mongodb / docs-realm

Realm Database SDK documentation
https://www.mongodb.com/docs/realm/
44 stars 88 forks source link

[Snyk] Upgrade realm-web from 2.0.0 to 2.0.1 #3305

Closed admin-token-bot closed 3 months ago

admin-token-bot commented 3 months ago

snyk-top-banner

Snyk has created this PR to upgrade realm-web from 2.0.0 to 2.0.1.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


Issues fixed by the recommended upgrade:

Issue Score Exploit Maturity
high severity Path Traversal
SNYK-JS-WEBPACKDEVMIDDLEWARE-6476555
477 Proof of Concept
high severity Denial of Service (DoS)
SNYK-JS-WS-7266574
477 Proof of Concept
high severity Denial of Service (DoS)
SNYK-JS-WS-7266574
477 Proof of Concept
high severity Uncontrolled resource consumption
SNYK-JS-BRACES-6838727
477 Proof of Concept
high severity Inefficient Regular Expression Complexity
SNYK-JS-MICROMATCH-6838728
477 No Known Exploit
medium severity Improper Control of Dynamically-Managed Code Resources
SNYK-JS-EJS-6689533
477 No Known Exploit
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509
477 No Known Exploit
medium severity Information Exposure
SNYK-JS-FOLLOWREDIRECTS-6444610
477 Proof of Concept
medium severity Uncontrolled Resource Consumption
SNYK-JS-GRPCGRPCJS-7242922
477 No Known Exploit
Release notes
Package name: realm-web
  • 2.0.1 - 2024-05-30

    Note

    This version communicates with Atlas Device Services through a different URL (https://services.cloud.mongodb.com). While we consider this an internal detail of the SDK, you might need to update rules in firewalls or other configuration that you've used to limit connections made by your app.

    Fixed

    • Fixed an endless loop of requests that would happen if linking credentials failed due to an authentication failure. (#6588, since v0.6.0)
    • Logging in with Credentials.anonymous() credentials will now reuse any existing anonymous user which is already authenticated with the app. This aligns with the behaviour of the realm package and will result in less users being created. Use Credentials.anonymous(false) to disable this behaviour and achieve the old behaviour of creating new anonymous users on every login. (#6592)
    • Fixed crash in Chrome from calling stream.return() on a watch stream. (PR #6688)

    Internal

  • 2.0.0 - 2022-10-18
from realm-web GitHub release notes

[!IMPORTANT]

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • This PR was automatically created by Snyk using the credentials of a real user.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

docs-builder-bot commented 3 months ago

✨ Staging URL: https://docs-atlas-staging.mongodb.com/realm/docsworker-xlarge/snyk-upgrade-397b630b733b45da3b446c022f17d3ad/

🪵 Logs