locales icon indicating copy to clipboard operation
locales copied to clipboard
verified publisher icon koajs

[Snyk] Security upgrade npminstall from 3.28.1 to 6.3.0

Open fengmk2 opened this issue 2 years ago • 1 comments

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
high severity 661/1000
Why? Recently disclosed, Has a fix available, CVSS 7.5		 Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116		 Yes No Known Exploit
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Server-side Request Forgery (SSRF)
SNYK-JS-REQUEST-3361831		 Yes Proof of Concept
medium severity 646/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 6.5		 Prototype Pollution
SNYK-JS-TOUGHCOOKIE-5672873		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: npminstall The new version differs by 108 commits.
  • 0432f13 Release 6.3.0
  • 3787df9 👌 IMPROVE: Remove mz modules deps (#405)
  • dbb3b7a Release 6.2.1
  • ce04b97 🐛 FIX: Remove disk cache when version not found (#404)
  • dbceaee deps: Security upgrade pacote from 11.3.5 to 13.0.0 (#402)
  • d8a095d Release 6.2.0
  • dad3dcf feat: add download url and size for ShasumNotMatchError (#400)
  • f692927 🤖 TEST: CI add Node.js 18 (#397)
  • 1364e29 🤖 TEST: Run action on 5.x
  • fee11d6 Release 6.1.0
  • c05046a 📦 NEW: Support override custom scripts on bug-versions (#393)
  • d760c2b chore: update contributors
  • d358658 Release 6.0.0
  • 0dc0f9e feat: upgrade node-gyp@9 to support python3 (#392)
  • 74a13b7 Release 5.7.3
  • 161d297 Revert "feat: upgrade node-gyp@8 to support python3 (#385)" (#391)
  • 9381c66 Release 5.7.2
  • 9a60297 fix: use pacote@^11 for Node.js@^10 (#390)
  • d23122b Release 5.7.1
  • b220ec3 🐛 FIX: Reduce http request retry warning message log (#389)
  • 00cc014 Release 5.7.0
  • d02fa24 feat: upgrade node-gyp@8 to support python3 (#385)
  • 7549dfa Release 5.6.1
  • d58a37b 🐛 FIX: Use detect-libc to get libc family (#388)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS) 🦉 Server-side Request Forgery (SSRF) 🦉 Prototype Pollution

fengmk2 avatar Dec 03 '23 16:12 fengmk2

Updated dependencies detected. Learn more about Socket for GitHub ↗︎

Packages Version New capabilities Transitives Size Publisher
npminstall 3.28.1...6.7.1 network, filesystem, shell, environment +216/-79 14 MB fengmk2

socket-security[bot] avatar Dec 03 '23 16:12 socket-security[bot]