wireless-fleet-tracker [Snyk] Fix for 5 vulnerabilities

[Snyk] Fix for 5 vulnerabilities

Open twilio-product-security opened this issue 3 years ago • 0 comments

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- angular/package.json

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Open Redirect SNYK-JS-NODEFORGE-2330875	Yes	Proof of Concept
529/1000 Why? Has a fix available, CVSS 6.3	Prototype Pollution SNYK-JS-NODEFORGE-2331908	Yes	No Known Exploit
479/1000 Why? Has a fix available, CVSS 5.3	Improper Certificate Validation SNYK-JS-NODESASS-1059081	Yes	No Known Exploit
479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-UGLIFYJS-1727251	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: html-loader

The new version differs by 93 commits.

d7cccfa chore(release): 1.0.0
3c9a1d8 refactor: `attributes` option (#265)
8c73761 feat: `preprocessor` option (#263)
f2ce5b1 feat: improve errors
9923244 chore(deps): update (#260)
9835bde feat: supports `link:href` attribute for css (#258)
7af2eff refactor: improve schema (#257)
98412f9 docs: `filter` sources (#256)
ff0f44c feat: implement the `filter` option for filtering some of sources (#255)
1c24662 refactor: move the `root` option under the `attributes` option (#254)
888b8fe docs: add footnote for `-attributes` (#252)
3d2907e refactor: remove the `interpolate` option
bd979e2 refactor: remove the `interpolate` option
fcba4ec fix: handle only valid srcset tags (#253)
9e5ce56 perf: improve source parse (#251)
c9c8dad refactor: improve source parse (#250)
079d623 fix: respect `#hash` in sources
a17df49 fix: reduce `import`/`require` count
d0b0150 fix: adding quotes when necessary for unquoted sources (#247)
e3727ab test: minifier
0bbe29c feat: migrate on `htmlparse2`
b7af031 fix: escape `\u2028` and `\u2029` characters (#244)
24b0427 fix: parser tags and attributes according spec (#243)
3df909d feat: support `script:src` attributes

Package name: node-sass

The new version differs by 74 commits.

Package name: webpack

The new version differs by 176 commits.

bf4ec9c 3.0.0
9feda63 Merge pull request #5028 from webpack/feature/externalize_uglify_plugin
49d6e38 Merge pull request #5086 from webpack/ci/node-8
3dcb133 OSX test on node.js 8
f4b8785 Merge pull request #5012 from webpack/TheLarkInn-patch-1
d26c402 chore(deps): upgrade uglifyjs-webpack-plugin deps to get latest webpack-sources so tests pass
3da4f3e Merge pull request #5085 from jbellenger/jbellenger/rawmodule-hash
8c9dc14 fix RawModule hashing
c2c5d73 Update README.md
316d4b9 Merge pull request #5084 from timse/remove-duplicate-code
ae18552 update test case with changed hash due to less clutter in dependencies
fc20348 unite iteration through modules into one loop
083843e remove code that pushes arrays of dependencies into dependencies
ab636b0 Merge pull request #5075 from andreipfeiffer/master
3b3449c Refactor: use const for non reassignable identifier
2ba0499 3.0.0-rc.2
1769fa2 Merge pull request #5064 from webpack/feature/scope-hoisting-multi-entry
a73646a Merge pull request #5060 from mikesherov/reason-chunks-as-set
28f826a consistent order
8a30188 use Set for ModuleReason chunk rewriting
5d4ba56 Allow scope hoisting to process modules in multiple chunks
d6a7594 harmony modules without exports have no exports instead of unknown
3ae782d Merge pull request #5049 from KTruong888/ES6_refactoring_multicompiler
18cdba8 4099_ES6 refactor lib/MultiCompiler.js

Package name: webpack-dev-server

The new version differs by 250 commits.

5280ee7 docs: fix typo
d834582 chore(release): 4.7.3
7b8c85b chore(deps): update `selfsigned` (#4170)
d598325 chore: fix lint
c1907f1 refactor: remove redundant `if` statements (#4158)
e535f25 ci: debug (#4144)
75999bb chore(release): 4.7.2
90a96f7 ci: fix (#4143)
f6bc644 fix: compatible with `onAfterSetupMiddleware`
317e4b9 docs: fix testing instructions (#4133)
ff4550e test: remove redundant test cases related to 3rd party code (#4131)
0dd1ee6 test: add e2e tests for `setupExitSignals` option (#4130)
afe4975 chore(release): 4.1.7
4e5d8ea fix: droped `url` package (#4132)
b0c98f0 chore(release): 4.7.0
3138213 chore(deps): update (#4127)
8f02c3f feat: added types
f4fb15f fix: update description of `onAfterSetupMiddleware` and `onBeforeSetupMiddleware` options (#4126)
37b73d5 test: add e2e test for `WEBPACK_SERVE` env variable (#4125)
f5a9d05 chore(deps-dev): bump eslint from 8.4.1 to 8.5.0 (#4121)
c9b959f chore(deps): bump ws from 8.3.0 to 8.4.0 (#4124)
42208aa chore(deps-dev): bump lint-staged from 12.1.2 to 12.1.3 (#4122)
f440f84 chore(deps): bump express from 4.17.1 to 4.17.2 (#4120)
c13aa56 feat: added the `setupMiddlewares` option (#4068)

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

Jan 31 '22 14:01 twilio-product-security