search

shikhir-arora / karma-simple

A simple, lightweight and functional Discord Karma tracking bot for guild members.
https://karmabot.vlexar.pw
Creative Commons Zero v1.0 Universal
12 stars 9 forks source link

[Snyk] Security upgrade discord.js from 14.5.1-dev.1664928912-d9137c3.0 to 14.6.0 #28

Closed shikhir-arora closed 1 year ago

shikhir-arora commented 1 year ago

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **623/1000**
**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 4.6 | CRLF Injection
[SNYK-JS-UNDICI-3323844](https://snyk.io/vuln/SNYK-JS-UNDICI-3323844) | No | Proof of Concept ![high severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/h.png "high severity") | **768/1000**
**Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-UNDICI-3323845](https://snyk.io/vuln/SNYK-JS-UNDICI-3323845) | No | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: discord.js The new version differs by 61 commits.
  • c5d5840 chore(discord.js): release discord.js@14.6.0
  • a4bf975 chore(ws): release @ discordjs/ws@0.4.1
  • c2b6777 fix(WebSocketShard): dispatch race condition (#8731)
  • ac83ada types: fix events augmentation (#8681)
  • 02ffce8 chore: make 'Note to developers' on version constant a regular comment (#8730)
  • caba122 fix: app paths (#8729)
  • 7b8966b feat(Util): escape more markdown characters (#8701)
  • 3ed668e chore: move website and guide out of packages
  • 0a9d57b chore: change token in readme to constant (#8688)
  • a31e605 docs(Utils): remove `private` from `parseEmoji` (#8718)
  • 7556db2 docs: update UserContextMenuCommandInteraction documentation (#8717)
  • 4c2955a fix(ClientOptions): make `ClientOptions#intents` returns an IntentsBitField (#8617)
  • 5f72d8b fix: website fonts
  • a5d2ce2 fix: alert component text selection
  • e548e6a fix: correctly construct a builder (#8727)
  • 6fd331d fix(Components): error with unknown components (#8724)
  • 32297d4 feat: prefetch pages for better navigation
  • 1b4f69b feat(guide): add github links for pages (#8725)
  • 1ea7664 fix: remove turbo experiment again
  • 723c0b9 fix: 404 not resolving
  • f0dd41f build: compress prod build
  • b6c0ab8 feat: implement turbo for navigation
  • 6120971 fix: height styling on toc
  • 87ec392 chore: update readmes
See the full diff
Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: 🧐 [View latest project report](https://app.snyk.io/org/shikhir-arora/project/de60db25-273a-49c6-8524-cd74263afadf?utm_source=github&utm_medium=referral&page=fix-pr) 🛠 [Adjust project settings](https://app.snyk.io/org/shikhir-arora/project/de60db25-273a-49c6-8524-cd74263afadf?utm_source=github&utm_medium=referral&page=fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"c6aa60ab-343a-40f5-8c39-9234772a26ed","prPublicId":"c6aa60ab-343a-40f5-8c39-9234772a26ed","dependencies":[{"name":"discord.js","from":"14.5.1-dev.1664928912-d9137c3.0","to":"14.6.0"}],"packageManager":"npm","projectPublicId":"de60db25-273a-49c6-8524-cd74263afadf","projectUrl":"https://app.snyk.io/org/shikhir-arora/project/de60db25-273a-49c6-8524-cd74263afadf?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-UNDICI-3323844","SNYK-JS-UNDICI-3323845"],"upgrade":["SNYK-JS-UNDICI-3323844","SNYK-JS-UNDICI-3323845"],"isBreakingChange":false,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","priorityScore"],"priorityScoreList":[623,768]}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [CRLF Injection](https://learn.snyk.io/lessons/malicious-code-injection/javascript/?loc=fix-pr) 🦉 [Regular Expression Denial of Service (ReDoS)](https://learn.snyk.io/lessons/redos/javascript/?loc=fix-pr) - - - This change is [Reviewable](https://reviewable.io/reviews/shikhir-arora/karma-simple/28)