raywo / MMM-NowPlayingOnSpotify

A module for MagicMirror displaying the song currently playing on Spotify.
MIT License
205 stars 43 forks source link

[Snyk] Security upgrade npm from 5.10.0 to 7.21.0 #105

Open snyk-bot opened 3 years ago

snyk-bot commented 3 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5
Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908
Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: npm The new version differs by 250 commits.
  • 30a9844 7.21.0
  • 0b2cd9d update AUTHORS
  • 06461ec docs: changelog for v7.21.0
  • 771a1cb chore(tests): fix snapshots
  • 71cdfd8 spdx-license-ids@3.0.10
  • 94f92de make-fetch-happen@9.0.5
  • 7ac621c smart-buffer@4.2.0
  • 218caca is-core-module@2.6.0
  • ff6626a fix(docs): update npm-publish access flag info
  • b6f40b5 tar@6.1.10
  • e9e5ee5 @ npmcli/arborist@2.8.2
  • 991a3bd read-package-json@4.0.0
  • f077724 init-package-json@2.0.4
  • 68a19bb fix(error-message): look for er.path not er.file
  • ff34d6c feat(cache): initial implementation of ls and rm
  • 8183976 normalize-package-data@3.0.3
  • df57f0d @ npmcli/run-script@1.8.6
  • 487731c fix(logging): sanitize logged argv
  • 7a58264 chore(ci): check that docs are up to date in ci
  • 22f3bbb chore(docs): add more 'autogenerated' comments
  • 4314490 fix(docs): revert auto-generated portion of docs
  • 32e88c9 fix(did-you-mean): switch levenshtein libraries
  • 59b9851 7.20.6
  • 2591e67 update AUTHORS
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

sonarcloud[bot] commented 2 years ago

Kudos, SonarCloud Quality Gate passed!    Quality Gate passed

Bug A 0 Bugs
Vulnerability A 0 Vulnerabilities
Security Hotspot A 0 Security Hotspots
Code Smell A 0 Code Smells

No Coverage information No Coverage information
0.0% 0.0% Duplication