New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 11 vulnerabilities #34

Open

laozhudetui wants to merge 1 commit into master from snyk-fix-5888301bb515479242bd9c257429a0fd

Owner

laozhudetui commented Dec 20, 2023

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	589/1000 Why? Has a fix available, CVSS 7.5	Directory Traversal SNYK-JS-MOMENT-2440688	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	Yes	Proof of Concept
	539/1000 Why? Has a fix available, CVSS 6.5	Improper Input Validation SNYK-JS-URIJS-1055003	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-URIJS-1078286	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-URIJS-1319803	Yes	Proof of Concept
	579/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution SNYK-JS-URIJS-1319806	Yes	No Known Exploit
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-URIJS-2401466	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Improper Input Validation SNYK-JS-URIJS-2415026	Yes	Proof of Concept
	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-URIJS-2419067	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Misinterpretation of Input SNYK-JS-URIJS-2440699	Yes	Proof of Concept
	591/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.4	Cross-site Scripting (XSS) SNYK-JS-URIJS-2441239	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: jsonwebtoken

The new version differs by 28 commits.

f313850 8.0.0
f38bd8e updated changelog
2ec3263 Merge pull request demo网站无法访问 YMFE/yapi#393 from ziluvatar/migration-notes-to-readme
12cd8f7 docs: readme, migration notes
cfc04a9 Merge pull request 设置基本路径时不能包含文件后缀 YMFE/yapi#349 from ziluvatar/fix-max-age-number-and-seconds
3305cf0 verify: remove process.nextTick (希望添加对多种http状态码返回结果的支持 YMFE/yapi#302)
0be5409 Reduce size of NPM package (1.3.16升级后测试集合报404 YMFE/yapi#347)
2e7e68d Remove joi to shrink module size (只修改参数必需/非必需, 文本/文件时, 查看改动详情, 提示没有改动 YMFE/yapi#348)
66a4f8b maxAge: Add validation to timespan result
e54e53c update changelog
fb48dde 7.4.3
2e4e30b Merge pull request 环境配置的header中能否填写变量? YMFE/yapi#386 from ziluvatar/issue_381
2a3404f add test & modify guard code
91ba14d Fixed alg non + secret set unit test
b1ff632 Fix for 1.3.17版本创建接口问题 YMFE/yapi#381. Set secret string before using jws when alg is none
e56f904 update changelog
480bb9b 7.4.2
c6a7026 Merge pull request yapi 支持 jsonp 跨域数据么? YMFE/yapi#374 from ziluvatar/add-check-for-empty-secrets
c584d1c sign: add check to be sure secret has a value
43739dc Merge pull request 复制接口操作，"返回数据设置"开关没有被复制 YMFE/yapi#371 from ziluvatar/docs-about-refreshing-tokens
016fc10 docs: about refreshing tokens
5f44a86 Merge pull request 命令行导入数据 YMFE/yapi#365 from ziluvatar/information-regarding-base64-secrets
c25e990 docs: verifying with base64 encoded secrets
2f36063 Merge pull request [bug] body数据为json格式的接口无法保存到测试用例中，手动添加该接口的测试用例的body数据还是无法保存起来 YMFE/yapi#360 from ziluvatar/add-ecdsa-tests

See the full diff

Package name: koa-router

The new version differs by 91 commits.

8fe1d54 11.0.1
d2ad849 feat: allow set router host match (9090端口占用问题，建议yapi server --port 7070 YMFE/yapi#156)
54a3198 11.0.0
fdf7117 chore: drop node 12 from tests
d0c6d8b feat: require node >= 12, modernize, bump deps
68253f6 fix(lib/test/doc): fix jsdoc and typo (为何执行ykit pack -m时报Unknown plugin "transform-runtime" YMFE/yapi#146)
c6a8fc8 feat: add `exclusive` option (Socket Support YMFE/yapi#129)
3454a7d doc: add comma for better understanding (内网部署的，不能通外网。启动服务后，后台提示要连接yapi.demo.qunar.com. 没法进一步部署，怎么处理啊？ YMFE/yapi#145)
13a634d Support symbols as route names (启动报错 YMFE/yapi#143)
6ba3efa feat(deps): update minimal version from 8 -> 12 (执行yapi server后访问9090页面白屏 YMFE/yapi#152)
6db0e68 feat(default-params): replace || cond with default params (POSTMAN 数据导入的问题 YMFE/yapi#153)
6aca720 Improve path checking before route registration (数据管理数据导出，html无法跳转 YMFE/yapi#155)
4fb50ac improve doc for prefix method. (接口运行里的保存按钮无法使用 YMFE/yapi#151)
65414f4 * update deps (本地部署没有成员管理 YMFE/yapi#150)
1aead99 doc: add header to refer to api reference. (已经按文档配置邮件，node提示收件人为定义 YMFE/yapi#112)
05fe8dd Include type installation instructions in README (swagger支持openapi3.0 YMFE/yapi#134)
5cec6fb Replace user with ctx.user in param docs (2xx的http statusCode都应该被处理 YMFE/yapi#136)
90dd73c 10.1.1
904db98 Correct @ hapi/boom usage example (fix: 实现不同group可以创建相同的项目名 YMFE/yapi#128)
fa48560 10.1.0
e9fa04b Fix additional entry inejcted to params (不同的项目之间能使用变量参数吗 YMFE/yapi#124)
344ba0b 10.0.0
89b7c02 Allow router.redirect() to accept external destinations (带参的get请求有问题 YMFE/yapi#110)
56735f0 v9.4.0

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Directory Traversal
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Improper Input Validation
🦉 More lessons are available in Snyk Learn


          fix: package.json & package-lock.json to reduce vulnerabilities

458c337

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-MOMENT-2440688
- https://snyk.io/vuln/SNYK-JS-MOMENT-2944238
- https://snyk.io/vuln/SNYK-JS-URIJS-1055003
- https://snyk.io/vuln/SNYK-JS-URIJS-1078286
- https://snyk.io/vuln/SNYK-JS-URIJS-1319803
- https://snyk.io/vuln/SNYK-JS-URIJS-1319806
- https://snyk.io/vuln/SNYK-JS-URIJS-2401466
- https://snyk.io/vuln/SNYK-JS-URIJS-2415026
- https://snyk.io/vuln/SNYK-JS-URIJS-2419067
- https://snyk.io/vuln/SNYK-JS-URIJS-2440699
- https://snyk.io/vuln/SNYK-JS-URIJS-2441239

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet