Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 80 vulnerabilities #2

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 80 vulnerabilities #2

wants to merge 1 commit into from

Conversation

snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • backend/package.json
    • backend/package-lock.json
    • backend/.snyk

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ACORN-559469		 No No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Prototype Pollution
SNYK-JS-AJV-584908		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 No Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Information Exposure
SNYK-JS-APOLLOSERVERCORE-571663		 No No Known Exploit
high severity 706/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.7		 Remote Memory Exposure
SNYK-JS-BL-608877		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-BROWSERSLIST-1090194		 No Proof of Concept
high severity 630/1000
Why? Has a fix available, CVSS 8.1		 Internal Property Tampering
SNYK-JS-BSON-561052		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-CODEMIRROR-1016937		 No Proof of Concept
low severity 410/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-CODEMIRROR-569611		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-CSSWHAT-1298035		 No No Known Exploit
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Arbitrary File Write via Archive Extraction (Zip Slip)
SNYK-JS-DECOMPRESS-557358		 No Proof of Concept
medium severity 554/1000
Why? Has a fix available, CVSS 6.8		 Cryptographic Issues
SNYK-JS-ELLIPTIC-1064899		 No No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Timing Attack
SNYK-JS-ELLIPTIC-511941		 No No Known Exploit
high severity 706/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.7		 Cryptographic Issues
SNYK-JS-ELLIPTIC-571484		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 No Proof of Concept
medium severity 711/1000
Why? Mature exploit, Has a fix available, CVSS 6.5		 Cross-site Scripting (XSS)
SNYK-JS-GRAPHQLPLAYGROUNDHTML-571775		 No Mature
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HOSTEDGITINFO-1088355		 No Proof of Concept
medium severity 626/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.1		 Man-in-the-Middle (MitM)
SNYK-JS-HTTPSPROXYAGENT-469131		 No Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-INI-1048974		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ISSVG-1085627		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ISSVG-1243891		 No Proof of Concept
high severity 644/1000
Why? Has a fix available, CVSS 8.6		 Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922		 No No Known Exploit
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7		 Validation Bypass
SNYK-JS-KINDOF-537849		 No Proof of Concept
critical severity 704/1000
Why? Has a fix available, CVSS 9.8		 SQL Injection
SNYK-JS-KNEX-471962		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		 No Proof of Concept
high severity 681/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.2		 Command Injection
SNYK-JS-LODASH-1040724		 No Proof of Concept
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
SNYK-JS-LODASH-567746		 No Proof of Concept
critical severity 704/1000
Why? Has a fix available, CVSS 9.8		 Prototype Pollution
SNYK-JS-LODASH-590103		 No No Known Exploit
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-LODASH-608086		 No Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MINIMIST-559764		 No Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MONGOOSE-1086688		 No Proof of Concept
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Information Exposure
SNYK-JS-MONGOOSE-472486		 No No Known Exploit
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-MPATH-1577289		 No Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-MQUERY-1050858		 No Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-MQUERY-1089718		 No Proof of Concept
medium severity 520/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service
SNYK-JS-NODEFETCH-674311		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Certificate Validation
SNYK-JS-NODESASS-1059081		 No No Known Exploit
critical severity 715/1000
Why? Has a fix available, CVSS 9.8		 Use After Free
SNYK-JS-NODESASS-535497		 No No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Denial of Service (DoS)
SNYK-JS-NODESASS-542662		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-NTHCHECK-1586032		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-PATHPARSE-1077067		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1090595		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-POSTCSS-1255640		 No Proof of Concept
critical severity 811/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.8		 Prototype Pollution
SNYK-JS-PROPERTYEXPR-598800		 No Proof of Concept
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-REDIS-1255645		 No No Known Exploit
high severity 619/1000
Why? Has a fix available, CVSS 8.1		 Cross-site Scripting (XSS)
SNYK-JS-SERIALIZEJAVASCRIPT-536840		 No No Known Exploit
high severity 706/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.7		 Arbitrary Code Injection
SNYK-JS-SERIALIZEJAVASCRIPT-570062		 No Proof of Concept
