jambonz / realtimedb-helpers

utility functions for querying jambonz redis database
0 stars 9 forks source link

[Snyk] Security upgrade undici from 5.18.0 to 5.19.1 #31

Closed snyk-bot closed 1 year ago

snyk-bot commented 1 year ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 623/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 4.6
CRLF Injection
SNYK-JS-UNDICI-3323844
No Proof of Concept
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5
Regular Expression Denial of Service (ReDoS)
SNYK-JS-UNDICI-3323845
No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: undici The new version differs by 13 commits.
  • 984d53b Bumped v5.19.1
  • 6c32c0f lint fixes
  • f2324e5 Merge pull request from GHSA-r6ch-mqf9-qc9w
  • a2eff05 Merge pull request from GHSA-5r9g-qh6m-jxff
  • f5c89e5 Bumped v5.19.0
  • f7c6c6a Make the fetch() abort test pass locally, on Linux and Mac, Node 18 and 19 (#1927)
  • aebb232 fix(types): add missing keepAlive params (#1918)
  • e155c6d doc(mock): update out-of-date reply documentation (#1913)
  • 87fa734 fix(headers): clone getSetCookie list & add getSetCookie type (#1917)
  • ba5ef44 feat: add Headers.prototype.getSetCookie (#1915)
  • 0a59535 fix: remove test (#1916)
  • c0ba75f fix: content-disposition header parsing (#1911)
  • 7827031 fix(fetch): raise AbortSignal max event listeners (#1910)
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 CRLF Injection 🦉 Regular Expression Denial of Service (ReDoS)