New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Snyk] Security upgrade serverless-offline from 4.3.0 to 10.2.1 #34

Open

CatbearmanCodes wants to merge 1 commit into master from snyk-fix-ed140196459e755db11bc5bc805c244b

Owner

CatbearmanCodes commented Dec 23, 2022

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
- package.json
- package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	671/1000 Why? Recently disclosed, Has a fix available, CVSS 7.7	Improper Input Validation SNYK-JS-JSONWEBTOKEN-3180020	Yes	No Known Exploit
	611/1000 Why? Recently disclosed, Has a fix available, CVSS 6.5	Improper Authentication SNYK-JS-JSONWEBTOKEN-3180022	Yes	No Known Exploit
	611/1000 Why? Recently disclosed, Has a fix available, CVSS 6.5	Improper Restriction of Security Token Assignment SNYK-JS-JSONWEBTOKEN-3180024	Yes	No Known Exploit
	526/1000 Why? Recently disclosed, Has a fix available, CVSS 4.8	Use of a Broken or Risky Cryptographic Algorithm SNYK-JS-JSONWEBTOKEN-3180026	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: serverless-offline

The new version differs by 250 commits.

462eb87 v10.2.1
877463b refactor: replace jsonwebtoken with jose (#1579)
c0b8d75 fix: usage identifier key condition
ac45a34 chore: add quotes to log vars
5aa44ae refactor: create lambda only when needed
28b68e8 chore: destructuring order nit
c8f22ea v10.2.0
b1a6121 refactor: use node:fs/promises
2843e86 refactor: websocket server instantation
4c7a034 refactor: http server instantation for websockets
af68056 chore: bump deps
4788e04 refactor: websocket servers instantiation
1a6c2fe chore: await websocket start
dda6e57 chore: import order nit
311fc52 feat: secure web sockets (#1468)
0000ba7 refactor: use optional chaining
52b0176 chore: bump deps
59b0309 v10.1.0
97a2c34 chore: rename old npm scripts
6027d46 test: add code coverage
e877cef doc: fix option line breaks
546cca1 doc: reformat options
b7b8e36 test: remove api keys from builder
c6749da chore: quote x-api-key header name

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Use of a Broken or Risky Cryptographic Algorithm


fix: package.json & package-lock.json to reduce vulnerabilities

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180020
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180022
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180024
- https://snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment