GGonryun
commented
1 year ago closing this PR because all of these updates have been addressed after rebuilding our sample app: #140
Closed FS-github-snyk closed 1 year ago
GGonryun
commented
1 year ago closing this PR because all of these updates have been addressed after rebuilding our sample app: #140
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - samples/single-page-app/package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------  | **658/1000****Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-SEMVER-3247795](https://snyk.io/vuln/SNYK-JS-SEMVER-3247795) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: babel-jest
The new version differs by 250 commits.- be16e47 v27.0.0
- 63102ec chore: update changelog for release
- 564694a docs(blog): Jest 27 blog post (#11131)
- b68d91b feat(pretty-print): add option `printBasicPrototype` (#11441)
- 2226742 chore: minor simplify format results error (#11432)
- 78eb25d chore: remove needless assign (#11433)
- 696c455 chore: update lockfile after publish
- e2eb9ae v27.0.0-next.11
- 3b253f8 Wait for closed resources to actually close before detecting open handles (#11429)
- 27bee72 fix: run GC before collecting open handles (#11278)
- 50451df feat: use fallback if prettier not found (#11400)
- 150dbd8 chore: update lockfile after publish
- 6f44529 v27.0.0-next.10
- cbcec7d Upgrade fsevents in jest-haste-map (#11428)
- 9633a26 feat: support reporters written in ESM (#11427)
- 59f42d8 fix: do not cache modules that throw during evaluation (#11263)
- 57e32e9 Detect open handles with done callbacks (#11382)
- a397607 Document and test dontThrow for custom inline snapshot matchers (#10995)
- 4fa3a0b feat: custom haste (#11107)
- 2047a36 chore: bump deps (#11419)
- a4358d6 chore: run prettier on changelog
- bdd6282 Move all default values into `jest-config` (#9924)
- db643a1 Link to Jest config (#11106)
- b16082c Fix locale issue #10014 (#11412)
See the full diffPackage name: eslint
The new version differs by 210 commits.- 3dd6741 7.0.0
- 9a722f9 Build: changelog update for 7.0.0
- b98d8bd Upgrade: eslint-release@2.0.0 (#13271)
- 4c0b028 Fix: remove Node.js and CommonJS category from build process (#13242)
- 401a687 Chore: fix rules list for prereleases (#13230)
- 4ef6158 Breaking: espree@7.0.0 (#13270)
- b5c8d73 Docs: update 7.0.0 migration guide for consistency (#13267)
- 356fdb4 Docs: add migration guide (#12692)
- 015edf6 Sponsors: Sync README with website
- fdfa364 7.0.0-rc.0
- 8d1b4db Build: changelog update for 7.0.0-rc.0
- 0b1d65a Update: Improve report location for array-callback-return (refs #12334) (#13109)
- d85e291 Fix: yoda left string fix for exceptRange (fixes #12883) (#13052)
- 2ce6bed Chore: added tests for nested arrays (#13145)
- d3aac53 Update: report backtick loc in no-unexpected-multiline (refs #12334) (#13142)
- 8e7a2d9 Fix: func-call-spacing "never" reports wrong message (fixes #13190) (#13193)
- bcafd0f Update: Add ESLint API (refs eslint/rfcs#40) (#12939)
- 3eeae56 Upgrade: some (dev) deps (#13155)
- 6b7030b Chore: Run tests on Node.js v14 (#13210)
- ebc28d7 Fix: Remove default .js from --ext CLI option (#13176)
- 5c1bdeb Update: Improve report location for getter-return (refs #12334) (#13164)
- 56d2bee Docs: fix typos (#13204)
- e13256e Chore: use espree.latestEcmaVersion in config-initializer (#13157)
- e4f57b7 Chore: add nested array tests for array-element-newline (#13161)
See the full diffPackage name: eslint-plugin-import
The new version differs by 250 commits.- b0131d2 Bump to v2.25.0
- 7463de2 utils: v2.7.0
- 900ac9a [resolvers/webpack] [deps] update `is-core-module`
- c117be5 [Dev Deps] update `array.prototype.flatmap`, `glob`; remove `babel-preset-es2015-argon`
- 0e857b6 [Deps] update `array-includes`, `array.prototype.flat`, `is-core-module`, `is-glob`, `object.values`
- 62e2d88 [New] Support `eslint` v8
- 9a744f7 [Fix] `default`, `ExportMap`: Resolve extended TypeScript configuration files
- dd81424 [Refactor] `no-unresolved`, `no-extraneous-dependencies`: moduleVisitor usage
- 4f0f560 [Docs] `no-namespace`: fix a typo
- 430d16c [Tests] eslint-import-resolver-typescript@1.0.2 doesn't resolve .js
- 47e9c89 [Tests] type-only imports were added in TypeScript ESTree 2.23.0
- 28669b9 [Tests] `no-extraneous-dependencies` ignores unresolved imports
- 471790f [Tests] fix skip usage
- fd85369 [Tests] skip failing test on eslint < 6 + node < 8
- 64423e9 [Tests] add passing test for export-star
- 58fe766 [Tests] ignore resolver tests, scripts, and unused memo-parser
- 47ea669 [Fix] `order`: Fix import ordering in TypeScript module declarations
- 4ed7867 [Fix] `no-unresolved`: ignore type-only imports
- 4d15e26 [patch] TypeScript config: remove `.d.ts` from `import/parsers` setting and `import/extensions` setting
- 9ccdcb7 [Refactor] switch to an internal replacement for `pkg-up` and `read-pkg-up`
- 1571913 [utils] [new] create internal replacement for `pkg-up` and `read-pkg-up`
- 7c382f0 [New] `no-unused-modules`: support dynamic imports
- 7579748 [utils] [new] add `visit`, to support dynamic imports
- 35bd977 [New] `no-unresolved`: add `caseSensitiveStrict` option
See the full diffPackage name: eslint-plugin-react
The new version differs by 27 commits.- 25bf6cc Update CHANGELOG and bump version
- 2598b1e [Dev Deps] update `@ types/eslint`, `@ types/estree`, `@ types/node`, `@ typescript-eslint/parser`, `coveralls`, `eslint-config-airbnb-base`, `eslint-plugin-import`, `typescript`
- f94d851 [Fix] `jsx-sort-props`: only use localeCompare when case is ignored
- c481a26 [Docs] Clean up examples in rule docs
- 88d404d [eslint] remove `operator-linebreak` override
- 304590a Merge pull request #2635 from ljharb/eslint7
- 35030a0 [Tests] fix mistaken error property and add output property
- 906b474 [New] support eslint v7
- d66f467 [Fix] `jsx-key`: add a failing test case for optional chaining
- da7a045 [Fix] `no-unused-state`: handle optional chaining
- 9861469 [New] `forbid-component-props`/`forbid-dom-props`: Allow a custom message with forbid props
- ab28224 [Fix] `jsx-pascal-case`: Do not consider namespaces when checking for DOM
- 25b1936 [Fix] `jsx-curly-spacing`, `jsx-no-bind`, `usedPropTypes` util: avoid node.start and node.end
- db4e471 [readme] Add Rules of Hooks to Other useful plugins section
- b9d2eb5 [Fix] `jsx-no-target-blank`: allow `no-referrer` without `noopener` by default
- 3385caa [Tests] `button-has-type`: ensure no mistakenly allowed identifiers named `button`/`submit`/`reset`
- aecff62 [Fix] `button-has-type`: improve message when non-static value is used
- bea3b30 [Docs] `no-this-in-sfc`: backtick `this`
- 78ddd46 [Fix] `no-adjacent-inline-elements`: prevent crash on nullish children
- 80f3826 [Docs] `function-component-definition`: Fix unnamedComponents option examples
- e19287d [tests] `displayName`: add a test case
- a93ef20 [Fix] `prop-types`: avoid crash when spreading any type
- ad18d35 [Fix] `require-render-return`: add missing "a"
- 6aa7874 [Fix] `jsx-no-comment-textnodes`: fix for `@ typescript-eslint/parser`
See the full diffPackage name: sass-loader
The new version differs by 35 commits.- 45bd865 chore(release): 9.0.0
- 0629915 refactor: code before release
- c11478d test: ambiguous imports (#855)
- 73009fd docs: yarn pnp + using `dart-sass` by default (#854)
- d487683 feat: pass the loader context to custom importers under `this.webpackLoaderContext` property (#853)
- b3ffd5b test: resolution logic (#852)
- 3abe3f5 fix: resolution logic
- 20b7a11 docs: fix link for prependData (#847)
- 006c02e refactor: code
- 2a18d5b ci: node@14 (#842)
- 17832fd fix: resolution for `file` scheme
- 744112d fix: perf (#840)
- aeb86f0 fix: resolution logic (#839)
- 7380b7b fix: resolution logic (#838)
- 0c8d3b3 feat: support `process.cwd()` resolution (#837)
- 8376179 feat: support SASS-PATH env variable (#836)
- ddeff88 test: refactor (#835)
- 24c852a docs: options table (#834)
- f892eba refactor: code (#833)
- 68dd278 fix: avoid different content on different os (#832)
- 1655baf fix: resolution logic (#831)
- fe3b33b fix: resolution logic (#830)
- 41e0e45 test: foundation-sites (#829)
- a3dec34 chore: minimum supported Nodejs version is `10.13` (#828)
See the full diffPackage name: semver
The new version differs by 140 commits.- e7b78de chore: release 7.5.2
- 58c791f fix: diff when detecting major change from prerelease (#566)
- 5c8efbc fix: preserve build in raw after inc (#565)
- 717534e fix: better handling of whitespace (#564)
- 2f738e9 chore: bump @ npmcli/template-oss from 4.14.1 to 4.15.1 (#558)
- aa016a6 chore: release 7.5.1
- d30d25a fix: show type on invalid semver error (#559)
- 09c69e2 chore: bump @ npmcli/template-oss from 4.13.0 to 4.14.1 (#555)
- 5b02ad7 chore: release 7.5.0
- e219bb4 fix: throw on bad version with correct error message (#552)
- 503a4e5 feat: allow identifierBase to be false (#548)
- fc2f3df fix: incorrect results from diff sometimes with prerelease versions (#546)
- 2781767 fix: avoid re-instantiating SemVer during diff compare (#547)
- 82aa7f6 chore: release 7.4.0
- 731d896 chore: enable CD (#545)
- 940723d fix: intersects with v0.0.0 and v0.0.0-0 (#538)
- aa516b5 fix: faster parse options (#535)
- 61e6ea1 fix: faster cache key factory for range (#536)
- f8b8b61 fix: optimistic parse (#541)
- 796cbe2 fix: semver.diff prerelease to release recognition (#533)
- 3f222b1 fix: reuse comparators on subset (#537)
- 113f513 feat: identifierBase parameter for .inc (#532)
- ea689bc chore: basic type test for RELEASE_TYPES
- c5d29df docs: Add "Constants" section to README
See the full diff