[Snyk] Fix for 14 vulnerabilities #71

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

snyk-bot wants to merge 1 commit into master from snyk-fix-344beeda11a41fddfa37a27fb105a12b

snyk-bot commented Oct 9, 2022

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- src/ProjectTemplates/Web.Spa.ProjectTemplates/content/Angular-CSharp/ClientApp/package.json
- src/ProjectTemplates/Web.Spa.ProjectTemplates/content/Angular-CSharp/ClientApp/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	409/1000 Why? Has a fix available, CVSS 3.9	Cross-site Scripting (XSS) SNYK-JS-ANGULARCORE-1070902	Yes	No Known Exploit
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
	701/1000 Why? Mature exploit, Has a fix available, CVSS 6.3	Cross-site Scripting (XSS) SNYK-JS-JQUERY-565129	No	Mature
	711/1000 Why? Mature exploit, Has a fix available, CVSS 6.5	Cross-site Scripting (XSS) SNYK-JS-JQUERY-567880	No	Mature
	479/1000 Why? Has a fix available, CVSS 5.3	Improper Certificate Validation SNYK-JS-NODESASS-1059081	Yes	No Known Exploit
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SCSSTOKENIZER-2339884	Yes	No Known Exploit
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536528	Yes	No Known Exploit
	624/1000 Why? Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536531	Yes	No Known Exploit
	410/1000 Why? Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) SNYK-JS-TAR-1536758	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579147	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579152	Yes	No Known Exploit
	639/1000 Why? Has a fix available, CVSS 8.5	Arbitrary File Write SNYK-JS-TAR-1579155	Yes	No Known Exploit
	589/1000 Why? Has a fix available, CVSS 7.5	Denial of Service (DoS) SNYK-JS-TRIMNEWLINES-1298042	Yes	No Known Exploit
	506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:jasmine-core:20180216	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: node-sass

The new version differs by 97 commits.

3b556c1 7.0.2
c716359 Bump sass-graph@^4.0.1 (Remove support for the implicit package version of Microsoft.AspNetCore.App dotnet/aspnetcore#3292)
24741b3 docs(readme): fix docpad plugin link
1523330 feat: Drop Node 12
365d357 update https://registry.npm.taobao.org to https://registry.npmmirror.com
1456114 build(deps): bump actions/upload-artifact from 2 to 3
b465b69 chore: bump GitHub Actions to Windows 2019 (Ammending the request pipeline with WebApplicationFactory dotnet/aspnetcore#3254)
e6194b1 build(deps): bump make-fetch-happen from 9.1.0 to 10.0.4
4edf594 build(deps): bump node-gyp from 8.4.1 to 9.0.0
29e2344 build(deps): bump actions/checkout from 2 to 3
85b0d22 build(deps): bump actions/setup-node from 2 to 3
3bb51da Use make-fetch-happen instead of request (Razor pages - textarea asp-for binding problem dotnet/aspnetcore#3193)
adc2f8b build(deps): bump true-case-path from 1.0.3 to 2.2.1 (System.IO.IOException thrown by MultipartReaderStream dotnet/aspnetcore#3000)
77d12f0 chore: disable Apline for Node 16/17 builds
308d533 ci: use Python 3 for Node 12
c818907 ci: unpin actions/setup-node to v2
99242d7 7.0.1
77049d1 build(deps): bump sass-graph from 2.2.5 to 4.0.0 (Question about ActionResult<IEnumerable<Something>> dotnet/aspnetcore#3224)
c929f25 build(deps): bump node-gyp from 7.1.2 to 8.4.1 (This is killing me dotnet/aspnetcore#3209)
918dcb3 Lint fix
0a21792 Set rejectUnauthorized to true by default (Updated issue template dotnet/aspnetcore#3149)
e80d4af chore: Drop EOL Node 15 (Unix socket bidding with Owin not working dotnet/aspnetcore#3122)
d753397 feat: Add Node 17 support (Host shuts down immediately dotnet/aspnetcore#3195)
dcf2e75 build(deps-dev): bump eslint from 7.32.0 to 8.0.0

See the full diff

Package name: protractor

The new version differs by 63 commits.

5d8da04 chore(release): version bump to 6.0.0 and update the changelog
d777738 chore(tests): circleci - chrome 69 requires chromdriver to 2.44 (Provide hooks to allow for integration with other JavaScript frameworks dotnet/aspnetcore#5182)
3d50b68 chore(deps): update based on npm audit
e478ba8 chore(release): bump version to 6.0.1-beta
7054827 chore(types): fix types to use not @ types/selenium-webdriver (Add health checks routing extensions dotnet/aspnetcore#5127)
2e5c2e6 chore(jasmine): prevent random execution order in jasmine 3 (converting asp.net to asp.net core issue on onredirecttoidentityprovider dotnet/aspnetcore#5126)
8afc4e2 chore(release): release 6.0.0-beta and update the changelog
5fd711c chore(webdriver-manager): use [email protected]
96ae17c deps(jasmine): upgrade jasmine 3.3 (Razor Sdk 3.0 migration docs dotnet/aspnetcore#5102)
68491dd chore(expectedConditions): update generic Function typings (Add a test verifying 3.0 SDK is compatible with 2.2 targeting project dotnet/aspnetcore#5101)
cf43651 chore(debugprint): convert debugprint to TypeScript (#5074)
d213aa9 deps(selenium): upgrade to selenium 4 (DocumentSnapshot system needs to understands imports better dotnet/aspnetcore#5095)
4672265 chore(browser): remove timing issues with restart and fork (Razor Language Service does not appear to work with cshtml files in fsproj project dotnet/aspnetcore#5085)
b4dbcc2 chore(elementexplorer): remove explorer bin file (Review and update dependencies in vsixmanifest dotnet/aspnetcore#5094)
7de6d85 docs(api): update examples to use async/await (ManualServerShutdown_NoPipeName_ShutsDownServer hangs on linux VSTS dotnet/aspnetcore#5081)
1b2036e typings(selenium): try out new version of typings (Directive usage errors need to appear in runtime too dotnet/aspnetcore#5084)
befb457 chore(bin): update webdriver-manager require to use the cli ([Tracking] Parser improvements feedback dotnet/aspnetcore#5093)
509f1b2 deps(latest): upgrade to the gulp and typescript (Make the debugging experience of the new syntax tree better dotnet/aspnetcore#5089)
2def202 deps(webdriver-manager): use replacement (Add unit tests for the new syntax infrastructure dotnet/aspnetcore#5088)
9d510db chore(test): remove jasmine addMatcher test (Allow Core Razor editor to work in non-project scenarios. dotnet/aspnetcore#5072)
6522e40 chore(cleanup): clean up imports and wdpromises (Implement DocumentSnapshot tracking in VS 4 Mac dotnet/aspnetcore#5073)
3b8f263 chore(ignoreSynchornization): clean up to use waitForAngularEnabled (Syntax for writing a dictionary of attributes onto an element dotnet/aspnetcore#5071)
ffa3519 chore(debugger): remove debugger and explore methods (Make it easier to use static assets that are part of a RCL project dotnet/aspnetcore#5070)
0f7a38a chore(test): error tests fixed (Referenced RCL project is built even though there are no recent changes to it dotnet/aspnetcore#5069)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Denial of Service (DoS)
🦉 Arbitrary File Write
🦉 More lessons are available in Snyk Learn


          fix: src/ProjectTemplates/Web.Spa.ProjectTemplates/content/Angular-CS…

6338fb0

…harp/ClientApp/package.json & src/ProjectTemplates/Web.Spa.ProjectTemplates/content/Angular-CSharp/ClientApp/package-lock.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-ANGULARCORE-1070902
- https://snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908
- https://snyk.io/vuln/SNYK-JS-JQUERY-565129
- https://snyk.io/vuln/SNYK-JS-JQUERY-567880
- https://snyk.io/vuln/SNYK-JS-NODESASS-1059081
- https://snyk.io/vuln/SNYK-JS-SCSSTOKENIZER-2339884
- https://snyk.io/vuln/SNYK-JS-TAR-1536528
- https://snyk.io/vuln/SNYK-JS-TAR-1536531
- https://snyk.io/vuln/SNYK-JS-TAR-1536758
- https://snyk.io/vuln/SNYK-JS-TAR-1579147
- https://snyk.io/vuln/SNYK-JS-TAR-1579152
- https://snyk.io/vuln/SNYK-JS-TAR-1579155
- https://snyk.io/vuln/SNYK-JS-TRIMNEWLINES-1298042
- https://snyk.io/vuln/npm:jasmine-core:20180216

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet