search

twilio / twilio-voice-notification-app

Reference app built in ReactJS that demonstrates how to leverage Twilio Programmable Voice and Twilio SDKs to create a voice notification system.
Apache License 2.0
36 stars 26 forks source link

[Snyk] Security upgrade webpack-dev-server from 3.11.3 to 4.7.3 #95

Closed twilio-product-security closed 2 years ago

twilio-product-security commented 2 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 566/1000
Why? Recently disclosed, Has a fix available, CVSS 5.6		 Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430337		 Yes No Known Exploit
high severity 651/1000
Why? Recently disclosed, Has a fix available, CVSS 7.3		 Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430339		 Yes No Known Exploit
medium severity 566/1000
Why? Recently disclosed, Has a fix available, CVSS 5.6		 Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430341		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: webpack-dev-server The new version differs by 250 commits.
  • 5280ee7 docs: fix typo
  • d834582 chore(release): 4.7.3
  • 7b8c85b chore(deps): update `selfsigned` (#4170)
  • d598325 chore: fix lint
  • c1907f1 refactor: remove redundant `if` statements (#4158)
  • e535f25 ci: debug (#4144)
  • 75999bb chore(release): 4.7.2
  • 90a96f7 ci: fix (#4143)
  • f6bc644 fix: compatible with `onAfterSetupMiddleware`
  • 317e4b9 docs: fix testing instructions (#4133)
  • ff4550e test: remove redundant test cases related to 3rd party code (#4131)
  • 0dd1ee6 test: add e2e tests for `setupExitSignals` option (#4130)
  • afe4975 chore(release): 4.1.7
  • 4e5d8ea fix: droped `url` package (#4132)
  • b0c98f0 chore(release): 4.7.0
  • 3138213 chore(deps): update (#4127)
  • 8f02c3f feat: added types
  • f4fb15f fix: update description of `onAfterSetupMiddleware` and `onBeforeSetupMiddleware` options (#4126)
  • 37b73d5 test: add e2e test for `WEBPACK_SERVE` env variable (#4125)
  • f5a9d05 chore(deps-dev): bump eslint from 8.4.1 to 8.5.0 (#4121)
  • c9b959f chore(deps): bump ws from 8.3.0 to 8.4.0 (#4124)
  • 42208aa chore(deps-dev): bump lint-staged from 12.1.2 to 12.1.3 (#4122)
  • f440f84 chore(deps): bump express from 4.17.1 to 4.17.2 (#4120)
  • c13aa56 feat: added the `setupMiddlewares` option (#4068)
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

ricardotwilio commented 2 years ago

Will update dependencies manually