Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 25 vulnerabilities #35342

Closed
melvin-bot bot opened this issue Jan 29, 2024 · 9 comments
Closed

[Snyk] Fix for 25 vulnerabilities #35342

melvin-bot bot opened this issue Jan 29, 2024 · 9 comments
Assignees
@shubham1206agra
Labels
Internal Requires API changes or must be handled by Expensify staff Monthly KSv2

Comments

@melvin-bot
Copy link

melvin-bot bot commented Jan 29, 2024 •
edited
Loading

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
⚠️ Warning 
Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 482/1000
Why? Proof of Concept exploit, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-ANSIREGEX-1583908		 Yes Proof of Concept
high severity /1000
Why?		 Use After Free
SNYK-JS-ELECTRON-6057536		 No No Known Exploit
high severity /1000
Why?		 Use After Free
SNYK-JS-ELECTRON-6062177		 No No Known Exploit
high severity /1000
Why?		 Integer Overflow or Wraparound
SNYK-JS-ELECTRON-6095118		 No Mature
high severity /1000
Why?		 Use After Free
SNYK-JS-ELECTRON-6095120		 No No Known Exploit
high severity /1000
Why?		 Use After Free
SNYK-JS-ELECTRON-6095121		 No No Known Exploit
high severity /1000
Why?		 Out-of-Bounds
SNYK-JS-ELECTRON-6095122		 No No Known Exploit
high severity /1000
Why?		 Use After Free
SNYK-JS-ELECTRON-6100741		 No No Known Exploit
high severity /1000
Why?		 Use After Free
SNYK-JS-ELECTRON-6105391		 Yes No Known Exploit
high severity /1000
Why?		 Heap-based Buffer Overflow
SNYK-JS-ELECTRON-6137744		 Yes Mature
high severity /1000
Why?		 Use After Free
SNYK-JS-ELECTRON-6146929		 Yes No Known Exploit
high severity /1000
Why?		 Use After Free
SNYK-JS-ELECTRON-6146930		 Yes No Known Exploit
high severity /1000
Why?		 Heap-based Buffer Overflow
SNYK-JS-ELECTRON-6146931		 Yes No Known Exploit
high severity /1000
Why?		 Use After Free
SNYK-JS-ELECTRON-6146932		 Yes No Known Exploit
high severity /1000
Why?		 Type Confusion
SNYK-JS-ELECTRON-6173170		 Yes No Known Exploit
high severity /1000
Why?		 Out-of-bounds Write
SNYK-JS-ELECTRON-6173171		 Yes No Known Exploit
high severity /1000
Why?		 Out-of-bounds Read
SNYK-JS-ELECTRON-6179663		 Yes Mature
medium severity 372/1000
Why? Proof of Concept exploit, CVSS 5.3		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-GLOBPARENT-1016905		 Yes Proof of Concept
medium severity /1000
Why?		 Missing Release of Resource after Effective Lifetime
SNYK-JS-INFLIGHT-6095116		 Yes Proof of Concept
medium severity 265/1000
Why? CVSS 5.3		 Improper Input Validation
SNYK-JS-POSTCSS-5926692		 Yes No Known Exploit
medium severity /1000
Why?		 Cross-site Scripting (XSS)
SNYK-JS-SERIALIZEJAVASCRIPT-6147607		 Yes Proof of Concept
high severity 482/1000
Why? Proof of Concept exploit, CVSS 7.5		 Regular Expression Denial of Service (ReDoS)
SNYK-JS-TRIM-1017038		 Yes Proof of Concept
high severity 375/1000
Why? CVSS 7.5		 Denial of Service (DoS)
SNYK-JS-TRIMNEWLINES-1298042		 Yes No Known Exploit
high severity 375/1000
Why? CVSS 7.5		 Prototype Pollution
SNYK-JS-UNSETVALUE-2400660		 Yes No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3		 Prototype Pollution
SNYK-JS-XML2JS-5414874		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: @storybook/builder-webpack5 The new version differs by 250 commits.

See the full diff

Package name: @storybook/react The new version differs by 250 commits.

See the full diff

Package name: copy-webpack-plugin The new version differs by 29 commits.

See the full diff

Package name: expo The new version differs by 95 commits.

See the full diff

Package name: react-native-blob-util The new version differs by 6 commits.

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)
🦉 Use After Free
🦉 Type Confusion
🦉 More lessons are available in Snyk Learn

Upwork Automation - Do Not Edit
  • Upwork Job URL: https://www.upwork.com/jobs/~01e838404b4397359e
  • Upwork Job ID: 1752114592755728384
  • Last Price Increase: 2024-01-29
@melvin-bot melvin-bot bot added Internal Requires API changes or must be handled by Expensify staff Weekly KSv2 labels Jan 29, 2024
@melvin-bot Melvin Bot
Copy link
Author

melvin-bot bot commented Jan 29, 2024

This is a Snyk issue. Snyk is a tool that automatically tracks our repositories' dependencies and reports associated security vulnerabilities. It also automatically create PRs to fix these vulnerabilities.

    C+: Please follow these steps to test the linked PR before running through the reviewer checklist:
    - [ ] The first step is to understand the PR: what dependency is it upgrading, for which vulnerability, how it impacts our product & end users.
    - [ ] If the issue is not worth fixing, please add your reasoning in the issue and have the internal engineer review it.
    - [ ] Check the change log (which should be included in the PR description) to see all changes. We want to identify any breaking changes. If it is a minor version bump, it's unlikely that there are any breaking changes.
    - [ ] Test our feature(s) that make use of this package. If it does not work, we should understand what broke it. It is also a good idea to check our main flows to make sure they are not broken that you can add in the checklist screenshots/videos.

@melvin-bot Melvin Bot
Copy link
Author

melvin-bot bot commented Jan 29, 2024

Job added to Upwork: https://www.upwork.com/jobs/~01e838404b4397359e

@melvin-bot Melvin Bot
Copy link
Author

melvin-bot bot commented Jan 29, 2024

Triggered auto assignment to Contributor Plus for review of internal employee PR - @shubham1206agra (Internal)

@shubham1206agra
Copy link
Contributor

@mountiny This is not a straight updation of packages. May require 2 different PRs, one for storybook, and one for rest.

@mountiny
Copy link
Contributor

@shubham1206agra sure

@shubham1206agra
Copy link
Contributor

Update: expo and react-native-blob-util have already been upgraded.

@melvin-bot melvin-bot bot added Monthly KSv2 and removed Weekly KSv2 labels Feb 26, 2024
@melvin-bot Melvin Bot
Copy link
Author

melvin-bot bot commented Feb 26, 2024

This issue has not been updated in over 15 days. @shubham1206agra eroding to Monthly issue.

P.S. Is everyone reading this sure this is really a near-term priority? Be brave: if you disagree, go ahead and close it out. If someone disagrees, they'll reopen it, and if they don't: one less thing to do!

@shubham1206agra
Copy link
Contributor

@mountiny Can you close this? I think storybook upgrades are not necessary.

@shubham1206agra
Copy link
Contributor

@mountiny Bump for closing the issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@shubham1206agra shubham1206agra

Labels
Internal Requires API changes or must be handled by Expensify staff Monthly KSv2
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@mountiny @shubham1206agra