search

voltrue2 / in-app-purchase

A Node.js module for in-App-Purchase for iOS, Android, Amazon and Windows.
http://iap.gracenode.org
Other
1.05k stars 289 forks source link

[Snyk] Security upgrade xml-crypto from 0.10.1 to 2.1.0 #337

Open voltrue2 opened 3 years ago

voltrue2 commented 3 years ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 556/1000
Why? Recently disclosed, Has a fix available, CVSS 5.4		 XML External Entity (XXE) Injection
SNYK-JS-XMLDOM-1084960		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: xml-crypto The new version differs by 87 commits.
  • ca0e3c3 2.1.0
  • 2136f8e Bump xmldom from 0.1.27 to 0.5.0 (#225)
  • 9d5727b Merge pull request #220 from dosullivan557/master
  • 52aa883 Merge pull request #218 from paulish/master
  • 66fbb50 Bump junit from 4.12 to 4.13.1 in /test/validators/XmlCryptoJava (#217)
  • 6985e40 ignore example files
  • f65947f upversion
  • 0410b22 Formatting package json
  • 6c794eb Formatting package json
  • 8b09330 Updated package json
  • 37c117a 2.1.0
  • 666225d Updated package json to not pull in example into module build
  • 4e8d41e + use existingPrefixes while lookup for references
  • 3d9db71 [SECURITY] Disable HMAC sig methods by default due to key confusion
  • d295ecc 1.5.3
  • 79fc2ac Merge pull request #209 from troyfactor4/master
  • f982b0c return response as well even if async
  • 4ffe0aa Async response for built in algo sign/verify
  • 713f3d8 1.5.2
  • 638ab6c Lock ejs to 2.6.1
  • 2730604 1.5.1
  • 07e2320 Merge pull request #207 from troyfactor4/master
  • 234bc0b enable more use cases by returning the xml object in callback
  • 01d462d Test suites of other projects (mocha) that include v1.5.0 fail with error: "Error: global leak detected: existingPrefixes"
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

svzi commented 3 years ago

@voltrue2 Could you please merge this dependency update?

reecebedding commented 3 years ago

Any update on this at all?

thatshailesh commented 7 months ago

@voltrue2 can you please merge this and other PRs to fix security vulnerabilities?