[Snyk] Upgrade: , , crypto-js, npm, ts-node, typescript #4

BitcoinOutput · 2024-09-10T02:44:06Z

Snyk has created this PR to upgrade multiple dependencies.

👯 The following dependencies are linked and will therefore be updated together.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

Name	Versions	Released on

@types/crypto-js
from 4.1.1 to 4.2.2 | 5 versions ahead of your current version | 8 months ago
on 2024-01-22
@types/js-yaml
from 4.0.5 to 4.0.9 | 4 versions ahead of your current version | 10 months ago
on 2023-11-07
crypto-js
from 4.1.1 to 4.2.0 | 1 version ahead of your current version | a year ago
on 2023-10-24
npm
from 8.19.2 to 8.19.4 | 2 versions ahead of your current version | 2 years ago
on 2023-02-14
ts-node
from 10.9.1 to 10.9.2 | 1 version ahead of your current version | 9 months ago
on 2023-12-08
typescript
from 4.8.2 to 4.9.5 | 85 versions ahead of your current version | 2 years ago
on 2023-01-30

Issues fixed by the recommended upgrade:

Issue	Score	Exploit Maturity
Use of Weak Hash SNYK-JS-CRYPTOJS-6028119	574	No Known Exploit
Server-side Request Forgery (SSRF) SNYK-JS-IP-6240864	574	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-SEMVER-3247795	574	Proof of Concept
Regular Expression Denial of Service (ReDoS) SNYK-JS-HTTPCACHESEMANTICS-3248783	574	Proof of Concept
Server-Side Request Forgery (SSRF) SNYK-JS-IP-7148531	574	Proof of Concept
Uncontrolled Resource Consumption ('Resource Exhaustion') SNYK-JS-TAR-6476909	574	Proof of Concept

Release notes

Package name: @types/crypto-js

4.2.2 - 2024-01-22
4.2.1 - 2023-11-07
4.2.0 - 2023-11-06
4.1.3 - 2023-10-18
4.1.2 - 2023-09-04
4.1.1 - 2022-02-14

from @types/crypto-js GitHub release notes

Package name: @types/js-yaml

4.0.9 - 2023-11-07
4.0.8 - 2023-10-18
4.0.7 - 2023-10-10
4.0.6 - 2023-09-15
4.0.5 - 2021-11-19

from @types/js-yaml GitHub release notes

Package name: crypto-js

4.2.0 - 2023-10-24
No content.
4.1.1 - 2021-07-22
No content.

from crypto-js GitHub release notes

Package name: npm

8.19.4 - 2023-02-14
8.19.4 (2023-02-14)

Documentation
- dd51f34 #6155 don't redirect "npm config' to itself (#6155) (@ ivanosevitch)
Dependencies
- cfab523 #6166 [email protected] (#6166)
8.19.3 - 2022-11-03
8.19.2 - 2022-09-13

from npm GitHub release notes

Package name: ts-node

10.9.2 - 2023-12-08
Fixed
- Fixed tsconfig.json file not found on latest TypeScript version (#2091)
10.9.1 - 2022-07-14
Fixed
- Workaround nodejs bug introduced in 18.6.0 (#1838) @ cspotcode
  - Only affects projects on node >=18.6.0 using --esm
  - Older versions of node and projects without --esm are unaffected
v10.9.0...v10.9.1
https://github.com/TypeStrong/ts-node/milestone/18?closed=1

from ts-node GitHub release notes

Package name: typescript

4.9.5 - 2023-01-30
4.9.4 - 2022-12-07
4.9.3 - 2022-11-15
4.9.2-rc - 2022-11-01
4.9.1-beta - 2022-09-23
4.9.0-dev.20221031 - 2022-10-31
4.9.0-dev.20221030 - 2022-10-30
4.9.0-dev.20221029 - 2022-10-29
4.9.0-dev.20221028 - 2022-10-28
4.9.0-dev.20221027 - 2022-10-27
4.9.0-dev.20221026 - 2022-10-26
4.9.0-dev.20221025 - 2022-10-25
4.9.0-dev.20221024 - 2022-10-24
4.9.0-dev.20221023 - 2022-10-23
4.9.0-dev.20221022 - 2022-10-22
4.9.0-dev.20221021 - 2022-10-21
4.9.0-dev.20221020 - 2022-10-20
4.9.0-dev.20221019 - 2022-10-19
4.9.0-dev.20221018 - 2022-10-18
4.9.0-dev.20221017 - 2022-10-17
4.9.0-dev.20221016 - 2022-10-16
4.9.0-dev.20221015 - 2022-10-15
4.9.0-dev.20221014 - 2022-10-14
4.9.0-dev.20221013 - 2022-10-13
4.9.0-dev.20221012 - 2022-10-12
4.9.0-dev.20221011 - 2022-10-11
4.9.0-dev.20221007 - 2022-10-07
4.9.0-dev.20221006 - 2022-10-06
4.9.0-dev.20221005 - 2022-10-05
4.9.0-dev.20221004 - 2022-10-04
4.9.0-dev.20221003 - 2022-10-03
4.9.0-dev.20221002 - 2022-10-02
4.9.0-dev.20221001 - 2022-10-01
4.9.0-dev.20220930 - 2022-09-30
4.9.0-dev.20220929 - 2022-09-29
4.9.0-dev.20220928 - 2022-09-28
4.9.0-dev.20220927 - 2022-09-27
4.9.0-dev.20220926 - 2022-09-26
4.9.0-dev.20220925 - 2022-09-25
4.9.0-dev.20220924 - 2022-09-24
4.9.0-dev.20220923 - 2022-09-23
4.9.0-dev.20220922 - 2022-09-22
4.9.0-dev.20220921 - 2022-09-21
4.9.0-dev.20220920 - 2022-09-20
4.9.0-dev.20220919 - 2022-09-19
4.9.0-dev.20220918 - 2022-09-18
4.9.0-dev.20220917 - 2022-09-17
4.9.0-dev.20220916 - 2022-09-16
4.9.0-dev.20220915 - 2022-09-15
4.9.0-dev.20220914 - 2022-09-14
4.9.0-dev.20220913 - 2022-09-13
4.9.0-dev.20220912 - 2022-09-12
4.9.0-dev.20220911 - 2022-09-11
4.9.0-dev.20220910 - 2022-09-10
4.9.0-dev.20220909 - 2022-09-09
4.9.0-dev.20220908 - 2022-09-08
4.9.0-dev.20220907 - 2022-09-07
4.9.0-dev.20220905 - 2022-09-05
4.9.0-dev.20220904 - 2022-09-04
4.9.0-dev.20220903 - 2022-09-03
4.9.0-dev.20220902 - 2022-09-02
4.9.0-dev.20220901 - 2022-09-01
4.9.0-dev.20220831 - 2022-08-31
4.9.0-dev.20220830 - 2022-08-30
4.9.0-dev.20220829 - 2022-08-29
4.9.0-dev.20220828 - 2022-08-28
4.9.0-dev.20220827 - 2022-08-27
4.9.0-dev.20220825 - 2022-08-25
4.9.0-dev.20220824 - 2022-08-24
4.9.0-dev.20220823 - 2022-08-23
4.9.0-dev.20220822 - 2022-08-22
4.9.0-dev.20220821 - 2022-08-21
4.9.0-dev.20220820 - 2022-08-20
4.9.0-dev.20220819 - 2022-08-19
4.9.0-dev.20220818 - 2022-08-18
4.9.0-dev.20220817 - 2022-08-17
4.9.0-dev.20220816 - 2022-08-16
4.9.0-dev.20220815 - 2022-08-15
4.9.0-dev.20220814 - 2022-08-14
4.9.0-dev.20220813 - 2022-08-13
4.9.0-dev.20220812 - 2022-08-12
4.9.0-dev.20220811 - 2022-08-11
4.9.0-beta - 2022-09-23
4.8.4 - 2022-09-27
4.8.3 - 2022-09-08
4.8.2 - 2022-08-25

from typescript GitHub release notes

Important

Check the changes in this PR to ensure they won't cause issues with your project.
This PR was automatically created by Snyk using the credentials of a real user.
Max score is 1000. Note that the real score may have changed since the PR was raised.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

