Skip to content

[Snyk] Fix for 8 vulnerabilities#22

Open
snyk-bot wants to merge 1 commit into
masterfrom
snyk-fix-ee6ad486cba65801f370fb3eb8a3bbb6
Open

[Snyk] Fix for 8 vulnerabilities#22
snyk-bot wants to merge 1 commit into
masterfrom
snyk-fix-ee6ad486cba65801f370fb3eb8a3bbb6

Conversation

@snyk-bot
Copy link
Copy Markdown
Contributor

@snyk-bot snyk-bot commented Nov 4, 2019

Description

This PR fixes one or more vulnerable packages in the yarn dependencies of this project.
See the Snyk test report for more details.

Snyk Project: wgoodall01/wikipath:web/wikipath-web/package.json

Snyk Organization: wgoodall01

Lockfile

If you are using package-lock.json or yarn.lock, please re-lock your dependencies and push an updated lockfile before merging this PR.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • web/wikipath-web/.snyk
    • web/wikipath-web/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Title Issue ID Breaking Change
medium severity Denial of Service (DoS) SNYK-JS-JSYAML-173999 Yes
high severity Arbitrary Code Execution SNYK-JS-JSYAML-174129 Yes
high severity Information Exposure SNYK-JS-WEBPACKDEVSERVER-72405 Yes
low severity Regular Expression Denial of Service (ReDoS) npm:braces:20180219 Yes
low severity Regular Expression Denial of Service (ReDoS) npm:eslint:20180222 Yes
With a Snyk patch:
Severity Title Issue ID
high severity Prototype Pollution npm:extend:20180424
medium severity Prototype Pollution npm:hoek:20180212
medium severity Uninitialized Memory Exposure npm:stringstream:20180511

You can read more about Snyk's upgrade and patch logic in Snyk's documentation.

Check the changes in this PR to ensure they won't cause issues with your project.

Stay secure,
The Snyk team

Note: You are seeing this because you or someone else with access to this repository has authorised Snyk to open Fix PRs. To review the settings for this Snyk project please go to the project settings page.

@codecov
Copy link
Copy Markdown

codecov Bot commented Nov 4, 2019

Codecov Report

Merging #22 into master will not change coverage.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##           master      #22   +/-   ##
=======================================
  Coverage   57.31%   57.31%           
=======================================
  Files           6        6           
  Lines         335      335           
=======================================
  Hits          192      192           
  Misses        133      133           
  Partials       10       10

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e2e9c15...20902c8. Read the comment docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant