snyk / vulncost

Find security vulnerabilities in open source npm packages while you code
https://marketplace.visualstudio.com/items?itemName=snyk-security.vscode-vuln-cost
MIT License
202 stars 35 forks source link

[Snyk] Upgrade st from 0.2.4 to 3.0.0 #61

Closed snyk-bot closed 3 years ago

snyk-bot commented 3 years ago

Snyk has created this PR to upgrade st from 0.2.4 to 3.0.0.

merge advice :information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.


Warning: This is a major version upgrade, and may be a breaking change.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Regular Expression Denial of Service (ReDoS)
npm:negotiator:20160616
589/1000
Why? Has a fix available, CVSS 7.5
No Known Exploit
Open Redirect
npm:st:20171013
589/1000
Why? Has a fix available, CVSS 7.5
Mature
Directory Traversal
npm:st:20140206
589/1000
Why? Has a fix available, CVSS 7.5
Proof of Concept
Regular Expression Denial of Service (ReDoS)
npm:mime:20170907
589/1000
Why? Has a fix available, CVSS 7.5
No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: st from st GitHub release notes

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs