Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade next from 12.0.2 to 12.1.0 #20

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

snyk-bot
Copy link
Contributor

@snyk-bot snyk-bot commented Oct 7, 2022

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

merge advice

✨ Snyk has automatically assigned this pull request, set who gets assigned.

As this is a private repository, Snyk-bot does not have access. Therefore, this PR has been created automatically, but appears to have been created by a real user.

Changes included in this PR

  • Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
    • package.json
    • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
low severity 506/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 3.7
Prototype Pollution
SNYK-JS-MINIMIST-2429795
No Proof of Concept
high severity 589/1000
Why? Has a fix available, CVSS 7.5
Denial of Service (DoS)
SNYK-JS-NEXT-2312745
No No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Denial of Service (DoS)
SNYK-JS-NEXT-2388583
No No Known Exploit
medium severity 509/1000
Why? Has a fix available, CVSS 5.9
User Interface (UI) Misrepresentation of Critical Information
SNYK-JS-NEXT-2405694
No No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5
Information Exposure
SNYK-JS-NODEFETCH-2342118
No No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: next The new version differs by 250 commits.
  • 8545fd1 v12.1.0
  • 1605f30 v12.0.11-canary.21
  • 69aedbd Fix typo (#34480)
  • f0f322c Remove deprecation for relative URL usage in middlewares (#34461)
  • d4d79b2 Fix chunk buffering for server components (#34474)
  • 74fa4d4 update webpack (#34477)
  • b70397e Revert "Allow reading request bodies in middlewares (#34294)" (#34479)
  • 4202011 Update font-optimization test snapshot (#34478)
  • 1edd851 Allow reading request bodies in middlewares (#34294)
  • ba78437 fix: don't wrap `profile` in firebase example (#34457)
  • f3c3810 Remove hello world RSC example. (#34456)
  • 49da8c0 v12.0.11-canary.20
  • 2264d35 Fix `.svg` image optimization with a `loader` prop (#34452)
  • 59714db Update server-only changes HMR handling (#34298)
  • d288d43 Update MDX Guide config example (#34405)
  • 54dbeb3 update webpack (#34444)
  • 9b38ffe Update 2.example_bug_report.yml
  • 86aac3f Update 1.bug_report.yml
  • 732b405 v12.0.11-canary.19
  • 01524ef Revert swc css bump temporarily (#34440)
  • 8a55612 Add image config for `dangerouslyAllowSVG` and `contentSecurityPolicy` (#34431)
  • 9639fe7 Ensure we don't poll page in development when notFound: true is returned (#34352)
  • 7e93a89 Update 2.example_bug_report.yml
  • d88793d feat: improve opening a new issue flow (#34434)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

👩‍💻 Set who automatically gets assigned

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Denial of Service (DoS)
🦉 Prototype Pollution

@vercel
Copy link

vercel bot commented Oct 7, 2022

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Updated
relochinho ✅ Ready (Inspect) Visit Preview Oct 7, 2022 at 2:03PM (UTC)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant