Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 6 vulnerabilities #18

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 6 vulnerabilities #18

wants to merge 1 commit into from

Conversation

andris9
Copy link
Owner

@andris9 andris9 commented Jun 22, 2022

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Internal Property Tampering
SNYK-JS-BSON-561052		 Yes No Known Exploit
high severity 751/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.6		 Command Injection
SNYK-JS-NODEMAILER-1038834		 Yes Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 HTTP Header Injection
SNYK-JS-NODEMAILER-1296415		 Yes Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
npm:mailsplit:20180625		 No No Known Exploit
medium severity 576/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.1		 Uninitialized Memory Exposure
npm:tunnel-agent:20170305		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: mailsplit The new version differs by 10 commits.

See the full diff

Package name: mongodb The new version differs by 250 commits.
  • 79da11f 3.1.3
  • 337cb79 feat(core): update to mongodb-core 3.1.2
  • ff5fafc refactor(topology-base): `getServer` => `selectServer`
  • b33fc74 3.1.2
  • 78f6977 fix(mongo_client): translate options for connectWithUrl
  • 36e92f1 fix(db_ops): call collection.find() with correct parameters (#1795)
  • 759dd85 fix(buffer): replace deprecated Buffer constructor
  • cb9d915 docs(connect): remove references to MongoClient.connect
  • b8d2f1d fix(teardown): properly destroy a topology when initial connect fails
  • 64027e8 refactor(export): expose CommandCursor
  • 6ef85c4 refactor(export): expose AggregationCursor
  • 13d776f fix(cursor): set readPreference for cursor.count
  • a5d0f1d feat(deprecation): wrap deprecated functions
  • 4f907a0 feat(deprecation): create deprecation function
  • 666b8fa refactor(bulk): Unify bulk operations
  • a0d84f6 test(evergreen): adding evergreen config to native driver
  • b8471f1 fix(collection): isCapped returns false instead of undefined
  • 86344f4 fix(collection): ensure findAndModify always use readPreference primary
  • c25c519 test(countDocuments): full test coverage for countDocuments
  • 25ca557 docs(contributing): fix link to HISTORY.md
  • 4395110 chore(MongoClient): add missing legacy option name on warning message
  • 297d843 docs(sessions): updating docs for sessions
  • 15dc808 fix(db_ops): fix two incorrectly named variables
  • fca1185 fix(count-documents): return callback on error case

See the full diff

Package name: npmlog The new version differs by 16 commits.

See the full diff

Package name: restify The new version differs by 22 commits.
  • b3fd7e9 4.3.4
  • afdfada chore(package): update tunnel-agent to 0.6.0 (#1656)
  • c5a6250 chore(release): update 'make cutarelease' to use 'latest-$majorVer' tag (#1392)
  • 5861a12 4.3.3
  • da6ec7a fix: handle multibyte chars properly in gzip decoder (#1638)
  • fbc5a3b test(server): do not run IPv6 related tests with TEST_SKIP_IP_V6 env. variable (#1547) (#1571)
  • cc1a126 4.3.2
  • 2c02633 fix: get headers 4.x (#1473)
  • 78b7254 4.3.1
  • 4d5db74 fix 'make check' by dropping 'TODO' comments
  • b9637bd fix(static): avoid user-provided data in Error messages being interpreted as sprintf codes (#1384)
  • 468d834 fix(audit): use public APIs for accessing response headers (#1379)
  • 5ca1b81 fix: Honor port value in options object for response.redirect
  • 8358333 patch(dep): Upgrade dtrace plugin to version 0.8.2
  • 1fa876b Merge pull request #1294 from restify/4.x-fix-tests
  • db1abaf Merge branch '4.x' into 4.x-fix-tests
  • 55d4f9a Merge pull request #1295 from restify/uuid
  • 3ce6ed2 Merge branch '4.x' into uuid
  • 7139eef Expose bodyReader plugin
  • 644941a Upgrade: update uuid
  • a402feb fix failing style rules and unit tests
  • 808f30a Fix 'make versioncheck' and 'make cutarelease' where /bin/sh isn't Bash

See the full diff

Package name: smtp-server The new version differs by 55 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@andris9 @snyk-bot