search

matchID-project / deces-backend

API Personnes décédées
https://deces.matchid.io/deces/api/v1/docs
GNU Lesser General Public License v3.0
9 stars 4 forks source link

[Snyk] Security upgrade bullmq from 3.15.8 to 5.3.3 #398

Closed rhanka closed 6 months ago

rhanka commented 6 months ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - backend/package.json - backend/package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **631/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 6.2 | Missing Release of Resource after Effective Lifetime
[SNYK-JS-INFLIGHT-6095116](https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: bullmq The new version differs by 250 commits.
  • e31fe65 chore(release): 5.3.3 [skip ci]
  • 91cf9a9 fix(deps): replaced glob by fast-glob due to security advisory
  • 927d2a5 chore(release): 5.3.2 [skip ci]
  • 7606e36 fix(sandbox): extend SandboxedJob from JobJsonSandbox (#2446) fixes #2439
  • 8f8cb88 test(dragonfly): fix flaky test when getting worker rawnames(#2445)
  • 651d086 chore(release): 5.3.1 [skip ci]
  • 1e9a13f fix(add-job): fix parent job cannot be replaced error message (#2441)
  • 7fc6f91 GITBOOK-192: change request with no subject merged in GitBook
  • bfa1839 chore(release): 5.3.0 [skip ci]
  • 9bf50bc chore(queue-events): add TODO to the comment
  • 7ba2729 feat(worker): add support for naming workers
  • b1432ab GITBOOK-191: change request with no subject merged in GitBook
  • 1a77c16 GITBOOK-190: change request with no subject merged in GitBook
  • 56e578b GITBOOK-189: change request with no subject merged in GitBook
  • 571b417 chore(release): 5.2.1 [skip ci]
  • 8a85207 fix(flow): remove failed children references on auto removal (#2432)
  • 83e8a61 chore(release): 5.2.0 [skip ci]
  • c7559f4 feat(flow): add ignoreDependencyOnFailure option (#2426)
  • 51ef4ae test(flow): do not remove grandparent on regular remove (#2429)
  • 5938664 chore(release): 5.1.12 [skip ci]
  • 1bc26a6 fix(redis-connection): close redis connection even when initializing (#2425) fixes #2385
  • d08cd59 refactor(add-job): remove extra include (#2423)
  • 415f389 docs(guide): fix queueEvents.on failed description (#2420)
  • 4c54873 docs(guide): fix markdown syntax in prioritized jobs (#2421)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/matchid/project/9ab362e3-1966-4cfe-9493-2a33433094c8?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/matchid/project/9ab362e3-1966-4cfe-9493-2a33433094c8?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"15fa6fad-5b45-491b-a0fc-b2deac5cfe12","prPublicId":"15fa6fad-5b45-491b-a0fc-b2deac5cfe12","dependencies":[{"name":"bullmq","from":"3.15.8","to":"5.3.3"}],"packageManager":"npm","projectPublicId":"9ab362e3-1966-4cfe-9493-2a33433094c8","projectUrl":"https://app.snyk.io/org/matchid/project/9ab362e3-1966-4cfe-9493-2a33433094c8?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-INFLIGHT-6095116"],"upgrade":["SNYK-JS-INFLIGHT-6095116"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[631],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Learn about vulnerability in an interactive lesson of Snyk Learn.](https://learn.snyk.io/?loc=fix-pr)
coderabbitai[bot] commented 6 months ago

[!IMPORTANT]

Auto Review Skipped

Review was skipped due to path filters

Files ignored due to path filters (2) * `backend/package-lock.json` is excluded by: `!**/*.json` * `backend/package.json` is excluded by: `!**/*.json`

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share - [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)
Tips ### Chat There are 3 ways to chat with CodeRabbit: - Review comments: Directly reply to a review comment made by CodeRabbit. Example: - `I pushed a fix in commit .` - `Generate unit-tests for this file.` - Files and specific lines of code (under the "Files changed" tab): Tag `@coderabbitai` in a new review comment at the desired location with your query. Examples: - `@coderabbitai generate unit tests for this file.` - `@coderabbitai modularize this function.` - PR comments: Tag `@coderabbitai` in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples: - `@coderabbitai generate interesting stats about this repository from git and render them as a table.` - `@coderabbitai show all the console.log statements in this repository.` - `@coderabbitai read src/utils.ts and generate unit tests.` - `@coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.` Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. ### CodeRabbit Commands (invoked as PR comments) - `@coderabbitai pause` to pause the reviews on a PR. - `@coderabbitai resume` to resume the paused reviews. - `@coderabbitai review` to trigger a review. This is useful when automatic reviews are disabled for the repository. - `@coderabbitai resolve` resolve all the CodeRabbit review comments. - `@coderabbitai help` to get help. Additionally, you can add `@coderabbitai ignore` anywhere in the PR description to prevent this PR from being reviewed. ### CodeRabbit Configration File (`.coderabbit.yaml`) - You can programmatically configure CodeRabbit by adding a `.coderabbit.yaml` file to the root of your repository. - The JSON schema for the configuration file is available [here](https://coderabbit.ai/integrations/coderabbit-overrides.v2.json). - If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: `# yaml-language-server: $schema=https://coderabbit.ai/integrations/coderabbit-overrides.v2.json` ### CodeRabbit Discord Community Join our [Discord Community](https://discord.com/invite/GsXnASn26c) to get help, request features, and share feedback.