search

sdelements / lets-chat

Self-hosted chat app for small teams
http://sdelements.github.io/lets-chat
MIT License
9.76k stars 1.58k forks source link

[Snyk] Fix for 1 vulnerabilities #837

Open saralaw1212 opened 7 months ago

saralaw1212 commented 7 months ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **630/1000**
**Why?** Has a fix available, CVSS 8.1 | Internal Property Tampering
[SNYK-JS-BSON-6056525](https://snyk.io/vuln/SNYK-JS-BSON-6056525) | Yes | No Known Exploit (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: connect-mongo The new version differs by 90 commits.
  • 63ca966 docs: update readme and bump version to 3.0.0
  • aceb1ee chore: bump version to 3.0.0-rc.2
  • 0e4a234 test: add test cases on event listener
  • e77a7f1 test: replace mocha with jest (#324)
  • ad39e88 test: replace deprecated collection.insert to collection.insertOne
  • 545c06e docs: update README on testing
  • 2d5442e chore: upgrade depns mocha
  • 5d3a321 chore: upgrade nyc depns
  • 54cd91d chore: upgrade depns
  • afb7a12 docs: remove some badges
  • 6c2484b docs: update README for supporting version
  • c925c92 test: fix test case
  • 6827330 chore: bump version to 3.0.0-rc.1
  • f62692b ci: update .npmignore
  • aa2637d ci: remove node 6 support and add linting in travis
  • 801291b fix linting error
  • f928547 travis add test on Node 12
  • 12275f0 better linting
  • eb23b1e linting fix
  • 66194c7 bump major version to 3.0.0-rc
  • f29084f Wait for client open, before calling db. (#321)
  • d252bfc Install Stale bot
  • 15d91c1 Transparent crypto support (#314)
  • 08ccada Update readme refer to latest release to avoid confusion
See the full diff
Package name: mongoose The new version differs by 250 commits.
  • 76fae6d chore: release 5.3.9
  • 40d4177 Merge pull request #7213 from NewEraCracker/master
  • 751397c fix(document): run setter only once when doing `.set()` underneath a single nested subdoc
  • 10837d4 test(document): repro #7196
  • 10a63a9 Bump version of bson dependency to match mongodb-core
  • d10274e docs(transactions): add example of aborting a transaction
  • d245847 Merge branch 'master' of github.com:Automattic/mongoose
  • 551a75b chore: add cpc to some pages that were missing it
  • 1ca3514 Merge pull request #7210 from gfranco93/patch-1
  • c1606b6 Merge pull request #7207 from lineus/fix-7098
  • e9d538e Merge pull request #7203 from lineus/fix-7202
  • 8f16b67 fix(document): surface errors in subdoc pre validate
  • 87005a1 test(document): repro #7187
  • 5b1d81c Documentation fix: fixed anchor link
  • eebfb36 docs(query): add note re: cursor()
  • c1e2617 docs(query): improve find() docs re: #7188
  • 526f82d fix(query): run default functions after hydrating the loaded document
  • 320d5f8 test(query): repro #7182
  • 64c6d15 if our update schema path is a nested array do not skip query casting.
  • 5d122e8 test for #7098
  • 5ba13a7 refactor(test): move strictQuery tests to query.test.js since they do not use findOneAndUpdate()
  • 4121629 chore: refer to correct issue #7178
  • 22ed5d2 fix(query): handle strictQuery: 'throw' with nested path correctly
  • 8c16354 test(query): repro #7152
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/saralaw1212/project/36f96f7e-291b-4690-8bfc-fec98a5c7607?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/saralaw1212/project/36f96f7e-291b-4690-8bfc-fec98a5c7607?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"879fab4f-a9fa-4ca2-8ee1-cdad5fcfd891","prPublicId":"879fab4f-a9fa-4ca2-8ee1-cdad5fcfd891","dependencies":[{"name":"connect-mongo","from":"1.3.2","to":"3.0.0"},{"name":"mongoose","from":"4.13.21","to":"5.3.9"}],"packageManager":"npm","projectPublicId":"36f96f7e-291b-4690-8bfc-fec98a5c7607","projectUrl":"https://app.snyk.io/org/saralaw1212/project/36f96f7e-291b-4690-8bfc-fec98a5c7607?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-BSON-6056525"],"upgrade":["SNYK-JS-BSON-6056525"],"isBreakingChange":true,"env":"prod","prType":"fix","templateVariants":["priorityScore"],"priorityScoreList":[630],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Learn about vulnerability in an interactive lesson of Snyk Learn.](https://learn.snyk.io/?loc=fix-pr)