search

kmaida / mean-rBox

Recipe box MEAN stack application for creating, storing, and filing recipes.
https://rbox.kmaida.net
MIT License
1 stars 0 forks source link

[Snyk] Security upgrade mongoose-encryption from 1.5.0 to 2.1.1 #86

Open snyk-bot opened 3 years ago

snyk-bot commented 3 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 673/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MPATH-1577289		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: mongoose-encryption The new version differs by 44 commits.
  • 02b1ba1 2.1.1
  • c06e97d Bump mpath from 0.5.2 to 0.8.4 (#101)
  • 65fce61 update mocha
  • 8d8aa89 docs: update copyright
  • e8a6ccb 2.1.0
  • a3f2707 CI: remove explicit support for Node v4 & v6
  • a4b77ae style: cleanup
  • d6f240b ci: add latest node version to tests
  • 09b722b update to support node 15.3.0 and large documents
  • 2b2fbe5 2.0.3
  • 89ec315 Add TypeScript type declarations (#94)
  • 249d44e 2.0.2
  • e145370 Update mpath to v0.5.1 (vulnerability fix) (#85)
  • 4595cc3 2.0.1
  • a22eb88 Upgrade dependencies (#80)
  • 027a697 Release notes for 2.0.0
  • e887f78 2.0.0
  • 06c68cd Decrypt children using encryptedChildren plugin (#79)
  • 3d28a88 Remove Mongoose version conditionals
  • 4add461 Merge branch 'master' of github.com:joegoldbeck/mongoose-encryption
  • 953c5eb Merge commits from @ yelworc and @ colinhemphill
  • e41d10f Merge commits from @ yelworc and @ colinhemphill
  • 8d79fe4 Drop Mongoose v3 & v4 support
  • 818b309 Start 2.0.0-draft
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic