New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 5 vulnerabilities #25

Open

snyk-bot wants to merge 1 commit into master from snyk-fix-0666420c1f44f42d7d66be5211e3b0c1

snyk-bot commented May 15, 2023

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- cyclotron-svc/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:mime:20170907	No	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) npm:ms:20151024	Yes	No Known Exploit
	399/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:ms:20170412	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) npm:negotiator:20160616	No	No Known Exploit
	576/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.1	Uninitialized Memory Exposure npm:tunnel-agent:20170305	No	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: body-parser

The new version differs by 157 commits.

77b7431 1.17.2
a39d0af docs: clarify that the middleware filters on Content-Type
a058fb8 deps: [email protected]
524cfa5 build: [email protected]
417be75 build: [email protected]
7f46c5d tests: use safe-buffer
da9c876 build: [email protected]
320af3f build: [email protected]
3d4a4b5 deps: type-is@~1.6.15
6295849 build: [email protected]
24c48f8 deps: [email protected]
57d237f build: [email protected]
737ba9c build: ignore line for code coverage
0f1bed0 1.17.1
0532096 lint: remove unreachable code branches
b34aab5 build: [email protected]
77b1ca1 build: [email protected]
e51dbc5 deps: [email protected]
79bc939 1.17.0
e6140e1 build: [email protected]
42f467d deps: [email protected]
4954aec build: test against Node.js 8.x nightly
e2050df build: [email protected]
2f941c4 build: [email protected]

See the full diff

Package name: compression

The new version differs by 108 commits.

8c3f7ea 1.7.0
c27dc0f build: support Node.js 8.x
d886306 build: [email protected]
598d876 Use safe-buffer for improved Buffer API
47fca12 build: [email protected]
3c78e39 build: [email protected]
6c4c539 deps: [email protected]
6d2de08 deps: compressible@~2.0.10
ac13bc4 deps: [email protected]
527907c deps: [email protected]
6488fc2 build: [email protected]
55532e1 build: [email protected]
0e4ad01 build: [email protected]
be58132 deps: compressible@~2.0.10
4d5238e deps: vary@~1.1.1
4bd00d3 tests: fix flush tests to validate chunks
b980b94 build: [email protected]
6b836c5 build: [email protected]
32206c3 deps: [email protected]
a417be3 deps: [email protected]
b3a4ff7 build: [email protected]
826d622 build: support Node.js 7.x
5cc6772 build: [email protected]
90e4561 lint: use standard style in the README

See the full diff

Package name: errorhandler

The new version differs by 37 commits.

c41e9aa 1.4.3
ffce329 build: [email protected]
90a8777 build: [email protected]
38b745b deps: accepts@~1.3.0
80aea51 deps: escape-html@~1.0.3
b0be93a docs: fix typo in readme
2f688d0 build: support Node.js 5.x
1238ed4 build: [email protected]
fdeb13c build: [email protected]
cc6fd1f build: support Node.js 4.x
3a2117a build: support io.js 3.x
75b9ee1 build: reduce runtime versions to one per major
6797752 tests: add test for util.inspect in HTML response
b6e53d7 docs: add more documentation regarding util.inspect
88b9a58 deps: accepts@~1.2.13
ac75d3f build: [email protected]
5ee62b7 deps: [email protected]
1e89ae7 build: [email protected]
ef1e8f1 build: [email protected]
a7a6dce 1.4.2
692e2e7 deps: accepts@~1.2.12
6f2e8d2 build: [email protected]
564c117 build: fix running Node.js 0.8 tests on Travis CI
2dfd872 1.4.1

See the full diff

Package name: express

The new version differs by 250 commits.

f974d22 4.16.0
8d4ceb6 docs: add more information to installation
c0136d8 Add express.json and express.urlencoded to parse bodies
86f5df0 deps: [email protected]
4196458 deps: [email protected]
ddeb713 tests: add maxAge option tests for res.sendFile
7154014 Add "escape json" setting for res.json and res.jsonp
628438d deps: update example dependencies
a24fd0c Add options to res.download
95fb5cc perf: remove dead .charset set in res.jsonp
44591fe deps: vary@~1.1.2
2df1ad2 Improve error messages when non-function provided as middleware
12c3712 Use safe-buffer for improved Buffer API
fa272ed docs: fix typo in jsdoc comment
d9d09b8 perf: re-use options object when generating ETags
02a9d5f deps: proxy-addr@~2.0.2
c2f4fb5 deps: [email protected]
673d51f deps: [email protected]
5cc761c deps: parseurl@~1.3.2
ad7d96d deps: [email protected]
e62bb8b deps: etag@~1.8.1
70589c3 deps: content-type@~1.0.4
9a99c15 deps: accepts@~1.3.4
550043c deps: [email protected]

See the full diff

Package name: mongoose

The new version differs by 250 commits.

23efdcf chore: release 4.10.2
f627ba5 fix: bump ms -> 2.0.0
b8263d6 fix: bump mquery for regexp vulnerability
84b3e28 docs: improve projection descriptions re: #1534
ca5e53c chore: now working on 4.10.2
3474d8d chore: release 4.10.1
dc6f887 fix(populate): handle doc.populate() with virtuals
a6dd311 test(populate): repro #5240
6a2d405 fix(aggregate): handle sorting by text score correctly
b386516 test(aggregate): repro #5258
54f624e Merge branch 'master' of github.com:Automattic/mongoose
5038635 fix(schema): enforce that _id is never null
f7cbbdc docs: list a couple intermediate changes in changelog
d951bed chore: now working on 4.10.1
274ed0f docs: add missing ignore
43752e8 chore: release 4.10.0
142fbba Merge pull request #5270 from Automattic/4.10
4bc7b3e docs: add missing ignores to sharding plugin
e8c8789 Merge branch '4.10' of github.com:Automattic/mongoose into 4.10
9d4c9d4 Merge branch 'master' into 4.10
b8f0dd8 Merge pull request #5253 from Automattic/5145
f3805fa Merge pull request #5252 from Automattic/4569
8ba7869 Merge pull request #5268 from clozanosanchez/patch-2
373bb6f Update clone method to include indexes

See the full diff

Package name: morgan

The new version differs by 106 commits.

475ae38 1.8.2
b33ed70 deps: [email protected]
864a036 build: [email protected]
ab10b6c build: [email protected]
714577d build: [email protected]
fb33e99 tests: add stream option tests
d265d9f build: [email protected]
e17e76f build: [email protected]
3be5721 build: test against Node.js 8.x nightly
30d7053 build: [email protected]
23b6a30 build: [email protected]
8074ed6 build: [email protected]
29daba3 1.8.1
90d0544 deps: [email protected]
b0e3c90 1.8.0
c8f66a4 build: support Node.js 7.x
78aee59 docs: expand documentation on custom format functions
741615d docs: use rotating-file-stream in rotation example
2693d69 build: add package keywords
c774bbf lint: use standard style in the README
6d3bce4 build: [email protected]
f5d3aaf tests: fix buffer tests to test all expectations
131797d deps: [email protected]
824a0b3 build: [email protected]

See the full diff

Package name: serve-static

The new version differs by 102 commits.

1c58cfd 1.13.0
d9c5e27 deps: [email protected]
843d1ea 1.12.6
54c27ab perf: improve slash collapsing
6159b4b deps: [email protected]
afd17c3 1.12.5
0c4ea33 deps: [email protected]
c859544 deps: parseurl@~1.3.2
2700095 build: [email protected]
f9be141 build: [email protected]
f79acf0 build: [email protected]
7bf8e67 build: [email protected]
c16b4d1 1.12.4
52c2ece deps: [email protected]
ba7c65b build: support Node.js 8.x
93a7d2c build: [email protected]
c36df59 build: [email protected]
c3e33f5 build: [email protected]
281475f 1.12.3
b39c5c8 deps: [email protected]
b28d2b0 build: [email protected]
cb296b7 1.12.2
5dae11e deps: [email protected]
546cf80 build: [email protected]

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)


          fix: cyclotron-svc/package.json to reduce vulnerabilities

17081e5

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/npm:mime:20170907
- https://snyk.io/vuln/npm:ms:20151024
- https://snyk.io/vuln/npm:ms:20170412
- https://snyk.io/vuln/npm:negotiator:20160616
- https://snyk.io/vuln/npm:tunnel-agent:20170305

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet