Snyk fix PR (addresses 4 issues) #194

kriti-d · 2023-09-13T22:05:06Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
751/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.6	Prototype Pollution SNYK-JS-DUSTJSLINKEDIN-1089257	Yes	Proof of Concept
726/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 8.1	Prototype Pollution SNYK-JS-MONGOOSE-5777721	Yes	Proof of Concept
899/1000 Why? Mature exploit, Has a fix available, CVSS 9.4	Arbitrary File Write via Archive Extraction (Zip Slip) npm:adm-zip:20180415	No	Mature
644/1000 Why? Has a fix available, CVSS 8.6	Code Injection npm:dustjs-linkedin:20160819	No	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: adm-zip

The new version differs by 50 commits.

80d259f Version bump
3f00a03 Fixed Bump lodash from 4.17.4 to 4.17.21 #176
650e752 Fixed wrong date on files (issue [Snyk] Security upgrade ejs from 1.0.0 to 3.1.10 #203)
d01fa8c Fixed bugs introduced with 0.4.9
c0cc85d Merge pull request [Snyk Update] New fixes for 2 vulnerable dependency paths snyk-labs/nodejs-goof#219 from jontore/master
39c83a2 Merge pull request Snyk fix PR (addresses 2 issues) #209 from poshta1900/fix
b94c5dd Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#227 from hhaidar/master
c95c553 Merge pull request [Snyk Update] New fixes for 16 vulnerable dependency paths snyk-labs/nodejs-goof#228 from jmcollin78/patch-1
cda668c Fix issue [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#218
0f2cb41 Fix octal literals so they work in strict mode
888931d To support strict mode use 0o prefix to octal numbers
89b6f67 Update package.json
9592298 Update README.md
ce59e5a Merge pull request [Snyk Update] New fixes for 1 vulnerable dependency path snyk-labs/nodejs-goof#215 from grnd/master
38cb4a4 fix: resolve both target and entry path
18c3d31 Update package.json
666adec Update package.json
499d59b Update package.json
62f6400 Merge pull request Snyk fix PR (addresses 1 issues) #212 from aviadatsnyk/master
6f4dfeb fix: prevent extracting archived files outside of target path
ef0abe6 add try-catch around fs.writeSync
e116bc1 Merge pull request Snyk fix PR (addresses 1 issues) #208 from pmuens/patch-1
12d2099 Fix data accessing example in README
032566b Merge pull request [Snyk] Security upgrade tap from 10.7.3 to 12.0.2 #204 from BridgeAR/master

See the full diff

Package name: mongoose

The new version differs by 250 commits.

0f3997a chore: release 5.13.20
f1efabf fix: avoid prototype pollution on init
98e0762 chore: release 5.13.19
7e36d21 chore: release 5.13.18
6759c60 undo accidental changes and actually pin @ types/json-schema
4ed4a89 chore: pin version of @ types/json-schema because of install issues on node v4 and v6
9a9536d Merge pull request #13535 from lorand-horvath/patch-12
26424d5 5.x - bump mongodb driver to 3.7.4
4b8b0a9 add versionNumber to 5.x
1bc07ec chore: release 5.13.17
3f827b3 Merge branch '5.x' of github.com:Automattic/mongoose into 5.x
eeabe5f chore: run CI tests on ubuntu 20.04 because 18.04 no longer supported
14464d1 Merge pull request #13195 from raj-goguardian/gh-13192
7e888e4 fix(update): handle $and & $or in array filters.
5dd0a4e Merge pull request #13138 from rdeavila94/gh-13136
c8191da Update model.indexes.test.js
7364264 Update model.indexes.test.js
77b9d99 Updated the isIndexEqual function to take into account non-text indexes when checking compound indexes that include both text and non-text indexes
9dd82be Merge pull request #13132 from rdeavila94/gh-12654
d0e149b Merge pull request #12737 from Automattic/vkarpov15/gh-12654
e76c41c chore: release 5.13.16
cdab11e chore: remove Node 5 and 7 from CI because GitHub actions is bugging out with them
e33a8be fix(types): add missing typedefs for bulkSave() to 5.x
896cd76 Merge pull request #12692 from hasezoey/backportLinkUpdate