STEMMechanics/Website
1
0
Fork 0
Code Issues 4 Pull Requests 1 Actions Packages Projects Releases 3 Wiki Activity

[Snyk] Security upgrade dompurify from 3.0.8 to 3.0.11 #502

Closed
nomadjimbob wants to merge 1 commits from snyk-fix-9d1cf2462c80b56500d6dbbf3f68f72e into main
pull from: snyk-fix-9d1cf2462c80b56500d6dbbf3f68f72e
merge into: STEMMechanics:main
Conversation 0 Commits 1 Files Changed 1 +1 -1
nomadjimbob commented 2024-04-14 17:00:45 +00:00 (Migrated from github.com)
Copy Link

This PR was automatically created by Snyk using the credentials of a real user.


Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

✨ Snyk has automatically assigned this pull request, set who gets assigned.

As this is a private repository, Snyk-bot does not have access. Therefore, this PR has been created automatically, but appears to have been created by a real user.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
⚠️ Warning 
Failed to update the package-lock.json, please update manually before merging.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 658/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3		 Template Injection
SNYK-JS-DOMPURIFY-6474511		 No Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: dompurify The new version differs by 24 commits.
  • 03d20b1 chore: Preparing 3.0.11 release
  • c60a4df fix: Made the NodeFilter see CDATA sections as well, thanks @ Ry0taK
  • dce81a5 fix: Addressed a conditional bypass pattern spotted by @ Ry0taK
  • 51eea81 chore: Preparing 3.0.10 release
  • dbc1d26 Merge pull request #915 from cure53/dependabot/npm_and_yarn/follow-redirects-1.15.6
  • aaa6da1 build(deps-dev): bump follow-redirects from 1.15.4 to 1.15.6
  • fcb9dbd fix: added a fix to handle invalid HTML Custom Element tagNames better
  • 1b59639 fix: Fixed a possible issue with XML processing instructions deployed in HTML
  • 7bc954c chore: Preparing 3.0.9 release
  • c4d49f6 Merge pull request #910 from ssi02014/fix/purify
  • 0ced51c fix: Change the "in" operator to hasOwnProperty
  • 5ca0879 fix: Fixed an unintended bypass when *-* is allowed for CEs, thanks @ kevin-mizu
  • cb18519 Merge pull request #908 from ssi02014/fix/utils
  • 3081134 refac(utils): Refactoring objectHasOwnProperty
  • 4abee1e fix(utils): fixed isPropertyExist naming
  • cab1281 fix(utils): fix naming
  • aa4c194 fix(utils): Modify getOwnPropertyDescriptor to hasOwnProperty prototype function
  • 9a1ba81 Update README.md
  • a21a128 Merge pull request #903 from HugoPoi/patch-2
  • a856694 fix: console warn removed
  • 756cec3 chore: Modernized most of the demos to use actual ES6
  • 84980c3 fix: Updated the CSS sanitizer hook demo, thanks @ Steb95
  • 695c94f Merge pull request #901 from cure53/dependabot/npm_and_yarn/follow-redirects-1.15.4
  • 92a7bfd build(deps-dev): bump follow-redirects from 1.14.8 to 1.15.4

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

👩‍💻 Set who automatically gets assigned

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Learn about vulnerability in an interactive lesson of Snyk Learn.

