[Snyk] Fix for 140 vulnerabilities #7

snyk-bot · 2023-04-01T13:31:18Z

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- static/node/package.json
- static/node/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Issue	Breaking Change	Exploit Maturity
Use After Free SNYK-JS-ELECTRON-1252280	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1253279	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1253281	No	No Known Exploit
Out-of-bounds SNYK-JS-ELECTRON-1257943	No	Mature
Use After Free SNYK-JS-ELECTRON-1258207	No	No Known Exploit
Integer Overflow or Wraparound SNYK-JS-ELECTRON-1260586	No	No Known Exploit
Heap-based Buffer Overflow SNYK-JS-ELECTRON-1277203	No	No Known Exploit
Improper Input Validation SNYK-JS-ELECTRON-1277526	No	No Known Exploit
Out Of Bounds Read SNYK-JS-ELECTRON-1278596	No	No Known Exploit
Heap-based Buffer Overflow SNYK-JS-ELECTRON-1296553	No	No Known Exploit
Heap-based Buffer Overflow SNYK-JS-ELECTRON-1296555	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1296557	No	No Known Exploit
Type Confusion SNYK-JS-ELECTRON-1296559	No	Proof of Concept
Use After Free SNYK-JS-ELECTRON-1296561	No	No Known Exploit
Race Condition SNYK-JS-ELECTRON-1296563	No	No Known Exploit
Heap-based Buffer Overflow SNYK-JS-ELECTRON-1296565	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1312313	No	No Known Exploit
Access of Resource Using Incompatible Type ('Type Confusion') SNYK-JS-ELECTRON-1312314	No	Mature
Use After Free SNYK-JS-ELECTRON-1312315	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1313765	No	Mature
Use After Free SNYK-JS-ELECTRON-1313767	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1314896	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1315151	No	No Known Exploit
Out-of-bounds Write SNYK-JS-ELECTRON-1315668	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1533614	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1534881	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1534882	No	No Known Exploit
Type Confusion SNYK-JS-ELECTRON-1534883	No	Mature
Heap-based Buffer Overflow SNYK-JS-ELECTRON-1534884	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1536579	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1536581	No	Proof of Concept
Use After Free SNYK-JS-ELECTRON-1536587	No	No Known Exploit
Out-of-Bounds SNYK-JS-ELECTRON-1585619	No	Mature
Type Confusion SNYK-JS-ELECTRON-1586050	No	No Known Exploit
Buffer Overflow SNYK-JS-ELECTRON-1656742	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1656743	No	Mature
Out-of-Bounds SNYK-JS-ELECTRON-1656745	No	No Known Exploit
Access Restriction Bypass SNYK-JS-ELECTRON-1656746	No	No Known Exploit
Type Confusion SNYK-JS-ELECTRON-1656752	No	No Known Exploit
Improper Input Validation SNYK-JS-ELECTRON-1727342	No	No Known Exploit
Improper Input Validation SNYK-JS-ELECTRON-1727344	No	Mature
Information Exposure SNYK-JS-ELECTRON-1730574	No	No Known Exploit
Sandbox Bypass SNYK-JS-ELECTRON-1731315	No	Proof of Concept
Use After Free SNYK-JS-ELECTRON-1910985	No	Mature
Use After Free SNYK-JS-ELECTRON-1910987	No	No Known Exploit
Exposure of Resource to Wrong Sphere SNYK-JS-ELECTRON-1910988	No	No Known Exploit
Improper Access Control SNYK-JS-ELECTRON-1910991	No	No Known Exploit
Type Confusion SNYK-JS-ELECTRON-1911949	No	Proof of Concept
Use After Free SNYK-JS-ELECTRON-1912074	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1912075	Yes	No Known Exploit
Heap-based Buffer Overflow SNYK-JS-ELECTRON-1912082	Yes	No Known Exploit
Heap-based Buffer Overflow SNYK-JS-ELECTRON-1912084	No	No Known Exploit
Information Exposure SNYK-JS-ELECTRON-1912085	No	Mature
Use After Free SNYK-JS-ELECTRON-1924893	Yes	No Known Exploit
Inappropriate Implementation SNYK-JS-ELECTRON-1924894	Yes	No Known Exploit
Inappropriate Implementation SNYK-JS-ELECTRON-1924895	Yes	No Known Exploit
Type Confusion SNYK-JS-ELECTRON-1930826	Yes	No Known Exploit
Out-of-bounds Write SNYK-JS-ELECTRON-1932538	No	No Known Exploit
Out-of-bound Write SNYK-JS-ELECTRON-1932540	No	Mature
Improper Input Validation SNYK-JS-ELECTRON-1932542	No	No Known Exploit
Out-of-bounds Read SNYK-JS-ELECTRON-1932545	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-1932547	No	No Known Exploit
Out-of-bounds Write SNYK-JS-ELECTRON-1932549	No	No Known Exploit
Out-of-bounds Write SNYK-JS-ELECTRON-1932551	No	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2322001	Yes	Mature
Domain Spoofing SNYK-JS-ELECTRON-2329155	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2329162	Yes	No Known Exploit
Type Confusion SNYK-JS-ELECTRON-2329257	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2330890	Yes	No Known Exploit
