search

mmomtchev / react-native-settings

React Native Universal Settings Screen
ISC License
3 stars 0 forks source link

[Snyk] Fix for 4 vulnerabilities #1

Closed snyk-bot closed 1 year ago

snyk-bot commented 1 year ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIHTML-1296849		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-GHPAGES-3042993		 Yes No Known Exploit
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Server-side Request Forgery (SSRF)
SNYK-JS-PARSEURL-3023021		 Yes Proof of Concept
medium severity 571/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5		 Improper Input Validation
SNYK-JS-PARSEURL-3024398		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: documentation The new version differs by 92 commits.
  • 5b7e6cd fix changelog
  • 73609e5 chore(release): 14.0.1
  • 97e9361 chore: upgrade git-url-parse to 13.1.0 (#1565)
  • 849a083 chore(release): 14.0.0
  • 42b14a0 build(deps-dev): bump eslint from 8.21.0 to 8.22.0 (#1547)
  • 85ecbbf build(deps): bump @ babel/generator from 7.18.10 to 7.18.12 (#1545)
  • 4609719 chore(release): 14.0.0-alpha.1
  • f513485 Align babel plugin list with Prettier
  • 5d66953 Sort babel plugins
  • 7e17203 revert to upsteam package-lock.json
  • 3f187d7 feat: :sparkles: update Babel, copy list of plugins from Prettier
  • 73bb2a4 chore(release): 14.0.0-alpha.0
  • 390edff Update release instructions
  • e4ba155 patch updates to babel and husky
  • 9941fb6 Bump husky from 4 to 8
  • 69066bb don't ignore updates to husky
  • 3d2c043 run migration script from husky 4 to 8
  • c5e0156 Merge pull request #1541 from documentationjs/bump-mock-fs
  • 8236bd0 Bump to mock-fs 5.1.4
  • ab0cade Merge pull request #1530 from SojinSamuel/patch-1
  • 77968e1 Bump mock-fs from 5.1.2 to 5.1.3
  • 0d04462 Merge pull request #1540 from documentationjs/Add-test-suite-for-node-18
  • a6dc1bd Add test suite for node 18
  • 2c885bf Run npm audit fix
See the full diff
Package name: gh-pages The new version differs by 19 commits.
  • f729b97 5.0.0
  • 51534c7 Log changes
  • ace063b Merge pull request #438 from Vicropht/patch-1
  • 58e54be Merge pull request #459 from tschaub/dependabot/npm_and_yarn/async-3.2.4
  • 2189df3 Bump async from 2.6.4 to 3.2.4
  • 051846e Merge pull request #454 from tschaub/dependabot/npm_and_yarn/email-addresses-5.0.0
  • 5c91c67 Merge pull request #455 from tschaub/dependabot/github_actions/actions/setup-node-3
  • fe0ad83 Merge pull request #453 from tschaub/dependabot/github_actions/actions/checkout-3
  • b89287d Merge pull request #445 from Nezteb/patch-1
  • e890bd1 Bump email-addresses from 3.0.1 to 5.0.0
  • f041e67 Bump actions/setup-node from 1 to 3
  • ca63d1d Bump actions/checkout from 2 to 3
  • f323e23 Merge pull request #452 from tschaub/updates
  • bdc342b Stop testing on 12, start testing on 18
  • 90ee644 Dependabot config
  • e1374b3 Update dependencies and always return a promise
  • fc04b25 Use set for unique dirs
  • 2ebfb74 Update docs to clarify project site configuration
  • a634d5e Remove quotation marks
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS) 🦉 Prototype Pollution 🦉 Server-side Request Forgery (SSRF)

codecov-commenter commented 1 year ago

Codecov Report

Patch and project coverage have no change.

Comparison is base (cccaad0) 100.00% compared to head (6017509) 100.00%.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #1 +/- ## ========================================= Coverage 100.00% 100.00% ========================================= Files 1 1 Lines 177 177 Branches 39 53 +14 ========================================= Hits 177 177 ``` Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Momtchil+Momtchev). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=Momtchil+Momtchev)

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Do you have feedback about the report comment? Let us know in this issue.