high severity 748/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.1		 Improper Privilege Management
SNYK-JS-SHELLJS-2332187		 No Proof of Concept
low severity 380/1000
Why? Has a fix available, CVSS 3.1		 Reverse Tabnabbing
SNYK-JS-SHOWDOWN-469487		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-SSRI-1246392		 No Proof of Concept
high severity 574/1000
Why? Has a fix available, CVSS 7.2		 Server-side Request Forgery (SSRF)
SNYK-JS-STRAPI-1022256		 No No Known Exploit
critical severity 811/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 9.8		 Improper Access Control
SNYK-JS-STRAPI-480418		 No Proof of Concept
high severity 746/1000
Why? Mature exploit, Has a fix available, CVSS 7.2		 Arbitrary Code Injection
SNYK-JS-STRAPI-536641		 No Mature
low severity 349/1000
Why? Has a fix available, CVSS 2.7		 Denial of Service (DoS)
SNYK-JS-STRAPI-543624		 No No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9		 Access Restriction Bypass
SNYK-JS-STRAPI-572909		 No No Known Exploit
critical severity 679/1000
Why? Has a fix available, CVSS 9.3		 Cross-site Scripting (XSS)
SNYK-JS-STRAPIPLUGINCONTENTMANAGER-1021615		 No No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Improper Authorization
SNYK-JS-STRAPIPLUGINCONTENTTYPEBUILDER-1021616		 No No Known Exploit
high severity 624/1000
Why? Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536528		 No No Known Exploit
high severity 624/1000
Why? Has a fix available, CVSS 8.2		 Arbitrary File Overwrite
SNYK-JS-TAR-1536531		 No No Known Exploit
low severity 410/1000
Why? Has a fix available, CVSS 3.7		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TAR-1536758		 No No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579147		 No No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579152		 No No Known Exploit
high severity 639/1000
Why? Has a fix available, CVSS 8.5		 Arbitrary File Write
SNYK-JS-TAR-1579155		 No No Known Exploit
high severity 751/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 8.6		 Arbitrary Code Execution
SNYK-JS-THENIFY-571690		 No Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-TRIMNEWLINES-1298042		 No No Known Exploit
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-UAPARSERJS-1023599		 No Proof of Concept
medium severity 616/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.9		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-UAPARSERJS-1072471		 No Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-UAPARSERJS-610226		 No Proof of Concept
medium severity 539/1000
Why? Has a fix available, CVSS 6.5		 Improper Input Validation
SNYK-JS-URIJS-1055003		 No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3		 Improper Input Validation
SNYK-JS-URIJS-1078286		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Open Redirect
SNYK-JS-URIJS-1319803		 No Proof of Concept
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-URIJS-1319806		 No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090599		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090600		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090601		 No Proof of Concept
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-VALIDATOR-1090602		 No Proof of Concept
high severity 686/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.3		 Prototype Pollution
SNYK-JS-Y18N-1021887		 No Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6		 Prototype Pollution
SNYK-JS-YARGSPARSER-560381		 No Proof of Concept
high severity 579/1000
Why? Has a fix available, CVSS 7.3		 Prototype Pollution
npm:extend:20180424		 No No Known Exploit
high severity 589/1000
Why? Has a fix available, CVSS 7.5		 Prototype Override Protection Bypass
npm:qs:20170213		 No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: strapi The new version differs by 250 commits.
  • 43b947b v3.6.2
  • c46b6cc Keep metadata during resize images (#10161)
  • ae927f5 Removing positive requirement of integer validation (#10269)
  • a11c236 Update strapi-admin Polish language translations (#10198)
  • e547b11 Fix date field being parsed with a timezone (#10033)
  • 2d8d3fd Added missing translations (#10202)
  • 0bb208d Update German strapi-admin translations (#10207)
  • 807101f Added missing translations (#10205)
  • e780bad Added missing translation (#10204)
  • e2c06e3 Removed extra space (#10203)
  • 95b81cd Added norwegian translation. (#9846)
  • 30ccad9 Fix compatibility issue for mongo < 4.2 (#10281)
  • 436d9fd Upgrade @ buffet.js (#10270)
  • 934a47e Add possibility to set "required" RBAC conditions (#10185)
  • 81a9a63 GraphQL Plugin (bug): Content type's attributes marked as private are being exposed in the exported GraphQL schema (#9805)
  • 3198d19 Fixes #10187 (#10193)
  • 0b31bc3 make listLocales route available (#10255)
  • 311d8e1 Merge pull request #10250 from strapi/fix/sso
  • 8117d47 Fix SSO success redirection
  • 458ade1 Disable dependabot PR for now
  • 32e0453 Bump @ babel/core from 7.13.16 to 7.14.0 (#10231)
  • a7de815 Bump ora from 5.3.0 to 5.4.0 (#10223)
  • 89bcbb1 Bump stylelint from 13.12.0 to 13.13.1 (#10213)
  • ace6572 Update SECURITY.md

