Open victornpb opened 8 months ago
socket-security[bot]
commented
8 months ago Updated dependencies detected. Learn more about Socket for GitHub ↗︎
| Packages | Version | New capabilities | Transitives | Size | Publisher |
|---|---|---|---|---|---|
| jsdom | 16.4.0...16.6.0 | network | +20/-63 |
5.32 MB | domenic |
socket-security[bot]
commented
8 months ago 🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎
To accept the risk, merge this PR and you will not be notified again.
| Issue | Package | Version | Note | Source |
|---|---|---|---|---|
| Dynamic require | url-parse | 1.5.10 |
|
Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Packages should avoid dynamic imports when possible. Audit the use of dynamic require to ensure it is not executing malicious or vulnerable code.
Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.
If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.
To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all
@SocketSecurity ignore url-parse@1.5.10
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
#### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json - package-lock.json #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:-------------------------  | **644/1000****Why?** Has a fix available, CVSS 8.6 | Prototype Pollution
[SNYK-JS-JSONSCHEMA-1920922](https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922) | No | No Known Exploit  | **586/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.3 | Regular Expression Denial of Service (ReDoS)
[SNYK-JS-LODASH-1018905](https://snyk.io/vuln/SNYK-JS-LODASH-1018905) | No | Proof of Concept  | **681/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.2 | Command Injection
[SNYK-JS-LODASH-1040724](https://snyk.io/vuln/SNYK-JS-LODASH-1040724) | No | Proof of Concept  | **696/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 7.5 | Prototype Poisoning
[SNYK-JS-QS-3153490](https://snyk.io/vuln/SNYK-JS-QS-3153490) | No | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Commit messages
Package name: jsdom
The new version differs by 68 commits.- 74a8d1e Version 16.6.0
- f51f2ec Remove the dependency on request
- 2b6d5ae Update dependencies
- b72b33b Disable now-crashing canvas test
- 39b7972 Handle null and undefined thrown as exceptions
- 04f6c13 Add ParentNode.replaceChildren() (#3176)
- e4c4004 Version 16.5.3
- 2f41466 Fix MutationObserver infinite loop bugs (#3173)
- b232f2a Run partially-failing WPTs in the custom-elements directory
- 35e103e Run partially-failing WPTs in the cors directory
- 77b660a Run partially-failing WPTs in the FileAPI directory
- d8a245f Use `InnerHTML` mixin for `innerHTML` definition (#2981)
- bd50bbe Version 16.5.2
- d5cfd69 Fix event handler ObjectEnvironment instantiation
- 93e3d4a Remove vestigial concurrentNodeIterators option-passing
- c92f9c1 Check all associated elements for form validity
- 2202703 Fix failing WPTs calculation
- 21c7671 Upgrade dependencies
- c1b9ea1 Port skipped "test_body_event_handler_inline" to WPT
- a13d854 Use WeakRefs for NodeIterator tracking when supported
- fdf97d8 Fix radio/checkbox to not fire events when disconnected
- 761d8cc Refactor <output>
- b36d418 Make customElements.whenDefined() resolve with the constructor
- c5d13bb Remove a variety of redundant to-port tests
See the full diff