GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — [Snyk] Fix for 2 vulnerabilities by snyk-bot · Pull Request #12 · contentascode/nodegit

Conversation

snyk-bot commented Aug 5, 2021

Copy link

Copy Markdown

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Recently disclosed, Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536528	Yes	No Known Exploit
	696/1000 Why? Recently disclosed, Has a fix available, CVSS 8.2	Arbitrary File Overwrite SNYK-JS-TAR-1536531	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: node-gyp

The new version differs by 49 commits.

41f2b23 4.0.0
35e765b doc: update changelog
ceed5cb deps: updated tar package version to 4.4.8
374519e Upgrade to tar v3
e6699d1 test: fix addon test for Node.js 12 and V8 7.4
0c6bf53 lib: use print() for python version detection
9a404d6 3.8.0
9b9d98f doc: update changelog
c5929cb doc: update Xcode preferences tab name.
8b488da doc: update link to commit guidelines
b4fe8c1 doc: fix visual studio links
536759c configure: use sys.version_info to get python version
94c39c6 gyp: fix ninja build failure (GYP patch)
e8ea74e tools: patch gyp to avoid xcrun errors
ea9aff4 tools: fix "the the" typos in comments
207e5aa gyp: implement LD/LDXX for ninja and FIPS
b416c5f gyp: enable cctest to use objects (gyp part)
40692d0 gyp: add compile_commands.json gyp generator
fc3c4e2 gyp: float gyp patch for long filenames
8aedbfd gyp: backport GYP fix to fix AIX shared suffix
6cd84b8 test: formatting and minor fixes for execFileSync replacement
60e4213 test: added test/processExecSync.js for when execFileSync is not available.
969447c deps: bump request to 2.8.7, fixes heok/hawk issues
340403c win: improve parsing of SDK version

See the full diff

Package name: node-pre-gyp

The new version differs by 39 commits.

2844fa4 bump to v0.8.0 with N-API support
b22612c remove node-pre-gyp dep from app7 package.json
9bb97af Merge pull request Update dependency node-pre-gyp to ~0.6 nodegit/nodegit#345 from inspiredware/napi-support
c31cce4 Merge branch 'master' into napi-support
cf3ebb6 bump to v0.7.1 with tar v4.x
9bc1ff3 avoid double declare of tape in devDeps
b1ce220 fix package.json syntax
e9fb2e5 Merge pull request Module fails to load nodegit/nodegit#299 from isaacs/master
81f2e60 Merge branch 'master' into master
e7bb6cd bump to v0.7.0 / drop node v0.10.x support
837c48b update versions
af507d1 Merge pull request Added checkout head method and tests nodegit/nodegit#347 from krotscheck/hawk
eda90e0 Remove dependency on hawk, upgrade request
9684ef6 Another CI build tweak
9870491 Addresses CI build errors
b2ed35a update with latest versions
e352a05 kick travis
37eb637 bump to v0.6.40
8f7c497 CI tweaks
488ac7b Fix for code cleanup
82a641e Code cleanup.
f0719bd Fix for reveal command
1122fdb Fixes clean and app7 for automated testing
411f5be Windows fixes

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          fix: package.json & package-lock.json to reduce vulnerabilities

da45630

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-TAR-1536528
- https://snyk.io/vuln/SNYK-JS-TAR-1536531

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.