See the full diff

Package name: strapi-admin The new version differs by 250 commits.
  • 0ab3503 v3.6.3
  • 092c219 Update yarn lock
  • 8354f4c Upgrade yup to resolve prototype pollution (#10351)
  • 5bb76c1 Issue #8020: Disabled autoPopulate for File model (upload plugin) (#10370)
  • e2cd817 Update de.json (#10361)
  • 85eecf7 Merge pull request #10331 from strapi/feat/export-template
  • c318c3d exit loop if path doesn't exist
  • eec4aa2 copy folders that exist
  • aad0515 remove default path
  • 5bfbf33 change wording
  • c25e212 update test variables
  • e71d573 refactor
  • a6eb49b add template config file to root
  • c2d438b rename export => generate
  • e652a53 add tests
  • 8beb4b8 add export-template command to cli
  • 5207606 Update badges and copy README to main Strapi package for NPM (#10398)
  • 6b8aedf Update slack to discord (#10381)
  • c6b3ab7 fix duplicate locale when creating without specifying the locale (#10378)
  • 55eaa91 Update: dropping MongoDB support (#10266)
  • 631ac69 Add CLI support for branch in direct GitHub URL (#10273)
  • 04ad9bd Merge pull request #10339 from strapi/fix/10328
  • bdfd531 Fixes #10328
  • 4c844a7 Update webhook doc link (#10309)

See the full diff

Package name: strapi-plugin-content-manager The new version differs by 250 commits.
  • 0ab3503 v3.6.3
  • 092c219 Update yarn lock
  • 8354f4c Upgrade yup to resolve prototype pollution (#10351)
  • 5bb76c1 Issue #8020: Disabled autoPopulate for File model (upload plugin) (#10370)
  • e2cd817 Update de.json (#10361)
  • 85eecf7 Merge pull request #10331 from strapi/feat/export-template
  • c318c3d exit loop if path doesn't exist
  • eec4aa2 copy folders that exist
  • aad0515 remove default path
  • 5bfbf33 change wording
  • c25e212 update test variables
  • e71d573 refactor
  • a6eb49b add template config file to root
  • c2d438b rename export => generate
  • e652a53 add tests
  • 8beb4b8 add export-template command to cli
  • 5207606 Update badges and copy README to main Strapi package for NPM (#10398)
  • 6b8aedf Update slack to discord (#10381)
  • c6b3ab7 fix duplicate locale when creating without specifying the locale (#10378)
  • 55eaa91 Update: dropping MongoDB support (#10266)
  • 631ac69 Add CLI support for branch in direct GitHub URL (#10273)
  • 04ad9bd Merge pull request #10339 from strapi/fix/10328
  • bdfd531 Fixes #10328
  • 4c844a7 Update webhook doc link (#10309)

See the full diff

Package name: strapi-plugin-content-type-builder The new version differs by 250 commits.
  • 0ab3503 v3.6.3
  • 092c219 Update yarn lock
  • 8354f4c Upgrade yup to resolve prototype pollution (#10351)
  • 5bb76c1 Issue #8020: Disabled autoPopulate for File model (upload plugin) (#10370)
  • e2cd817 Update de.json (#10361)
  • 85eecf7 Merge pull request #10331 from strapi/feat/export-template
  • c318c3d exit loop if path doesn't exist
  • eec4aa2 copy folders that exist
  • aad0515 remove default path
  • 5bfbf33 change wording
  • c25e212 update test variables
  • e71d573 refactor
  • a6eb49b add template config file to root
  • c2d438b rename export => generate
  • e652a53 add tests
  • 8beb4b8 add export-template command to cli
  • 5207606 Update badges and copy README to main Strapi package for NPM (#10398)
  • 6b8aedf Update slack to discord (#10381)
  • c6b3ab7 fix duplicate locale when creating without specifying the locale (#10378)
  • 55eaa91 Update: dropping MongoDB support (#10266)
  • 631ac69 Add CLI support for branch in direct GitHub URL (#10273)
  • 04ad9bd Merge pull request #10339 from strapi/fix/10328
  • bdfd531 Fixes #10328
  • 4c844a7 Update webhook doc link (#10309)

