[Snyk] Security upgrade tap from 7.1.2 to 15.0.0#25

leonardoadame · 2023-07-06T20:20:28Z

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- tools/node_modules/eslint/node_modules/once/package.json

Vulnerabilities that will be fixed

With an upgrade:

Priority Score (*)	Issue	Breaking Change	Exploit Maturity
696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	Yes	Proof of Concept
584/1000 Why? Has a fix available, CVSS 7.4	Regular Expression Denial of Service (ReDoS) SNYK-JS-HAWK-2808852	Yes	No Known Exploit
429/1000 Why? Has a fix available, CVSS 4.3	Reverse Tabnabbing SNYK-JS-ISTANBULREPORTS-2328088	Yes	No Known Exploit
509/1000 Why? Has a fix available, CVSS 5.9	Denial of Service (DoS) SNYK-JS-JSYAML-173999	Yes	No Known Exploit
619/1000 Why? Has a fix available, CVSS 8.1	Arbitrary Code Execution SNYK-JS-JSYAML-174129	Yes	No Known Exploit
506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Prototype Pollution SNYK-JS-MINIMIST-2429795	Yes	Proof of Concept
601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-MINIMIST-559764	Yes	Proof of Concept
658/1000 Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	Yes	Proof of Concept
601/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.6	Prototype Pollution SNYK-JS-YARGSPARSER-560381	Yes	Proof of Concept
506/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 3.7	Regular Expression Denial of Service (ReDoS) npm:braces:20180219	Yes	Proof of Concept
636/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.3	Prototype Pollution npm:hoek:20180212	Yes	Proof of Concept
576/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.1	Uninitialized Memory Exposure npm:tunnel-agent:20170305	Yes	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: tap

The new version differs by 250 commits.

bc49fb7 15.0.0
4378608 remove publishConfig beta tag
2c2e75f provide mkdirRecursive polyfill for old node versions
8f4c855 correctly specify 10.0.x versions
5e61672 update deps
c44c418 Support 10.0 and test in CI
dc5c841 [email protected]
385b6d2 Add .taprc.yml/yaml handling to change log
4f87466 just run regular test script as snap script
315a921 delete FORCE_COLOR/NO_COLOR rather than setting to '0'
564e96f Add detection for .yaml and .yml
75bae93 update cli doc
c1289bf 15.0.0-3
d6fe32f Do not CI on node 10
d2e0428 do not use equals() alias in self-test
3f787c4 tell npm to be colorful in CI
1512818 run tests with color on github actions
4626fa1 Docs: update documentation for tap v15
02d536b [email protected]
f7c7c58 update cli doc
2aa497c 15.0.0-2
8d7f62e Add support for overriding libtap's internal settings
29eed63 new snapshot folder layout
3a28d4d update libtap git ref to isaacs/tap-v15-prep branch

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note:You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Arbitrary Code Execution
🦉 Prototype Pollution

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-BABEL-1278589 - https://snyk.io/vuln/SNYK-PYTHON-CERTIFI-3164749 - https://snyk.io/vuln/SNYK-PYTHON-SETUPTOOLS-3180412 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-1014645 - https://snyk.io/vuln/SNYK-PYTHON-URLLIB3-1533435

Snyk has created this PR to upgrade: - @babel/types from 7.1.3 to 7.21.4. See this package in npm: https://www.npmjs.com/package/@babel/types - @babel/generator from 7.1.3 to 7.21.4. See this package in npm: https://www.npmjs.com/package/@babel/generator - @babel/parser from 7.1.3 to 7.21.4. See this package in npm: https://www.npmjs.com/package/@babel/parser - @babel/template from 7.1.2 to 7.20.7. See this package in npm: https://www.npmjs.com/package/@babel/template - @babel/traverse from 7.1.4 to 7.21.4. See this package in npm: https://www.npmjs.com/package/@babel/traverse See this project in Snyk: https://app.snyk.io/org/leonardoadame/project/17b9377e-05c7-466c-817b-64859e210aa8?utm_source=github&utm_medium=referral&page=upgrade-pr

Snyk has created this PR to upgrade globals from 10.1.0 to 10.4.0. See this package in npm: https://www.npmjs.com/package/globals See this project in Snyk: https://app.snyk.io/org/leonardoadame/project/17b9377e-05c7-466c-817b-64859e210aa8?utm_source=github&utm_medium=referral&page=upgrade-pr

Snyk has created this PR to upgrade tempy from 0.5.0 to 0.7.1. See this package in npm: https://www.npmjs.com/package/tempy See this project in Snyk: https://app.snyk.io/org/leonardoadame/project/17b9377e-05c7-466c-817b-64859e210aa8?utm_source=github&utm_medium=referral&page=upgrade-pr