<p>This PR was automatically created by Snyk using the credentials of a real user.</p><br /><h3>Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.</h3> :sparkles: Snyk has automatically assigned this pull request, [set who gets assigned](https://app.snyk.io/org/nomadjimbob/project/66c7b29c-3171-4fcc-b6f1-0bc65698880c?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr/settings/integration). As this is a private repository, Snyk-bot does not have access. Therefore, this PR has been created automatically, but appears to have been created by a real user. #### Changes included in this PR - Changes to the following files to upgrade the vulnerable dependencies to a fixed version: - package.json <details> <summary>⚠️ <b>Warning</b></summary> ``` Failed to update the package-lock.json, please update manually before merging. ``` </details> #### Vulnerabilities that will be fixed ##### With an upgrade: Severity | Priority Score (*) | Issue | Breaking Change | Exploit Maturity :-------------------------:|-------------------------|:-------------------------|:-------------------------|:------------------------- ![medium severity](https://res.cloudinary.com/snyk/image/upload/w_20,h_20/v1561977819/icon/m.png "medium severity") | **658/1000** <br/> **Why?** Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 5.3 | Template Injection <br/>[SNYK-JS-DOMPURIFY-6474511](https://snyk.io/vuln/SNYK-JS-DOMPURIFY-6474511) | No | Proof of Concept (*) Note that the real score may have changed since the PR was raised. <details> <summary><b>Commit messages</b></summary> </br> <details> <summary>Package name: <b>dompurify</b></summary> The new version differs by 24 commits.</br> <ul> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/03d20b18d4f7750dc8d8a7b6a8c49f0bc93b05f0">03d20b1</a> chore: Preparing 3.0.11 release</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/c60a4dfdabc50fe67b758f1efff8c03d2b8c5472">c60a4df</a> fix: Made the NodeFilter see CDATA sections as well, thanks @ Ry0taK</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/dce81a5766d255aaac7b0f1996cb3c78351fee74">dce81a5</a> fix: Addressed a conditional bypass pattern spotted by @ Ry0taK</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/51eea814ee0cd47fe52ad618f2a821a88e02c8fe">51eea81</a> chore: Preparing 3.0.10 release</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/dbc1d26ab7a0b4db24d43dec9a135fabd3778069">dbc1d26</a> Merge pull request #915 from cure53/dependabot/npm_and_yarn/follow-redirects-1.15.6</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/aaa6da137327607453044cbb46325c705b64aece">aaa6da1</a> build(deps-dev): bump follow-redirects from 1.15.4 to 1.15.6</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/fcb9dbd9a935d91e1a087b5ee721da1c6b008790">fcb9dbd</a> fix: added a fix to handle invalid HTML Custom Element tagNames better</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/1b5963966c6a444f5ebc6f77e0c21a1d46a80164">1b59639</a> fix: Fixed a possible issue with XML processing instructions deployed in HTML</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/7bc954cea7cf3e39a8a5bd539dfc6e58dd6a744c">7bc954c</a> chore: Preparing 3.0.9 release</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/c4d49f64a7eb03b81abfdab40008745f4d42d634">c4d49f6</a> Merge pull request #910 from ssi02014/fix/purify</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/0ced51c7d0c55ec4d48e6c178b6bdcbafc440131">0ced51c</a> fix: Change the &quot;in&quot; operator to hasOwnProperty</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/5ca087932104da4a4a938a1ffc14500cd9e9a559">5ca0879</a> fix: Fixed an unintended bypass when *-* is allowed for CEs, thanks @ kevin-mizu</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/cb185195abca9f3d55ced1e970c3c82c6bb75462">cb18519</a> Merge pull request #908 from ssi02014/fix/utils</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/308113483d3002135796f25072c1b57c1c8099ae">3081134</a> refac(utils): Refactoring objectHasOwnProperty</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/4abee1e3d8e718986682e56376917e9e2cf5f058">4abee1e</a> fix(utils): fixed isPropertyExist naming</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/cab128154d9bd851b31166987aabcafc65e3e779">cab1281</a> fix(utils): fix