twilio-labs / dev-phone

A developer tool for testing SMS and Voice applications
MIT License
75 stars 20 forks source link

[Snyk] Security upgrade babel-loader from 8.3.0 to 9.0.0 #176

Closed twilio-product-security closed 11 months ago

twilio-product-security commented 1 year ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-JS-SEMVER-3247795
Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: babel-loader The new version differs by 16 commits.
  • 9ff288f 9.0.0
  • 006a3dc Update README.md
  • daed88a Update README.md
  • 0ed5fd6 Bump ini from 1.3.5 to 1.3.8 (#968)
  • b1749e3 Bump y18n from 4.0.0 to 4.0.3 (#967)
  • 3a55a4a Bump lodash from 4.17.20 to 4.17.21 (#966)
  • 9a4ffe0 Bump normalize-url from 4.5.0 to 4.5.1 (#962)
  • 28f2482 Bump hosted-git-info from 2.8.8 to 2.8.9 (#964)
  • d850108 Bump glob-parent from 5.1.1 to 5.1.2 (#965)
  • 29de619 Build for node 14.15.0 (#963)
  • 9a2451f Remove dependency on loader-utils and drop webpack 4 support (#942)
  • 12876a5 Bump tar from 6.0.5 to 6.1.11 (#960)
  • 98a708e Bump trim-off-newlines from 1.0.1 to 1.0.3 (#958)
  • 4ae5696 Bump minimist from 1.2.5 to 1.2.7 (#957)
  • 4f00e41 Bump terser from 5.6.1 to 5.15.1 (#959)
  • 87bfae7 Bump babel and node minimum versions (#956)
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🩉 Regular Expression Denial of Service (ReDoS)

ayyrickay commented 1 year ago

I run into the following error when I try to run this:

ReferenceError: SelectedPn is not defined in PhoneNumberPicker.jsx

ReferenceError: SelectedPn is not defined in PhoneNumberPicker.jsx

Would like to see if this can be replicated for somebody else and understand why it's happening. Until we fix it, adding DO NOT MERGE

ayyrickay commented 11 months ago

Fixed by #182