Bump js-yaml and mocha - #12
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) to 5.4.1 and updates ancestor dependency [mocha](https://github.com/mochajs/mocha). These dependencies need to be updated together. Updates `js-yaml` from 3.13.1 to 5.4.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.13.1...5.4.1) Updates `mocha` from 6.2.2 to 12.0.1 - [Release notes](https://github.com/mochajs/mocha/releases) - [Changelog](https://github.com/mochajs/mocha/blob/main/CHANGELOG.md) - [Commits](mochajs/mocha@v6.2.2...v12.0.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.4.1 dependency-type: indirect - dependency-name: mocha dependency-version: 12.0.1 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![semgrepcode-auth0[bot]](https://avatars.githubusercontent.com/in/977730?s=60&v=4){kind=small}
| "safe-buffer": "^5.0.1" | ||
| } | ||
| }, | ||
| "ejs": { | ||
| "node_modules/ejs": { |
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 1271 lists a dependency (ejs) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of ejs are vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') / Protection Mechanism Failure. ejs before 3.1.10 lacks prototype-pollution protection when handling template options, so a polluted Object.prototype can inject options such as client and escapeFunction into the template compiler and reach arbitrary-code paths. Any code that compiles or renders a template through render, renderFile, compile, or the Template constructor exercises the vulnerable options handling.
References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-1209, GHSA, CVE
To resolve this comment:
Check if you are using ejs on the CLI.
- If you're affected, upgrade this dependency to at least version 3.1.10 at package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| }, | ||
| "jsonwebtoken": { | ||
| "node_modules/jsonwebtoken": { |
There was a problem hiding this comment.
Medium severity vulnerability may affect your project—review required:
Line 2278 lists a dependency (jsonwebtoken) with a known Medium severity vulnerability.
ℹ️ Why this matters
Affected versions of jsonwebtoken are vulnerable to Improper Authentication. Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC.
References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7650, GHSA, CVE
To resolve this comment:
Check if you are using a poorly implemented key retrieval function and your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function..
- If you're affected, upgrade this dependency to at least version 9.0.0 at package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| }, | ||
| "jsonwebtoken": { | ||
| "node_modules/jsonwebtoken": { |
There was a problem hiding this comment.
High severity vulnerability may affect your project—review required:
Line 2278 lists a dependency (jsonwebtoken) with a known High severity vulnerability.
ℹ️ Why this matters
Affected versions of jsonwebtoken are vulnerable to Use Of A Broken Or Risky Cryptographic Algorithm. The library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm.
References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7563, GHSA, CVE
To resolve this comment:
Check if you are using a legacy, insecure key type with a supported algorithm; for example, DSA keys could be used with the RS256 algorithm.
- If you're affected, upgrade this dependency to at least version 9.0.0 at package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| }, | ||
| "get-func-name": { | ||
| "node_modules/get-func-name": { |
There was a problem hiding this comment.
High severity vulnerability introduced by a package you're using:
Line 1643 lists a dependency (get-func-name) with a known High severity vulnerability. Fixing requires upgrading or replacing the dependency.
ℹ️ Why this matters
Affected version of get-func-name is vulnerable to Uncontrolled Resource Consumption / Inefficient Regular Expression Complexity. The current regex implementation for parsing values in the module is susceptible to excessive backtracking, leading to potential DoS attacks.
References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2419, GHSA, CVE
To resolve this comment:
Upgrade this dependency to at least version 2.0.1 at package-lock.json.
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
| } | ||
| }, | ||
| "knex": { | ||
| "node_modules/knex": { |
There was a problem hiding this comment.
Critical severity vulnerability may affect your project—review required:
Line 2361 lists a dependency (knex) with a known Critical severity vulnerability.
ℹ️ Why this matters
Affected version of knex is vulnerable to Improper Neutralization Of Special Elements Used In An Sql Command ('Sql Injection'). Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.
References: https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0687, GHSA, CVE
To resolve this comment:
Check if you are using MSSQL.
- If you're affected, upgrade this dependency to at least version 0.19.5 at package-lock.json.
- If you're not affected, comment
/fp we don't use this [condition]
💬 Ignore this finding
To ignore this, reply with:
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
You can view more details on this finding in the Semgrep AppSec Platform here.
Bumps js-yaml to 5.4.1 and updates ancestor dependency mocha. These dependencies need to be updated together.
Updates
js-yamlfrom 3.13.1 to 5.4.1Changelog
Sourced from js-yaml's changelog.
... (truncated)
Commits
e5a3ba05.4.1 releasede54dea3Hard-limit merge sequence size to 100dfd3a29Cleanup 6a8e05f, #7976a8e05ffix: count empty merge sources against maxTotalMergeKeys (#797)6b4ff5e5.4.0 released3b3625eUpdate changelog4f25a74Fix file name3bd003bExpose new scalar styling APIfbb3e9dRemove regex lookbehind for ES2015 compatibilityd43c185FixflowSkipColonSpaceby forcingquoteFlowKeysUpdates
mochafrom 6.2.2 to 12.0.1Release notes
Sourced from mocha's releases.
... (truncated)
Changelog
Sourced from mocha's changelog.
... (truncated)
Commits
5fbd134chore(main): release 12.0.1 (#6257)69f7631fix(ci): fix for bug in Windows/node 26 (#6290)97b8df6chore(deps): update dependency globals to v17.12.0 (#6288)85ff1b6chore(deps): update dependency knip to v6.34.0 (#6279)3a11840chore(deps): update dependency eslint-plugin-n to v18.3.0 (#6240)1cf345bchore(deps): update dependency globals to v17.11.0 (#6243)d6824f7ci: also test node 26 in ci (#6273)1633779fix: only reject positional args that are entirely numeric (#6222)5f4b926Change "needs: triage" to "status: in triage" (#6284)02558a3fix: bump serialize-javascript to ^7.1.1 (#6278)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for mocha since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.