twilio / twilio-voice-notification-app

Reference app built in ReactJS that demonstrates how to leverage Twilio Programmable Voice and Twilio SDKs to create a voice notification system.
Apache License 2.0
36 stars 26 forks source link

[Snyk] Fix for 5 vulnerabilities #91

Closed twilio-product-security closed 2 years ago

twilio-product-security commented 3 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908
Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090599
Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090600
Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090601
Yes Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090602
Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: mochawesome The new version differs by 54 commits.
  • 1b9c68d release v7.0.0
  • 4f18093 Merge pull request #362 from adamgruber/greenkeep
  • bc356a7 Update nodejs.yml
  • 1a11184 Update changelog
  • 33dbf01 Update mochawesome-report-generator
  • 0b4b612 Update chalk
  • 09f9f1d Update strip-ansi dependency
  • 84e02ba release v6.3.1
  • e5a8c50 Merge pull request #357 from kolbasik/hotfix/issue-356
  • 439ae5c Ignore retriedTest serialization to avoid circular issues
  • f478f70 release v6.3.0
  • 9c2d2cd Update npm-publish.yml
  • 2332642 Create npm-publish.yml
  • 9834346 Update nodejs.yml
  • b853d50 Merge pull request #353 from kolbasik/parallel
  • bcf52e0 Make full dump of root suite on EVENT_SUITE_END
  • bb23ed8 Use 'npm ci' instead of 'npm install'
  • 74c2034 Changing the processing of parallel events
  • b600095 Calculate skipped totals while cleaning suites (#348)
  • 2f501e6 Update nodejs.yml
  • 18d6ac5 README: add note about typescript types
  • c896191 release v6.2.2
  • a5d0e26 Greenkeeping (#342)
  • 341fcb5 release v6.2.1
See the full diff
Package name: mochawesome-report-generator The new version differs by 38 commits.
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

ricardotwilio commented 2 years ago

Will update dependencies manually