New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Security upgrade jest from 24.9.0 to 27.0.0 #12

Open

organich wants to merge 1 commit into main from snyk-fix-90cdb325aa779ba5ffcddd14b44e9b77

Owner

organich commented Oct 22, 2024

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- lighthouse-cli/de-la-m-quina-de-computaci-n-autom-tica/docs/recipes/integration-test/package.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Uncontrolled resource consumption SNYK-JS-BRACES-6838727	Yes	Proof of Concept
	631/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.2	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Inefficient Regular Expression Complexity SNYK-JS-MICROMATCH-6838728	Yes	No Known Exploit
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Server-side Request Forgery (SSRF) SNYK-JS-REQUEST-3361831	Yes	Proof of Concept
	646/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.5	Prototype Pollution SNYK-JS-TOUGHCOOKIE-5672873	Yes	Proof of Concept
	589/1000 Why? Has a fix available, CVSS 7.5	Prototype Pollution SNYK-JS-UNSETVALUE-2400660	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: jest

The new version differs by 250 commits.

be16e47 v27.0.0
63102ec chore: update changelog for release
564694a docs(blog): Jest 27 blog post (CLI, Node: Performance Score null if running headless GoogleChrome/lighthouse#11131)
b68d91b feat(pretty-print): add option `printBasicPrototype` (deps(inquirer): upgrade to 7.3.3 GoogleChrome/lighthouse#11441)
2226742 chore: minor simplify format results error (misc(axe): rename axe types GoogleChrome/lighthouse#11432)
78eb25d chore: remove needless assign (tests(page-functions): add test for getNodePath GoogleChrome/lighthouse#11433)
696c455 chore: update lockfile after publish
e2eb9ae v27.0.0-next.11
3b253f8 Wait for closed resources to actually close before detecting open handles (data:image/png;base64 => ERR_INVALID_URL GoogleChrome/lighthouse#11429)
27bee72 fix: run GC before collecting open handles (misc: fix types in duplicated-javascript GoogleChrome/lighthouse#11278)
50451df feat: use fallback if prettier not found (Unescaped HTML in uses-rel-preconnect i18n message GoogleChrome/lighthouse#11400)
150dbd8 chore: update lockfile after publish
6f44529 v27.0.0-next.10
cbcec7d Upgrade fsevents in jest-haste-map (tests(smoke): drop screenshot-too-big case GoogleChrome/lighthouse#11428)
9633a26 feat: support reporters written in ESM (Page timeout => PROTOCOL_TIMEOUT on Network.emulateNetworkConditions GoogleChrome/lighthouse#11427)
59f42d8 fix: do not cache modules that throw during evaluation (aria-valid-attr-value: allow numbers with comma as decimal separator GoogleChrome/lighthouse#11263)
57e32e9 Detect open handles with done callbacks (Lighthouse returned error: FAILED_DOCUMENT_REQUEST GoogleChrome/lighthouse#11382)
a397607 Document and test dontThrow for custom inline snapshot matchers (tests: move proto roundtrip json to .tmp/ GoogleChrome/lighthouse#10995)
4fa3a0b feat: custom haste (deps(snyk): update snyk snapshot GoogleChrome/lighthouse#11107)
2047a36 chore: bump deps (automate updating bundlephobia data GoogleChrome/lighthouse#11419)
a4358d6 chore: run prettier on changelog
bdd6282 Move all default values into `jest-config` (misc(build): bundle pub ads plugin for devtools GoogleChrome/lighthouse#9924)
db643a1 Link to Jest config (Logging doesn't work in programmatic use code example GoogleChrome/lighthouse#11106)
b16082c Fix locale issue Wildly inconsistent results in headless mode GoogleChrome/lighthouse#10014 (CPU throttling GoogleChrome/lighthouse#11412)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled resource consumption
🦉 Server-side Request Forgery (SSRF)
🦉 Prototype Pollution


          fix: lighthouse-cli/de-la-m-quina-de-computaci-n-autom-tica/docs/reci…

03c5e7f

…pes/integration-test/package.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-BRACES-6838727
- https://snyk.io/vuln/SNYK-JS-INFLIGHT-6095116
- https://snyk.io/vuln/SNYK-JS-MICROMATCH-6838728
- https://snyk.io/vuln/SNYK-JS-REQUEST-3361831
- https://snyk.io/vuln/SNYK-JS-TOUGHCOOKIE-5672873
- https://snyk.io/vuln/SNYK-JS-UNSETVALUE-2400660

organich self-assigned this

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet