some-comments [Snyk] Fix for 2 vulnerabilities

[Snyk] Fix for 2 vulnerabilities

Open fiddur opened this issue 4 years ago • 0 comments

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	Yes	Proof of Concept
	753/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.2	Command Injection SNYK-JS-LODASH-1040724	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: knex

The new version differs by 250 commits.

40c80b3 release 0.11.0
415d008 Prepare for 0.11.0
8a303f1 Merge pull request #1342 from h0vhannes/mssql-conn-urls
9903e7d Merge pull request #1372 from mdrmuhaimin/patch-1
4d88e1d Update package.json to use latest node-postures
d990708 Merge pull request #1362 from wolfgang42/mssql-fixes
a7f609a mssql dialect: Fix integration tests that check for quoted wrappers.
aa3c1c2 mssql dialect: make createTableIfNotExists actually work.
85403e8 Merge pull request #1343 from wubzz/bugfix/pool.ping_for_mssql
14eca7a Fix MSSQL ping function, calling resource.request().query instead of resource.query.
8e41a33 Add parse URL connection string tests for MSSQL
e49b0d4 Correct connection URL parsing for MSSQL
1f09df8 Merge pull request #1296 from wubzz/default_pool_ping_fn_and_rollback_handler
a223858 Increase rollback timeout to 5secs
abfff60 Update documentation regarding default `ping` function.
fa12571 A default `ping` fn in default pool settings, and silently ignore errors when querying 'ROLLBACK' on a dead connection by using Promise.Timeout.
a104cc0 Merge pull request #1315 from wubzz/bugfix/missing_error_event_for_mysql2
bb9663f Merge pull request #1326 from wubzz/bugfix/renameCol_drops_default_value
d3b1fcc Fixed test, forgot ES6 is not supported in the test suite.
0b45356 .renameColumn should not drop defaultValue or nullable state. Currently this happens for mysql. Fixes #933
2fad6d1 Mysql2 should also listen to 'error' events.
b8c8572 Merge pull request #1313 from jurko-gospodnetic/code-cleanup
34d9a76 Merge pull request #1269 from wubzz/bugfix/fix_valuesForUndefined_actual_query
e9ebf6f touch up wording in warning message about manually removing migration locks

See the full diff

Package name: objection

The new version differs by 192 commits.

1027cb9 v0.5.0
86d55d9 update examples for objection 0.5.0
6ca624e minor fixes
e8e4acd Merge pull request #148 from gitter-badger/gitter-badge
6a1eb13 Add Gitter badge
2874434 Merge pull request #142 from rafaljanicki/master
b1ffc1d Bumped up knex version
066c6d1 Bumped up maximum knex version
2612519 0.5.0-rc.5
01e6498 0.5.0-rc.4
a5b4f4e fix #127
fd28e63 0.5.0-rc.3
b57a11e fix #124
03949e7 add knex as a peerDependency so that compatibility can be assured
0749cb1 remove some dead code
bb1c817 removing node 6 from travis for now. sqlite isn't updated to support it yet
6be4858 0.5.0-rc.2
5ed0e88 add alias option for joinRelation method. closes #121
1d22fc4 add modify, options and columnInfo query builder methods. fixes #119
10c654f add links to eager query blog post. closes #115
9167176 add node 6 to travis config
485ca3f fix babel build on pre 6 nodes
5d006f2 change *Method to *Operation
a2a91f5 optimize babel build