From 8c22a05a612c18750a0eff21704c466eec75f0bc Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Tue, 14 Sep 2021 17:35:17 +0200 Subject: [PATCH 1/4] yarn.lock: bump jsonpointer Signed-off-by: Patrik Oldsberg --- yarn.lock | 23 +++-------------------- 1 file changed, 3 insertions(+), 20 deletions(-) diff --git a/yarn.lock b/yarn.lock index 274b41d73e..cd431df83b 100644 --- a/yarn.lock +++ b/yarn.lock @@ -6622,11 +6622,6 @@ resolved "https://registry.npmjs.org/@types/git-url-parse/-/git-url-parse-9.0.0.tgz#aac1315a44fa4ed5a52c3820f6c3c2fb79cbd12d" integrity sha512-kA2RxBT/r/ZuDDKwMl+vFWn1Z0lfm1/Ik6Qb91wnSzyzCDa/fkM8gIOq6ruB7xfr37n6Mj5dyivileUVKsidlg== -"@types/github-slugger@^1.3.0": - version "1.3.0" - resolved "https://registry.npmjs.org/@types/github-slugger/-/github-slugger-1.3.0.tgz#16ab393b30d8ae2a111ac748a015ac05a1fc5524" - integrity sha512-J/rMZa7RqiH/rT29TEVZO4nBoDP9XJOjnbbIofg7GQKs4JIduEO3WLpte+6WeUz/TcrXKlY+bM7FYrp8yFB+3g== - "@types/glob-base@^0.3.0": version "0.3.0" resolved "https://registry.npmjs.org/@types/glob-base/-/glob-base-0.3.0.tgz#a581d688347e10e50dd7c17d6f2880a10354319d" @@ -12617,11 +12612,6 @@ emittery@^0.7.1: resolved "https://registry.npmjs.org/emittery/-/emittery-0.7.1.tgz#c02375a927a40948c0345cc903072597f5270451" integrity sha512-d34LN4L6h18Bzz9xpoku2nPwKxCPlPMr3EEKTkoEBi+1/+b0lcRkRJ1UVyyZaKNeqGR3swcGl6s390DNO4YVgQ== -"emoji-regex@>=6.0.0 <=6.1.1": - version "6.1.1" - resolved "https://registry.npmjs.org/emoji-regex/-/emoji-regex-6.1.1.tgz#c6cd0ec1b0642e2a3c67a1137efc5e796da4f88e" - integrity sha1-xs0OwbBkLio8Z6ETfvxeeW2k+I4= - emoji-regex@^7.0.1: version "7.0.3" resolved "https://registry.npmjs.org/emoji-regex/-/emoji-regex-7.0.3.tgz#933a04052860c85e83c122479c4748a8e4c72156" @@ -14497,13 +14487,6 @@ github-from-package@0.0.0: resolved "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz#97fb5d96bfde8973313f20e8288ef9a167fa64ce" integrity sha1-l/tdlr/eiXMxPyDoKI75oWf6ZM4= -github-slugger@^1.3.0: - version "1.3.0" - resolved "https://registry.npmjs.org/github-slugger/-/github-slugger-1.3.0.tgz#9bd0a95c5efdfc46005e82a906ef8e2a059124c9" - integrity sha512-gwJScWVNhFYSRDvURk/8yhcFBee6aFjye2a7Lhb2bUyRulpIoek9p0I9Kt7PT67d/nUlZbFu8L9RLiA0woQN8Q== - dependencies: - emoji-regex ">=6.0.0 <=6.1.1" - glob-base@^0.3.0: version "0.3.0" resolved "https://registry.npmjs.org/glob-base/-/glob-base-0.3.0.tgz#dbb164f6221b1c0b1ccf82aea328b497df0ea3c4" @@ -17567,9 +17550,9 @@ jsonpath-plus@^0.19.0: integrity sha512-GSVwsrzW9LsA5lzsqe4CkuZ9wp+kxBb2GwNniaWzI2YFn5Ig42rSW8ZxVpWXaAfakXNrx5pgY5AbQq7kzX29kg== jsonpointer@^4.0.1: - version "4.0.1" - resolved "https://registry.npmjs.org/jsonpointer/-/jsonpointer-4.0.1.tgz#4fd92cb34e0e9db3c89c8622ecf51f9b978c6cb9" - integrity sha1-T9kss04OnbPInIYi7PUfm5eMbLk= + version "4.1.0" + resolved "https://registry.npmjs.org/jsonpointer/-/jsonpointer-4.1.0.tgz#501fb89986a2389765ba09e6053299ceb4f2c2cc" + integrity sha512-CXcRvMyTlnR53xMcKnuMzfCA5i/nfblTnnr74CZb6C4vG39eu6w51t7nKmU5MfLfbTgGItliNyjO/ciNPDqClg== jsonschema@^1.2.6: version "1.4.0" From 77bcf58c5c1142b7967fc1970e17a2bc669ddece Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Tue, 14 Sep 2021 17:36:47 +0200 Subject: [PATCH 2/4] yarn.lock: bump normalize-url Signed-off-by: Patrik Oldsberg --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index cd431df83b..4c75abd9e3 100644 --- a/yarn.lock +++ b/yarn.lock @@ -19980,9 +19980,9 @@ normalize-url@^3.0.0, normalize-url@^3.3.0: integrity sha512-U+JJi7duF1o+u2pynbp2zXDW2/PADgC30f0GsHZtRh+HOcXHnw137TrNlyxxRvWW5fjKd3bcLHPxofWuCjaeZg== normalize-url@^4.1.0: - version "4.5.0" - resolved "https://registry.npmjs.org/normalize-url/-/normalize-url-4.5.0.tgz#453354087e6ca96957bd8f5baf753f5982142129" - integrity sha512-2s47yzUxdexf1OhyRi4Em83iQk0aPvwTddtFz4hnSSw9dCEsLEGf6SwIO8ss/19S9iBb5sJaOuTvTGDeZI00BQ== + version "4.5.1" + resolved "https://registry.npmjs.org/normalize-url/-/normalize-url-4.5.1.tgz#0dd90cf1288ee1d1313b87081c9a5932ee48518a" + integrity sha512-9UZCFRHQdNrfTpGg8+1INIg93B6zE0aXMVFkw1WFwvO4SlZywU6aLg5Of0Ap/PgcbSw4LNxvMWXMeugwMCX0AA== npm-bundled@^1.0.1, npm-bundled@^1.1.1: version "1.1.1" From 545b61a5f7a819764720791a6e3c02921d73e156 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Tue, 14 Sep 2021 17:38:51 +0200 Subject: [PATCH 3/4] todo-backend: ignore ansi-regex vulnerability Signed-off-by: Patrik Oldsberg --- plugins/todo-backend/.snyk | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 plugins/todo-backend/.snyk diff --git a/plugins/todo-backend/.snyk b/plugins/todo-backend/.snyk new file mode 100644 index 0000000000..da6c67e8e2 --- /dev/null +++ b/plugins/todo-backend/.snyk @@ -0,0 +1,10 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.22.1 +# ignores vulnerabilities until expiry date; change duration by modifying expiry date +ignore: + SNYK-JS-ANSIREGEX-1583908: + - 'leasot@12.0.0 > strip-ansi@6.0.0 > ansi-regex@5.0.0': + reason: This vulnerability only affects the leasot CLI, which is not used by todo backend + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z +patch: {} From 2048e3443ce9c17fe475c4e04595d0ccbda65192 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Tue, 14 Sep 2021 17:41:02 +0200 Subject: [PATCH 4/4] test-utils-core: ignore ansi-regex vulnerability Signed-off-by: Patrik Oldsberg --- packages/test-utils-core/.snyk | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 packages/test-utils-core/.snyk diff --git a/packages/test-utils-core/.snyk b/packages/test-utils-core/.snyk new file mode 100644 index 0000000000..f368a3ddb9 --- /dev/null +++ b/packages/test-utils-core/.snyk @@ -0,0 +1,10 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.22.1 +# ignores vulnerabilities until expiry date; change duration by modifying expiry date +ignore: + SNYK-JS-ANSIREGEX-1583908: + - '*': + reason: This only exposes the user's machine or build worker to a ReDos attack, which we don't consider an issue + expires: 2022-03-06T17:18:55.019Z + created: 2021-09-06T17:18:55.027Z +patch: {}