…94a74ffadedd8032d [Snyk] Upgrade tempy from 0.5.0 to 0.7.1

…2cad22ca48f99fb34 [Snyk] Upgrade globals from 10.1.0 to 10.4.0

The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-REQUESTS-5595532

…14fcf9fdb45341 [Snyk] Security upgrade requests from 2.22.0 to 2.31.0

…452a2501c403d [Snyk] Fix for 5 vulnerabilities

…to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

…age.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

…reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

…-targets/package.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

…8829879580bfb4 [Snyk] Security upgrade semver from 6.3.0 to 7.5.2

…aa20aac868f5e5 [Snyk] Security upgrade semver from 6.3.0 to 7.5.2

…5479ebc6233124 [Snyk] Security upgrade local-web-server from 4.2.1 to 5.0.0

…fa026d85a0edb65c5 [Snyk] Upgrade: @babel/types, @babel/generator, @babel/parser, @babel/template, @babel/traverse

…11126a17ab65f0 [Snyk] Security upgrade semver from 6.3.0 to 7.5.2

bolt-new-by-stackblitz · 2023-07-06T20:20:30Z

Run & review this pull request in StackBlitz Codeflow.

changeset-bot · 2023-07-06T20:20:32Z

⚠️ No Changeset found

Latest commit: 3453c12

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

snyk-botand others added 19 commits May 2, 2023 17:57

Merge pull request#7from leonardoadame/snyk-upgrade-2995fc05233b7a0…
6292d1a
…94a74ffadedd8032d [Snyk] Upgrade tempy from 0.5.0 to 0.7.1

Merge pull request#6from leonardoadame/snyk-upgrade-4d5b4bd486c2748…
616a8bf
…2cad22ca48f99fb34 [Snyk] Upgrade globals from 10.1.0 to 10.4.0

fix: deps/uv/docs/requirements.txt to reduce vulnerabilities
a614a8a
The following vulnerabilities are fixed by pinning transitive dependencies: - https://snyk.io/vuln/SNYK-PYTHON-REQUESTS-5595532

Merge pull request#10from leonardoadame/snyk-fix-8d86d74fb78e75dbf9…
52682c9
…14fcf9fdb45341 [Snyk] Security upgrade requests from 2.22.0 to 2.31.0

Merge pull request#3from leonardoadame/snyk-fix-3fed45732244c5baec2…
2e2374f
…452a2501c403d [Snyk] Fix for 5 vulnerabilities

fix: tools/node_modules/eslint/node_modules/@babel/core/package.json …
eb66b7e
…to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

fix: tools/node_modules/eslint/node_modules/@babel/eslint-parser/pack…
47a5b14
…age.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

fix: deps/v8/tools/package.json & deps/v8/tools/package-lock.json to …
30fc1d1
…reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

fix: tools/node_modules/eslint/node_modules/@babel/helper-compilation…
1100bde
…-targets/package.json to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JS-SEMVER-3247795

Merge pull request#13from leonardoadame/snyk-fix-ee8912d3a9cd5262aa…
853f217
…8829879580bfb4 [Snyk] Security upgrade semver from 6.3.0 to 7.5.2

Merge pull request#15from leonardoadame/snyk-fix-900859a513e8ed4cc8…
35fab6e
…aa20aac868f5e5 [Snyk] Security upgrade semver from 6.3.0 to 7.5.2

Merge pull request#14from leonardoadame/snyk-fix-b7180ea97e108aabee…
f827f4a
…5479ebc6233124 [Snyk] Security upgrade local-web-server from 4.2.1 to 5.0.0

Merge pull request#4from leonardoadame/snyk-upgrade-f919faf2a9ba7c3…
73ba401
…fa026d85a0edb65c5 [Snyk] Upgrade: @babel/types, @babel/generator, @babel/parser, @babel/template, @babel/traverse

Merge pull request#12from leonardoadame/snyk-fix-763b7501c41ba23cc9…
d735ea2
…11126a17ab65f0 [Snyk] Security upgrade semver from 6.3.0 to 7.5.2

leonardoadame force-pushed the main branch 2 times, most recently from 1eeaa09 to d9438ccCompare July 7, 2023 00:52

This was referenced Nov 29, 2023
[Snyk] Security upgrade cpy-cli from 2.0.0 to 4.0.0 #242
Open
[Snyk] Fix for 1 vulnerabilities #543
Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Security upgrade tap from 7.1.2 to 15.0.0#25

[Snyk] Security upgrade tap from 7.1.2 to 15.0.0 #25

Uh oh!

leonardoadame commented Jul 6, 2023

Uh oh!

bolt-new-by-stackblitzbot commented Jul 6, 2023

Uh oh!

changeset-botbot commented Jul 6, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

[Snyk] Security upgrade tap from 7.1.2 to 15.0.0#25

Are you sure you want to change the base?

[Snyk] Security upgrade tap from 7.1.2 to 15.0.0 #25

Uh oh!

Conversation

leonardoadame commented Jul 6, 2023

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:

Uh oh!

bolt-new-by-stackblitzbot commented Jul 6, 2023

Uh oh!

changeset-botbot commented Jul 6, 2023

⚠️ No Changeset found

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants