sample-appointment-reminders-node icon indicating copy to clipboard operation
sample-appointment-reminders-node copied to clipboard

[Snyk] Fix for 5 vulnerabilities

Open twilio-product-security opened this issue 4 years ago • 0 comments

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905
Yes No Known Exploit
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6
Prototype Pollution
SNYK-JS-MINIMIST-559764
No Proof of Concept
medium severity 601/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.6
Prototype Pollution
SNYK-JS-YARGSPARSER-560381
No Proof of Concept
low severity 399/1000
Why? Has a fix available, CVSS 3.7
Denial of Service (DoS)
npm:superagent:20170807
Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Information Exposure
npm:superagent:20181108
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: mocha The new version differs by 3 commits.
  • eb781e2 Release v6.2.3
  • 10dbe94 update CHANGELOG for v6.2.3 [ci skip]
  • 848d6fb security: update mkdirp, yargs, yargs-parser

See the full diff

Package name: nodemon The new version differs by 7 commits.
  • 9a67f36 feat: update chokidar to v3
  • 6781b40 docs: add license file
  • 0e6ba3c fix: wait for all subprocesses to terminate (fixes issue #1476)
  • b58cf7d chore: Merge branch 'master'
  • 95a4c09 docs: add to faq
  • 3a2eaf7 choe: merge master
  • 3d90879 chore: add logo to site

See the full diff

Package name: supertest The new version differs by 5 commits.
  • 199506d Prepare 3.0.0 release. Small readme updates, update dev libs.
  • 1d82e5b Allow TestAgent pass a cert and key to request (#373)
  • 188f8f2 Update readme (#392)
  • bd63752 Use superagent 3 (#400)
  • 3c16aa1 Couple small updates to README

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

twilio-product-security avatar Jul 22 '21 04:07 twilio-product-security