wireless-security-camera icon indicating copy to clipboard operation
wireless-security-camera copied to clipboard

Published 20 hours ago • verified publisher icon twilio

[Snyk] Fix for 2 vulnerabilities

Open twilio-product-security opened this issue 3 years ago • 0 comments

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • angular/package.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
high severity 584/1000
Why? Has a fix available, CVSS 7.4		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-HAWK-2808852		 Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: less The new version differs by 127 commits.
  • b873737 Merge pull request #3177 from Kartoffelsalat/master
  • bd2a93f chore(package): update request to 2.83.0
  • 3699921 Merge pull request #3170 from thorn0/patch-1
  • 6985541 Having `inline` and `less` imports of the same name lead to a race condition
  • 2f1386f Merge pull request #3168 from matthew-dean/master
  • 4272871 Fixes #3116 - lessc not loading plugins in 3.0
  • ba5ad9c Point badges at master branch
  • 4962988 Update CHANGELOG.md
  • 12fe0c6 Update README.md
  • 45d06b9 Merge pull request #3163 from matthew-dean/master
  • 9590b7b Add dist files
  • 0b6536b Merge branch '3.x'
  • a48c24c calc() fix - fixes #974 (partially #1880)
  • 367b46a Merge pull request #3161 from matthew-dean/3.x
  • 4508495 Remove legacy upgrade
  • 2a4a63a Update CHANGELOG.md with 3.x list
  • bb6da28 Update README.md
  • f80a021 Merge pull request #3159 from matthew-dean/3.x
  • 8b4524f Bump to 3.0.0-RC.1
  • d30e3a6 Merge pull request #3150 from anthony-redFox/3.x
  • 0b7c81c Removed install npm 2 version for appveyor. It was hotfix for old node version.
  • 5d230dd Drop node 0.10 and 0.12 and added node 9 matrix testing
  • 385da8f Update stale.yml
  • d384779 Create stale.yml

See the full diff

Package name: webpack The new version differs by 250 commits.
  • 213226e 4.0.0
  • fde0183 Merge pull request #6081 from webpack/formating/prettier
  • b6396e7 update stats
  • f32bd41 fix linting
  • 5238159 run prettier on existing code
  • 518d1e0 replace js-beautify with prettier
  • 4c25bfb 4.0.0-beta.3
  • dd93716 Merge pull request #6296 from shellscape/fix/hmr-before-node-stuff
  • 7a07901 Merge pull request #6563 from webpack/performance/assign-depth
  • c7eb895 Merge pull request #6452 from webpack/update_acorn
  • 9179980 Merge pull request #6551 from nveenjain/fix/templatemd
  • e52f323 optimize performance of assignDepth
  • 6bf5df5 Fixed template.md
  • 90ab23a Merge branch 'master' into fix/hmr-before-node-stuff
  • b0949cb add integration test for spread operator
  • 39438c7 unittest now also walks the ast
  • 15ab027 Merge pull request #6536 from jevan0307/sideEffects-selectors
  • 1611ce1 Merge pull request #6561 from joshunger/patch-1
  • 6e175bc Merge pull request #6549 from webpack/md4_hash
  • 0637531 Add a hyperlink to create a new issue
  • 0e1f9c6 Merge pull request #6554 from webpack/deps/end-of-beta
  • 72477f4 upgrade versions to stable versions
  • ed30285 Merge pull request #6546 from webpack/bot/review-permission
  • 40ee8c7 Use MD4 for hashing

See the full diff

Package name: webpack-dev-server The new version differs by 250 commits.
  • 4ab1f21 chore(release): 3.11.0
  • 0e51fb1 fix: invalidate route (#2584)
  • f857c40 chore: deps and tests
  • 41d1d0c fix(deps): security vulnerability in yargs-parser (#2566)
  • 375ab23 ci: add node@14 (#2530)
  • 776e7d4 chore(deps): update dependency html-entities to ^1.3.1 (master) (#2513)
  • 984536c chore: update lint-staged config (#2524)
  • 89ffb86 feat: add invalidate endpoint (#2493)
  • 0e9bffb chore(deps): update all patch dependencies (#2508)
  • 99ccfd8 fix: update jquery (#2516)
  • 06583f2 fix: do not swallow errors from server (#2512)
  • 0d5c681 fix(server): don't crash on setupExitSignals(undefined) (#2507)
  • c436058 chore(deps): update all patch dependencies (master) (patch) (#2503)
  • 4808abd feat(progess): emit progress-update (#2498)
  • adeb92e feat: allow open option to accept an object (#2492)
  • c6bdfe4 feat(contentBasePublicPath): allow multiple paths (#2489)
  • f317358 chore(deps): update all patch dependencies (master) (patch) (#2481)
  • de763e9 chore(deps): update all minor dependencies (master) (minor) (#2473)
  • f7b6fa1 chore(deps): update package-lock.json (#2482)
  • 3bf43a7 chore(deps): update all patch dependencies (#2477)
  • 12d76be docs: fix typos across the project (#2452)
  • 9a6e4a1 chore(deps): update all patch dependencies (#2468)
  • d4739f8 chore(deps): update dependency husky to v4 (#2383)
  • 5f357f3 chore(deps): update all patch dependencies (#2450)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

twilio-product-security avatar Jun 29 '22 19:06 twilio-product-security