search

sshivananda / ts-sqs-consumer

Typescript based sqs consumer
MIT License
3 stars 2 forks source link

[Snyk] Upgrade winston from 3.3.3 to 3.5.0 #124

Open snyk-bot opened 2 years ago

snyk-bot commented 2 years ago

Snyk has created this PR to upgrade winston from 3.3.3 to 3.5.0.

merge advice :information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version fixes:

Severity Issue PriorityScore (*) Exploit Maturity
Regular Expression Denial of Service (ReDoS)
SNYK-JS-COLORSTRING-1082939		 372/1000
Why? Proof of Concept exploit, CVSS 5.3		 Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes
Package name: winston
  • 3.5.0 - 2022-01-27

    This release includes the following, in sequence by first merge in group:

    Feature updates:

    Patch-level updates:

    • Bump dependency versions (thanks @ dependabot & @ DABH!)
      • Bump @ types/node from 16.11.12 to 17.0.8 (PR #2009)
      • Bump @ babel/preset-env from 7.16.7 to 7.16.8 (#2036)
      • Bump @ types/node from 17.0.8 to 17.0.9 (#2035)
      • Bump @ babel/cli from 7.16.7 to 7.16.8 (#2034)
      • Bump @ types/node from 17.0.9 to 17.0.10 (#2042)
      • Bump @ babel/core from 7.16.7 to 7.16.12 (#2041)
      • Bump @ babel/preset-env from 7.16.8 to 7.16.11 (#2040)
    • Fixing documentation syntax errors in transports code examples (#1916; thanks @ romanzaycev!)
    • Fix missing type declarations, especially for .rejections (#1842, #1929, #2021; thanks @ vanflux, @ svaj, @ glensc, & others!)
    • More narrowly typing the “level” string (#1896, thanks @ yonas-g!)
    • Using a safer stringify, e.g. to avoid issues from circular structures, in the http transport (#2043, thanks @ karlwir!)

    Updates to the repo & project which don’t actually affect the running code:

    Thanks also to maintainers @ DABH, @ fearphage, @ Maverick1872, and @ wbt for issue/PR shepherding and help across multiple parts of the release!

    If somebody got missed in the list of thanks, please forgive the accidental oversight and/or feel free to open a PR on the changelog.

  • 3.4.0 - 2022-01-10

    v3.4.0 / 2022-01-10

    Yesterday's release was done with a higher sense of urgency than usual due to vandalism in the colors package. This release:

    • ties up a loose end by including [#1973] to go with [#1824]
    • adds a missing http property in NpmConfigSetColors [#2004] (thanks @ SimDaSong)
    • fixes a minor issue in the build/release process [#2014]
    • pins the version of the testing framework to avoid an issue with a test incorrectly failing [#2017]

    The biggest change in this release, motivating the feature-level update, is [#2006] Make winston more ESM friendly, thanks to @ miguelcobain.

    Thanks also to @ DABH, @ wbt, and @ fearphage for contributions and reviews!

  • 3.3.4 - 2022-01-10

    Version 3.3.4

  • 3.3.3 - 2020-06-23

    v3.3.2...v3.3.3

from winston GitHub release notes
Commit messages
Package name: winston
  • 237534a Release 3.5.0 (#2045)
  • d18198d chore: use safe stringify in http transport (#2043)
  • 8a1735b Update README.md (#2027)
  • 278c492 Bump @ babel/preset-env from 7.16.8 to 7.16.11 (#2040)
  • 609a84b Bump @ babel/core from 7.16.7 to 7.16.12 (#2041)
  • f2d7e06 Bump @ types/node from 17.0.9 to 17.0.10 (#2042)
  • 3b48008 Bump @ babel/cli from 7.16.7 to 7.16.8 (#2034)
  • 4a0ed4f Bump @ types/node from 17.0.8 to 17.0.9 (#2035)
  • 936bc50 Bump @ babel/preset-env from 7.16.7 to 7.16.8 (#2036)
  • 20776fc chore: fix bug request template identation (#2031)
  • 8f0d487 Update issue templates (#2030)
  • 765b564 fixed coverage equation (#2028)
  • 46e0063 chore: added coverage tracking (#2025)
  • 4aac91b Create SECURITY.md (#2024)
  • 3b21cc4 typed level type
  • c0afef6 Typings on LoggerOptions and Logger interfaces. (#2021)
  • a9c7ce1 Fixed syntax errors in transports code examples (#1916)
  • 207a6d2 Fix for http batch support (#1998)
  • 10d9c37 Bump @ types/node from 16.11.12 to 17.0.8 (#2009)
  • c5f6c5c Update package.json version to 3.4.0
  • 6a71cbb Add 3.4.0 release notes
  • 955dffa Pin mocha to v8 as short-term test failure fix
  • 5f38299 Simplify path so that e.g. 'npm run build' can find it more easily
  • 754ca4e More general testing beyond undefined
Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs