[Snyk] Fix for 3 vulnerabilities #162
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
… vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-BRACES-6838727 - https://snyk.io/vuln/SNYK-JS-HAWK-6969142 - https://snyk.io/vuln/SNYK-JS-MICROMATCH-6838728
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.
Changes included in this PR
Vulnerabilities that will be fixed
With an upgrade:
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00045, Social Trends: No, Days since published: 9, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.81, Score Version: V5
SNYK-JS-BRACES-6838727
Why? Confidentiality impact: High, Integrity impact: High, Availability impact: None, Scope: Changed, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Adjacent, EPSS: 0.01055, Social Trends: No, Days since published: 0, Reachable: No, Transitive dependency: No, Is Malicious: No, Business Criticality: High, Provider Urgency: Critical, Package Popularity Score: 99, Impact: 9.6, Likelihood: 2.94, Score Version: V5
SNYK-JS-HAWK-6969142
Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00045, Social Trends: No, Days since published: 9, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.06, Score Version: V5
SNYK-JS-MICROMATCH-6838728
(*) Note that the real score may have changed since the PR was raised.
Release notes
Package name: @cypress/browserify-preprocessor
-
3.0.2 - 2021-11-04
- deps: update dependency glob-parent to version 5.1.2 🌟 (#84) (61dae70)
-
3.0.1 - 2020-07-14
- Handle function transforms when
-
3.0.0 - 2020-05-21
- This plugin now requires Node.js 8+
- Validate type of typescript option and its existence as a path (3fb7b2c)
- Improve error when attempting to preprocess a TypeScript file but the typescript option is not set (36d77a8)
-
2.2.4 - 2020-05-11
- generate sourcemaps on .ts and .tsx files (#51) (d64122c)
-
2.2.3 - 2020-05-08
- Only enable TypeScript jsx compiling for
-
2.2.2 - 2020-04-23
- Fix TypeScript iterator support. (#43) (f549896)
-
2.2.1 - 2020-04-04
- Fix lib files not being published (#40) (24117d0)
-
2.2.0 - 2020-04-03
- Add out-of-the-tbox typescript support (#38) (344a057)
-
2.1.4 - 2020-02-11
- Fix non-top-level requires (#37) (642a671)
-
2.1.3 - 2020-02-05
- use newer module exports plugin (#35) (8601521)
-
2.1.2 - 2020-02-05
-
2.1.1 - 2019-06-07
from @cypress/browserify-preprocessor GitHub release notes3.0.2 (2021-11-04)
Miscellaneous
3.0.1 (2020-07-14)
Bug Fixes
typescriptis set (#57) (fb2f417), closes #563.0.0 (2020-05-21)
Breaking Changes
Bug Fixes
2.2.4 (2020-05-11)
Bug Fixes
2.2.3 (2020-05-08)
Bug Fixes
.js,.jsx, and.tsxfiles (#45) (00e9be9)2.2.2 (2020-04-23)
Bug Fixes
2.2.1 (2020-04-04)
Bug Fixes
2.2.0 (2020-04-03)
Features
2.1.4 (2020-02-11)
Bug Fixes
2.1.3 (2020-02-05)
Bug Fixes
Package name: add-asset-html-webpack-plugin
-
5.0.0 - 2022-03-08
- update globby to v11 (#248) (7265aba), closes #231
-
4.0.1 - 2022-03-08
- include src in npm package (c1cf189)
-
4.0.0 - 2022-03-08
- update micromatch to v4 (#199) (4073291)
- Drops support for Node v6, v8, v10 and v15
-
3.2.2 - 2022-03-08
- remove the hash calculation if hash exists (#159) (8387886)
-
3.2.1 - 2022-03-08
- fix "compilation.emitAsset" with more than 1 HtmlWebpackPlugins (#236) (e84e7d5)
-
3.2.0 - 2021-02-20
- add support for webpack@5 and html-webpack-plugin@5 (#187) (a3c0134)
-
3.1.3 - 2019-01-27
- do not add trailing commas to compiled output (1e6fb04), closes #147
- upgrade dependencies (60c10f0)
-
3.1.2 - 2018-10-31
- add webpack to peer dependencies (08ace07), closes #141
-
3.1.1 - 2018-10-13
- update TS definition (6f74d9c)
-
3.1.0 - 2018-10-13
- add
-
3.0.1 - 2018-09-16
-
3.0.0 - 2018-09-15
from add-asset-html-webpack-plugin GitHub release notes5.0.0 (2022-03-08)
Bug Fixes
BREAKING CHANGES
filenameno longer accepts a glob pattern, that must be passed asglobinstead.4.0.1 (2022-03-08)
Bug Fixes
4.0.0 (2022-03-08)
Bug Fixes
BREAKING CHANGES
3.2.2 (2022-03-08)
Bug Fixes
3.2.1 (2022-03-08)
Bug Fixes
3.2.0 (2021-02-20)
Features
3.1.3 (2019-01-27)
Bug Fixes
3.1.2 (2018-10-31)
Bug Fixes
3.1.1 (2018-10-13)
Bug Fixes
3.1.0 (2018-10-13)
Features
attributesoption (cfb247a)Package name: braces
-
3.0.3 - 2024-05-21
-
3.0.2 - 2019-04-16
-
3.0.1 - 2019-04-10
-
3.0.0 - 2019-04-08
-
2.3.2 - 2018-04-08
from braces GitHub release notes…aces/pull/40.
3.0.2
3.0.1
Package name: chokidar
-
3.0.0 - 2019-04-30
-
2.1.8 - 2019-08-21
-
2.1.6 - 2019-05-15
-
2.1.5 - 2019-03-22
-
2.1.4 - 2019-03-22
-
2.1.3 - 2019-03-22
-
2.1.2 - 2019-02-18
-
2.1.1 - 2019-02-11
-
2.1.0 - 2019-02-05
-
2.0.4 - 2018-06-18
-
2.0.3 - 2018-03-23
-
2.0.2 - 2018-02-14
-
2.0.1 - 2018-02-08
-
2.0.0 - 2017-12-29
from chokidar GitHub release notesPackage name: expect
Features
[expect]Highlight substring differences when matcher fails, part 1 (#8448)[expect]Highlight substring differences when matcher fails, part 2 (#8528)[expect]Improve report when mock-spy matcher fails, part 1 (#8640)[expect]Improve report when mock-spy matcher fails, part 2 (#8649)[expect]Improve report when mock-spy matcher fails, part 3 (#8697)[expect]Improve report when mock-spy matcher fails, part 4 (#8710)[expect]Throw matcher error when received cannot be jasmine spy (#8747)[expect]Improve report when negative CalledWith assertion fails (#8755)[expect]Improve report when positive CalledWith assertion fails (#8771)[expect]Display equal values for ReturnedWith similar to CalledWith (#8791)[expect, jest-snapshot]Change color from green for some args in matcher hints (#8812)[jest-snapshot]Highlight substring differences when matcher fails, part 3 (#8569)[jest-core]Improve report when snapshots are obsolete (#8448)[jest-cli]Improve chai support (with detailed output, to match jest exceptions) (#8454)[*]Manage the global timeout with--testTimeoutcommand line argument. (#8456)[pretty-format]Render custom displayName of memoized components (#8546)[jest-validate]AllowmaxWorkersas part of thejest.config.js(#8565)[jest-runtime]Allow passing configuration objects to transformers (#7288)[@ jest/core, @ jest/test-sequencer]Support async sort in customtestSequencer(#8642)[jest-runtime, @ jest/fake-timers]Addjest.advanceTimersToNextTimer(#8713)[@ jest-transform]Extract transforming require logic withinjest-coreinto@ jest-transform(#8756)[jest-matcher-utils]Add color options tomatcherHint(#8795)[jest-circus/jest-jasmine2]Give clearer output for Node assert errors (#8792)[jest-runner]Export all types in the type signature ofjest-runner(#8825)Fixes
[jest-cli]Detect side-effect only imports when running--onlyChangedor--changedSince(#8670)[jest-cli]Allow--maxWorkersto work with % input again (#8565)[babel-plugin-jest-hoist]Expand list of whitelisted globals in global mocks (#8429)[jest-core]Make watch plugin initialization errors look nice (#8422)[jest-snapshot]Prevent inline snapshots from drifting when inline snapshots are updated (#8492)[jest-haste-map]Don't throw on missing mapper in Node crawler (#8558)[jest-core]Fix incorrectpassWithNoTestswarning (#8595)[jest-snapshots]Fix test retries that contain snapshots (#8629)[jest-mock]Fix incorrect assignments when restoring mocks in instances where they originally didn't exist (#8631)[expect]Fix stack overflow when matching objects with circular references (#8687)[jest-haste-map]Workaround a node >=12.5.0 bug that causes the process not to exit after tests have completed and cancerous memory growth (#8787)Chore & Maintenance