📜 Customise PR templates

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"","from":"types/crypto-js","to":"types/crypto-js"},{"name":"","from":"types/js-yaml","to":"types/js-yaml"},{"name":"crypto-js","from":"4.1.1","to":"4.2.0"},{"name":"npm","from":"8.19.2","to":"8.19.4"},{"name":"ts-node","from":"10.9.1","to":"10.9.2"},{"name":"typescript","from":"4.8.2","to":"4.9.5"}],"env":"prod","hasFixes":true,"isBreakingChange":false,"isMajorUpgrade":false,"issuesToFix":[{"exploit_maturity":"no-known-exploit","id":"SNYK-JS-CRYPTOJS-6028119","issue_id":"SNYK-JS-CRYPTOJS-6028119","priority_score":574,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.2","score":360},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Use of Weak Hash"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-IP-6240864","issue_id":"SNYK-JS-IP-6240864","priority_score":751,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.6","score":430},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Server-side Request Forgery (SSRF)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-SEMVER-3247795","issue_id":"SNYK-JS-SEMVER-3247795","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-HTTPCACHESEMANTICS-3248783","issue_id":"SNYK-JS-HTTPCACHESEMANTICS-3248783","priority_score":586,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-IP-7148531","issue_id":"SNYK-JS-IP-7148531","priority_score":646,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Server-Side Request Forgery (SSRF)"},{"exploit_maturity":"proof-of-concept","id":"SNYK-JS-TAR-6476909","issue_id":"SNYK-JS-TAR-6476909","priority_score":646,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.5","score":325},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Uncontrolled Resource Consumption ('Resource Exhaustion')"}],"prId":"aff02570-9201-438b-a696-ed596d46a2c9","prPublicId":"aff02570-9201-438b-a696-ed596d46a2c9","packageManager":"npm","priorityScoreList":[574,751,696,586,646,646],"projectPublicId":"3014bf3d-8d1b-40d6-acaf-82e6618edeb5","projectUrl":"https://app.snyk.io/org/debuggineffect/project/3014bf3d-8d1b-40d6-acaf-82e6618edeb5?utm_source=github&utm_medium=referral&page=upgrade-pr","prType":"upgrade","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["priorityScore"],"type":"auto","upgrade":["SNYK-JS-CRYPTOJS-6028119","SNYK-JS-IP-6240864","SNYK-JS-SEMVER-3247795","SNYK-JS-HTTPCACHESEMANTICS-3248783","SNYK-JS-IP-7148531","SNYK-JS-TAR-6476909"],"upgradeInfo":{"versionsDiff":5,"publishedDate":"2024-01-22T06:37:12.244Z"},"vulns":["SNYK-JS-CRYPTOJS-6028119","SNYK-JS-IP-6240864","SNYK-JS-SEMVER-3247795","SNYK-JS-HTTPCACHESEMANTICS-3248783","SNYK-JS-IP-7148531","SNYK-JS-TAR-6476909"]}'

Snyk has created this PR to upgrade: - @types/crypto-js from 4.1.1 to 4.2.2. See this package in npm: https://www.npmjs.com/package/@types/crypto-js - @types/js-yaml from 4.0.5 to 4.0.9. See this package in npm: https://www.npmjs.com/package/@types/js-yaml - crypto-js from 4.1.1 to 4.2.0. See this package in npm: https://www.npmjs.com/package/crypto-js - npm from 8.19.2 to 8.19.4. See this package in npm: https://www.npmjs.com/package/npm - ts-node from 10.9.1 to 10.9.2. See this package in npm: https://www.npmjs.com/package/ts-node - typescript from 4.8.2 to 4.9.5. See this package in npm: https://www.npmjs.com/package/typescript See this project in Snyk: https://app.snyk.io/org/debuggineffect/project/3014bf3d-8d1b-40d6-acaf-82e6618edeb5?utm_source=github&utm_medium=referral&page=upgrade-pr

guardrails · 2024-09-10T02:44:26Z

⚠️ We detected 2 security issues in this pull request:

Vulnerable Libraries (2)

Severity	Details
Critical	pkg:npm/[email protected] (t) upgrade to: 4.2.0
Critical	pkg:npm/[email protected] (t) upgrade to: > 8.19.2

More info on how to fix Vulnerable Libraries in JavaScript.

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Snyk] Upgrade: , , crypto-js, npm, ts-node, typescript #4

[Snyk] Upgrade: , , crypto-js, npm, ts-node, typescript #4

Uh oh!

BitcoinOutput commented Sep 10, 2024

8.19.4 (2023-02-14)

Documentation

Dependencies

Uh oh!

guardrails bot commented Sep 10, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

[Snyk] Upgrade: , , crypto-js, npm, ts-node, typescript #4

Are you sure you want to change the base?

[Snyk] Upgrade: , , crypto-js, npm, ts-node, typescript #4

Uh oh!

Conversation

BitcoinOutput commented Sep 10, 2024

Snyk has created this PR to upgrade multiple dependencies.

Issues fixed by the recommended upgrade:

8.19.4 (2023-02-14)

Documentation

Dependencies

Uh oh!

guardrails bot commented Sep 10, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants