newrelic / newrelic-node-apollo-server-plugin

Apache License 2.0
62 stars 29 forks source link

[Snyk] Security upgrade newrelic from 10.3.2 to 11.5.0 #279

Closed nr-security-github closed 10 months ago

nr-security-github commented 10 months ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **748/1000**
**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.1 | Cross-site Request Forgery (CSRF)
[SNYK-JS-AXIOS-6032459](https://snyk.io/vuln/SNYK-JS-AXIOS-6032459) | Yes | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: newrelic The new version differs by 80 commits.
  • 20b7680 chore: Release v11.5.0 (#1839)
  • fb06ac9 chore(dep): Updated @ newrelic/security-agent to v0.4.0 (#1837)
  • fe1b4fc ci: Disable fail-fast on nightly versioned test runs (#1836)
  • 06b3364 chore: Release v11.4.0 (#1833)
  • 8b4e963 chore(deps): Updated aws-sdk, koa, superagent (#1831)
  • 9892901 feat: Added support for parsing container ids from docker versions using cgroups v2. (#1830)
  • 81f9450 chore: [Snyk] Upgraded @ grpc/grpc-js from 1.9.2 to 1.9.4. (#1823)
  • 5202048 test: Increased timeout for integration tests to avoid random failures. (#1827)
  • 1ed0c5c chore: release v11.3.0 (#1826)
  • a39f0ef feat: Updated agent initialization to allow running in worker threads when config.worker_threads.enabled is true (#1817)
  • 0928ee3 ci: disable fail-fast on testing jobs to make sure all versions are run before getting canceled because of a flappy test (#1819)
  • 6437671 fix: Updated Elasticsearch instrumentation to only register on v7.13.0+ (#1816)
  • 95ac917 test: updated the grpc versioned tests utils to dynamically bind ports to avoid conflicts between cjs and esm tests (#1820)
  • 317a00a ci: Updated post release script to update the nodejs_agent_version only on staging and us prod, eu will get it via replication now (#1811)
  • d3c8d04 security(deps): bump @ babel/traverse (#1818)
  • 01eaa14 ci: Updated CI workflow to use larger runners on versioned tests but only when running against the main branch (#1812)
  • cb8bee2 chore: included changelog entry for removing ability to run in worker threads to 11.0.0 (#1813)
  • 31a7ad0 test: Removed skipping elasticsearch versioned tests on Node 20 (#1810)
  • 91d3600 chore: Updated release note headers to follow standard sentence caps(#1806)
  • 3a210ad chore: release v11.2.1 (#1808)
  • 99e5792 fix: Updated intialization to properly return the api on start up to the security agent (#1807)
  • 0647411 chore: release v11.2.0 (#1805)
  • 0a54729 ci: add steps to zip up container logs on versioned test failure (#1804)
  • 8380e9d test: Updated elasticsearch container to ignore highwatermark to function on a constrained environment (#1803)
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/newrelic/project/b7d41e5a-4b9a-4796-bf0c-df2678fc5561?utm_source=github-enterprise&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/newrelic/project/b7d41e5a-4b9a-4796-bf0c-df2678fc5561?utm_source=github-enterprise&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"1db38af1-4fd0-4849-ae82-7bfbfce80aae","prPublicId":"1db38af1-4fd0-4849-ae82-7bfbfce80aae","dependencies":[{"name":"newrelic","from":"10.3.2","to":"11.5.0"}],"packageManager":"npm","projectPublicId":"b7d41e5a-4b9a-4796-bf0c-df2678fc5561","projectUrl":"https://app.snyk.io/org/newrelic/project/b7d41e5a-4b9a-4796-bf0c-df2678fc5561?utm_source=github-enterprise&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-AXIOS-6032459"],"upgrade":["SNYK-JS-AXIOS-6032459"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[748],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Cross-site Request Forgery (CSRF)](https://learn.snyk.io/lesson/csrf-attack/?loc=fix-pr)
codecov[bot] commented 10 months ago

Codecov Report

Merging #279 (3530b8b) into main (23a7c87) will not change coverage. The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #279   +/-   ##
=======================================
  Coverage   99.05%   99.05%           
=======================================
  Files           4        4           
  Lines         740      740           
=======================================
  Hits          733      733           
  Misses          7        7           
Flag Coverage Δ
integration-tests-16.x 92.97% <ø> (ø)
integration-tests-18.x 92.97% <ø> (ø)
integration-tests-20.x 92.97% <ø> (ø)
unit-tests-16.x 54.05% <ø> (ø)
unit-tests-18.x 54.05% <ø> (ø)
unit-tests-20.x 54.05% <ø> (ø)
versioned-tests-16.x 95.27% <ø> (ø)
versioned-tests-18.x 95.27% <ø> (ø)
versioned-tests-20.x 95.27% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

:mega: We’re building smart automated test selection to slash your CI/CD build times. Learn more