Amino.JS [Snyk] Fix for 7 vulnerabilities

[Snyk] Fix for 7 vulnerabilities

Open moelrobi opened this issue 3 years ago • 0 comments

This PR was automatically created by Snyk using the credentials of a real user.

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json
Adding or updating a Snyk policy (.snyk) file; this file is required in order to apply Snyk vulnerability patches. Find out more.

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
619/1000 Why? Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-AJV-584908	No	No Known Exploit
584/1000 Why? Has a fix available, CVSS 7.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-HAWK-2808852	No	No Known Exploit
539/1000 Why? Has a fix available, CVSS 6.5	Information Exposure SNYK-JS-NODEFETCH-2342118	Yes	No Known Exploit
520/1000 Why? Has a fix available, CVSS 5.9	Denial of Service SNYK-JS-NODEFETCH-674311	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: isomorphic-fetch

The new version differs by 12 commits.

fc5e0d0 3.0.0
496fa43 Add version that was previously uncomitted to the package.json due to the previous release process
9f5a8b6 Add a list of alternatives
49280e6 Resolve minor security issue
0f5edd0 Explain why Isomorphic Fetch is needed in docs (#135)
e32b006 Fix travis (#190)
db0aa8c Update to latest version
8bf02c4 Bump node-fetch from 1.7.3 to 2.6.1 (#189)
89c7e70 Merge pull request #93 from paulmelnikow/fetch_ponyfill
25e3cab Add link to fetch-ponyfill
8d33aba Merge pull request #90 from josiah0/update-lintspaces-cli
c22fcda Update lintspaces-cli

Package name: request

The new version differs by 41 commits.

6420240 2.88.0
bd22e21 fix: massive dependency upgrade, fixes all production vulnerabilities
925849a Merge pull request #2996 from kwonoj/fix-uuid
7b68551 fix(uuid): import versioned uuid
5797963 Merge pull request #2994 from dlecocq/oauth-sign-0.9.0
628ff5e Update to oauth-sign 0.9.0
10987ef Merge pull request #2993 from simov/fix-header-tests
cd848af These are not going to fail if there is a server listening on those ports
a92e138 #515, #2894 Strip port suffix from Host header if the protocol is known. (#2904)
45ffc4b Improve AWS SigV4 support. (#2791)
a121270 Merge pull request #2977 from simov/update-cert
bd16414 Update test certificates
536f0e7 2.87.1
02fc5b1 Update changelog
de1ed5a 2.87.0
a6741d4 Replace hawk dependency with a local implemenation (#2943)
a7f0a36 2.86.1
8f2fd4d Update changelog
386c7d8 2.86.0
76a6e5b Merge pull request #2885 from ChALkeR/patch-1
db76838 Merge branch 'patch-1' of github.com:ChALkeR/request
fb7aeb3 Merge pull request #2942 from simov/fix-tests
e47ce95 Add Node v10 build target explicitly
0c5db42 Skip status code 105 on Node > v10

Priority Score (*)	Issue	Exploit Maturity
731/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.2	Prototype Pollution SNYK-JS-LODASH-567746	Proof of Concept
579/1000 Why? Has a fix available, CVSS 7.3	Prototype Pollution npm:extend:20180424	No Known Exploit
646/1000 Why? Mature exploit, Has a fix available, CVSS 5.2	Uninitialized Memory Exposure npm:stringstream:20180511	Mature