CLAassistant
commented
1 year ago
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------  | **673/1000****Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.6 | Improper Neutralization
[SNYK-JS-SHESCAPE-5849592](https://snyk.io/vuln/SNYK-JS-SHESCAPE-5849592) | No | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: shescape
The new version differs by 250 commits.- 5b0d201 New patch release (#1145)
- 0b976da Provide explicit `$PATH` value to which (#1142)
- 0d65610 Bump eslint-plugin-jsdoc from 46.4.6 to 46.5.0 (#1144)
- 6dc544c Use script to copy .d.ts files to .d.cts (#1143)
- de40b16 Drop commit SHA from artifact IDs (#1141)
- df9bfde Improve executable resolution coverage for Windows (#1138)
- 72b2baf Update throws assertions in line with the test level (#1139)
- dee44a5 Bump nve from 16.1.0 to 16.1.1 (#1136)
- e9fe111 Support Windows shell without `.exe` included (#1137)
- 6940e0f Change `package.json` "linting" to "vetting" (#1133)
- aa1e827 Correct various typos writing "a X" instead of "an X" (#1131)
- a419553 Bump publint from 0.2.0 to 0.2.1 (#1129)
- 7aed3b6 Update `executables.js` (#1126)
- dc090ae Bump knip from 2.19.3 to 2.19.5 (#1124)
- ef439b2 Bump actions/setup-node from 3.8.0 to 3.8.1 (#1123)
- f483aa2 Bump prettier from 3.0.1 to 3.0.2 (#1121)
- cdcc190 Bump actions/setup-node from 3.7.0 to 3.8.0 (#1120)
- faef659 Bump github/codeql-action from 2.21.3 to 2.21.4 (#1119)
- 112da69 Bump eslint from 8.46.0 to 8.47.0 (#1118)
- fb89260 Bump rollup from 3.27.0 to 3.28.0 (#1117)
- 954ccca Harden CI workflow against shell/script injection (#1114)
- 636f2c5 Format type unions in JSDoc consistently (#1112)
- 77eea79 Update license information in `README.md` (#1116)
- ff0e9b7 Bump knip from 2.17.0 to 2.19.3 (#1115)
See the full diff