See the full diff

Package name: strapi-plugin-email The new version differs by 250 commits.
  • 4ab210e v3.6.0
  • b264ceb Merge pull request #10000 from strapi/features/i18n
  • 00637a8 Merge branch 'master' into features/i18n
  • 142da25 Merge pull request #10092 from strapi/i18n/telemetry
  • 2b7e5ad Bump is-docker from 2.2.0 to 2.2.1 (#10087)
  • 750a0ee Add clean stringify
  • 85e40ef Add i18n telemetry
  • 4a0448e Merge branch 'master' into features/i18n
  • 5e40b06 Merge pull request #10073 from strapi/chore/track-plugins
  • 4c822a6 Merge pull request #10086 from strapi/i18n/fix-plural-name
  • 8f76532 Fix graphql naming to use the same input namine convention as the plugin
  • 0852638 Merge branch 'master' into features/i18n
  • 77f87cb add plugins and providers to send event
  • e46a96c Remove broken & useless typdef (#10085)
  • 19a15b4 Fixes private field of target relation being reset - #9712 (#9713)
  • 9ce011b Update missing fields (#10022)
  • e4d4ad1 improve english text (#9858)
  • 9f54542 FIx Email Provider Readme. (#9947)
  • 4a8139a Fix typo in spanish translation (#10060)
  • 009e026 Merge branch 'master' into features/i18n
  • dbcaad3 Merge pull request #10081 from strapi/i18n/allow-env-var-default-locale
  • 7669b52 Fix typo
  • e939a2a Add an env var to set the init locale code on startup
  • 6f6d701 Merge pull request #10079 from strapi/dependabot/npm_and_yarn/eslint-7.24.0

See the full diff

Package name: strapi-plugin-users-permissions The new version differs by 250 commits.
  • 4ab210e v3.6.0
  • b264ceb Merge pull request #10000 from strapi/features/i18n
  • 00637a8 Merge branch 'master' into features/i18n
  • 142da25 Merge pull request #10092 from strapi/i18n/telemetry
  • 2b7e5ad Bump is-docker from 2.2.0 to 2.2.1 (#10087)
  • 750a0ee Add clean stringify
  • 85e40ef Add i18n telemetry
  • 4a0448e Merge branch 'master' into features/i18n
  • 5e40b06 Merge pull request #10073 from strapi/chore/track-plugins
  • 4c822a6 Merge pull request #10086 from strapi/i18n/fix-plural-name
  • 8f76532 Fix graphql naming to use the same input namine convention as the plugin
  • 0852638 Merge branch 'master' into features/i18n
  • 77f87cb add plugins and providers to send event
  • e46a96c Remove broken & useless typdef (#10085)
  • 19a15b4 Fixes private field of target relation being reset - #9712 (#9713)
  • 9ce011b Update missing fields (#10022)
  • e4d4ad1 improve english text (#9858)
  • 9f54542 FIx Email Provider Readme. (#9947)
  • 4a8139a Fix typo in spanish translation (#10060)
  • 009e026 Merge branch 'master' into features/i18n
  • dbcaad3 Merge pull request #10081 from strapi/i18n/allow-env-var-default-locale
  • 7669b52 Fix typo
  • e939a2a Add an env var to set the init locale code on startup
  • 6f6d701 Merge pull request #10079 from strapi/dependabot/npm_and_yarn/eslint-7.24.0

See the full diff

Package name: strapi-utils The new version differs by 250 commits.
  • 4ab210e v3.6.0
  • b264ceb Merge pull request #10000 from strapi/features/i18n
  • 00637a8 Merge branch 'master' into features/i18n
  • 142da25 Merge pull request #10092 from strapi/i18n/telemetry
  • 2b7e5ad Bump is-docker from 2.2.0 to 2.2.1 (#10087)
  • 750a0ee Add clean stringify
  • 85e40ef Add i18n telemetry
  • 4a0448e Merge branch 'master' into features/i18n
  • 5e40b06 Merge pull request #10073 from strapi/chore/track-plugins
  • 4c822a6 Merge pull request #10086 from strapi/i18n/fix-plural-name
  • 8f76532 Fix graphql naming to use the same input namine convention as the plugin
  • 0852638 Merge branch 'master' into features/i18n
  • 77f87cb add plugins and providers to send event
  • e46a96c Remove broken & useless typdef (#10085)
  • 19a15b4 Fixes private field of target relation being reset - #9712 (#9713)
  • 9ce011b Update missing fields (#10022)
  • e4d4ad1 improve english text (#9858)
  • 9f54542 FIx Email Provider Readme. (#9947)
  • 4a8139a Fix typo in spanish translation (#10060)
  • 009e026 Merge branch 'master' into features/i18n
  • dbcaad3 Merge pull request #10081 from strapi/i18n/allow-env-var-default-locale
  • 7669b52 Fix typo
  • e939a2a Add an env var to set the init locale code on startup
  • 6f6d701 Merge pull request #10079 from strapi/dependabot/npm_and_yarn/eslint-7.24.0

See the full diff

With a Snyk patch:
Severity Priority Score (*) Issue Exploit Maturity
medium severity 636/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.3		 Prototype Pollution
SNYK-JS-LODASH-567746		 Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

@snyk-bot
fix: backend/package.json, backend/package-lock.json & backend/.snyk …
21abcef 
…to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ACORN-559469
- https://snyk.io/vuln/SNYK-JS-AJV-584908
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-APOLLOSERVERCORE-571663
- https://snyk.io/vuln/SNYK-JS-BL-608877
- https://snyk.io/vuln/SNYK-JS-BROWSERSLIST-1090194
- https://snyk.io/vuln/SNYK-JS-BSON-561052
- https://snyk.io/vuln/SNYK-JS-CODEMIRROR-1016937
- https://snyk.io/vuln/SNYK-JS-CODEMIRROR-569611
- https://snyk.io/vuln/SNYK-JS-CSSWHAT-1298035
- https://snyk.io/vuln/SNYK-JS-DECOMPRESS-557358
- https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899
- https://snyk.io/vuln/SNYK-JS-ELLIPTIC-511941
- https://snyk.io/vuln/SNYK-JS-ELLIPTIC-571484
- https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
- https://snyk.io/vuln/SNYK-JS-GRAPHQLPLAYGROUNDHTML-571775
- https://snyk.io/vuln/SNYK-JS-HOSTEDGITINFO-1088355
- https://snyk.io/vuln/SNYK-JS-HTTPSPROXYAGENT-469131
- https://snyk.io/vuln/SNYK-JS-INI-1048974
- https://snyk.io/vuln/SNYK-JS-ISSVG-1085627
- https://snyk.io/vuln/SNYK-JS-ISSVG-1243891
- https://snyk.io/vuln/SNYK-JS-JSONSCHEMA-1920922
- https://snyk.io/vuln/SNYK-JS-KINDOF-537849
- https://snyk.io/vuln/SNYK-JS-KNEX-471962
- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
- https://snyk.io/vuln/SNYK-JS-LODASH-590103
- https://snyk.io/vuln/SNYK-JS-LODASH-608086
- https://snyk.io/vuln/SNYK-JS-MINIMIST-559764
- https://snyk.io/vuln/SNYK-JS-MONGOOSE-1086688
- https://snyk.io/vuln/SNYK-JS-MONGOOSE-472486
- https://snyk.io/vuln/SNYK-JS-MPATH-1577289
- https://snyk.io/vuln/SNYK-JS-MQUERY-1050858
- https://snyk.io/vuln/SNYK-JS-MQUERY-1089718
- https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311
- https://snyk.io/vuln/SNYK-JS-NODESASS-1059081
- https://snyk.io/vuln/SNYK-JS-NODESASS-535497
- https://snyk.io/vuln/SNYK-JS-NODESASS-542662
- https://snyk.io/vuln/SNYK-JS-NTHCHECK-1586032
- https://snyk.io/vuln/SNYK-JS-PATHPARSE-1077067
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1090595
- https://snyk.io/vuln/SNYK-JS-POSTCSS-1255640
- https://snyk.io/vuln/SNYK-JS-PROPERTYEXPR-598800
- https://snyk.io/vuln/SNYK-JS-REDIS-1255645
- https://snyk.io/vuln/SNYK-JS-SERIALIZEJAVASCRIPT-536840
- https://snyk.io/vuln/SNYK-JS-SERIALIZEJAVASCRIPT-570062
- https://snyk.io/vuln/SNYK-JS-SHELLJS-2332187
- https://snyk.io/vuln/SNYK-JS-SHOWDOWN-469487
- https://snyk.io/vuln/SNYK-JS-SSRI-1246392
- https://snyk.io/vuln/SNYK-JS-STRAPI-1022256
- https://snyk.io/vuln/SNYK-JS-STRAPI-480418
- https://snyk.io/vuln/SNYK-JS-STRAPI-536641
- https://snyk.io/vuln/SNYK-JS-STRAPI-543624
- https://snyk.io/vuln/SNYK-JS-STRAPI-572909
- https://snyk.io/vuln/SNYK-JS-STRAPIPLUGINCONTENTMANAGER-1021615
- https://snyk.io/vuln/SNYK-JS-STRAPIPLUGINCONTENTTYPEBUILDER-1021616
- https://snyk.io/vuln/SNYK-JS-TAR-1536528
- https://snyk.io/vuln/SNYK-JS-TAR-1536531
- https://snyk.io/vuln/SNYK-JS-TAR-1536758
- https://snyk.io/vuln/SNYK-JS-TAR-1579147
- https://snyk.io/vuln/SNYK-JS-TAR-1579152
- https://snyk.io/vuln/SNYK-JS-TAR-1579155
- https://snyk.io/vuln/SNYK-JS-THENIFY-571690
- https://snyk.io/vuln/SNYK-JS-TRIMNEWLINES-1298042
- https://snyk.io/vuln/SNYK-JS-UAPARSERJS-1023599
- https://snyk.io/vuln/SNYK-JS-UAPARSERJS-1072471
- https://snyk.io/vuln/SNYK-JS-UAPARSERJS-610226
- https://snyk.io/vuln/SNYK-JS-URIJS-1055003
- https://snyk.io/vuln/SNYK-JS-URIJS-1078286
- https://snyk.io/vuln/SNYK-JS-URIJS-1319803
- https://snyk.io/vuln/SNYK-JS-URIJS-1319806
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090599
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090600
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090601
- https://snyk.io/vuln/SNYK-JS-VALIDATOR-1090602
- https://snyk.io/vuln/SNYK-JS-Y18N-1021887
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381
- https://snyk.io/vuln/npm:extend:20180424
- https://snyk.io/vuln/npm:qs:20170213


The following vulnerabilities are fixed with a Snyk patch:
- https://snyk.io/vuln/SNYK-JS-LODASH-567746
@commit-lint
Copy link

commit-lint bot commented Jan 13, 2022

Bug Fixes

  • backend/package.json, backend/package-lock.json & backend/.snyk to reduce vulnerabilities (21abcef)

Contributors

snyk-bot

Commit-Lint commands

You can trigger Commit-Lint actions by commenting on this PR:

  • @Commit-Lint merge patch will merge dependabot PR on "patch" versions (X.X.Y - Y change)
  • @Commit-Lint merge minor will merge dependabot PR on "minor" versions (X.Y.Y - Y change)
  • @Commit-Lint merge major will merge dependabot PR on "major" versions (Y.Y.Y - Y change)
  • @Commit-Lint merge disable will desactivate merge dependabot PR
  • @Commit-Lint review will approve dependabot PR
  • @Commit-Lint stop review will stop approve dependabot PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@snyk-bot