[Snyk] Fix for 6 vulnerabilities #25

danielberman79 · 2023-11-29T14:51:28Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
159/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00299, Social Trends: No, Days since published: 808, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 2.65, Score Version: V5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
/1000 Why?	Command Injection SNYK-JS-NEMOAPPIUM-3183747	No	Proof of Concept
118/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00063, Social Trends: No, Days since published: 257, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 4.19, Likelihood: 2.81, Score Version: V5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	No	Proof of Concept
/1000 Why?	Heap-based Buffer Overflow SNYK-JS-SHARP-5922108	No	Mature
118/1000 Why? Confidentiality impact: Low, Integrity impact: Low, Availability impact: None, Scope: Unchanged, Exploit Maturity: Proof of Concept, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.00173, Social Trends: No, Days since published: 152, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: Medium, Package Popularity Score: 99, Impact: 4.19, Likelihood: 2.81, Score Version: V5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	No	Proof of Concept
115/1000 Why? Confidentiality impact: None, Integrity impact: None, Availability impact: High, Scope: Unchanged, Exploit Maturity: No data, User Interaction (UI): None, Privileges Required (PR): None, Attack Complexity: Low, Attack Vector: Network, EPSS: 0.01055, Social Trends: No, Days since published: 653, Reachable: No, Transitive dependency: Yes, Is Malicious: No, Business Criticality: High, Provider Urgency: High, Package Popularity Score: 99, Impact: 5.99, Likelihood: 1.92, Score Version: V5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: check-dependencies

The new version differs by 61 commits.

03c8847 Tag 2.0.0
65d9ef5 Set Node.js requirement in package.json engines to >=18.3
4917ab0 Simplify the spawn logic
fc04cc8 Drop support for the callback interface
28257dd Tweak ESLint settings
dc16e8a Drop the bluebird devDependency
412337a Drop fs-extra & graceful-fs devDependencies
091279a Drop the findup-sync dependency
10ac9c5 Drop lodash.camelcase & minimist dependencies
35dce52 Update dependencies
2929ba7 Update tested Node.js versions
1f514eb Don't invoke `npm prune`, `npm install` is already enough
65107d2 Drop support for Bower & the `checkCustomPackageNames` option
f28ba1b Avoid `git://` URLs, they're no longer supported
8fdc6ad Limit allowed `packageManager` values
9809f13 Bump word-wrap from 1.2.3 to 1.2.4 ([Snyk] Security upgrade @angular-devkit/build-angular from 0.1000.8 to 14.0.0 #58)
e522471 Bump semver from 7.3.8 to 7.5.2 ([Snyk] Security upgrade socket.io from 2.4.1 to 2.5.1 #57)
031416d Bump yaml from 2.2.1 to 2.2.2 ([Snyk] Security upgrade @angular-devkit/build-angular from 0.1000.8 to 13.0.0 #56)
dff3ab9 Build: Fix running tests on Windows
062005f Build: Update the GitHub Actions config
ecf138f Build: Update dependencies
15c13b3 Build: Remove AppVeyor
89b9df0 Build: Update .gitattributes to files always use LF line endings
db8c172 Build: Tweak GitHub Actions workflow code style

See the full diff

Package name: grunt-contrib-compress

The new version differs by 5 commits.

bd9fc8e v2.0.0
b8565a9 Update Archiver ([Snyk] Security upgrade express from 4.17.2 to 4.21.0 alexeisnyk/juice-shop#232)
f6815bf Update deps and remove nodeunit loading ([Snyk] Fix for 4 vulnerabilities alexeisnyk/juice-shop#231)
b70c1d9 Update tests and dependencies ([Snyk] Fix for 4 vulnerabilities alexeisnyk/juice-shop#230)
5759edd Bump ini from 1.3.5 to 1.3.7 ([Snyk] Fix for 18 vulnerabilities alexeisnyk/juice-shop#228)

See the full diff

Package name: nemo-appium

The new version differs by 4 commits.

5472eb1 Merge pull request super functional new pkg #2 from paypal/fix.path-validation
5b1d1aa bumping patch version
aa271d3 prevent OS commands from being injected
0eef7af update doc

See the full diff

Package name: sharp

The new version differs by 250 commits.

eefaa99 Release v0.32.6
dbce6fa Upgrade to libvips v8.14.5
af0fcb3 Docs: changelog for #3799
c6f54e5 Bump devDeps
846563e TypeScript: add definitions for block and unblock (#3799)
9c217ab Ensure withMetadata can add RGB16 profiles #3773
e7381e5 Alternative fix for 4340d60, uses existing StaySequential
4340d60 Ensure composite tile images fully decoded #3767
7f64d46 Docs: add missing returns property to raw
67e927b Docs: ensure all functions include method signature #3777
9c7713e Docs: remove mention of EXIF from flip/flop ops
8be6da1 Docs: clarify when rotate op will remove EXIF Orientation
9563568 Ensure withMetadata skips default profile for RGB16 #3773
44a0ee3 Release v0.32.5
ccd51c8 Upgrade to libvips v8.14.4
bb7469b Ensure withMetadata adds default sRGB profile #3761
a2cac61 Simplify 90/270 orient-before-resize logic (#3762)
5c19f6d Ensure resize fit=inside respects 90/270 rotate #3756
3d01775 Docs: changelog entries for #3748 #3755 #3758
87562a5 TypeScript: Ensure WebpOptions minSize is boolean (#3758)
2829e17 Fix build with musl 1.2.4 (#3755)
ffefbd2 TypeScript: add missing WebpPresetEnum (#3748)
bc8f983 Tests: ensure Jimp benchmark uses bicubic as resizing kernel (#3745)
440936a Tests: update benchmark deps and container (#3744)

See the full diff

Package name: sqlite3

The new version differs by 44 commits.

573784b v5.0.3
e5a24fd Deleted `examples/` folder
b05f459 Added note about GitHub Releases to CHANGELOG.md
33d0656 Modernised Usage example in README
9d05c55 Fixed up more README nits
08d6319 Fixed link to API docs
0e2235a Altered wording in README
76b6c56 Altered README header
e3df365 Updated README
426930f Enabled CI to run when pushing tags
a21d41f Fixed uploading binaries to commit artifacts
bc978c7 Fixed CI step wording
7f744a1 Added prebuilt binaries via GitHub Releases
b4b3c3a Deleted `scripts/` directory
71bbdea Pinned dev dependencies (updated socket.io and socket.io-client juice-shop/juice-shop#1558)
a597383 Updated badges in README
0eb4a0f Deleted Travis and Appveyor configs
b58d341 Downgraded `mocha` and `eslint`
f39b10d Added missing Node versions to CI
8db96d4 Replaced Python extraction script with JS (Add "NoSql Manipulation" video by Hacksplained juice-shop/juice-shop#1570)
11c988c Fixed Windows build architecture in CI
8e63848 Updated Windows CI runner to `windows-latest`
d9e7d8b Fixed building on MacOS Monterey 12.3
859b95b Updated `node-gyp` to v8.x