sailthru / sailthru-node-client

Sailthru Node.js client
http://docs.sailthru.com
MIT License
17 stars 15 forks source link

[Snyk] Upgrade proxy-agent from 3.1.0 to 3.1.1 #40

Closed snyk-bot closed 3 years ago

snyk-bot commented 3 years ago

Snyk has created this PR to upgrade proxy-agent from 3.1.0 to 3.1.1.

merge advice :information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Man-in-the-Middle (MitM)
SNYK-JS-HTTPSPROXYAGENT-469131
626/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.1
Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: proxy-agent
  • 3.1.1 - 2019-10-22

    Patches

    • Update https-proxy-agent to v3.0.0: #47
    • Use GH Actions instead of Travis-CI: 1a1abb5
    • Update dependencies: 778ea05
    • Use localhost instead of 127.0.0.1 for tests: cd18ccf
    • Update "pack-proxy-agent" to v3.0.1: af5434d

    Credits

    Huge thanks to @ adrukh for helping!

  • 3.1.0 - 2019-03-20

    Minor Changes

    • Add TypeScript types: #34

    Patches

    • Remove package-lock.json file: 063ad8f

    Credits

    Huge thanks to @ jbarrus for helping!

from proxy-agent GitHub release notes
Commit messages
Package name: proxy-agent
  • 4af6f5e 3.1.1
  • af5434d Update "pack-proxy-agent" to v3.0.1
  • cd18ccf Use `localhost` instead of `127.0.0.1` for tests
  • 778ea05 Update dependencies
  • 70ffd00 Meh…
  • 1a1abb5 Use GH Actions instead of Travis-CI
  • 3588645 Update `https-proxy-agent` to v3.0.0 (#47)
Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

ben833 commented 3 years ago

We're on 5.x now, so this vulnerability doesn't exist anymore