[docs]Replace FlowType with TypeScript in CONTRIBUTING.MD code conventions[jest-leak-detector]remove code repeat (#8438)[docs]Add example tojest.requireActual(#8482)[docs]Add example tojest.mockfor mocking ES6 modules with thefactoryparameter (#8550)[docs]Add information about usingjest.doMockwith ES6 imports (#8573)[docs]Fix variable name in custom-matcher-api code example (#8582)[docs]Fix example used in custom environment docs (#8617)[docs]Updated react tutorial to refer to new package of react-testing-library (@ testing-library/react) (#8753)[docs]Updated imports of react-testing-library to @ testing-library/react in website (#8757)[jest-core]AddgetVersion(moved fromjest-cli) (#8706)[docs]Fix MockFunctions example that was using toContain instead of toContainEqual (#8765)[*]Make sure copyright header comment includes license (#8783)[*]Check copyright and license as one joined substring (#8815)[docs]Fix WatchPluginsjestHooks.shouldRunTestSuiteexample that receives an object (#8784)[*]Enforce LF line endings (#8809)[pretty-format]Delete obsolete link and simplify structure in README (#8824)[docs]Fix broken transform link on webpack page (#9155)Performance
[jest-watcher]Minor optimization for JestHook (#8746)[@ jest/reporters]Prevent runaway CPU useage with--notifyon macOS (#8830)Features
[jest-circus]Bind to Circus events via an optional event handler on any custom env (#8344)[expect]Improve report when matcher fails, part 15 (#8281)[jest-cli]Update--forceExitand "did not exit for one second" message colors (#8329)[expect]Improve report when matcher fails, part 16 (#8306)[jest-runner]Pass docblock pragmas to TestEnvironment constructor (#8320)[docs]Add DynamoDB guide (#8319)[expect]Improve report when matcher fails, part 17 (#8349)[expect]Improve report when matcher fails, part 18 (#8356)[expect]Improve report when matcher fails, part 19 (#8367)Fixes
[jest-each]Fix bug with placeholder values (#8289)[jest-snapshot]Inline snapshots: do not indent empty lines (#8277)[@ jest/runtime, @ jest/transform]Allow custom transforms for JSON dependencies (#8278)[jest-core]MakedetectOpenHandlesimplyrunInBand(#8283)[jest-haste-map]Fix themapperoption which was incorrectly ignored (#8299)[jest-jasmine2]Fix describe return value warning being shown if the describe function throws (#8335)[jest-environment-jsdom]Re-declare global prototype of JSDOMEnvironment (#8352)[jest-snapshot]Handle arrays when merging snapshots (#7089)[expect]Extract names of async and generator functions (#8362)[jest-runtime]Fix virtual mocks not being unmockable after previously being mocked (#8396)[jest-transform]Replace special characters in transform cache filenames to support Windows (#8353)[jest-config]Allow exactly one project (#7498)Chore & Maintenance
[expect]Fix label and add opposite assertion for toEqual tests (#8288)[docs]Mention Jest MongoDB Preset (#8318)[@ jest/reporters]Migrate away fromistanbul-api(#8294)[*]Delete obsolete emails tag from header comment in test files (#8377)[expect]optimize compare nodes (#8368)[docs]Fix typo in MockFunctionAPI.md (#8406)[LICENSE]Follow copyright header guidelines and delete For Jest software (#8428)Performance
[jest-runtime]Fix module registry memory leak (#8282)[jest-resolve]optimize resolve module path (#8388)[jest-resolve]cache current directory (#8412)[jest-get-type]Simplify checking for primitive (#8416)Fixes
[@ jest/config]NormalizetestSequencerto its absolute path (#8267)[@ jest/console]Print to stderr when callingconsole.error,console.warnorconsole.assertusing thejest-runtimeCLI (#8261)Features
[@ jest/core, @ jest/test-sequencer]MovetestSequencerto individual package@ jest/test-sequencer(#8223)[@ jest/core, jest-cli, jest-config]Add optiontestSequencerallow user use custom sequencer. (#8223)Fixes
[expect]Add negative equality tests for iterables (#8260)[jest-haste-map]Resolve fs watcher EMFILE error (#8258)Chore & Maintenance
[expect]Remove repetition of matcherName and options in matchers (#8224)Performance
Features
[expect]: Improve report when matcher fails, part 13 (#8077)[@ jest/core]Filter API pre-filter setup hook (#8142)[jest-snapshot]Improve report when matcher fails, part 14 (#8132)[@ jest/reporter]Display todo and skip test descriptions when verbose is true (#8038)[jest-runner]Support default exports for test environments (#8163)[pretty-format]Support React.Suspense (#8180)[jest-snapshot]Indent inline snapshots (#8198)[jest-config]Support colors indisplayNameconfiguration (#8025)Fixes
[jest-circus]Fix test retries with beforeAll/beforeEach failures (#8227)[expect]Fix circular references in iterable equality (#8160)[jest-changed-files]Change method of obtaining git root (#8052)[jest-each]Fix test function type (#8145)[jest-fake-timers]getTimerCountnot taking immediates and ticks into account (#8139)[jest-runtime]Allow json file as manual mock (#8159)[pretty-format]PrintBigIntas a readable number instead of{}(#8138)[jest-core]Fix ability to transform dependencies required from globalSetup script (#8143)[@ jest/reporters]Fix Cannot read property converageData of null (#8168)[jest-worker]JEST_WORKER_IDstarts at 1 (#8205)[jest-config]Use default cwd even if config contains a cwd property (#7923)[jest-resolve-dependencies]: Remove internal peer dependencies (#8215)[jest-resolve]: Remove internal peer dependencies (#8215)[jest-snapshot]: Remove internal peer dependencies (#8215)[jest-resolve]Fix requireActual with moduleNameMapper (#8210)[jest-haste-map]Fix haste map duplicate detection in watch mode (#8237)Chore & Maintenance
[*]Remove flow from code base (#8061)[*]Use property initializer syntax in Jest codebase (#8117)[*]Move @ types/node to the root package.json (#8129)[*]Add documentation and tests related to auto-mocking (#8099)[*]Addjest-watch-typeaheadas a devDependency (#6449)[*]upgrade TS to 3.4.0-dev* for incremental builds (#8149)[docs]Improve description of optional arguments in ExpectAPI.md (#8126)Performance
[jest-haste-map]Optimize haste map data structure for serialization/deserialization (#8171)[jest-haste-map]Avoid persisting haste map or processing files when not changed (#8153)[jest-core]Improve performance of SearchSource.findMatchingTests by 15% (#8184)[jest-resolve]Optimize internal cache lookup performance (#8183)[jest-core]Dramatically improve watch mode performance (#8201)[jest-transform]Cache regular expression instead of creating anew for every file in ScriptTransformer (#8235)[jest-core]Fix memory leak of source map info and minor performance improvements (#8234)[jest-console]Fix memory leak by releasing console output reference when printed to stdout (#8233)[jest-runtime]UseMapinstead ofObjectfor module registry (#8232)Features
[jest-haste-map]ExposethrowOnModuleCollisionviaconfig.haste(#8113)Chore & Maintenance
[expect]ExportMatchersinterface fromexpect(#8093)Features
[jest-resolve]Now supports PnP environment without plugins (#8094)Fixes
[expect]Compare DOM nodes even if there are multiple Node classes (#8064)[jest-worker]worker.getStdout()can returnnull(#8083)[jest-worker]Re-attach stdout and stderr from new processes/threads created after retries (#8087)[jest-reporters/jest-runner]SerializechangedFilespassed to workers (#8090)Chore & Maintenance
[*]Make sure to included.tsfiles in the tarball when building (#8086)v24.3.1
We skipped 24.2.0 because a draft was accidentally published. Please use
24.3.0or a newer version instead.Features
[expect]: Improve report when matcher fails, part 10 (#7960)[expect]: Improve report when matcher fails, part 11 (#8008)[expect]: Improve report when matcher fails, part 12 (#8033)[expect]: Improve report when matcher fails, part 7 (#7866)[expect]: Improve report when matcher fails, part 8 (#7876)[expect]: Improve report when matcher fails, part 9 (#7940)[jest-circus/jest-jasmine2]Warn if describe returns a value (#7852)[jest-config]Print error information on preset normalization error (#7935)[jest-get-type]AddisPrimitivefunction (#7708)[jest-haste-map]AddskipPackageJsonoption (#7778)[jest-util]AddisPromise(#7852)[pretty-format]SupportReact.memo(#7891)Fixes
[expect]FixtoStrictEqualnot considering arrays with objects having undefined values correctly (#7938)[expect]Fix custom async matcher stack trace (#7652)[expect]Fix non-object received value in toHaveProperty (#7986, #8067)[expect]Fix non-symmetric equal for Number (#7948)[expect]Remove duck typing and obsolete browser support code when comparing DOM nodes and use DOM-Level-3 API instead (#7995)[jest-changed-files]FixgetChangedFilesFromRootsto not return parts of the commit messages as if they were files, when the commit messages contained multiple paragraphs (#7961)[jest-changed-files]Fix pattern for HG changed files (#8066)[jest-changed-files]Improve default file selection for Mercurial repos (#7880)[jest-circus]Fix bug with test.only (#7888)[jest-circus]: Throw explicit error when errors happen after test is considered complete (#8005)[jest-cli]Fix prototype pollution vulnerability in dependency (#7904)[jest-cli]Refactor-oand--coveragecombined (#7611)[jest-environment-node]Add missing globals: TextEncoder and TextDecoder (#8022)[jest-haste-map]Enforce uniqueness in names (mocks and haste ids) (#8002)[jest-jasmine2]: Throw explicit error when errors happen after test is considered complete (#8005)[jest-mock]Adds a type check toprototypeto allow mocks of objects with a primitiveprototypeproperty. (#8040)[jest-transform]Normalize config and remove unnecessary checks, convertTestUtils.jsto TypeScript (#7801)[jest-util]Make sure to not fail if unable to assigntoStringTagto theprocessobject, which is read only in Node 12 (#8050)[jest-validate]Fix validating async functions (#7894)[jest-worker]Fixjest-workerwhen using pre-allocated jobs (#7934)[static]Remove console log '-' on the front page (#7977)Chore & Maintenance
[*]: Setup building, linting and testing of TypeScript (#7808, #7855, #7951)[@ jest/console]: Extract customconsoleimplementations fromjest-utilinto a new separate package (#8030)[@ jest/core]Create new package, which isjest-climinusyargsandprompts(