naming</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/aa4c1940c5890b7477521e9cabe28ea90e3fbb2c">aa4c194</a> fix(utils): Modify getOwnPropertyDescriptor to hasOwnProperty prototype function</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/9a1ba81a8742039557b129449408a740b9940503">9a1ba81</a> Update README.md</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/a21a1285144e239528201fb710d039380b8c4c86">a21a128</a> Merge pull request #903 from HugoPoi/patch-2</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/a856694c923fdb6b67bc7ab2b860bbd1340a9f52">a856694</a> fix: console warn removed</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/756cec35240cefe261aab06be1e0a7a1e66a6b19">756cec3</a> chore: Modernized most of the demos to use actual ES6</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/84980c3504b7571e2fcbbbdd8f4f644b532d3992">84980c3</a> fix: Updated the CSS sanitizer hook demo, thanks @ Steb95</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/695c94f68acbca5984c1b4258bb6dffe7778b4a1">695c94f</a> Merge pull request #901 from cure53/dependabot/npm_and_yarn/follow-redirects-1.15.4</li> <li><a href="https://snyk.io/redirect/github/cure53/DOMPurify/commit/92a7bfd5057bf4538bda9191142e83d995e1e709">92a7bfd</a> build(deps-dev): bump follow-redirects from 1.14.8 to 1.15.4</li> </ul> <a href="https://snyk.io/redirect/github/cure53/DOMPurify/compare/ec1346a8dcf52471276b84bdf4180d3059a00c57...03d20b18d4f7750dc8d8a7b6a8c49f0bc93b05f0">See the full diff</a> </details> </details> Check the changes in this PR to ensure they won't cause issues with your project. ------------ **Note:** *You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.* For more information: <img src="https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiJlMDRhZjU2Ny05MDU5LTQ4ZDEtOGIzZC0xZDYzMGY4ODA1MmEiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImUwNGFmNTY3LTkwNTktNDhkMS04YjNkLTFkNjMwZjg4MDUyYSJ9fQ==" width="0" height="0"/> 🧐 [View latest project report](https://app.snyk.io/org/nomadjimbob/project/66c7b29c-3171-4fcc-b6f1-0bc65698880c?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr) 👩‍💻 [Set who automatically gets assigned](https://app.snyk.io/org/nomadjimbob/project/66c7b29c-3171-4fcc-b6f1-0bc65698880c?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr/settings/integration) 🛠 [Adjust project settings](https://app.snyk.io/org/nomadjimbob/project/66c7b29c-3171-4fcc-b6f1-0bc65698880c?utm_source&#x3D;github&amp;utm_medium&#x3D;referral&amp;page&#x3D;fix-pr/settings) 📚 [Read more about Snyk's upgrade and patch logic](https://support.snyk.io/hc/en-us/articles/360003891078-Snyk-patches-to-fix-vulnerabilities) [//]: # (snyk:metadata:{"prId":"e04af567-9059-48d1-8b3d-1d630f88052a","prPublicId":"e04af567-9059-48d1-8b3d-1d630f88052a","dependencies":[{"name":"dompurify","from":"3.0.8","to":"3.0.11"}],"packageManager":"npm","projectPublicId":"66c7b29c-3171-4fcc-b6f1-0bc65698880c","projectUrl":"https://app.snyk.io/org/nomadjimbob/project/66c7b29c-3171-4fcc-b6f1-0bc65698880c?utm_source=github&utm_medium=referral&page=fix-pr","type":"auto","patch":[],"vulns":["SNYK-JS-DOMPURIFY-6474511"],"upgrade":["SNYK-JS-DOMPURIFY-6474511"],"isBreakingChange":false,"env":"prod","prType":"fix","templateVariants":["updated-fix-title","pr-warning-shown","priorityScore"],"priorityScoreList":[658],"remediationStrategy":"vuln"}) --- **Learn how to fix vulnerabilities with free interactive lessons:** 🦉 [Learn about vulnerability in an interactive lesson of Snyk Learn.](https://learn.snyk.io/?loc&#x3D;fix-pr)

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something isn't working
 dependencies
Pull requests that update a dependency file
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 javascript
Pull requests that update Javascript code
 php
Pull requests that update Php code
 question
Further information is requested
 wontfix
This will not be worked on
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
nomadjimbob renovate-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: STEMMechanics/Website#502
Delete Branch "snyk-fix-9d1cf2462c80b56500d6dbbf3f68f72e"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?