Ignore this dependency or unsubscribe from future upgrade PRs