Skip to content

Conversation

@snyk-bot
Copy link

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 566/1000
Why? Recently disclosed, Has a fix available, CVSS 5.6
Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430337
No No Known Exploit
high severity 651/1000
Why? Recently disclosed, Has a fix available, CVSS 7.3
Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430339
No No Known Exploit
medium severity 566/1000
Why? Recently disclosed, Has a fix available, CVSS 5.6
Improper Verification of Cryptographic Signature
SNYK-JS-NODEFORGE-2430341
No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: node-forge The new version differs by 12 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

@parse-github-assistant
Copy link

I will reformat the title to use the proper commit message syntax.

@parse-github-assistant parse-github-assistant bot changed the title [Snyk] Security upgrade node-forge from 1.2.1 to 1.3.0 refactor: security upgrade node-forge from 1.2.1 to 1.3.0 Mar 27, 2022
@mtrezza mtrezza changed the title refactor: security upgrade node-forge from 1.2.1 to 1.3.0 fix: security upgrade node-forge from 1.2.1 to 1.3.0 Mar 27, 2022
@parse-github-assistant
Copy link

Thanks for opening this pull request!

  • ❌ Please edit your post and use the provided template when creating a new pull request. This helps everyone to understand your post better and asks for essential information to quicker review the pull request.

@codecov
Copy link

codecov bot commented Mar 27, 2022

Codecov Report

Merging #101 (5b77e40) into master (2d8750c) will not change coverage.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##           master     #101   +/-   ##
=======================================
  Coverage   93.42%   93.42%           
=======================================
  Files          23       23           
  Lines         578      578           
=======================================
  Hits          540      540           
  Misses         38       38           
Impacted Files Coverage Δ
lib/credentials/certificate/parsePkcs12.js 100.00% <100.00%> (ø)

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 2d8750c...5b77e40. Read the comment docs.

@mtrezza mtrezza merged commit a713a2b into master Mar 27, 2022
@mtrezza mtrezza deleted the snyk-fix-dea025e37b3c8acdca22e0ebfb73071f branch March 27, 2022 12:30
parseplatformorg pushed a commit that referenced this pull request Mar 27, 2022
## [5.1.3](5.1.2...5.1.3) (2022-03-27)

### Bug Fixes

* security upgrade node-forge from 1.2.1 to 1.3.0 ([#101](#101)) ([a713a2b](a713a2b))
@parseplatformorg
Copy link

🎉 This change has been released in version 5.1.3

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants