search

iotaledger / gh-tangle-release

GitHub Action to publish release details to the Tangle
MIT License
15 stars 3 forks source link

[Snyk] Fix for 2 vulnerabilities #62

Open rajivshah3 opened 6 months ago

rajivshah3 commented 6 months ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **661/1000**
**Why?** Recently disclosed, Has a fix available, CVSS 7.5 | Uncontrolled resource consumption
[SNYK-JS-BRACES-6838727](https://snyk.io/vuln/SNYK-JS-BRACES-6838727) | Yes | No Known Exploit ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **661/1000**
**Why?** Recently disclosed, Has a fix available, CVSS 7.5 | Inefficient Regular Expression Complexity
[SNYK-JS-MICROMATCH-6838728](https://snyk.io/vuln/SNYK-JS-MICROMATCH-6838728) | Yes | No Known Exploit (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: @typescript-eslint/eslint-plugin The new version differs by 250 commits.
  • 8894106 chore: publish v5.10.0
  • 5046882 fix(type-utils): intersection types involving readonly arrays are now handled in most cases (#4429)
  • 39a6806 fix(type-utils): isTypeReadonly now handles conditional types (#4421)
  • f4016c2 fix(eslint-plugin): [no-extra-semi] false negatives when used with eslint 8.3.0 (#4458)
  • 99ab193 fix(type-utils): union types always being marked as readonly (#4419)
  • ef3147c fix(type-utils): check IndexSignature internals when checking isTypeReadonly (#4417)
  • 3061ea9 chore: bump @ babel/types from 7.16.7 to 7.16.8 (#4454)
  • e56f1e5 fix(eslint-plugin): [no-invalid-this] crash when used with eslint 8.7.0 (#4448)
  • ba3d3a3 chore: bump eslint-plugin-jest from 25.3.4 to 25.7.0 (#4456)
  • 04cb5d8 chore: bump ts-jest from 27.1.2 to 27.1.3 (#4457)
  • d8e296d chore: bump webpack from 5.65.0 to 5.66.0 (#4455)
  • d053cde fix(eslint-plugin): [explicit-function-return-type] support AllowTypedFunctionExpression within AllowHigherOrderFunction (#4250)
  • 8a30108 chore: bump eslint-visitor-keys from 3.1.0 to 3.2.0 (#4452)
  • 377cbcf chore: bump rollup from 2.63.0 to 2.64.0 (#4450)
  • daf7990 chore: bump @ types/prettier from 2.4.2 to 2.4.3 (#4451)
  • 4cb46ff chore: bump downlevel-dts from 0.7.0 to 0.8.0 (#4447)
  • ff05dd8 test(type-utils): fix incorrect utils import (#4453)
  • 95aea18 refactor(eslint-plugin): [restrict-plus-operands] add better error messages (#4332)
  • ea85dda test(type-utils): add basic tests for isTypeReadonly (#4416)
  • c8e650f fix(eslint-plugin): [no-magic-numbers] handle bigint in class props (#4411)
  • 253bfa3 docs: fix typo in comment (#4445)
  • 4bda6ec chore: bump shelljs from 0.8.4 to 0.8.5 (#4442)
  • 9eb0a5b chore: bump follow-redirects from 1.14.5 to 1.14.7 (#4437)
  • 1d55a75 feat: rename `experimental-utils` to `utils` and make `experimental-utils` an alias to the new package (#4172)
See the full diff
Package name: jest The new version differs by 250 commits.
  • 75006e4 v29.0.0
  • 7c82a9f chore: update jest-watch-typeahead again
  • 352ff29 chore: update changelog for release
  • 33ad8c3 docs: Jest 29 blog post (#13103)
  • dda77e5 docs: collapse 28.0 and 28.1 docs (#13104)
  • c0dc84c chore: update jest-watch-typeahead
  • 05f6217 fix: support deep CJS re-exports when using ESM (#13170)
  • 490fd88 chore: update yarn (#13169)
  • 98936a2 docs: Update Enzyme links to use new URL (#13166)
  • 187566a feat(pretty-format): allow to opt out from sorting object keys with `compareKeys: null` (#12443)
  • ae2bed7 chore: tweak regex used in e2e tests (#13129)
  • 8c56d74 docs: Update Configuration.md for added special notes on usage scenarios for pnpm. (#13115)
  • fb1c53d feat(jest-config)!: remove undocumented `collectCoverageOnlyFrom` option (#13156)
  • 075b489 fix: ignore `EISDIR` when resolving symlinks (#13157)
  • 3bef02e feat(@ jest/test-result, @ jest/types)!: replace `Bytes` and `Milliseconds` types with `number` (#13155)
  • 4def94b v29.0.0-alpha.6
  • 0f00d4e fix: replace non-CLI `rimraf` usage (#13151)
  • 6a90a2c fix: Allow updating inline snapshots when test includes JSX (#12760)
  • 983274a feat: Let `babel` find config when updating inline snapshots (#13150)
  • d2ff18a chore: make prettierPath optional in `SnapshotState` (#13149)
  • 7d8d01c feat(circus): added each to failing tests (#13142)
  • a5b52a5 chore(types): separate MatcherContext, MatcherUtils and MatcherState (#13141)
  • 79b5e41 chore: get rid of peer dep warning in website
  • 812763d chore: enable 'no-duplicate-imports' (#13138)
See the full diff
Package name: ts-jest The new version differs by 250 commits.
  • 35cf9e8 chore(release): 27.0.0 (#2617)
  • 9d77c7b docs(devs-infra): prepare docs for v27 (#2614)
  • 6406c6a build(devs-dep): upgrade deps to be compatible to jest 27 (#2613)
  • 2a6e9f9 build(deps-dev): bump eslint-plugin-jsdoc from 34.8.2 to 35.0.0 (#2606)
  • f18fc54 build(deps-dev): bump @ typescript-eslint/parser from 4.24.0 to 4.25.0 (#2607)
  • 5765831 build(deps-dev): bump @ typescript-eslint/eslint-plugin (#2608)
  • 6a8200f build(devs-dep): upgrade jest deps and prettier (#2605)
  • 04a1534 build(deps-dev): bump @ types/yargs from 16.0.2 to 17.0.0 (#2601)
  • 478a494 build(deps-dev): bump @ types/lodash from 4.14.169 to 4.14.170 (#2602)
  • f2093c1 build(deps-dev): bump eslint from 7.26.0 to 7.27.0 (#2603)
  • fc2a067 build(deps-dev): bump eslint-plugin-import from 2.22.1 to 2.23.3 (#2604)
  • 51c6592 build(deps-dev): bump eslint-plugin-jsdoc from 34.8.1 to 34.8.2 (#2594)
  • abddb20 build(deps-dev): bump @ types/yargs from 16.0.1 to 16.0.2 (#2590)
  • 9b95e1e build(deps-dev): bump @ types/react from 17.0.5 to 17.0.6 (#2591)
  • a2e8e3a build(deps-dev): bump eslint-plugin-jsdoc from 34.7.0 to 34.8.1 (#2592)
  • 341b19d build(deps-dev): bump @ typescript-eslint/parser from 4.23.0 to 4.24.0 (#2586)
  • ad93c40 build(deps-dev): bump @ typescript-eslint/eslint-plugin (#2587)
  • 0f4055f build(deps-dev): bump eslint-plugin-jsdoc from 34.6.3 to 34.7.0 (#2588)
  • 181486d build(deps-dev): bump eslint-plugin-jsdoc from 34.2.1 to 34.6.3 (#2583)
  • 530eeda build(deps-dev): bump eslint-plugin-jsdoc from 34.0.2 to 34.2.1 (#2580)
  • 8fd2eb7 build(deps-dev): bump @ types/semver from 7.3.5 to 7.3.6 (#2581)
  • ac46b9c build(deps-dev): bump @ commitlint/cli from 12.1.1 to 12.1.4 (#2576)
  • fa9d8bf build(deps-dev): bump @ types/lodash from 4.14.168 to 4.14.169 (#2575)
  • 7d00304 build(deps-dev): bump @ commitlint/config-angular from 12.1.1 to 12.1.4 (#2577)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/iota-foundation/project/77c9f581-cef1-49a0-9b74-f9b7537182ae?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/iota-foundation/project/77c9f581-cef1-49a0-9b74-f9b7537182ae?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"7b7d4c91-99be-4d3f-8d79-8913348453b4","prPublicId":"7b7d4c91-99be-4d3f-8d79-8913348453b4","dependencies":[{"name":"@typescript-eslint/eslint-plugin","from":"4.1.1","to":"5.10.0"},{"name":"jest","from":"26.4.2","to":"29.0.0"},{"name":"ts-jest","from":"26.3.0","to":"27.0.0"}],"packageManager":"npm","projectPublicId":"77c9f581-cef1-49a0-9b74-f9b7537182ae","projectUrl":"https://app.snyk.io/org/iota-foundation/project/77c9f581-cef1-49a0-9b74-f9b7537182ae?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-BRACES-6838727","SNYK-JS-MICROMATCH-6838728"],"upgrade":["SNYK-JS-BRACES-6838727","SNYK-JS-MICROMATCH-6838728"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[661,661],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Uncontrolled resource consumption](https://learn.snyk.io/lesson/redos/?loc=fix-pr)