Improper Input Validation SNYK-JS-ELECTRON-2332173	Yes	No Known Exploit
Improper Control of a Resource Through its Lifetime SNYK-JS-ELECTRON-2332176	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2338684	Yes	No Known Exploit
Type Confusion SNYK-JS-ELECTRON-2339883	Yes	No Known Exploit
Interger Underflow SNYK-JS-ELECTRON-2351961	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2404183	Yes	No Known Exploit
Improper Check or Handling of Exceptional Conditions SNYK-JS-ELECTRON-2404184	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2414027	Yes	Mature
Integer Overflow or Wraparound SNYK-JS-ELECTRON-2420972	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2420994	Yes	No Known Exploit
Information Exposure SNYK-JS-ELECTRON-2422385	Yes	No Known Exploit
Improper Access Control SNYK-JS-ELECTRON-2431353	Yes	No Known Exploit
Type Confusion SNYK-JS-ELECTRON-2434822	Yes	Mature
Use After Free SNYK-JS-ELECTRON-2434824	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2774694	Yes	No Known Exploit
Type Confusion SNYK-JS-ELECTRON-2803052	Yes	No Known Exploit
Improper implementation SNYK-JS-ELECTRON-2803053	Yes	No Known Exploit
Type Confusion SNYK-JS-ELECTRON-2805803	Yes	Mature
Use After Free SNYK-JS-ELECTRON-2805927	Yes	No Known Exploit
Type Confusion SNYK-JS-ELECTRON-2806357	Yes	No Known Exploit
Heap-based Buffer Overflow SNYK-JS-ELECTRON-2806730	Yes	No Known Exploit
Inappropriate implementation SNYK-JS-ELECTRON-2807802	Yes	No Known Exploit
Improper Input Validation SNYK-JS-ELECTRON-2807803	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2807804	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2807809	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2808872	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2808873	Yes	No Known Exploit
Inappropriate implementation SNYK-JS-ELECTRON-2808874	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2812497	Yes	No Known Exploit
Inappropriate implementation SNYK-JS-ELECTRON-2812499	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2824110	Yes	No Known Exploit
Heap-based Buffer Overflow SNYK-JS-ELECTRON-2838863	Yes	No Known Exploit
Improper Input Validation SNYK-JS-ELECTRON-2869408	Yes	No Known Exploit
Exposure of Resource to Wrong Sphere SNYK-JS-ELECTRON-2869410	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2870632	Yes	No Known Exploit
Improper Input Validation SNYK-JS-ELECTRON-2932172	Yes	No Known Exploit
Protection Mechanism Failure SNYK-JS-ELECTRON-2934721	Yes	No Known Exploit
Heap-based Buffer Overflow SNYK-JS-ELECTRON-2946881	Yes	Mature
Type Confusion SNYK-JS-ELECTRON-2946891	Yes	No Known Exploit
Denial of Service (DoS) SNYK-JS-ELECTRON-2961655	Yes	No Known Exploit
Information Exposure SNYK-JS-ELECTRON-2977510	Yes	No Known Exploit
Improper Input Validation SNYK-JS-ELECTRON-2977512	Yes	No Known Exploit
Buffer Overflow SNYK-JS-ELECTRON-2978483	Yes	No Known Exploit
Access Control Bypass SNYK-JS-ELECTRON-2978519	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2992453	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2992478	Yes	No Known Exploit
Improper Authentication SNYK-JS-ELECTRON-2992482	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-2994414	Yes	No Known Exploit
Denial of Service (DoS) SNYK-JS-ELECTRON-3014402	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-3014405	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-3014407	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-3014409	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-3014411	Yes	Mature
Use After Free SNYK-JS-ELECTRON-3028028	Yes	No Known Exploit
Type Confusion SNYK-JS-ELECTRON-3091122	Yes	Mature
Improper Input Validation SNYK-JS-ELECTRON-3097694	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-3097832	Yes	No Known Exploit
Information Exposure SNYK-JS-ELECTRON-3107036	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-3111876	Yes	No Known Exploit
Heap-based Buffer Overflow SNYK-JS-ELECTRON-3111878	Yes	No Known Exploit
Denial of Service (DoS) SNYK-JS-ELECTRON-3111879	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-3111880	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-3111881	Yes	No Known Exploit
Use After Free SNYK-JS-ELECTRON-3160317	Yes	No Known Exploit
Heap-based Buffer Overflow SNYK-JS-ELECTRON-3237489	Yes	No Known Exploit
Out-of-bounds Read SNYK-JS-ELECTRON-3370529	Yes	No Known Exploit
Cryptographic Issues SNYK-JS-ELLIPTIC-1064899	Yes	No Known Exploit
Timing Attack SNYK-JS-ELLIPTIC-511941	Yes	No Known Exploit
Cryptographic Issues SNYK-JS-ELLIPTIC-571484	Yes	Proof of Concept
Open Redirect SNYK-JS-GOT-2932019	Yes	No Known Exploit
Arbitrary Code Injection SNYK-JS-UNDERSCORE-1080984	Yes	Proof of Concept

Commit messages

Package name: @truffle/config

The new version differs by 250 commits.

c984fe3 Publish
b278409 Merge pull request System Error when running Ganache 2.7.1 on win32 trufflesuite/ganache-ui#5788 from trufflesuite/console-fix
7f833fd optimize logic
3131642 add condition checking for 1 source to determine whether to filter artifact
8ebc466 don't load Truffle's console contract into the console environment
ac013dc Merge pull request Decoding Error when running Ganache 2.7.1 on win32 trufflesuite/ganache-ui#5785 from trufflesuite/fix-migrate
86b0e3d Merge pull request Gift trufflesuite/ganache-ui#5743 from trufflesuite/implement-1193-provider
f83cf2d core(console): add workaround for weird migration format
b50b9e5 Use the word collision instead of race condition in the note
9b2b914 Add note for the requestId counter
3123c7b Implement console.log in Truffle (System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#5687)
bcbc026 Merge pull request System Error when running Ganache 2.7.1 on linux trufflesuite/ganache-ui#5780 from trufflesuite/remove-invalidation
d945752 Merge pull request System Error when running Ganache 2.7.1 on win32 trufflesuite/ganache-ui#5782 from trufflesuite/fix/in-test-runnable
7899cad Merge pull request System Error when running Ganache 2.7.1 on linux trufflesuite/ganache-ui#5763 from trufflesuite/sneved
077ca84 Slightly improve type
f93ca58 Switch Test's `mochaRunner` to be a Promise
85e682f Simplify transfers of names
d5b0970 add debug to config
972a5d9 move before setup into beforeEach for config test
0a818ba add some debug logging to config
6fe5a17 remove require cache invalidation which didn't work in the first place - and unused Module import
5797eca Merge pull request System Error when running Ganache 2.7.1 on darwin trufflesuite/ganache-ui#5777 from trufflesuite/make-easy
b115d52 Add encodeCreation method also to ContractInstanceEncoder
2a087d6 Add test of encodeCreation() with default constructor

See the full diff

Package name: @truffle/decoder

The new version differs by 250 commits.

fb27278 Publish
b31b941 Merge pull request System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4363 from trufflesuite/archaeology
c1cb87d Add test of compiling on Solidity <0.4.20
9e51fe6 Merge pull request System Error when running Ganache 2.5.4 on win32 trufflesuite/ganache-ui#4346 from trufflesuite/extract-web3-eth
9500eea Update type for Eip1193Provider request method
5467f5b Remove unused import
b29a361 Rename type
58ff2d6 Add block type and add typings
cdbe05b Simplify check for eip1193-compliancy
ebe5c41 Add type for 1193-compliant provider
bd5ff12 Simplify variable name
ff9d48a Add Log type and adjust a typing
ccddc9d Rename Web3Adapter to ProviderAdapter
d2b9dfc Refine some methods and tweak return values to keep parity with web3's returns
0fef3d8 Remove web3-eth and implement our own rpc calls
0a6e24e Write our own implementation for eth_getCode in decoder
a422fe4 Adjust implementation for web3-eth to copy the style in the docs
537ad5a Remove type, refine a type, and get ts to compile
ecf743a Add getStorageAt method and use it in decoders
b34657e Update decoders to use web3Adapter instead of web3 directly
6a0aac8 Add one more method and loosen a type or two to continue hacking
7afff55 Add a few more methods to Web3Adapter class
efac32b Refine types a bit and update call to getPastLogs
c66e6dd WIP for implementing the Web3Adapter for the decoder