From 8e58e1b961b381faca00b5410a59802721e7d4e1 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Tue, 14 Jan 2020 21:28:54 +0000 Subject: [PATCH] fix: package.json & .snyk to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-473997 - https://snyk.io/vuln/SNYK-JS-JQUERY-174006 - https://snyk.io/vuln/SNYK-JS-JSYAML-173999 - https://snyk.io/vuln/SNYK-JS-JSYAML-174129 - https://snyk.io/vuln/SNYK-JS-LODASH-450202 - https://snyk.io/vuln/SNYK-JS-LODASH-73638 - https://snyk.io/vuln/SNYK-JS-LODASH-73639 - https://snyk.io/vuln/SNYK-JS-MARKED-174116 - https://snyk.io/vuln/SNYK-JS-MARKED-451540 - https://snyk.io/vuln/SNYK-JS-MONGODB-473855 - https://snyk.io/vuln/SNYK-JS-MONGOOSE-472486 - https://snyk.io/vuln/npm:adm-zip:20180415 - https://snyk.io/vuln/npm:braces:20180219 - https://snyk.io/vuln/npm:debug:20170905 - https://snyk.io/vuln/npm:dustjs-linkedin:20160819 - https://snyk.io/vuln/npm:ejs:20161128 - https://snyk.io/vuln/npm:ejs:20161130 - https://snyk.io/vuln/npm:ejs:20161130-1 - https://snyk.io/vuln/npm:fresh:20170908 - https://snyk.io/vuln/npm:hoek:20180212 - https://snyk.io/vuln/npm:jquery:20150627 - https://snyk.io/vuln/npm:lodash:20180130 - https://snyk.io/vuln/npm:marked:20150520 - https://snyk.io/vuln/npm:marked:20170112 - https://snyk.io/vuln/npm:marked:20170815 - https://snyk.io/vuln/npm:marked:20170815-1 - https://snyk.io/vuln/npm:marked:20170907 - https://snyk.io/vuln/npm:marked:20180225 - https://snyk.io/vuln/npm:mime:20170907 - https://snyk.io/vuln/npm:moment:20161019 - https://snyk.io/vuln/npm:moment:20170905 - https://snyk.io/vuln/npm:mongoose:20160116 - https://snyk.io/vuln/npm:ms:20170412 - https://snyk.io/vuln/npm:negotiator:20160616 - https://snyk.io/vuln/npm:npmconf:20180512 - https://snyk.io/vuln/npm:qs:20170213 - https://snyk.io/vuln/npm:semver:20150403 - https://snyk.io/vuln/npm:st:20140206 - https://snyk.io/vuln/npm:st:20171013 - https://snyk.io/vuln/npm:tunnel-agent:20170305 The following vulnerabilities are fixed with a Snyk patch: - https://snyk.io/vuln/npm:hawk:20160119 - https://snyk.io/vuln/npm:http-signature:20150122 - https://snyk.io/vuln/npm:mime:20170907 - https://snyk.io/vuln/npm:ms:20151024 - https://snyk.io/vuln/npm:request:20160119 - https://snyk.io/vuln/npm:tunnel-agent:20170305 --- .snyk | 23 +++++++++++++++++++++++ package.json | 40 ++++++++++++++++++++++------------------ 2 files changed, 45 insertions(+), 18 deletions(-) create mode 100644 .snyk diff --git a/.snyk b/.snyk new file mode 100644 index 0000000000..7e670bf56f --- /dev/null +++ b/.snyk @@ -0,0 +1,23 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.14.0 +ignore: {} +# patches apply the minimum changes required to fix a vulnerability +patch: + 'npm:hawk:20160119': + - tap > codecov.io > request > hawk: + patched: '2020-01-14T21:28:50.653Z' + 'npm:http-signature:20150122': + - tap > codecov.io > request > http-signature: + patched: '2020-01-14T21:28:50.653Z' + 'npm:mime:20170907': + - tap > codecov.io > request > form-data > mime: + patched: '2020-01-14T21:28:50.653Z' + 'npm:ms:20151024': + - humanize-ms > ms: + patched: '2020-01-14T21:28:50.653Z' + 'npm:request:20160119': + - tap > codecov.io > request: + patched: '2020-01-14T21:28:50.653Z' + 'npm:tunnel-agent:20170305': + - tap > codecov.io > request > tunnel-agent: + patched: '2020-01-14T21:28:50.653Z' diff --git a/package.json b/package.json index a63eeb5e30..ed30084eb1 100644 --- a/package.json +++ b/package.json @@ -10,42 +10,46 @@ "scripts": { "start": "node app.js", "build": "browserify -r jquery > public/js/bundle.js", - "cleanup": "mongo express-todo --eval 'db.todos.remove({});'" + "cleanup": "mongo express-todo --eval 'db.todos.remove({});'", + "snyk-protect": "snyk protect", + "prepublish": "npm run snyk-protect" }, "engines": { "node": "6.14.1" }, "dependencies": { "@snyk/nodejs-runtime-agent": "^1.31.0", - "adm-zip": "0.4.7", - "body-parser": "1.9.0", + "adm-zip": "0.4.11", + "body-parser": "1.17.1", "cfenv": "^1.0.4", "consolidate": "0.14.5", "cookie-parser": "1.3.3", "dustjs-helpers": "1.5.0", - "dustjs-linkedin": "2.5.0", - "ejs": "1.0.0", + "dustjs-linkedin": "2.6.0", + "ejs": "2.5.5", "ejs-locals": "1.0.2", - "errorhandler": "1.2.0", - "express": "4.12.4", - "express-fileupload": "0.0.5", + "errorhandler": "1.4.3", + "express": "4.16.0", + "express-fileupload": "1.1.6", "file-type": "^8.1.0", "humanize-ms": "1.0.1", - "jquery": "^2.2.4", - "lodash": "4.17.4", - "marked": "0.3.5", + "jquery": "^3.4.0", + "lodash": "4.17.12", + "marked": "0.6.2", "method-override": "latest", - "moment": "2.15.1", - "mongoose": "4.2.4", + "moment": "2.19.3", + "mongoose": "5.7.5", "morgan": "latest", - "ms": "^0.7.1", - "npmconf": "0.0.24", + "ms": "^2.0.0", + "npmconf": "2.1.3", "optional": "^0.1.3", - "st": "0.2.4", + "st": "1.2.2", "stream-buffers": "^3.0.1", - "tap": "^5.7.0" + "tap": "^11.1.3", + "snyk": "^1.278.1" }, "devDependencies": { "browserify": "^13.1.1" - } + }, + "snyk": true }